@lanes-sh/link 0.6.0 → 0.6.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanes-sh/link",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "A self-hostable MCP gateway for all your connections, memory, tasks, files, and secrets",
   "license": "Apache-2.0",
   "homepage": "https://lanes.sh/link",

package/src/cli/commands/operate/migrate.ts

@@ -42,16 +42,24 @@ export async function migratedRenamedProviders(
 ): Promise<boolean> {
   if (!(refusal instanceof ConfigError)) return false;
 
-  const selection = await resolveSelection({ profileFlag: flags.profile });
-  const document = await ConfigDocument.open(selection.workspaceRoot, selection.profile);
+  // **The target's workspace, not this machine's.** `resolveSelection` defaults
+  // to the local root, which is where this looked before ADR-052 — and there was
+  // only one place a profile could be. The row that needs renaming is in the
+  // file the *named target* holds, so a bucket's stale row was invisible from
+  // here while the refusal kept naming this command as the fix.
+  const target = flags.target ?? '';
+  const localRoot = resolveWorkspaceRoot();
+  const root = await resolveTargetWorkspace(localRoot, target).catch(() => localRoot);
+
+  const selection = await resolveSelection({ profileFlag: flags.profile, root });
+  const document = await ConfigDocument.open(root, selection.profile);
   if (pendingRenames(document).length === 0) return false;
 
   // Shape-only, because the check this document fails runs after the schema.
   // Throws when it is malformed beyond a rename, which is a better sentence
   // than the referential one it would otherwise be reported under.
   const config = shapeOf(document);
-  const target = flags.target ?? '';
-  const credentials = await openSecretStoreFor(config, selection.workspaceRoot, target);
+  const credentials = await openSecretStoreFor(config, root, target);
 
   const migration = await migrateRenamedProviders(document, credentials, {
     apply: flags.fix === true,
@@ -70,6 +78,7 @@ export async function migratedRenamedProviders(
       ok: applied && migration.blocked.length === 0,
       profile: selection.profile,
       target,
+      workspace: root,
       applied,
       rows: migration.rows,
       changes: migration.changes,

