@lanes-sh/link 0.4.1 → 0.5.1

package/src/cli/runtime/registry.ts

@@ -7,12 +7,14 @@ import { loadProfileProviders } from '#providers/custom/index.ts';
 import { loadProfileSkills, type LoadedSkill } from '#providers/skills/store.ts';
 import { exampleProvider } from '#providers/example/provider.ts';
 import {
+  assetsProvider,
   createIdentityProvider,
   createMemoryVaultStore,
   createSetupProvider,
   createSkillsProvider,
   createVaultProvider,
   memoryProvider,
+  tasksProvider,
   type IdentityProviderOptions,
   type SetupProviderOptions,
   type VaultStore,
@@ -84,8 +86,8 @@ export interface OwnerLayerOptions {
  * Statically imported for now; the registry does not care where a manifest came
  * from, which is what lets workspace YAML register alongside these.
  *
- * `allowReserved` is what admits `memory`, `skills`, `vault`, `setup`, and
- * `identity`. The guard
+ * `allowReserved` is what admits `memory`, `tasks`, `assets`, `skills`, `vault`,
+ * `setup`, and `identity`. The guard
  * stays rather than being retired: it exists so a *third-party* provider cannot
  * claim a namespace whose policy rules would then silently mean something else,
  * and that reason survives the owner layer shipping. Only this one construction
@@ -95,7 +97,13 @@ export function buildRegistry(owner: OwnerLayerOptions = {}): ProviderRegistry {
   const registry = new ProviderRegistry({ allowReserved: true });
 
   registry.register(exampleProvider);
+  // The three that hold what the owner keeps. All module-level constants rather
+  // than factories: each reads and writes through `context.storage`, which core
+  // scopes per call, so there is nothing to hand in at construction time and
+  // nothing for `OwnerLayerOptions` to carry.
   registry.register(memoryProvider);
+  registry.register(tasksProvider);
+  registry.register(assetsProvider);
   registry.register(skillsProviderFor(owner));
   registry.register(
     createVaultProvider({

package/src/cli/selection.ts

@@ -111,6 +111,11 @@ export const SELECTION: Record<string, Requires> = {
   'identity list': 'profile',
 
   connect: 'profile+target',
+  // Both edit the profile config, and `disconnect` also opens the target's
+  // credential store to delete from it. Same requirement as `connect` for the
+  // same reasons.
+  disconnect: 'profile+target',
+  relabel: 'profile+target',
   // Its own row rather than an inheritance from `connect`. Both need the same
   // two things, but the row is what makes `selectionKey` return the two-word
   // key — and that is what keeps thirty declaration flags off
@@ -153,6 +158,8 @@ export const SELECTION: Record<string, Requires> = {
   'mcp add': 'profile+target',
   'mcp stdio': 'profile+target',
   memory: 'profile+target',
+  tasks: 'profile+target',
+  assets: 'profile+target',
   skills: 'profile+target',
   vault: 'profile+target',
   // Both halves open the target's adapters — `show` counts what is in the
@@ -181,6 +188,8 @@ const SUBCOMMANDS: Record<string, readonly string[]> = {
   config: ['show'],
   setup: ['plan'],
   memory: ['list', 'get', 'write', 'forget'],
+  tasks: ['list', 'get', 'add', 'update', 'remove'],
+  assets: ['list', 'get', 'add', 'remove'],
   skills: ['list', 'show', 'add', 'remove'],
   vault: ['list', 'get', 'set', 'remove', 'key'],
   mcp: ['skill', 'add', 'stdio', 'list'],
@@ -310,6 +319,12 @@ const ACCEPTS: Record<string, readonly string[]> = {
   // `removalPlan`, and was refused here — the flag existed everywhere except in
   // the list that decides whether it may be typed.
   'profile remove': ['dry-run', 'yes', 'target'],
+  disconnect: ['yes', 'keep-credential'],
+  // The one repair `doctor` can apply rather than only name. Narrow on purpose:
+  // it undoes a provider rename this project shipped, and every other finding
+  // there is something only the operator can decide.
+  doctor: ['fix'],
+  relabel: [],
   'target list': ['urls', 'target'],
   'target show': ['target'],
   'token show': ['show', 'raw'],
@@ -332,6 +347,9 @@ const ACCEPTS: Record<string, readonly string[]> = {
   update: ['check'],
   'identity add': ['note'],
   memory: ['connection', 'title', 'description', 'file', 'tag'],
+  // `--yes` on both, because both have a delete that asks first.
+  tasks: ['connection', 'title', 'status', 'due', 'tag', 'yes'],
+  assets: ['connection', 'name', 'content-type', 'yes'],
   skills: ['connection', 'title', 'description', 'file'],
   vault: ['connection'],
   // `no-migrate` is listed beside `migrate` because they are three states

