@lanes-sh/link 0.4.1 → 0.5.1

package/src/cli/commands/operate/inspect.ts

@@ -1,9 +1,11 @@
 import { credentialRefFor, formatPlan, planIsNoop, planReconcile } from '#registry';
+import { DEFAULT_SURFACES } from '../../config-repair.ts';
 import { announce, announceProfile, emit, fail, ok, print, warn } from '../../output.ts';
 import { staleNudge } from '../../release.ts';
-import { openRuntime, resolveProfileOnly, type GlobalFlags } from '../../runtime.ts';
+import { openRuntime, resolveProfileOnly, type GlobalFlags, type Runtime } from '../../runtime.ts';
 import type { FetchLike } from '#deployments/knowledge.ts';
 import { credentialAge, reportCapabilityDrift } from './findings.ts';
+import { migratedRenamedProviders } from './migrate.ts';
 
 /**
  * The gate order — check, doctor, plan, start — exists so failures surface in
@@ -40,6 +42,8 @@ export async function plan(flags: GlobalFlags): Promise<void> {
 
 export interface DoctorFlags extends GlobalFlags {
   readonly json?: boolean | undefined;
+  /** Apply a repair `doctor` would otherwise only report. */
+  readonly fix?: boolean | undefined;
   /** Injected for tests. A knowledge repository is the only thing doctor fetches. */
   readonly fetch?: FetchLike | undefined;
 }
@@ -62,7 +66,18 @@ export interface DoctorFinding {
 
 /** Read-only external checks: credentials resolve, stores reachable. */
 export async function doctor(flags: DoctorFlags): Promise<void> {
-  const runtime = await openRuntime(flags, { fetch: flags.fetch });
+  // The one check that cannot use a runtime, because it answers for the profiles
+  // that cannot open one. A provider rename left in the config refuses at load,
+  // which takes every command down together — including the rest of this one —
+  // so it is asked first and, with `--fix`, undone. Anything else that refused
+  // is rethrown untouched.
+  let runtime: Runtime;
+  try {
+    runtime = await openRuntime(flags, { fetch: flags.fetch });
+  } catch (refusal) {
+    if (await migratedRenamedProviders(flags, refusal)) return;
+    throw refusal;
+  }
 
   const checks: string[] = [];
   const warnings: DoctorFinding[] = [];
@@ -180,33 +195,49 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
       }
     }
 
-    // A profile written before the setup surface existed has no connection for
-    // it, and `allowedConnections` returns nothing for a provider with no
-    // connection *before* consulting policy — so the capabilities are simply
-    // absent, with nothing saying why. An agent then has no way to see what is
-    // configured and starts guessing at commands.
+    // A profile written before the owner layer was default has no connection row
+    // for any of it, and `allowedConnections` returns nothing for a provider with
+    // no connection *before* consulting policy — so the capabilities are simply
+    // absent, with nothing saying why. An agent then has no memory to consult, no
+    // list to add to, and no way to see what is configured, and starts guessing.
     //
     // Both halves, because either alone is inert: a connection row that no rule
     // grants serves nothing, and a rule naming a provider with no row is what
     // `allowedConnections` drops before policy is consulted. Reporting only the
-    // row left the half-repaired profile reading as healthy while serving
-    // exactly as little as the untouched one — and both halves are what
-    // `ensureSetupConnection` writes, so this is the check that says whether it
-    // has run.
-    const hasSetupRow = runtime.config.connections.some(
-      (connection) => connection.provider === 'setup',
-    );
-    const grantsSetup = runtime.config.policy.allow.some(
-      (rule) => rule.capability === '*' || rule.capability === 'setup.*',
-    );
+    // row left the half-repaired profile reading as healthy while serving exactly
+    // as little as the untouched one — and both halves are what
+    // `ensureOwnerLayer` writes, so this is the check that says whether it ran.
+    //
+    // A surface the operator has *denied* is not missing, it is off, so a deny
+    // covering it is not reported. That is the same rule the repair follows, and
+    // reading it here from `policy.deny` rather than asking the repair keeps
+    // `doctor` a read.
+    const denied = (rule: string): boolean =>
+      runtime.config.policy.deny.some(
+        (entry) => entry.capability === '*' || entry.capability === rule,
+      );
+
+    const missing = DEFAULT_SURFACES.filter((provider) => {
+      const rule = `${provider}.*`;
+      if (denied(rule)) return false;
+
+      const hasRow = runtime.config.connections.some(
+        (connection) => connection.provider === provider,
+      );
+      const granted = runtime.config.policy.allow.some(
+        (entry) => entry.capability === '*' || entry.capability === rule,
+      );
+      return !hasRow || !granted;
+    });
 
