@lanes-sh/link 0.4.0 → 0.5.0

package/src/cli/commands/mcp/list.ts

@@ -1,8 +1,46 @@
-import { heading, print, style } from '../../output.ts';
+import { emit, heading, print, style } from '../../output.ts';
 import { assetState, plannedAssets, readAsset } from './assets.ts';
 import { HARNESSES, type Harness } from './harnesses.ts';
 import { exists } from './register.ts';
 
+/** Why a document this harness can hold is not what we ship, if it is not. */
+export type DocumentState = 'current' | 'stale' | 'missing' | 'unreadable';
+
+export interface ListedDocument {
+  readonly label: string;
+  readonly path: string;
+  readonly state: DocumentState;
+  /** Only for `unreadable` — what went wrong reading the bundled copy. */
+  readonly detail?: string;
+}
+
+export interface ListedHarness {
+  readonly id: string;
+  readonly label: string;
+  readonly installed: boolean;
+  /** The resolved binary, so a caller can see *which* claude answered. */
+  readonly binary: string | null;
+  readonly registered: boolean;
+  /**
+   * Empty when the harness is not installed, matching what the text rendering
+   * says: with no binary there is nothing to register the documents against, and
+   * reporting them would describe a setup that does not exist.
+   */
+  readonly documents: readonly ListedDocument[];
+}
+
+export interface McpListing {
+  readonly name: string;
+  readonly scope: string;
+  readonly harnesses: readonly ListedHarness[];
+}
+
+export interface McpListFlags {
+  readonly name?: string | undefined;
+  readonly scope?: string | undefined;
+  readonly json?: boolean | undefined;
+}
+
 /**
  * `lanes link mcp list` — where this endpoint is registered, and whether what
  * each harness has been told about it is still what we ship.
@@ -11,58 +49,114 @@ import { exists } from './register.ts';
  * different fixes. A registration without the skill is a working endpoint
  * nobody reaches for; a skill against no registration is a document describing
  * tools that are not there.
+ *
+ * The listing is gathered before anything is printed, so `--json` and the text
+ * rendering describe the same snapshot rather than two probes taken a moment
+ * apart. `--json` exists because this is the one command another program has a
+ * reason to read: it is how a UI decides between "add" and "re-add", and the
+ * `stale` state is the only signal that a re-run would do something.
  */
-export async function mcpList(options: { name?: string | undefined; scope?: string | undefined }): Promise<void> {
+export async function mcpList(options: McpListFlags): Promise<void> {
   const name = options.name ?? 'lanes-link';
   const scope = options.scope ?? 'user';
 
-  heading(`Registered as ${style.bold(name)}`);
+  const listing = await listRegistrations(name, scope);
+
+  await emit(options.json, listing, () => render(listing));
+}
+
+/** The whole answer, gathered. No printing, so a caller can have it as data. */
+export async function listRegistrations(name: string, scope: string): Promise<McpListing> {
+  const harnesses: ListedHarness[] = [];
 
   for (const harness of HARNESSES) {
     const binary = Bun.which(harness.binary);
 
     if (!binary) {
-      print(`  ${harness.label.padEnd(14)} ${style.dim('not installed')}`);
+      harnesses.push({
+        id: harness.id,
+        label: harness.label,
+        installed: false,
+        binary: null,
+        registered: false,
+        documents: [],
+      });
       continue;
     }
 
-    print(
-      `  ${harness.label.padEnd(14)} ${
-        exists(binary, harness, name)
-          ? style.green('registered')
-          : style.dim(`not registered — lanes link mcp add ${harness.id}`)
-      }`,
-    );
-
-    for (const line of await documentLines(harness, scope)) print(`  ${' '.repeat(14)} ${line}`);
+    harnesses.push({
+      id: harness.id,
+      label: harness.label,
+      installed: true,
+      binary,
+      registered: exists(binary, harness, name),
+      documents: await documents(harness, scope),
+    });
   }
+
+  return { name, scope, harnesses };
 }
 