package/src/cli/usage.ts

@@ -16,7 +16,7 @@ import { style } from './output.ts';
 /** How this CLI is invoked — the `link` area of the `lanes` command. */
 export const PROGRAM = 'lanes link';
 
-export const USAGE = `${style.bold(PROGRAM)} — a self-hostable MCP gateway for all your connections, memory, skills, and secrets
+export const USAGE = `${style.bold(PROGRAM)} — a self-hostable MCP gateway for all your connections, memory, tasks, files, and secrets
 
 ${style.bold('Everyday')}
   ${PROGRAM} setup plan [--json]        what each provider needs, and which are connected
@@ -26,6 +26,9 @@ ${style.bold('Everyday')}
   ${PROGRAM} connect <...> --replace    ask for the stored password or key again
   ${PROGRAM} connect <...> --auth <method>  pick how, where there is a choice
   ${PROGRAM} connect <...> --non-interactive [--json]
+  ${PROGRAM} disconnect <provider>.<id>  remove an account, and delete its credential
+  ${PROGRAM} disconnect <...> --keep-credential   leave the credential in the store
+  ${PROGRAM} relabel <provider>.<id> <name>      rename what an account is called
   ${PROGRAM} connect custom <id> --connector <kind> --auth <method>
                                  declare a service that is not built in, and connect it.
                                  kinds: mcp, http, imap, dav, fs. Omit a value and it is
@@ -78,6 +81,18 @@ ${style.bold('Your own context')}
   ${PROGRAM} memory write <id> --title <t> [--tag t]   body on stdin
   ${PROGRAM} memory forget <id>
 
+  ${PROGRAM} tasks list [--status s]     what is outstanding; --status all for everything
+  ${PROGRAM} tasks get <id>
+  ${PROGRAM} tasks add <title> [--status s] [--due d] [--tag t]   notes on stdin
+  ${PROGRAM} tasks update <id> --status <s>   closing one is an update, not a remove
+  ${PROGRAM} tasks remove <id>
+                                 statuses: in_progress open blocked muted done dropped
+
+  ${PROGRAM} assets list                files kept in this profile
+  ${PROGRAM} assets get <name>          the bytes, to stdout — redirect them
+  ${PROGRAM} assets add <file> [--name n] [--content-type t]
+  ${PROGRAM} assets remove <name>
+
   ${PROGRAM} skills list                the procedures agents can invoke
   ${PROGRAM} skills show <name>
   ${PROGRAM} skills add <name> [--file f]             document on stdin
@@ -112,6 +127,8 @@ ${style.bold('Deploying')}
 ${style.bold('Inspection')}
   ${PROGRAM} check                      static validation, no external calls
   ${PROGRAM} doctor [--json]            credentials resolve, stores reachable
+  ${PROGRAM} doctor --fix               apply a repair it can make itself, such as
+                                        a provider this project renamed under you
   ${PROGRAM} tools [--json]             what the endpoint advertises to a client
   ${PROGRAM} plan                       what reconcile would change
   ${PROGRAM} audit tail [--limit N] [--denied-only] [--format md]
@@ -131,7 +148,8 @@ ${style.bold('Naming what a command acts on')}
                                  command that names neither refuses and lists what exists.
 