-    if (!hasSetupRow || !grantsSetup) {
+    if (missing.length > 0) {
       warnings.push({
-        kind: 'no_setup_connection',
+        kind: 'no_owner_layer',
         message:
-          `this profile ${hasSetupRow ? 'does not grant "setup.*"' : 'has no "setup" connection'}` +
-          ', so an agent cannot see what is configured — run: lanes link connect setup',
-        fix: forSelection('lanes link connect setup'),
+          `this profile cannot reach its own ${missing.join(', ')} — ` +
+          'the connection row or the allow rule is missing, and either alone serves nothing. ' +
+          'Any of start, connect or deploy repairs it',
+        fix: forSelection('lanes link start'),
       });
     }
 

package/src/cli/commands/operate/migrate.ts

@@ -0,0 +1,100 @@
+import { ConfigError, resolveSelection } from '#profile';
+import { ConfigDocument } from '../../config-edit.ts';
+import { migrateRenamedProviders, pendingRenames, shapeOf } from '../../config-migrate.ts';
+import { emit, fail, ok, print, style, warn } from '../../output.ts';
+import { openSecretStoreFor, type GlobalFlags } from '../../runtime.ts';
+
+/**
+ * `doctor` answering for a profile whose config will not load.
+ *
+ * Here rather than in `inspect.ts` because it is the opposite of everything
+ * there: every other check reads a runtime, and this one runs precisely when no
+ * runtime can be opened. Keeping it beside them would have put a second
+ * `try`/`catch` shape around a file that is otherwise one long list of findings.
+ *
+ * Why `doctor` at all, and not a command of its own: it is already the command
+ * whose job is to say what is wrong and name the fix, and a `lanes link migrate`
+ * would be a command an operator has to know exists before their config breaks.
+ * `doctor` is what someone runs when something is broken, so it has to be the
+ * one that works when everything else refuses.
+ */
+
+export interface RenameFlags extends GlobalFlags {
+  readonly json?: boolean | undefined;
+  /** Apply the migration rather than reporting it. */
+  readonly fix?: boolean | undefined;
+}
+
+/**
+ * Whether a refusal to load was a provider rename, and — with `--fix` — undo it.
+ *
+ * Returns false for anything else, so the caller rethrows the original error
+ * rather than replacing a real config problem with "nothing to migrate".
+ *
+ * The selection is resolved again here, and cheaply: `resolveSelection` reads
+ * the workspace and the flag, never a profile's config, which is what makes it
+ * usable on the path where the config is the thing that is broken.
+ */
+export async function migratedRenamedProviders(
+  flags: RenameFlags,
+  refusal: unknown,
+): Promise<boolean> {
+  if (!(refusal instanceof ConfigError)) return false;
+
+  const selection = await resolveSelection({ profileFlag: flags.profile });
+  const document = await ConfigDocument.open(selection.workspaceRoot, selection.profile);
+  if (pendingRenames(document).length === 0) return false;
+
+  // Shape-only, because the check this document fails runs after the schema.
+  // Throws when it is malformed beyond a rename, which is a better sentence
+  // than the referential one it would otherwise be reported under.
+  const config = shapeOf(document);
+  const target = flags.target ?? '';
+  const credentials = await openSecretStoreFor(config, selection.workspaceRoot, target);
+
+  const migration = await migrateRenamedProviders(document, credentials, {
+    apply: flags.fix === true,
+  });
+
+  const applied = flags.fix === true && migration.changes.length > 0;
+
+  // A report is a problem, because the profile is still unusable. A repair that
+  // left nothing behind is not, and one that could not decide every row is —
+  // those rows are exactly as broken as before.
+  if (!applied || migration.blocked.length > 0) process.exitCode = 1;
+
+  await emit(
+    flags.json,
+    {
+      ok: applied && migration.blocked.length === 0,
+      profile: selection.profile,
+      target,
+      applied,
+      rows: migration.rows,
+      changes: migration.changes,
+      blocked: migration.blocked,
+    },
+    () => {
+      print(`profile ${style.bold(selection.profile)}  target ${style.bold(target)}`);
+      print();
+
+      if (applied) {
+        print(ok(`${document.path} no longer names a provider that has moved`));
+      } else {
+        print(fail(`${document.path} names a provider that has moved, so nothing can load it`));
+      }
+
+      for (const change of migration.changes) {
+        print(`      ${style.dim(applied ? change : `would ${change}`)}`);
+      }
+      for (const problem of migration.blocked) print(warn(problem));
+
+      if (!applied && migration.changes.length > 0) {
+        print();
+        print(`Run the same command with ${style.bold('--fix')} to apply it.`);
+      }
+    },
+  );
+
+  return true;
+}