package/src/cli/migrate-plan.ts

@@ -0,0 +1,160 @@
+import { ConfigError, layout, isRemoteWorkspace, type LegacyTarget, type WorkspaceTarget } from '#profile';
+import { deployedWorkspace } from '#deployments/upload.ts';
+
+/**
+ * What one contract-1 target block becomes, and where.
+ *
+ * Apart from `workspace-migrate.ts`, which reads and writes: this is the
+ * decision, and it is the half that has been wrong twice. Both times the shape
+ * was right and the *perspective* was not — the same `cloud:` block is a pointer
+ * seen from a laptop and a declaration seen from inside the bucket, and a
+ * migration that cannot tell which end it is on writes `gs://b` pointing at
+ * `gs://b`.
+ *
+ * So the workspace being migrated is an argument to every function here, and the
+ * tests drive them directly.
+ */
+
+/**
+ * Every profile's target blocks, folded into one registry.
+ *
+ * Two refusals rather than guesses, because both are cases where one target
+ * would need two different answers and picking either silently is the class of
+ * bug this whole change is about.
+ */
+export async function hoist(
+  legacy: readonly { profile: string; targets: Record<string, LegacyTarget> }[],
+  workspaceRoot: string,
+): Promise<Record<string, WorkspaceTarget>> {
+  const registry: Record<string, WorkspaceTarget> = {};
+  const seenFrom: Record<string, string> = {};
+
+  for (const { profile, targets } of legacy) {
+    for (const [name, declared] of Object.entries(targets)) {
+      const entry = toEntry(name, declared, profile, workspaceRoot);
+      if (entry === null) continue;
+      const previous = registry[name];
+
+      if (previous === undefined) {
+        registry[name] = entry;
+        seenFrom[name] = profile;
+        continue;
+      }
+
+      if (JSON.stringify(previous) !== JSON.stringify(entry)) {
+        throw new ConfigError(
+          `Profiles "${seenFrom[name]}" and "${profile}" both declare target "${name}", and they ` +
+            `do not agree.\n` +
+            `  A target is declared once by the workspace it lives in (ADR-052), so one of these\n` +
+            `  has to win and this cannot pick.\n\n` +
+            `    ${seenFrom[name]}: ${summarise(previous)}\n` +
+            `    ${profile}: ${summarise(entry)}\n\n` +
+            `  Edit one of them to match the other, then run this again.`,
+        );
+      }
+    }
+  }
+
+  return registry;
+}
+
+/**
+ * One contract-1 target block as a registry entry.
+ *
+ * A block whose storage names a bucket becomes a pointer: that bucket is a
+ * workspace, it holds the profiles served there, and under ADR-052 it is the
+ * thing that declares the target. The adapters are not copied into the pointer —
+ * they travel to the bucket on the next `deploy`, which is the only command that
+ * can write there and roll an image that understands what it wrote.
+ *
+ * Per-profile paths are dropped when they are the layout defaults, which is the
+ * ordinary case: `./data/<profile>` and `./data/<profile>/credentials.enc` are
+ * exactly what `layout.ts` derives, so a workspace-level target that omits them
+ * addresses the same bytes. A genuinely custom path cannot be hoisted — one
+ * target cannot hold a different path per profile — and is refused by name.
+ */
+export function toEntry(
+  name: string,
+  declared: LegacyTarget,
+  profile: string,
+  workspaceRoot: string,
+): WorkspaceTarget | null {
+  const remote = deployedWorkspace(declared);
+
+  // **A target whose bucket is the workspace being migrated declares itself.**
+  //
+  // Migrating happens on both ends, and the second one is inside the bucket: the
+  // profile there carries the same `cloud` block, and deriving a pointer from it
+  // produces `gs://b` pointing at `gs://b`. That is a loop, and `openTarget`
+  // refuses it — which made `deploy` unable to run against the bucket it had
+  // just migrated, on the one command the refusal names as the fix.
+  if (remote && remote !== workspaceRoot) return { workspace: remote };
+
+  // **A filesystem target is dropped from a remote workspace.**
+  //
+  // The bucket's copy of a profile was uploaded from a laptop, so it carries
+  // that laptop's `local:` block — paths under `./data/` that address a disk the
+  // endpoint has never seen. Hoisting it would leave the bucket declaring a
+  // target it can never open, and `workspacePath` refuses that combination the
+  // moment anything tries.
+  //
+  // Nothing is lost: the machine that owns `local` has its own copy, and that is
+  // the one that was ever real.
+  if (isRemoteWorkspace(workspaceRoot) && declared.storage.adapter === 'filesystem') return null;
+
+  const storagePath = declared.storage.path;
+  const credentialsPath = declared.credentials.path;
+
+  const defaultStorage = `./${layout.blobs(profile)}`;
+  const defaultCredentials = `./${layout.credentials(profile)}`;
+
+  refuseCustomPath(name, profile, workspaceRoot, 'storage.path', storagePath, defaultStorage);
+  refuseCustomPath(
+    name,
+    profile,
+    workspaceRoot,
+    'credentials.path',
+    credentialsPath,
+    defaultCredentials,
+  );
+
+  const { path: _storage, ...storage } = declared.storage;
+  const { path: _credentials, ...credentials } = declared.credentials;
+
+  return {
+    credentials,
+    storage,
+    ...(declared.audit ? { audit: declared.audit } : {}),
+    ...(declared.vault ? { vault: declared.vault } : {}),
+    ...(declared.deploy ? { deploy: declared.deploy } : {}),
+  };
+}
+
+function refuseCustomPath(
+  target: string,
+  profile: string,
+  workspaceRoot: string,
+  field: string,
+  value: string | undefined,
+  expected: string,
+): void {
+  if (value === undefined) return;
+  // Both spellings of the same directory: `./data/personal` and `data/personal`
+  // resolve identically and the template has written each at different times.
+  if (value === expected || value === expected.replace(/^\.\//, '')) return;
+
+  throw new ConfigError(
+    `Profile "${profile}" declares target "${target}" with a custom ${field}:\n` +
+      `    ${value}\n` +
+      `  A target is declared once for the whole workspace now (ADR-052), so it cannot hold a\n` +
+      `  different path per profile. The default it would get is ${expected}.\n\n` +
+      `  Move the data there and delete the line, or keep this profile in a workspace of its\n` +
+      `  own: LANES_LINK_HOME=${workspaceRoot}/<somewhere> lanes link profile add ${profile} --target ${target}`,
+  );
+}
+
+export function summarise(entry: WorkspaceTarget): string {
+  if (entry.workspace !== undefined) return `points at ${entry.workspace}`;
+  const parts = [entry.credentials?.adapter, entry.storage?.adapter].filter(Boolean);
+  return `${parts.join(' + ')}${entry.deploy ? `, deploys ${entry.deploy.service}` : ''}`;
+}