-/** One line per document this harness can hold, saying whether it is current. */
-async function documentLines(harness: Harness, scope: string): Promise<string[]> {
-  const lines: string[] = [];
+/** One entry per document this harness can hold, saying whether it is current. */
+async function documents(harness: Harness, scope: string): Promise<ListedDocument[]> {
+  const listed: ListedDocument[] = [];
 
   for (const plan of plannedAssets(harness, scope)) {
     try {
-      const state = await assetState(plan, await readAsset(plan.asset));
-
-      lines.push(
-        state === 'current'
-          ? style.dim(`${plan.asset.label}: `) + style.green('up to date')
-          : style.dim(
-              state === 'stale'
-                ? `${plan.asset.label}: out of date — lanes link mcp add ${harness.id}`
-                : `${plan.asset.label}: not installed — lanes link mcp add ${harness.id}`,
-            ),
-      );
+      listed.push({
+        label: plan.asset.label,
+        path: plan.path,
+        state: await assetState(plan, await readAsset(plan.asset)),
+      });
     } catch (error) {
       // A checkout without `instructions/` — a container image, say. Worth one
       // line rather than a thrown error that hides the registration column.
-      lines.push(style.dim(`${plan.asset.label}: ${message(error)}`));
+      listed.push({
+        label: plan.asset.label,
+        path: plan.path,
+        state: 'unreadable',
+        detail: message(error),
+      });
+    }
+  }
+
+  return listed;
+}
+
+function render(listing: McpListing): void {
+  heading(`Registered as ${style.bold(listing.name)}`);
+
+  for (const harness of listing.harnesses) {
+    if (!harness.installed) {
+      print(`  ${harness.label.padEnd(14)} ${style.dim('not installed')}`);
+      continue;
+    }
+
+    print(
+      `  ${harness.label.padEnd(14)} ${
+        harness.registered
+          ? style.green('registered')
+          : style.dim(`not registered — lanes link mcp add ${harness.id}`)
+      }`,
+    );
+
+    for (const document of harness.documents) {
+      print(`  ${' '.repeat(14)} ${documentLine(harness.id, document)}`);
     }
   }
+}
 
-  return lines;
+function documentLine(id: string, document: ListedDocument): string {
+  switch (document.state) {
+    case 'current':
+      return style.dim(`${document.label}: `) + style.green('up to date');
+    case 'stale':
+      return style.dim(`${document.label}: out of date — lanes link mcp add ${id}`);
+    case 'missing':
+      return style.dim(`${document.label}: not installed — lanes link mcp add ${id}`);
+    case 'unreadable':
+      return style.dim(`${document.label}: ${document.detail}`);
+  }
 }
 
 function message(error: unknown): string {

package/src/cli/commands/operate/inspect.ts

@@ -1,4 +1,5 @@
 import { credentialRefFor, formatPlan, planIsNoop, planReconcile } from '#registry';
+import { DEFAULT_SURFACES } from '../../config-repair.ts';
 import { announce, announceProfile, emit, fail, ok, print, warn } from '../../output.ts';
 import { staleNudge } from '../../release.ts';
 import { openRuntime, resolveProfileOnly, type GlobalFlags } from '../../runtime.ts';
@@ -180,33 +181,49 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
       }
     }
 