package/src/cli/commands/operate/serve.ts

@@ -1,5 +1,6 @@
 import { startEndpoint } from '#server/endpoint.ts';
 import { streamLogger } from '#server/logging.ts';
+import { repairOwnerLayer } from '../../config-repair.ts';
 import { announce, ok, print, style, warn } from '../../output.ts';
 import { staleNudge } from '../../release.ts';
 import { resolveProfile, type GlobalFlags } from '../../runtime.ts';
@@ -16,6 +17,26 @@ export async function start(
   const { resolution } = await resolveProfile(flags);
   announce(resolution);
 
+  // Before the bootstrap, and only here.
+  //
+  // This is the one command an existing install runs without being told to, so
+  // it is how a profile written before ADR-050 comes to have memory, tasks,
+  // assets, skills and the vault at all — `connect` and `deploy` repair too, but
+  // someone who is already set up may not run either for months. What it writes
+  // is the rows and rules a fresh profile is created with; a `deny` covering a
+  // surface is left alone, which is how one stays off.
+  //
+  // Not inside `startEndpoint`, which the container entrypoint also calls: a
+  // deployed revision holds `objectViewer` on `profiles/` (ADR-023) and must not
+  // be the thing that edits config. The repair belongs to the control plane
+  // (ADR-007), and this is the control plane.
+  //
+  // Scoped as the serving is: `--only` serves one profile, so it repairs one.
+  await repairOwnerLayer(
+    resolution.workspaceRoot,
+    flags.only ? [resolution.profile] : undefined,
+  );
+
   // The bootstrap itself lives in `endpoint.ts`, shared with the container
   // entrypoint. What stays here is what a terminal wants: the plan, printed as
   // it is applied, and the endpoint at the end.