package/src/cli/workspace-migrate.ts

@@ -6,6 +6,7 @@ import {
   layout,
   listProfiles,
   readWorkspaceFile,
+  isRemoteWorkspace,
   workspaceFiles,
   isLegacyProfile,
   legacyConfigSchema,
@@ -13,8 +14,8 @@ import {
   type LegacyTarget,
   type WorkspaceTarget,
 } from '#profile';
-import { deployedWorkspace } from '#deployments/upload.ts';
 import { ConfigDocument } from './config-edit.ts';
+import { hoist, summarise } from './migrate-plan.ts';
 
 /**
  * Contract 1 → 2: the target moves out of the profile and into the workspace.
@@ -168,123 +169,6 @@ export async function migrateWorkspace(
   };
 }
 
-/**
- * Every profile's target blocks, folded into one registry.
- *
- * Two refusals rather than guesses, because both are cases where one target
- * would need two different answers and picking either silently is the class of
- * bug this whole change is about.
- */
-async function hoist(
-  legacy: readonly { profile: string; targets: Record<string, LegacyTarget> }[],
-  workspaceRoot: string,
-): Promise<Record<string, WorkspaceTarget>> {
-  const registry: Record<string, WorkspaceTarget> = {};
-  const seenFrom: Record<string, string> = {};
-
-  for (const { profile, targets } of legacy) {
-    for (const [name, declared] of Object.entries(targets)) {
-      const entry = toEntry(name, declared, profile, workspaceRoot);
-      const previous = registry[name];
-
-      if (previous === undefined) {
-        registry[name] = entry;
-        seenFrom[name] = profile;
-        continue;
-      }
-
-      if (JSON.stringify(previous) !== JSON.stringify(entry)) {
-        throw new ConfigError(
-          `Profiles "${seenFrom[name]}" and "${profile}" both declare target "${name}", and they ` +
-            `do not agree.\n` +
-            `  A target is declared once by the workspace it lives in (ADR-052), so one of these\n` +
-            `  has to win and this cannot pick.\n\n` +
-            `    ${seenFrom[name]}: ${summarise(previous)}\n` +
-            `    ${profile}: ${summarise(entry)}\n\n` +
-            `  Edit one of them to match the other, then run this again.`,
-        );
-      }
-    }
-  }
-
-  return registry;
-}
-
-/**
- * One contract-1 target block as a registry entry.
- *
- * A block whose storage names a bucket becomes a pointer: that bucket is a
- * workspace, it holds the profiles served there, and under ADR-052 it is the
- * thing that declares the target. The adapters are not copied into the pointer —
- * they travel to the bucket on the next `deploy`, which is the only command that
- * can write there and roll an image that understands what it wrote.
- *
- * Per-profile paths are dropped when they are the layout defaults, which is the
- * ordinary case: `./data/<profile>` and `./data/<profile>/credentials.enc` are
- * exactly what `layout.ts` derives, so a workspace-level target that omits them
- * addresses the same bytes. A genuinely custom path cannot be hoisted — one
- * target cannot hold a different path per profile — and is refused by name.
- */
-function toEntry(
-  name: string,
-  declared: LegacyTarget,
-  profile: string,
-  workspaceRoot: string,
-): WorkspaceTarget {
-  const remote = deployedWorkspace(declared);
-  if (remote) return { workspace: remote };
-
-  const storagePath = declared.storage.path;
-  const credentialsPath = declared.credentials.path;
-
-  const defaultStorage = `./${layout.blobs(profile)}`;
-  const defaultCredentials = `./${layout.credentials(profile)}`;
-
-  refuseCustomPath(name, profile, workspaceRoot, 'storage.path', storagePath, defaultStorage);
-  refuseCustomPath(
-    name,
-    profile,
-    workspaceRoot,
-    'credentials.path',
-    credentialsPath,
-    defaultCredentials,
-  );
-
-  const { path: _storage, ...storage } = declared.storage;
-  const { path: _credentials, ...credentials } = declared.credentials;
-
-  return {
-    credentials,
-    storage,
-    ...(declared.audit ? { audit: declared.audit } : {}),
-    ...(declared.vault ? { vault: declared.vault } : {}),
-    ...(declared.deploy ? { deploy: declared.deploy } : {}),
-  };
-}
-
-function refuseCustomPath(
-  target: string,
-  profile: string,
-  workspaceRoot: string,
-  field: string,
-  value: string | undefined,
-  expected: string,
-): void {
-  if (value === undefined) return;
-  // Both spellings of the same directory: `./data/personal` and `data/personal`
-  // resolve identically and the template has written each at different times.
-  if (value === expected || value === expected.replace(/^\.\//, '')) return;
-
-  throw new ConfigError(
-    `Profile "${profile}" declares target "${target}" with a custom ${field}:\n` +
-      `    ${value}\n` +
-      `  A target is declared once for the whole workspace now (ADR-052), so it cannot hold a\n` +
-      `  different path per profile. The default it would get is ${expected}.\n\n` +
-      `  Move the data there and delete the line, or keep this profile in a workspace of its\n` +
-      `  own: LANES_LINK_HOME=${workspaceRoot}/<somewhere> lanes link profile add ${profile} --target ${target}`,
-  );
-}
-
 /**
  * Write the registry into the workspace file, creating it when absent.
  *
@@ -351,12 +235,6 @@ function describe(
   );
 }
 