-    // A profile written before the setup surface existed has no connection for
-    // it, and `allowedConnections` returns nothing for a provider with no
-    // connection *before* consulting policy — so the capabilities are simply
-    // absent, with nothing saying why. An agent then has no way to see what is
-    // configured and starts guessing at commands.
+    // A profile written before the owner layer was default has no connection row
+    // for any of it, and `allowedConnections` returns nothing for a provider with
+    // no connection *before* consulting policy — so the capabilities are simply
+    // absent, with nothing saying why. An agent then has no memory to consult, no
+    // list to add to, and no way to see what is configured, and starts guessing.
     //
     // Both halves, because either alone is inert: a connection row that no rule
     // grants serves nothing, and a rule naming a provider with no row is what
     // `allowedConnections` drops before policy is consulted. Reporting only the
-    // row left the half-repaired profile reading as healthy while serving
-    // exactly as little as the untouched one — and both halves are what
-    // `ensureSetupConnection` writes, so this is the check that says whether it
-    // has run.
-    const hasSetupRow = runtime.config.connections.some(
-      (connection) => connection.provider === 'setup',
-    );
-    const grantsSetup = runtime.config.policy.allow.some(
-      (rule) => rule.capability === '*' || rule.capability === 'setup.*',
-    );
+    // row left the half-repaired profile reading as healthy while serving exactly
+    // as little as the untouched one — and both halves are what
+    // `ensureOwnerLayer` writes, so this is the check that says whether it ran.
+    //
+    // A surface the operator has *denied* is not missing, it is off, so a deny
+    // covering it is not reported. That is the same rule the repair follows, and
+    // reading it here from `policy.deny` rather than asking the repair keeps
+    // `doctor` a read.
+    const denied = (rule: string): boolean =>
+      runtime.config.policy.deny.some(
+        (entry) => entry.capability === '*' || entry.capability === rule,
+      );
+
+    const missing = DEFAULT_SURFACES.filter((provider) => {
+      const rule = `${provider}.*`;
+      if (denied(rule)) return false;
+
+      const hasRow = runtime.config.connections.some(
+        (connection) => connection.provider === provider,
+      );
+      const granted = runtime.config.policy.allow.some(
+        (entry) => entry.capability === '*' || entry.capability === rule,
+      );
+      return !hasRow || !granted;
+    });
 
-    if (!hasSetupRow || !grantsSetup) {
+    if (missing.length > 0) {
       warnings.push({
-        kind: 'no_setup_connection',
+        kind: 'no_owner_layer',
         message:
-          `this profile ${hasSetupRow ? 'does not grant "setup.*"' : 'has no "setup" connection'}` +
-          ', so an agent cannot see what is configured — run: lanes link connect setup',
-        fix: forSelection('lanes link connect setup'),
+          `this profile cannot reach its own ${missing.join(', ')} — ` +
+          'the connection row or the allow rule is missing, and either alone serves nothing. ' +
+          'Any of start, connect or deploy repairs it',
+        fix: forSelection('lanes link start'),
       });
     }
 

package/src/cli/commands/operate/serve.ts

@@ -1,5 +1,6 @@
 import { startEndpoint } from '#server/endpoint.ts';
 import { streamLogger } from '#server/logging.ts';
+import { repairOwnerLayer } from '../../config-repair.ts';
 import { announce, ok, print, style, warn } from '../../output.ts';
 import { staleNudge } from '../../release.ts';
 import { resolveProfile, type GlobalFlags } from '../../runtime.ts';
@@ -16,6 +17,26 @@ export async function start(
   const { resolution } = await resolveProfile(flags);
   announce(resolution);
 
+  // Before the bootstrap, and only here.
+  //
+  // This is the one command an existing install runs without being told to, so
+  // it is how a profile written before ADR-050 comes to have memory, tasks,
+  // assets, skills and the vault at all — `connect` and `deploy` repair too, but
+  // someone who is already set up may not run either for months. What it writes
+  // is the rows and rules a fresh profile is created with; a `deny` covering a
+  // surface is left alone, which is how one stays off.
+  //
+  // Not inside `startEndpoint`, which the container entrypoint also calls: a
+  // deployed revision holds `objectViewer` on `profiles/` (ADR-023) and must not
+  // be the thing that edits config. The repair belongs to the control plane
+  // (ADR-007), and this is the control plane.
+  //
+  // Scoped as the serving is: `--only` serves one profile, so it repairs one.
+  await repairOwnerLayer(
+    resolution.workspaceRoot,
+    flags.only ? [resolution.profile] : undefined,
+  );
+
   // The bootstrap itself lives in `endpoint.ts`, shared with the container
   // entrypoint. What stays here is what a terminal wants: the plan, printed as
   // it is applied, and the endpoint at the end.