package/src/cli/commands/owner/assets.ts

@@ -0,0 +1,132 @@
+import { readFile } from 'node:fs/promises';
+import { basename } from 'node:path';
+import { ConfigError } from '#profile';
+import { scopeNamespace } from '#dispatch';
+import { scopeBlobStore, type BlobStore } from '#stores/blobs';
+import { assetStorage } from '#providers/owner.ts';
+import { heading, ok, print, style, table } from '../../output.ts';
+import type { Runtime } from '../../runtime.ts';
+import {
+  agreed,
+  ownerConnection,
+  required,
+  withRuntime,
+  type OwnerFlags,
+} from './shared.ts';
+
+/** `lanes link assets` — files the owner wants kept. */
+
+export async function assetsList(flags: OwnerFlags): Promise<void> {
+  await withRuntime(flags, async (runtime) => {
+    const assets = await assetStorage.all(assetsStore(runtime, flags));
+
+    heading(`Assets (${assets.length})`);
+    if (assets.length === 0) {
+      print(style.dim('  none — keep one with: lanes link assets add <file>'));
+      return;
+    }
+
+    table(
+      assets.map((asset) => [
+        `  ${asset.name}`,
+        style.dim(asset.contentType),
+        style.dim(assetStorage.humanBytes(asset.bytes)),
+        style.dim(asset.modifiedAt.slice(0, 10)),
+      ]),
+    );
+  });
+}
+
+/**
+ * `lanes link assets add <file>` — a path on this machine.
+ *
+ * Only a path, where the capability takes five sources. The other four exist
+ * because the endpoint may not be on the caller's machine; a CLI is, by
+ * definition, already there, so a URL or a staged handle here would be
+ * ceremony over `curl -O`.
+ */
+export async function assetsAdd(path: string | undefined, flags: OwnerFlags): Promise<void> {
+  const from = required(path, 'lanes link assets add <file>');
+
+  let bytes: Uint8Array;
+  try {
+    bytes = new Uint8Array(await readFile(from));
+  } catch (failure) {
+    const code = (failure as { code?: string }).code;
+    if (code === 'ENOENT') throw new ConfigError(`No file at ${from}.`);
+    if (code === 'EISDIR') throw new ConfigError(`${from} is a directory, not a file.`);
+    throw new ConfigError(`Could not read ${from} — ${(failure as Error).message}`);
+  }
+
+  const name = flags.name ?? basename(from);
+  assetStorage.assertName(name);
+
+  await withRuntime(flags, async (runtime) => {
+    const store = assetsStore(runtime, flags);
+    const replaced = await store.has(name);
+
+    // Only when told. Left off, the store infers from the extension and writes no
+    // sidecar; `--content-type` is for the file whose name does not say what it
+    // is, which is the only case worth a `<name>.meta` beside it.
+    await store.put(name, bytes, flags.contentType ? { contentType: flags.contentType } : {});
+
+    print(
+      ok(
+        `${replaced ? 'replaced' : 'kept'} ${style.bold(name)} — ` +
+          `${assetStorage.humanBytes(bytes.byteLength)}, sha256 ${assetStorage.digest(bytes).slice(0, 12)}…`,
+      ),
+    );
+  });
+}
+
+/**
+ * `lanes link assets get <name>` — write the bytes to stdout.
+ *
+ * Bytes rather than a description, unlike the capability: this end of the pipe is
+ * a shell, so `lanes link assets get invoice.pdf > invoice.pdf` is the useful
+ * thing and there is no context window to protect. Refuses a terminal for the
+ * same reason `curl` warns about it — binary into a tty is a mess nobody wanted.
+ */
+export async function assetsGet(name: string | undefined, flags: OwnerFlags): Promise<void> {
+  const wanted = required(name, 'lanes link assets get <name> > <file>');
+
+  await withRuntime({ ...flags, raw: true }, async (runtime) => {
+    const store = assetsStore(runtime, flags);
+    const bytes = await store.get(wanted);
+    if (bytes === null) throw new ConfigError(`No asset "${wanted}" in this profile.`);
+
+    if (process.stdout.isTTY) {
+      throw new ConfigError(
+        `"${wanted}" would be written to your terminal. Redirect it:\n` +
+          `  lanes link assets get ${wanted} > ${wanted}`,
+      );
+    }
+
+    await Bun.write(Bun.stdout, bytes);
+  });
+}
+
+export async function assetsRemove(name: string | undefined, flags: OwnerFlags): Promise<void> {
+  const wanted = required(name, 'lanes link assets remove <name>');
+
+  await withRuntime(flags, async (runtime) => {
+    const store = assetsStore(runtime, flags);
+    const asset = await assetStorage.find(store, wanted);
+    if (!asset) throw new ConfigError(`No asset "${wanted}" in this profile.`);
+
+    print(`  ${style.bold(asset.name)}  ${assetStorage.describe(asset)}`);
+    if (!(await agreed(flags, 'Delete this file?'))) return;
+
+    await store.delete(wanted);
+    print(ok(`deleted ${style.bold(wanted)}`));
+  });
+}
+
+/**
+ * The blob namespace core would scope this provider to — see `tasks.ts` for why
+ * it is built from the same two functions rather than spelled as a path.
+ */
+export function assetsStore(runtime: Runtime, flags: OwnerFlags): BlobStore {
+  const connection = ownerConnection(runtime.config, 'assets', flags);
+  return scopeBlobStore(runtime.storage, scopeNamespace('assets', connection));
+}

package/src/cli/commands/owner/shared.ts

@@ -4,11 +4,11 @@ import { confirm } from '../../prompt.ts';
 import { openRuntime, type GlobalFlags, type Runtime } from '../../runtime.ts';
 
