@lanes-sh/link 0.6.0 → 0.6.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanes-sh/link",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "A self-hostable MCP gateway for all your connections, memory, tasks, files, and secrets",
   "license": "Apache-2.0",
   "homepage": "https://lanes.sh/link",

package/src/cli/migrate-plan.ts

@@ -0,0 +1,160 @@
+import { ConfigError, layout, isRemoteWorkspace, type LegacyTarget, type WorkspaceTarget } from '#profile';
+import { deployedWorkspace } from '#deployments/upload.ts';
+
+/**
+ * What one contract-1 target block becomes, and where.
+ *
+ * Apart from `workspace-migrate.ts`, which reads and writes: this is the
+ * decision, and it is the half that has been wrong twice. Both times the shape
+ * was right and the *perspective* was not — the same `cloud:` block is a pointer
+ * seen from a laptop and a declaration seen from inside the bucket, and a
+ * migration that cannot tell which end it is on writes `gs://b` pointing at
+ * `gs://b`.
+ *
+ * So the workspace being migrated is an argument to every function here, and the
+ * tests drive them directly.
+ */
+
+/**
+ * Every profile's target blocks, folded into one registry.
+ *
+ * Two refusals rather than guesses, because both are cases where one target
+ * would need two different answers and picking either silently is the class of
+ * bug this whole change is about.
+ */
+export async function hoist(
+  legacy: readonly { profile: string; targets: Record<string, LegacyTarget> }[],
+  workspaceRoot: string,
+): Promise<Record<string, WorkspaceTarget>> {
+  const registry: Record<string, WorkspaceTarget> = {};
+  const seenFrom: Record<string, string> = {};
+
+  for (const { profile, targets } of legacy) {
+    for (const [name, declared] of Object.entries(targets)) {
+      const entry = toEntry(name, declared, profile, workspaceRoot);
+      if (entry === null) continue;
+      const previous = registry[name];
+
+      if (previous === undefined) {
+        registry[name] = entry;
+        seenFrom[name] = profile;
+        continue;
+      }
+
+      if (JSON.stringify(previous) !== JSON.stringify(entry)) {
+        throw new ConfigError(
+          `Profiles "${seenFrom[name]}" and "${profile}" both declare target "${name}", and they ` +
+            `do not agree.\n` +
+            `  A target is declared once by the workspace it lives in (ADR-052), so one of these\n` +
+            `  has to win and this cannot pick.\n\n` +
+            `    ${seenFrom[name]}: ${summarise(previous)}\n` +
+            `    ${profile}: ${summarise(entry)}\n\n` +
+            `  Edit one of them to match the other, then run this again.`,
+        );
+      }
+    }
+  }
+
+  return registry;
+}
+
+/**
+ * One contract-1 target block as a registry entry.
+ *
+ * A block whose storage names a bucket becomes a pointer: that bucket is a
+ * workspace, it holds the profiles served there, and under ADR-052 it is the
+ * thing that declares the target. The adapters are not copied into the pointer —
+ * they travel to the bucket on the next `deploy`, which is the only command that
+ * can write there and roll an image that understands what it wrote.
+ *
+ * Per-profile paths are dropped when they are the layout defaults, which is the
+ * ordinary case: `./data/<profile>` and `./data/<profile>/credentials.enc` are
+ * exactly what `layout.ts` derives, so a workspace-level target that omits them
+ * addresses the same bytes. A genuinely custom path cannot be hoisted — one
+ * target cannot hold a different path per profile — and is refused by name.