-function summarise(entry: WorkspaceTarget): string {
-  if (entry.workspace !== undefined) return `points at ${entry.workspace}`;
-  const parts = [entry.credentials?.adapter, entry.storage?.adapter].filter(Boolean);
-  return `${parts.join(' + ')}${entry.deploy ? `, deploys ${entry.deploy.service}` : ''}`;
-}
-
 /**
  * Refuse a contract-1 workspace with the command that fixes it.
  *

package/src/deployments/deploy.ts

@@ -1,6 +1,7 @@
 import {
   ConfigError,
   recordTarget,
+  resolveTargetWorkspace,
   resolveWorkspaceRoot,
   type DeployConfig,
 } from '#profile';
@@ -61,6 +62,23 @@ export interface DeployFlags extends GlobalFlags {
 }
 
 export async function deploy(flags: DeployFlags): Promise<void> {
+  // **The target's own workspace is migrated before anything resolves it.**
+  //
+  // This is the first thing the command does, and it has to be. `deploy` is what
+  // the refusal on a contract-1 bucket tells you to run — and every other read of
+  // that bucket goes through `openTarget`, which refuses it for the same reason.
+  // Migrating after resolution made the instruction circular: the command named
+  // as the fix could not get past the problem it fixes.
+  //
+  // `resolveTargetWorkspace` is the one lookup that does not need the far end to
+  // declare anything: it reads this machine's pointer and stops. So the bucket is
+  // located, migrated, and only then opened.
+  //
+  // Idempotent, and silent on a workspace already at contract 2 — a listing and
+  // no writes. `--dry-run` reports what it would do and writes nothing, like
+  // every other step of this command.
+  if (!(await migrateTargetWorkspace(requireTargetFlag(flags), flags.dryRun !== true))) return;
+
   // The one command allowed to name a target that does not exist yet: creating
   // it is what a first deploy is for.
   //
@@ -254,25 +272,28 @@ export async function deploy(flags: DeployFlags): Promise<void> {
     // Before the rollout, so the revision that comes up finds a config to read.
     // Uploading after would leave a window where the service is serving and the
     // workspace it was told to read is not there yet.
-    await uploadWorkspace(resolution.workspaceRoot, workspace, serving);
+    // **Only when there is somewhere to copy from.** After ADR-052 the profiles
+    // a deployed target serves *live in* that target's workspace, so
+    // `resolution.workspaceRoot` and `workspace` are the same bucket and this is
+    // a copy onto itself. It ran, and the self-copy is how the bucket's registry
+    // came to be overwritten.
+    //
+    // What it is still for is the one-way trip: a first deploy, where the
+    // profile is on this machine and the bucket does not hold it yet. That is a
+    // move, not a sync — the next deploy finds it already there.
+    if (resolution.workspaceRoot !== workspace) {
+      await uploadWorkspace(resolution.workspaceRoot, workspace, serving);
+    }
 