 /**
- * What `lanes link memory`, `lanes link skills` and `lanes link vault` all need: the flag shape, the
- * runtime wrapper, connection resolution, and the two prompts.
+ * What every `lanes link` command over the owner's own data needs: the flag
+ * shape, the runtime wrapper, connection resolution, and the two prompts.
  *
- * All four commands are the same shape — open a runtime, announce, act, close —
- * so the wrapper lives here rather than three times over.
+ * All of them are the same shape — open a runtime, announce, act, close — so the
+ * wrapper lives here rather than once per noun.
  */
 
 export interface OwnerFlags extends GlobalFlags {
@@ -18,6 +18,14 @@ export interface OwnerFlags extends GlobalFlags {
   readonly tag?: string | undefined;
   readonly description?: string | undefined;
   readonly file?: string | undefined;
+  /** `tasks`: which status to set, or to filter a listing by. */
+  readonly status?: string | undefined;
+  /** `tasks`: when it is due, as the owner would write it. Empty clears it. */
+  readonly due?: string | undefined;
+  /** `assets`: what to call the stored file, where the path's basename is wrong. */
+  readonly name?: string | undefined;
+  /** `assets`: for the file whose extension does not say what it is. */
+  readonly contentType?: string | undefined;
   /** Reveal a vault value on a terminal. */
   readonly show?: boolean | undefined;
   /** Print only the value, for `$(…)`. */
@@ -102,6 +110,22 @@ export async function readStdin(usage: string, what: string): Promise<string> {
   return text;
 }
 
+/**
+ * Read stdin where there may legitimately be nothing on it.
+ *
+ * `readStdin` refuses both a terminal and an empty pipe, which is right for
+ * `memory write` and `vault set` — a command whose whole subject arrived empty
+ * has been mis-invoked. It is wrong for `tasks add`, whose subject is the title
+ * on argv and whose notes are optional: refusing there made
+ * `lanes link tasks add "x"` fail in every non-interactive context — a script, a
+ * cron, a `< /dev/null` — while working by hand, which is the worst shape for a
+ * bug to have.
+ */
+export async function optionalStdin(): Promise<string> {
+  if (process.stdin.isTTY) return '';
+  return (await Bun.stdin.text()).replace(/\n$/, '');
+}
+
 /** Confirm a destructive action, unless `--yes` already answered. */
 export async function agreed(flags: OwnerFlags, question: string): Promise<boolean> {
   if (flags.yes) return true;