 ${style.bold('Other flags')}
-  --connection <id>              which memory/skills/vault connection, if a profile has several
+  --connection <id>              which memory/tasks/assets/skills/vault connection, where
+                                 a profile has several of one kind
   --yes                          skip the confirmation a destructive command would ask for
   --json                         machine-readable output, where a command offers it
   --non-interactive              never prompt: connect refuses with what to store,

package/src/connectivity/mail/attachments.ts

@@ -362,7 +362,11 @@ const CONTENT_TYPES: Readonly<Record<string, string>> = {
   // opens by extension anyway. Adding them back will fail the suite.
 };
 
-function guessContentType(filename: string): string {
+/**
+ * Exported because `assets` needs exactly this and the table above must not be
+ * copied — its `.pages`/`.numbers` note is a rule the copy would not carry.
+ */
+export function guessContentType(filename: string): string {
   const extension = filename.split('.').pop()?.toLowerCase();
   return (extension ? CONTENT_TYPES[extension] : undefined) ?? 'application/octet-stream';
 }

package/src/connectivity/mail/index.ts

@@ -21,7 +21,12 @@ export { receiptFor } from './message.ts';
 export { composeMime } from './compose.ts';
 
 export type { AttachmentRef, MailboxAttachmentSource, ResolveOptions } from './attachments.ts';
-export { attachmentRefSchema, attachmentsJsonSchema, resolveAttachments } from './attachments.ts';
+export {
+  attachmentRefSchema,
+  attachmentsJsonSchema,
+  guessContentType,
+  resolveAttachments,
+} from './attachments.ts';
 
 export type { StagedFile, StagedMetadata } from './staging.ts';
 export {

package/src/connectivity/manifest/provider.ts

@@ -64,8 +64,21 @@ export const providerManifestSchema = z.object({
 
 export type ProviderManifest = z.infer<typeof providerManifestSchema>;
 
-/** Provider ids reserved for the owner layer. */
-export const RESERVED_PROVIDER_IDS: readonly string[] = ['memory', 'skills', 'vault', 'setup', 'identity'];
+/**
+ * Provider ids reserved for the owner layer.
+ *
+ * The order is read: `#server/mcp`'s instructions emit one paragraph per
+ * reachable id in this sequence, so it is the order an agent meets them in.
+ */
+export const RESERVED_PROVIDER_IDS: readonly string[] = [
+  'memory',
+  'tasks',
+  'assets',
+  'skills',
+  'vault',
+  'setup',
+  'identity',
+];
 
 /**
  * Validate a manifest, with the cross-field rules the schema alone cannot

package/src/deployments/deploy.ts

@@ -7,7 +7,8 @@ import { resolveTarget, vaultEnv } from './bootstrap.ts';
 import { printSteps, runSteps } from './steps.ts';
 import { driverFor } from './drivers.ts';
 import { prepareSecrets, readableRefs, rotatableRefs } from './prepare.ts';
-import { deployedWorkspace, repairSetupSurface, uploadWorkspace } from './upload.ts';
+import { repairOwnerLayer } from '#cli/config-repair.ts';
+import { deployedWorkspace, uploadWorkspace } from './upload.ts';
 import { unservableProfiles, unservableRefusal } from './servable.ts';
 import { collidingRefs, collisionRefusal, servingProfiles } from './serving.ts';
 import { healthLine, reachability, registerLine, reportUnauthorised } from './report.ts';
@@ -255,7 +256,7 @@ export async function deploy(flags: DeployFlags): Promise<void> {
       throw new ConfigError(unservableRefusal(unservable, target));
     }
 
-    await repairSetupSurface(resolution.workspaceRoot, serving);
+    await repairOwnerLayer(resolution.workspaceRoot, serving);
 