     // **The bucket's own migration, here and nowhere else.**
     //
-    // Contract 1 is not read by this binary at all (ADR-052), so the moment a
-    // bucket becomes contract 2 the revision in front of it stops being able to
-    // read its own config. Doing it here puts that window between an upload and
-    // a rollout that are seconds apart, rather than leaving it open until
-    // somebody happens to redeploy.
-    //
-    // After the upload, because the upload is what puts the profiles there for
-    // it to migrate. Idempotent, so a bucket already at contract 2 costs one
+    // A second pass, and it is not redundant. The one at the top of the command
+    // migrated whatever the bucket already held; this catches what the upload
+    // just put there — profiles from a workspace that is itself at contract 2
+    // arrive migrated, but a first deploy of a *newly created* bucket writes
+    // them here for the first time. Idempotent, so the ordinary case is one
     // listing and no writes.
-    const migrated = await migrateWorkspace(workspace);
-    if (!migrated.alreadyCurrent) {
-      heading('Migrated');
-      for (const change of migrated.changes) print(`  ${change}`);
-      print(style.dim('  The revision below is the first that can read it.'));
-    }
+    await migrateWorkspace(workspace, { apply: true });
 
     // **The target hands itself over to the workspace it now lives in.**
     //
@@ -294,7 +315,11 @@ export async function deploy(flags: DeployFlags): Promise<void> {
       last_deploy: stamped,
     });
 
-    await recordTarget(resolution.workspaceRoot, target, {
+    // **This machine's registry, not the target's.** `resolution.workspaceRoot`
+    // is the workspace the profile was *found* in, which for a deployed target is
+    // the bucket — so writing the pointer there pointed the bucket at itself, and
+    // the revision that came up refused to open its own target.
+    await recordTarget(resolveWorkspaceRoot(), target, {
       workspace,
       primary: resolution.profile,
       last_deploy: stamped,
@@ -330,3 +355,42 @@ function requireTargetFlag(flags: DeployFlags): string {
   }
   return flags.target;
 }
+
+/**
+ * Bring a target's own workspace to the current contract, before it is opened.
+ *
+ * Deliberately tolerant of a target this workspace has no pointer for: that is a
+ * first deploy, where there is nothing to migrate and `deploy` is about to create
+ * the workspace itself.
+ *
+ * Narrated when it does something. This rewrites every profile in somebody's
+ * bucket, and a command that reshapes that silently is one they cannot audit
+ * afterwards.
+ */
+async function migrateTargetWorkspace(target: string, apply: boolean): Promise<boolean> {
+  const root = resolveWorkspaceRoot();
+
+  const workspace = await resolveTargetWorkspace(root, target).catch(() => null);
+  if (workspace === null || workspace === root) return true;
+
+  const migrated = await migrateWorkspace(workspace, { apply });
+  if (migrated.alreadyCurrent) return true;
+
+  heading(apply ? 'Migrated' : 'Would migrate');
+  print(style.dim(`  ${workspace}`));
+  for (const change of migrated.changes) print(`  ${change}`);
+  if (apply) {
+    print(style.dim('  The revision this deploy rolls is the first that can read it.'));
+    return true;
+  }
+
+  // A dry run stops here rather than pressing on to survey and plan. Everything
+  // past this point opens the target, and the target is not readable until the
+  // migration above has actually happened — so continuing would report a second,
+  // confusing refusal about the thing the first paragraph just offered to fix.
+  print(style.dim('  Nothing was written, and nothing else was checked: the rest of this'));
+  print(style.dim('  command opens the target, which is not readable until this has run.'));
+  print('');
+  print(style.dim(`  Run it for real:  lanes link deploy --target ${target}`));
+  return false;
+}