package/src/cli/commands/owner/assets.ts

@@ -0,0 +1,132 @@
+import { readFile } from 'node:fs/promises';
+import { basename } from 'node:path';
+import { ConfigError } from '#profile';
+import { scopeNamespace } from '#dispatch';
+import { scopeBlobStore, type BlobStore } from '#stores/blobs';
+import { assetStorage } from '#providers/owner.ts';
+import { heading, ok, print, style, table } from '../../output.ts';
+import type { Runtime } from '../../runtime.ts';
+import {
+  agreed,
+  ownerConnection,
+  required,
+  withRuntime,
+  type OwnerFlags,
+} from './shared.ts';
+
+/** `lanes link assets` — files the owner wants kept. */
+
+export async function assetsList(flags: OwnerFlags): Promise<void> {
+  await withRuntime(flags, async (runtime) => {
+    const assets = await assetStorage.all(assetsStore(runtime, flags));
+
+    heading(`Assets (${assets.length})`);
+    if (assets.length === 0) {
+      print(style.dim('  none — keep one with: lanes link assets add <file>'));
+      return;
+    }
+
+    table(
+      assets.map((asset) => [
+        `  ${asset.name}`,
+        style.dim(asset.contentType),
+        style.dim(assetStorage.humanBytes(asset.bytes)),
+        style.dim(asset.modifiedAt.slice(0, 10)),
+      ]),
+    );
+  });
+}
+
+/**
+ * `lanes link assets add <file>` — a path on this machine.
+ *
+ * Only a path, where the capability takes five sources. The other four exist
+ * because the endpoint may not be on the caller's machine; a CLI is, by
+ * definition, already there, so a URL or a staged handle here would be
+ * ceremony over `curl -O`.
+ */
+export async function assetsAdd(path: string | undefined, flags: OwnerFlags): Promise<void> {
+  const from = required(path, 'lanes link assets add <file>');
+
+  let bytes: Uint8Array;
+  try {
+    bytes = new Uint8Array(await readFile(from));
+  } catch (failure) {
+    const code = (failure as { code?: string }).code;
+    if (code === 'ENOENT') throw new ConfigError(`No file at ${from}.`);
+    if (code === 'EISDIR') throw new ConfigError(`${from} is a directory, not a file.`);
+    throw new ConfigError(`Could not read ${from} — ${(failure as Error).message}`);
+  }
+
+  const name = flags.name ?? basename(from);
+  assetStorage.assertName(name);
+
+  await withRuntime(flags, async (runtime) => {
+    const store = assetsStore(runtime, flags);
+    const replaced = await store.has(name);
+
+    // Only when told. Left off, the store infers from the extension and writes no
+    // sidecar; `--content-type` is for the file whose name does not say what it
+    // is, which is the only case worth a `<name>.meta` beside it.
+    await store.put(name, bytes, flags.contentType ? { contentType: flags.contentType } : {});
+
+    print(
+      ok(
+        `${replaced ? 'replaced' : 'kept'} ${style.bold(name)} — ` +
+          `${assetStorage.humanBytes(bytes.byteLength)}, sha256 ${assetStorage.digest(bytes).slice(0, 12)}…`,
+      ),
+    );
+  });
+}
+
+/**
+ * `lanes link assets get <name>` — write the bytes to stdout.
+ *
+ * Bytes rather than a description, unlike the capability: this end of the pipe is
+ * a shell, so `lanes link assets get invoice.pdf > invoice.pdf` is the useful
+ * thing and there is no context window to protect. Refuses a terminal for the
+ * same reason `curl` warns about it — binary into a tty is a mess nobody wanted.
+ */
+export async function assetsGet(name: string | undefined, flags: OwnerFlags): Promise<void> {
+  const wanted = required(name, 'lanes link assets get <name> > <file>');
+
+  await withRuntime({ ...flags, raw: true }, async (runtime) => {
+    const store = assetsStore(runtime, flags);
+    const bytes = await store.get(wanted);
+    if (bytes === null) throw new ConfigError(`No asset "${wanted}" in this profile.`);
+
+    if (process.stdout.isTTY) {
+      throw new ConfigError(
+        `"${wanted}" would be written to your terminal. Redirect it:\n` +
+          `  lanes link assets get ${wanted} > ${wanted}`,
+      );
+    }
+
+    await Bun.write(Bun.stdout, bytes);
+  });
+}
+
+export async function assetsRemove(name: string | undefined, flags: OwnerFlags): Promise<void> {
+  const wanted = required(name, 'lanes link assets remove <name>');
+
+  await withRuntime(flags, async (runtime) => {
+    const store = assetsStore(runtime, flags);
+    const asset = await assetStorage.find(store, wanted);
+    if (!asset) throw new ConfigError(`No asset "${wanted}" in this profile.`);
+
+    print(`  ${style.bold(asset.name)}  ${assetStorage.describe(asset)}`);
+    if (!(await agreed(flags, 'Delete this file?'))) return;
+
+    await store.delete(wanted);
+    print(ok(`deleted ${style.bold(wanted)}`));
+  });
+}
+
+/**
+ * The blob namespace core would scope this provider to — see `tasks.ts` for why
+ * it is built from the same two functions rather than spelled as a path.
+ */
+export function assetsStore(runtime: Runtime, flags: OwnerFlags): BlobStore {
+  const connection = ownerConnection(runtime.config, 'assets', flags);
+  return scopeBlobStore(runtime.storage, scopeNamespace('assets', connection));
+}