     // Before the rollout, so the revision that comes up finds a config to read.
     // Uploading after would leave a window where the service is serving and the

package/src/deployments/prepare.ts

@@ -46,7 +46,7 @@ export interface PrepareResult {
  * path derives from the manifest and has never read config for. Sharing one list
  * would silently pick one answer for both.
  *
- * **Scoped exactly as the upload is**, for the reason `repairSetupSurface`
+ * **Scoped exactly as the upload is**, for the reason `repairOwnerLayer`
  * states and one more: a profile this deploy sends is a profile the endpoint may
  * serve, and a connection whose secret nobody bound fails an hour after the
  * revision reports healthy. The asymmetry decides it — an extra binding is a

package/src/deployments/servable.ts

@@ -30,7 +30,7 @@ export interface Unservable {
 /**
  * The profiles this deploy would send that the revision could not open.
  *
- * Scoped exactly as `uploadWorkspace` and `repairSetupSurface` are — by the
+ * Scoped exactly as `uploadWorkspace` and `repairOwnerLayer` are — by the
  * `--profile` flag, absent meaning the whole workspace — because the set that
  * gets uploaded is the set that gets served, and checking a different one would
  * be checking the wrong question.

package/src/deployments/upload.ts

@@ -7,8 +7,6 @@ import {
   type Config,
   type TargetConfig,
 } from '#profile';
-import { ConfigDocument } from '#cli/config-edit.ts';
-import { ensureSetupConnection, repairLines, repaired } from '#cli/config-repair.ts';
 import { ok, print, style, warn } from '#cli/output.ts';
 
 /**
@@ -100,57 +98,6 @@ function authoredAreaOwner(key: string): string | null {
   return area === layout.skills(owner) || area === layout.providers(owner) ? owner : null;
 }
 
-/**
- * Give every profile about to be uploaded its setup surface.
- *
- * **Scoped exactly as the upload is**, because a profile this deploy sends is a
- * profile the endpoint will serve: repairing a narrower set would leave a served
- * profile without the surface, which is this bug one profile over. Note what
- * `flags.profile` does not mean — it is the flag alone, so a profile resolved
- * from `LANES_LINK_PROFILE` leaves it undefined and both this and the upload
- * read that as the whole workspace. Surprising, pre-existing in the upload, and
- * fixed there rather than here so the two cannot drift apart.
- *
- * *Which files are profiles* comes from `listProfiles`, never from
- * `isWorkspaceConfig`: the allowlist decides what is safe to *copy*, so it
- * happily sends a committed `personal.example.yaml` and a nested
- * `profiles/archive/old.yaml` as bytes, while this opens and validates what it
- * is handed — which turned that template into a `ConfigError` aborting the
- * deploy after provisioning had already made cloud resources.
- *
- * A profile that cannot be read is warned about rather than fatal: the repair is
- * a courtesy on the way past, and the upload still sends the file. Not silent,
- * though — nothing else here widens a policy without being asked.
- */
-export async function repairSetupSurface(
-  workspaceRoot: string,
-  profiles: readonly string[] | undefined,
-): Promise<void> {
-  const wanted = profiles === undefined ? undefined : new Set(profiles);
-
-  for (const name of await listProfiles(workspaceRoot)) {
-    if (wanted !== undefined && !wanted.has(name)) continue;
-
-    try {
-      const document = await ConfigDocument.open(workspaceRoot, name);
-      const repair = ensureSetupConnection(document);
-      if (!repaired(repair)) continue;
-
-      await document.save();
-
-      print(ok(`gave ${style.bold(name)} the setup surface`));
-      for (const change of repairLines(repair)) print(`      ${style.dim(change)}`);
-      print(`      ${style.dim('an agent can now see what is connected here, instead of guessing')}`);
-    } catch (error) {
-      print(
-        warn(
-          `could not give ${name} the setup surface: ${error instanceof Error ? error.message.split('\n')[0] : String(error)}`,
-        ),
-      );
-    }
-  }
-}
-
 /**
  * Copy the workspace's config up.
  */