package/src/deployments/gcp/driver.ts

@@ -7,7 +7,8 @@ import type {
   SurveyInput,
   SurveyResult,
 } from '../driver.ts';
-import type { DeployConfig } from '#profile';
+import { join } from 'node:path';
+import { installRoot, type DeployConfig } from '#profile';
 import { encodeRef } from '../adapters/gcp-secret-manager.ts';
 import {
   captureGcloud,
@@ -50,6 +51,10 @@ export function deployPlan(input: PlanInput): DeployStep[] {
   const cloudrun = requireProject(input.deploy, input.target);
   const image = imageReference(cloudrun, input.tag);
   const scope = ['--project', cloudrun.project, '--region', cloudrun.region];
+  // Where this package is installed, which is where the Dockerfile and the build
+  // config live. Never the working directory: `lanes link deploy` is run from
+  // wherever somebody happens to be standing.
+  const root = installRoot(import.meta.dir);
 
   return [
     {
@@ -80,10 +85,15 @@ export function deployPlan(input: PlanInput): DeployStep[] {
         '--project',
         cloudrun.project,
         '--config',
-        'src/deployments/gcp/cloudbuild.yaml',
+        join(root, 'src/deployments/gcp/cloudbuild.yaml'),
         '--substitutions',
         `_IMAGE=${image}`,
-        '.',
+        // The build context, and the config beside it, are the *installed
+        // package* — not whatever directory the operator happened to run from.
+        // Both were relative, so `lanes link deploy` worked from a checkout and
+        // failed everywhere else with a missing cloudbuild.yaml, which reads as
+        // a broken install rather than as a wrong working directory.
+        root,
       ],
     },
     {

package/src/deployments/upload.ts

@@ -64,7 +64,15 @@ export function deployedWorkspace(declared: TargetConfig): string | undefined {
  * between matching it and not is a credential in a bucket.
  */
 export function isWorkspaceConfig(key: string, profiles?: readonly string[]): boolean {
-  if (key === WORKSPACE_FILE) return true;
+  // **Never the workspace file.** It was sent, and it is the one file that must
+  // not be: it holds the *target registry*, and the two workspaces have
+  // different ones. This machine's says `cloud: workspace: gs://…`, so copying
+  // it into that bucket left the bucket pointing at itself — a loop `openTarget`
+  // refuses, on the target it had just deployed (ADR-052).
+  //
+  // The bucket's own registry is written by `deploy`, from the declaration, once
+  // the upload is done.
+  if (key === WORKSPACE_FILE) return false;
 
   // A set rather than one name, because a deploy now sends every profile that
   // declares the target rather than the single one it was told. `undefined`

package/src/profile/deployments.ts

@@ -39,11 +39,14 @@ export async function recordTarget(
 ): Promise<void> {
   await editRegistry(workspaceRoot, (targets) => {
     const previous = targets[target];
+    // Neither shape merges into the other, and the symmetry is the point: an
+    // entry carrying both a `workspace:` and adapters is what the schema refuses.
+    //
     // A pointer replacing a declaration is `deploy` handing the target over to
-    // the workspace it just wrote, so the adapter keys have to go rather than
-    // merge — an entry carrying both is what the schema refuses.
-    targets[target] =
-      entry.workspace !== undefined ? { ...pick(previous), ...entry } : { ...previous, ...entry };
+    // the workspace it just wrote. A declaration replacing a pointer is the same
+    // command writing the bucket's own registry — and merging there left the
+    // laptop's `workspace:` on it, pointing the bucket at itself.
+    targets[target] = { ...pick(previous), ...entry };
   });
 }
 
@@ -54,7 +57,7 @@ export async function removeTarget(workspaceRoot: string, target: string): Promi
   });
 }
 
-/** The fields that survive a declaration becoming a pointer: the deploy record. */
+/** The fields that survive an entry changing shape: the deploy record, and only it. */
 function pick(previous: WorkspaceTarget | undefined): Partial<WorkspaceTarget> {
   if (!previous) return {};
   return {