+ */
+export function toEntry(
+  name: string,
+  declared: LegacyTarget,
+  profile: string,
+  workspaceRoot: string,
+): WorkspaceTarget | null {
+  const remote = deployedWorkspace(declared);
+
+  // **A target whose bucket is the workspace being migrated declares itself.**
+  //
+  // Migrating happens on both ends, and the second one is inside the bucket: the
+  // profile there carries the same `cloud` block, and deriving a pointer from it
+  // produces `gs://b` pointing at `gs://b`. That is a loop, and `openTarget`
+  // refuses it — which made `deploy` unable to run against the bucket it had
+  // just migrated, on the one command the refusal names as the fix.
+  if (remote && remote !== workspaceRoot) return { workspace: remote };
+
+  // **A filesystem target is dropped from a remote workspace.**
+  //
+  // The bucket's copy of a profile was uploaded from a laptop, so it carries
+  // that laptop's `local:` block — paths under `./data/` that address a disk the
+  // endpoint has never seen. Hoisting it would leave the bucket declaring a
+  // target it can never open, and `workspacePath` refuses that combination the
+  // moment anything tries.
+  //
+  // Nothing is lost: the machine that owns `local` has its own copy, and that is
+  // the one that was ever real.
+  if (isRemoteWorkspace(workspaceRoot) && declared.storage.adapter === 'filesystem') return null;
+
+  const storagePath = declared.storage.path;
+  const credentialsPath = declared.credentials.path;
+
+  const defaultStorage = `./${layout.blobs(profile)}`;
+  const defaultCredentials = `./${layout.credentials(profile)}`;
+
+  refuseCustomPath(name, profile, workspaceRoot, 'storage.path', storagePath, defaultStorage);
+  refuseCustomPath(
+    name,
+    profile,
+    workspaceRoot,
+    'credentials.path',
+    credentialsPath,
+    defaultCredentials,
+  );
+
+  const { path: _storage, ...storage } = declared.storage;
+  const { path: _credentials, ...credentials } = declared.credentials;
+
+  return {
+    credentials,
+    storage,
+    ...(declared.audit ? { audit: declared.audit } : {}),
+    ...(declared.vault ? { vault: declared.vault } : {}),
+    ...(declared.deploy ? { deploy: declared.deploy } : {}),
+  };
+}
+
+function refuseCustomPath(
+  target: string,
+  profile: string,
+  workspaceRoot: string,
+  field: string,
+  value: string | undefined,
+  expected: string,
+): void {
+  if (value === undefined) return;
+  // Both spellings of the same directory: `./data/personal` and `data/personal`
+  // resolve identically and the template has written each at different times.
+  if (value === expected || value === expected.replace(/^\.\//, '')) return;
+
+  throw new ConfigError(
+    `Profile "${profile}" declares target "${target}" with a custom ${field}:\n` +
+      `    ${value}\n` +
+      `  A target is declared once for the whole workspace now (ADR-052), so it cannot hold a\n` +
+      `  different path per profile. The default it would get is ${expected}.\n\n` +
+      `  Move the data there and delete the line, or keep this profile in a workspace of its\n` +
+      `  own: LANES_LINK_HOME=${workspaceRoot}/<somewhere> lanes link profile add ${profile} --target ${target}`,
+  );
+}
+
+export function summarise(entry: WorkspaceTarget): string {
+  if (entry.workspace !== undefined) return `points at ${entry.workspace}`;
+  const parts = [entry.credentials?.adapter, entry.storage?.adapter].filter(Boolean);
+  return `${parts.join(' + ')}${entry.deploy ? `, deploys ${entry.deploy.service}` : ''}`;
+}