package/src/profile/index.ts

@@ -38,10 +38,14 @@ export {
 
 export {
   ConfigError,
+  RENAMED_PROVIDERS,
   loadConfigFile,
   parseConfig,
+  renamedProviderFor,
   validateConfig,
+  validateConfigShape,
   type LoadedConfig,
+  type ProviderRename,
 } from './load.ts';
 
 export {

package/src/profile/load.ts

@@ -40,6 +40,25 @@ export interface LoadedConfig {
  *  4. Referential integrity, which needs a well-formed document to check.
  */
 export function validateConfig(raw: unknown, source = '<config>'): Config {
+  const config = validateConfigShape(raw, source);
+  assertReferentialIntegrity(config, source);
+  return config;
+}
+
+/**
+ * The first three steps, without the fourth.
+ *
+ * Only one caller, and it is the repair: `migrateRenamedProviders` has to open
+ * the credential store of a config that referential integrity has just refused,
+ * because whether a credential is stored is the evidence deciding which of two
+ * readings a row gets. A shape-valid document is enough to name a target's
+ * adapter, and nothing here trusts the part that failed.
+ *
+ * Not exported as a way to *load* a config. Everything that acts on one goes
+ * through `validateConfig`, and the split exists so that the one command whose
+ * job is to fix a refusal is not blocked by it.
+ */
+export function validateConfigShape(raw: unknown, source = '<config>'): Config {
   if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) {
     throw new ConfigError(`${source}: expected a YAML mapping at the top level`);
   }
@@ -59,7 +78,6 @@ export function validateConfig(raw: unknown, source = '<config>'): Config {
     throw new ConfigError(`${source}:\n${formatZodIssues(parsed.error)}`);
   }
 