package/src/cli/commands/owner/tasks.ts

@@ -0,0 +1,194 @@
+import { ConfigError } from '#profile';
+import { scopeNamespace } from '#dispatch';
+import { scopeBlobStore, type BlobStore } from '#stores/blobs';
+import { ACTIVE_STATUSES, TASK_STATUSES, taskStorage, type TaskStatus } from '#providers/owner.ts';
+import { heading, ok, print, style, table } from '../../output.ts';
+import type { Runtime } from '../../runtime.ts';
+import {
+  agreed,
+  optionalStdin,
+  ownerConnection,
+  required,
+  withRuntime,
+  type OwnerFlags,
+} from './shared.ts';
+
+/** `lanes link tasks` — what the owner has to do. */
+
+export async function tasksList(flags: OwnerFlags): Promise<void> {
+  await withRuntime(flags, async (runtime) => {
+    const store = tasksStore(runtime, flags);
+
+    // The same default the `tasks.list` capability applies, and for the same
+    // reason: the question is what is outstanding, and a list that grows forever
+    // is one nobody reads. `--status all` is the escape hatch.
+    const wanted = statusFilter(flags.status);
+    const tasks = (await taskStorage.all(store)).filter(
+      (task) =>
+        (wanted === null || wanted.has(task.status)) && (!flags.tag || task.tags.includes(flags.tag)),
+    );
+
+    heading(`Tasks (${tasks.length}${wanted === null ? '' : ' outstanding'})`);
+    if (tasks.length === 0) {
+      print(style.dim('  none — add one with: lanes link tasks add <title>'));
+      return;
+    }
+
+    table(
+      tasks.map((task) => [
+        `  ${task.id}`,
+        task.status,
+        task.title,
+        task.due ? style.dim(`due ${task.due}`) : '',
+        task.tags.length > 0 ? style.dim(task.tags.join(', ')) : '',
+      ]),
+    );
+  });
+}
+
+export async function tasksGet(id: string | undefined, flags: OwnerFlags): Promise<void> {
+  const taskId = required(id, 'lanes link tasks get <id>');
+
+  await withRuntime(flags, async (runtime) => {
+    const task = await taskStorage.read(tasksStore(runtime, flags), taskId);
+    if (!task) throw new ConfigError(`No task "${taskId}" in this profile.`);
+
+    print('');
+    print(`  ${style.bold(task.title)}`);
+    print(style.dim(`  ${task.status}${task.due ? `  due ${task.due}` : ''}`));
+    if (task.tags.length > 0) print(style.dim(`  ${task.tags.join(', ')}`));
+    if (task.body.length > 0) {
+      print('');
+      print(task.body);
+    }
+  });
+}
+
+/**
+ * `lanes link tasks add <title>` — the title on argv, notes optional on stdin.
+ *
+ * Unlike `memory write`, the title is the argument and the body is optional: a
+ * task is usually one line, and demanding a heredoc to write "chase the invoice"
+ * would make the common case the awkward one. So `optionalStdin` rather than
+ * `readStdin` — see its docstring for what refusing an empty pipe here broke.
+ */
+export async function tasksAdd(title: string | undefined, flags: OwnerFlags): Promise<void> {
+  const given = required(title, 'lanes link tasks add <title>   (notes on stdin, optional)');
+  const notes = await optionalStdin();
+
+  await withRuntime(flags, async (runtime) => {
+    const store = tasksStore(runtime, flags);
+    const id = taskStorage.slugify(given);
+    const existing = await taskStorage.read(store, id);
+    const now = new Date().toISOString();
+
+    await taskStorage.write(store, {
+      id,
+      title: given,
+      status: assertStatus(flags.status) ?? 'open',
+      tags: flags.tag ? [flags.tag] : (existing?.tags ?? []),
+      ...(flags.due ? { due: flags.due } : {}),
+      createdAt: existing?.createdAt ?? now,
+      updatedAt: now,
+      body: notes,
+    });
+
+    print(ok(`${existing ? 'replaced' : 'added'} task ${style.bold(id)}`));
+  });
+}
+
+/**
+ * `lanes link tasks update <id> --status done`.
+ *
+ * Omitted flags leave their fields alone, which is what makes this the way to
+ * close a task rather than delete it: the record of having done it is the useful
+ * part, and `--status done` keeps everything else.
+ */
+export async function tasksUpdate(id: string | undefined, flags: OwnerFlags): Promise<void> {
+  const taskId = required(id, 'lanes link tasks update <id> --status <status>');
+
+  await withRuntime(flags, async (runtime) => {
+    const store = tasksStore(runtime, flags);
+    const existing = await taskStorage.read(store, taskId);
+    if (!existing) throw new ConfigError(`No task "${taskId}" in this profile.`);
+
+    const status = assertStatus(flags.status);
+    if (!status && !flags.title && !flags.due && !flags.tag) {
+      throw new ConfigError(
+        `Nothing to change. Pass --status, --title, --due or --tag.\n` +
+          `  statuses: ${TASK_STATUSES.join(', ')}`,
+      );
+    }
+
+    // `due` is taken off the existing record rather than spread and overwritten,
+    // because spreading cannot remove a key — the same trap the provider's
+    // `update` documents.
+    const { due: previous, ...rest } = existing;
+    const due = flags.due === '' ? undefined : (flags.due ?? previous);
+
+    await taskStorage.write(store, {
+      ...rest,
+      title: flags.title ?? existing.title,
+      status: status ?? existing.status,
+      tags: flags.tag ? [flags.tag] : existing.tags,
+      ...(due ? { due } : {}),
+      updatedAt: new Date().toISOString(),
+    });
+
+    print(ok(`updated task ${style.bold(taskId)} — now ${status ?? existing.status}`));
+  });
+}
+
+export async function tasksRemove(id: string | undefined, flags: OwnerFlags): Promise<void> {
+  const taskId = required(id, 'lanes link tasks remove <id>');
+
+  await withRuntime(flags, async (runtime) => {
+    const store = tasksStore(runtime, flags);
+    const task = await taskStorage.read(store, taskId);
+    if (!task) throw new ConfigError(`No task "${taskId}" in this profile.`);
+
+    print(`  ${style.bold(task.id)}  ${task.status}  ${task.title}`);
+    print(
+      style.dim('  deleting loses the record that it happened — "update --status done" keeps it'),
+    );
+    if (!(await agreed(flags, 'Delete this task?'))) return;
+
+    await store.delete(taskStorage.key(taskId));
+    print(ok(`deleted task ${style.bold(taskId)}`));
+  });
+}
+
+/**
+ * `--status` as a filter: a named one, `all`, or the outstanding set by default.
+ *
+ * `null` means every status. Returning a set rather than a predicate so the
+ * heading can say whether it narrowed.
+ */
+function statusFilter(raw: string | undefined): Set<TaskStatus> | null {
+  if (raw === 'all') return null;
+  if (raw === undefined) return new Set(ACTIVE_STATUSES);
+  return new Set([assertStatus(raw)!]);
+}
+
+function assertStatus(raw: string | undefined): TaskStatus | undefined {
+  if (raw === undefined) return undefined;
+  if (!(TASK_STATUSES as readonly string[]).includes(raw)) {
+    throw new ConfigError(
+      `Unknown status "${raw}". One of: ${TASK_STATUSES.join(', ')}` +
+        '\n  (or "all", when filtering a listing)',
+    );
+  }
+  return raw as TaskStatus;
+}
+
+/**
+ * The blob namespace core would scope this provider to.
+ *
+ * Built from `scopeNamespace` and `scopeBlobStore` — the same two functions
+ * `buildProviderContext` uses — rather than from a path spelled out again, so the
+ * CLI cannot address a different directory from the provider.
+ */
+export function tasksStore(runtime: Runtime, flags: OwnerFlags): BlobStore {
+  const connection = ownerConnection(runtime.config, 'tasks', flags);
+  return scopeBlobStore(runtime.storage, scopeNamespace('tasks', connection));
+}