package/src/cli/workspace-migrate.ts

@@ -6,6 +6,7 @@ import {
   layout,
   listProfiles,
   readWorkspaceFile,
+  isRemoteWorkspace,
   workspaceFiles,
   isLegacyProfile,
   legacyConfigSchema,
@@ -13,8 +14,8 @@ import {
   type LegacyTarget,
   type WorkspaceTarget,
 } from '#profile';
-import { deployedWorkspace } from '#deployments/upload.ts';
 import { ConfigDocument } from './config-edit.ts';
+import { hoist, summarise } from './migrate-plan.ts';
 
 /**
  * Contract 1 → 2: the target moves out of the profile and into the workspace.
@@ -168,123 +169,6 @@ export async function migrateWorkspace(
   };
 }
 
-/**
- * Every profile's target blocks, folded into one registry.
- *
- * Two refusals rather than guesses, because both are cases where one target
- * would need two different answers and picking either silently is the class of
- * bug this whole change is about.
- */
-async function hoist(
-  legacy: readonly { profile: string; targets: Record<string, LegacyTarget> }[],
-  workspaceRoot: string,
-): Promise<Record<string, WorkspaceTarget>> {
-  const registry: Record<string, WorkspaceTarget> = {};
-  const seenFrom: Record<string, string> = {};
-
-  for (const { profile, targets } of legacy) {
-    for (const [name, declared] of Object.entries(targets)) {
-      const entry = toEntry(name, declared, profile, workspaceRoot);
-      const previous = registry[name];
-
-      if (previous === undefined) {
-        registry[name] = entry;
-        seenFrom[name] = profile;
-        continue;
-      }
-
-      if (JSON.stringify(previous) !== JSON.stringify(entry)) {
-        throw new ConfigError(
-          `Profiles "${seenFrom[name]}" and "${profile}" both declare target "${name}", and they ` +
-            `do not agree.\n` +
-            `  A target is declared once by the workspace it lives in (ADR-052), so one of these\n` +
-            `  has to win and this cannot pick.\n\n` +
-            `    ${seenFrom[name]}: ${summarise(previous)}\n` +
-            `    ${profile}: ${summarise(entry)}\n\n` +
-            `  Edit one of them to match the other, then run this again.`,
-        );
-      }
-    }
-  }
-
-  return registry;
-}
-
-/**
- * One contract-1 target block as a registry entry.
- *
- * A block whose storage names a bucket becomes a pointer: that bucket is a
- * workspace, it holds the profiles served there, and under ADR-052 it is the
- * thing that declares the target. The adapters are not copied into the pointer —
- * they travel to the bucket on the next `deploy`, which is the only command that
- * can write there and roll an image that understands what it wrote.
- *
- * Per-profile paths are dropped when they are the layout defaults, which is the
- * ordinary case: `./data/<profile>` and `./data/<profile>/credentials.enc` are
- * exactly what `layout.ts` derives, so a workspace-level target that omits them
- * addresses the same bytes. A genuinely custom path cannot be hoisted — one
- * target cannot hold a different path per profile — and is refused by name.
- */
-function toEntry(
-  name: string,
-  declared: LegacyTarget,
-  profile: string,
-  workspaceRoot: string,
-): WorkspaceTarget {
-  const remote = deployedWorkspace(declared);
-  if (remote) return { workspace: remote };
-
-  const storagePath = declared.storage.path;
-  const credentialsPath = declared.credentials.path;
-
-  const defaultStorage = `./${layout.blobs(profile)}`;
-  const defaultCredentials = `./${layout.credentials(profile)}`;
-
-  refuseCustomPath(name, profile, workspaceRoot, 'storage.path', storagePath, defaultStorage);
-  refuseCustomPath(
-    name,
-    profile,
-    workspaceRoot,
-    'credentials.path',
-    credentialsPath,
-    defaultCredentials,
-  );
-
-  const { path: _storage, ...storage } = declared.storage;
-  const { path: _credentials, ...credentials } = declared.credentials;
-
-  return {
-    credentials,
-    storage,
-    ...(declared.audit ? { audit: declared.audit } : {}),
-    ...(declared.vault ? { vault: declared.vault } : {}),
-    ...(declared.deploy ? { deploy: declared.deploy } : {}),
-  };
-}
-
-function refuseCustomPath(
-  target: string,
-  profile: string,
-  workspaceRoot: string,
-  field: string,
-  value: string | undefined,
-  expected: string,
-): void {
-  if (value === undefined) return;
-  // Both spellings of the same directory: `./data/personal` and `data/personal`
-  // resolve identically and the template has written each at different times.
-  if (value === expected || value === expected.replace(/^\.\//, '')) return;
-
-  throw new ConfigError(
-    `Profile "${profile}" declares target "${target}" with a custom ${field}:\n` +
-      `    ${value}\n` +
-      `  A target is declared once for the whole workspace now (ADR-052), so it cannot hold a\n` +
-      `  different path per profile. The default it would get is ${expected}.\n\n` +
-      `  Move the data there and delete the line, or keep this profile in a workspace of its\n` +
-      `  own: LANES_LINK_HOME=${workspaceRoot}/<somewhere> lanes link profile add ${profile} --target ${target}`,
-  );
-}
-
 /**
  * Write the registry into the workspace file, creating it when absent.
  *
@@ -351,12 +235,6 @@ function describe(
   );
 }
 
-function summarise(entry: WorkspaceTarget): string {
-  if (entry.workspace !== undefined) return `points at ${entry.workspace}`;
-  const parts = [entry.credentials?.adapter, entry.storage?.adapter].filter(Boolean);
-  return `${parts.join(' + ')}${entry.deploy ? `, deploys ${entry.deploy.service}` : ''}`;
-}
-
 /**
  * Refuse a contract-1 workspace with the command that fixes it.
  *

package/src/deployments/deploy.ts

@@ -1,6 +1,7 @@
 import {
   ConfigError,
   recordTarget,
+  resolveTargetWorkspace,
   resolveWorkspaceRoot,
   type DeployConfig,
 } from '#profile';
@@ -61,6 +62,23 @@ export interface DeployFlags extends GlobalFlags {
 }
 