-  assertReferentialIntegrity(parsed.data, source);
   return parsed.data;
 }
 
@@ -107,6 +125,119 @@ function formatZodIssues(error: z.ZodError): string {
  * left to resolve silently it grants nothing, which looks identical to a
  * working rule until the day someone relies on it.
  */
+/**
+ * A connection naming a provider whose id has moved out from under it.
+ *
+ * There is exactly one, and it is the reason this function exists: `tasks` was
+ * Google Tasks until the built-in task list took the plain noun (ADR-051). A row
+ * left saying `provider: tasks` does not fail — it resolves to the *built-in*,
+ * `reconcile` marks it active because a provider needing no credential is
+ * authorized by construction, and the operator is left with their Google Tasks
+ * tools gone, a task list wearing their old label, and nothing anywhere saying
+ * why. Refusing is the only outcome that names the fix.
+ *
+ * **The rule is a positive assertion, not a guess at what a vendor row looks
+ * like.** The built-in's row is written in exactly one spelling, by
+ * `newProfileTemplate` and by `ensureReservedConnection`: `account: Tasks`. So
+ * any other label on a `tasks` row is either a pre-rename Google Tasks row or a
+ * hand-edited built-in one, and the message names both fixes because either is
+ * one word.
+ *
+ * It was very nearly a guess, and the guess was wrong. The first version keyed
+ * on an `@` in the account, reasoning that `connect tasks` recorded the address
+ * the operator typed — Google Tasks publishes no identity, so `connect` asks.
+ * But what it asks for is a *label*: the real profile this was written for holds
+ * `account: personal`, so the check would have passed it and rebound their Google
+ * Tasks to the built-in in silence. That is the exact failure this exists to
+ * prevent, missed by one heuristic.
+ *
+ * Deliberately not a check on the connection *id*. Several task lists in one
+ * profile is a legitimate thing to want, exactly as several memory connections
+ * are, and keying on `id !== 'main'` would refuse a valid profile forever to
+ * catch a one-release migration. Labelling both `Tasks` is consistent with what
+ * the accountless providers already do — every memory connection is `Memory`.
+ *
+ * **The refusal names a command, because it is a refusal at load.** Every
+ * command opens the config, so this one takes `status`, `start` and `doctor`
+ * down together and leaves hand-editing YAML as the only way back — for a state
+ * an upgrade put the operator in, without asking. `doctor --fix` is that way
+ * back, and it is named here because this is the only place anyone sees.
+ */
+export interface ProviderRename {
+  /** What a row naming the old id should say instead. */
+  readonly to: string;
+  /** The account label that means this row is the built-in, not a vendor one. */
+  readonly keeps: string;
+  /** What the plain noun now names, for the sentence below. */
+  readonly becomes: string;
+  /** What it used to name. */
+  readonly was: string;
+  /** The built-in, in the operator's words. */
+  readonly noun: string;
+}
+
+/**
+ * Provider ids that have moved, and everything two places need to agree on.
+ *
+ * `renamedProviderFor` refuses a row still naming the old id; `#cli`'s
+ * `migrateRenamedProviders` rewrites one. A rename landing in one and not the
+ * other is a refusal with no fix, or a fix nothing asks for — which is why the
+ * pair reads from one table rather than each knowing the rename itself.
+ *
+ * `keeps` is the single spelling `newProfileTemplate` and `ensureReservedConnection`
+ * write for the built-in's row. Keep it in step with `RESERVED_SURFACES` there.
+ */
+export const RENAMED_PROVIDERS: Readonly<Record<string, ProviderRename>> = {
+  tasks: {
+    to: 'google_tasks',
+    keeps: 'Tasks',
+    becomes: 'the built-in task list',
+    was: 'Google Tasks',
+    noun: 'task list',
+  },
+};
+
+/**
+ * The repair, spelled with the selection it will refuse without.
+ *
+ * Both flags come off the document being validated rather than off the command
+ * that is running: nothing has resolved anything yet, and the profile is written
+ * in the file. A profile declaring one target names it; one declaring several
+ * cannot be guessed at, and a placeholder is more honest than picking.
+ */
+function repairCommand(config: Config): string {
+  const targets = Object.keys(config.targets);
+  const target = targets.length === 1 ? targets[0] : `<${targets.join('|') || 'target'}>`;
+  return `lanes link doctor --fix --profile ${config.instance.profile} --target ${target}`;
+}
+
+/** The rename a row is owed, or `null` when it is owed none. */
+export function renamedProviderFor(connection: {
+  provider: string;
+  account: string;
+}): ProviderRename | null {
+  const moved = RENAMED_PROVIDERS[connection.provider];
+  if (!moved || connection.account === moved.keeps) return null;
+  return moved;
+}
+
+function renamedProvider(
+  connection: { provider: string; account: string },
+  repair: string,
+): string | null {
+  const moved = renamedProviderFor(connection);
+  if (!moved) return null;
+
+  return (
+    `"${connection.provider}" is now ${moved.becomes}, and this row is labelled ` +
+    `"${connection.account}" rather than "${moved.keeps}".\n` +
+    `  If it was ${moved.was}: set provider to ${moved.to} here, and rename any ` +
+    `"${connection.provider}.*" policy rule.\n` +
+    `  If it is your own ${moved.noun}: set account to ${moved.keeps}.\n` +
+    `  ${repair} applies the first, where a stored credential proves it.`
+  );
+}
+
 function assertReferentialIntegrity(config: Config, source: string): void {
   const problems: string[] = [];
 
@@ -142,6 +273,9 @@ function assertReferentialIntegrity(config: Config, source: string): void {
       problems.push(`connections[${index}]: duplicate connection "${key}"`);
     }
     connectionKeys.add(key);
+
+    const renamed = renamedProvider(connection, repairCommand(config));
+    if (renamed) problems.push(`connections[${index}]: ${renamed}`);
   });
 
   // Same reason as a duplicate connection: two entries with the same kind and