package/src/cli/commands/owner.ts

@@ -1,5 +1,6 @@
 /**
- * `lanes link memory`, `lanes link skills`, `lanes link vault` — the owner layer's control plane.
+ * `lanes link memory`, `tasks`, `assets`, `skills`, `vault` — the owner layer's
+ * control plane.
  *
  * The layer shipped in M4 with no CLI at all, so the two stores holding the
  * owner's *own* data were reachable only by an agent, and the one thing that
@@ -20,9 +21,9 @@
  * both sides now: from here because this is the owner's control plane, and over
  * MCP because ADR-014 §1 decided a policy-gated grant beats a missing path.
  *
- * One noun per file — `memory.ts`, `skills.ts`, `vault.ts` — over the shape all
- * three share in `shared.ts`: the flag type, the open-announce-act-close
- * wrapper, connection resolution, and the two prompts.
+ * One noun per file — `memory.ts`, `tasks.ts`, `assets.ts`, `skills.ts`,
+ * `vault.ts` — over the shape they all share in `shared.ts`: the flag type, the
+ * open-announce-act-close wrapper, connection resolution, and the two prompts.
  */
 
 export {
@@ -33,6 +34,10 @@ export {
   memoryWrite,
 } from './owner/memory.ts';
 
+export { tasksAdd, tasksGet, tasksList, tasksRemove, tasksUpdate } from './owner/tasks.ts';
+
+export { assetsAdd, assetsGet, assetsList, assetsRemove } from './owner/assets.ts';
+
 export { skillsAdd, skillsList, skillsRemove, skillsShow } from './owner/skills.ts';
 
 export {