 export async function deploy(flags: DeployFlags): Promise<void> {
+  // **The target's own workspace is migrated before anything resolves it.**
+  //
+  // This is the first thing the command does, and it has to be. `deploy` is what
+  // the refusal on a contract-1 bucket tells you to run — and every other read of
+  // that bucket goes through `openTarget`, which refuses it for the same reason.
+  // Migrating after resolution made the instruction circular: the command named
+  // as the fix could not get past the problem it fixes.
+  //
+  // `resolveTargetWorkspace` is the one lookup that does not need the far end to
+  // declare anything: it reads this machine's pointer and stops. So the bucket is
+  // located, migrated, and only then opened.
+  //
+  // Idempotent, and silent on a workspace already at contract 2 — a listing and
+  // no writes. `--dry-run` reports what it would do and writes nothing, like
+  // every other step of this command.
+  if (!(await migrateTargetWorkspace(requireTargetFlag(flags), flags.dryRun !== true))) return;
+
   // The one command allowed to name a target that does not exist yet: creating
   // it is what a first deploy is for.
   //
@@ -258,21 +276,13 @@ export async function deploy(flags: DeployFlags): Promise<void> {
 
     // **The bucket's own migration, here and nowhere else.**
     //
-    // Contract 1 is not read by this binary at all (ADR-052), so the moment a
-    // bucket becomes contract 2 the revision in front of it stops being able to
-    // read its own config. Doing it here puts that window between an upload and
-    // a rollout that are seconds apart, rather than leaving it open until
-    // somebody happens to redeploy.
-    //
-    // After the upload, because the upload is what puts the profiles there for
-    // it to migrate. Idempotent, so a bucket already at contract 2 costs one
+    // A second pass, and it is not redundant. The one at the top of the command
+    // migrated whatever the bucket already held; this catches what the upload
+    // just put there — profiles from a workspace that is itself at contract 2
+    // arrive migrated, but a first deploy of a *newly created* bucket writes
+    // them here for the first time. Idempotent, so the ordinary case is one
     // listing and no writes.
-    const migrated = await migrateWorkspace(workspace);
-    if (!migrated.alreadyCurrent) {
-      heading('Migrated');
-      for (const change of migrated.changes) print(`  ${change}`);
-      print(style.dim('  The revision below is the first that can read it.'));
-    }
+    await migrateWorkspace(workspace, { apply: true });
 
     // **The target hands itself over to the workspace it now lives in.**
     //
@@ -330,3 +340,42 @@ function requireTargetFlag(flags: DeployFlags): string {
   }
   return flags.target;
 }
+
+/**
+ * Bring a target's own workspace to the current contract, before it is opened.
+ *
+ * Deliberately tolerant of a target this workspace has no pointer for: that is a
+ * first deploy, where there is nothing to migrate and `deploy` is about to create
+ * the workspace itself.
+ *
+ * Narrated when it does something. This rewrites every profile in somebody's
+ * bucket, and a command that reshapes that silently is one they cannot audit
+ * afterwards.
+ */
+async function migrateTargetWorkspace(target: string, apply: boolean): Promise<boolean> {
+  const root = resolveWorkspaceRoot();
+
+  const workspace = await resolveTargetWorkspace(root, target).catch(() => null);
+  if (workspace === null || workspace === root) return true;
+
+  const migrated = await migrateWorkspace(workspace, { apply });
+  if (migrated.alreadyCurrent) return true;
+
+  heading(apply ? 'Migrated' : 'Would migrate');
+  print(style.dim(`  ${workspace}`));
+  for (const change of migrated.changes) print(`  ${change}`);
+  if (apply) {
+    print(style.dim('  The revision this deploy rolls is the first that can read it.'));
+    return true;
+  }
+
+  // A dry run stops here rather than pressing on to survey and plan. Everything
+  // past this point opens the target, and the target is not readable until the
+  // migration above has actually happened — so continuing would report a second,
+  // confusing refusal about the thing the first paragraph just offered to fix.
+  print(style.dim('  Nothing was written, and nothing else was checked: the rest of this'));
+  print(style.dim('  command opens the target, which is not readable until this has run.'));
+  print('');
+  print(style.dim(`  Run it for real:  lanes link deploy --target ${target}`));
+  return false;
+}