package/src/cli/commands/owner/shared.ts

@@ -4,11 +4,11 @@ import { confirm } from '../../prompt.ts';
 import { openRuntime, type GlobalFlags, type Runtime } from '../../runtime.ts';
 
 /**
- * What `lanes link memory`, `lanes link skills` and `lanes link vault` all need: the flag shape, the
- * runtime wrapper, connection resolution, and the two prompts.
+ * What every `lanes link` command over the owner's own data needs: the flag
+ * shape, the runtime wrapper, connection resolution, and the two prompts.
  *
- * All four commands are the same shape — open a runtime, announce, act, close —
- * so the wrapper lives here rather than three times over.
+ * All of them are the same shape — open a runtime, announce, act, close — so the
+ * wrapper lives here rather than once per noun.
  */
 
 export interface OwnerFlags extends GlobalFlags {
@@ -18,6 +18,14 @@ export interface OwnerFlags extends GlobalFlags {
   readonly tag?: string | undefined;
   readonly description?: string | undefined;
   readonly file?: string | undefined;
+  /** `tasks`: which status to set, or to filter a listing by. */
+  readonly status?: string | undefined;
+  /** `tasks`: when it is due, as the owner would write it. Empty clears it. */
+  readonly due?: string | undefined;
+  /** `assets`: what to call the stored file, where the path's basename is wrong. */
+  readonly name?: string | undefined;
+  /** `assets`: for the file whose extension does not say what it is. */
+  readonly contentType?: string | undefined;
   /** Reveal a vault value on a terminal. */
   readonly show?: boolean | undefined;
   /** Print only the value, for `$(…)`. */
@@ -102,6 +110,22 @@ export async function readStdin(usage: string, what: string): Promise<string> {
   return text;
 }
 
+/**
+ * Read stdin where there may legitimately be nothing on it.
+ *
+ * `readStdin` refuses both a terminal and an empty pipe, which is right for
+ * `memory write` and `vault set` — a command whose whole subject arrived empty
+ * has been mis-invoked. It is wrong for `tasks add`, whose subject is the title
+ * on argv and whose notes are optional: refusing there made
+ * `lanes link tasks add "x"` fail in every non-interactive context — a script, a
+ * cron, a `< /dev/null` — while working by hand, which is the worst shape for a
+ * bug to have.
+ */
+export async function optionalStdin(): Promise<string> {
+  if (process.stdin.isTTY) return '';
+  return (await Bun.stdin.text()).replace(/\n$/, '');
+}
+
 /** Confirm a destructive action, unless `--yes` already answered. */
 export async function agreed(flags: OwnerFlags, question: string): Promise<boolean> {
   if (flags.yes) return true;