@lanes-sh/link 0.6.8 → 0.6.10

package/.gcloudignore

@@ -0,0 +1,50 @@
+# What `gcloud builds submit` uploads, and what it must not.
+#
+# **This file exists because `.dockerignore` is not consulted for the upload.**
+# The build context is packed and sent to a Cloud Build staging bucket before any
+# Dockerfile is read, so the first block of `.dockerignore` — which its own
+# comment calls "a security control, not an image-size optimisation" — governs
+# what reaches the *image* and says nothing about what reaches Google.
+#
+# Absent this file, gcloud derives its exclusions from `.gitignore` when the
+# context happens to be a git checkout, and from nothing at all when it is not.
+# `lanes link deploy` sends `installRoot`, which for the documented install
+# method is a directory under `~/.bun` with no `.git` in it — so the safe
+# behaviour was being inherited from a coincidence.
+#
+# Keep the first block in step with `.dockerignore`. `data/` holds the encrypted
+# credential store *and* the key that opens it.
+data/
+*.key
+*.pem
+*.enc
+*.p12
+.env
+.env.*
+
+# Not needed to build, and `.git` in particular carries every branch.
+.git/
+.gitignore
+.worktrees/
+node_modules/
+**/node_modules/
+coverage/
+dist/
+build/
+*.tsbuildinfo
+
+# Tests, docs and tooling: the image runs the endpoint and nothing else.
+**/*.test.ts
+**/*.test.json
+docs/
+instructions/
+**/README.md
+.lanes/
+.claude/
+.vscode/
+.idea/
+.DS_Store
+.playwright-mcp/
+
+# The compiled binary from `bun build --compile`, if one was made locally.
+/lanes

package/README.md

@@ -81,6 +81,11 @@ with Claude Code or Codex.
 It runs the commands above rather than reimplementing them, so consent and the token stay here where
 they belong, and an endpoint set up in the app is the same one you get from a shell. Available from
 Lanes v0.47.0, as a research preview.
+
+```console
+$ lanes link desktop     # opens the app on that page, installing it if it is not there
+```
+
 **[How to use it →](https://lanes.sh/docs/desktop/lanes-link)**
 
 ## What your agent gets

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanes-sh/link",
-  "version": "0.6.8",
+  "version": "0.6.10",
   "description": "A self-hostable MCP gateway for all your connections, memory, tasks, files, and secrets",
   "license": "Apache-2.0",
   "homepage": "https://lanes.sh/link",
@@ -44,13 +44,14 @@
     "README.md",
     "LICENSE",
     "bunfig.toml",
-    ".dockerignore"
+    ".dockerignore",
+    ".gcloudignore"
   ],
   "scripts": {
     "test": "bun test",
     "typecheck": "tsc --noEmit",
     "lanes": "bun run ./src/cli/lanes.ts",
-    "audit": "bun pm scan",
+    "audit": "bun audit",
     "vendor:bunq": "bun run ./src/providers/bunq/specs/vendor.ts",
     "vendor:discord": "bun run ./src/providers/discord/specs/vendor.ts",
     "vendor:google": "bun run ./src/providers/google/specs/vendor.ts"

package/src/auth/oidc.ts

@@ -108,8 +108,27 @@ export class OidcVerifier {
     return verified;
   }
 
-  async #endpoint(): Promise<string | null> {
-    if (this.#options.introspectionEndpoint) return this.#options.introspectionEndpoint;
+  /**
+   * Where to ask about a token, and whether the operator chose it.
+   *
+   * The second half decides one thing: whether the non-standard GET shape below
+   * is attempted at all. A discovered endpoint is one the issuer publishes as
+   * RFC 7662, and RFC 7662 is a form POST — so an issuer that answers discovery
+   * and then needs its token in a query string is not a case that exists. The
+   * shape is for issuers that ship an equivalent without advertising one, and
+   * those have to be named in config regardless.
+   */
+  async #endpoint(): Promise<{ url: string; explicit: boolean } | null> {
+    const named = this.#options.introspectionEndpoint;
+    if (named) {
+      if (!isHttps(named)) {
+        throw new Error(
+          `auth.authorization.introspection_endpoint is ${named}, which is not https. ` +
+            'A token is sent to it on every call.',
+        );
+      }
+      return { url: named, explicit: true };
+    }
 
     this.#discovered ??= this.#fetch(
       `${this.#options.issuer.replace(/\/$/, '')}/.well-known/openid-configuration`,
@@ -120,16 +139,33 @@ export class OidcVerifier {
 
     const metadata = await this.#discovered;
     const endpoint = metadata['introspection_endpoint'];
-    return typeof endpoint === 'string' ? endpoint : null;
+    if (typeof endpoint !== 'string') return null;
+
+    // **A discovery document decides where a credential is sent, so what it
+    // names is checked rather than followed.** The issuer is config and the
+    // operator chose it; the endpoint inside its metadata is a value fetched
+    // over the network, and until now anything there — any host, any scheme —
+    // received this endpoint's tokens. Same origin as the issuer is what a
+    // conforming document says anyway.
+    if (!isHttps(endpoint) || !sameOrigin(endpoint, this.#options.issuer)) return null;
+
+    return { url: endpoint, explicit: false };
   }
 
   /**
    * Two request shapes, because two are in the wild.
    *
    * RFC 7662 is a form POST of `token`. The other common spelling is a GET with
-   * the token in the query string, which several issuers ship instead. Trying
-   * the standard one first and the other on failure covers both without either
-   * being named in a conditional.
+   * the token in the query string, which several issuers ship instead — Google's
+   * `tokeninfo` among them, which is why the second shape exists at all.
+   *
+   * **The GET is attempted only for an endpoint the operator named.** A token in
+   * a query string is a credential in the issuer's access logs and in every
+   * proxy between here and it, which is a cost worth paying for the issuer whose
+   * documented setup requires it and worth paying for no other. A discovered
+   * endpoint publishes itself as RFC 7662 and RFC 7662 is the POST, so trying
+   * the query-string shape against one could only ever put a credential in a URL
+   * for an issuer that did not ask for it.
    */
   async #introspect(token: string): Promise<Introspection | null> {
     const endpoint = await this.#endpoint();
@@ -138,20 +174,21 @@ export class OidcVerifier {
       // audience would leave the confused-deputy hole open while looking like
       // it verified something.
       throw new Error(
-        `The issuer ${this.#options.issuer} publishes no introspection_endpoint. ` +
-          'Set auth.authorization.introspection_endpoint to the URL that answers ' +
-          'questions about a token, or this endpoint cannot check who a token was issued to.',
+        `The issuer ${this.#options.issuer} publishes no introspection_endpoint this endpoint ` +
+          'will use — it is absent, not https, or not on the issuer\'s own origin. Set ' +
+          'auth.authorization.introspection_endpoint to the URL that answers questions about a ' +
+          'token, or this endpoint cannot check who a token was issued to.',
       );
     }
 
-    const posted = await this.#ask(endpoint, {
+    const posted = await this.#ask(endpoint.url, {
       method: 'POST',
       headers: { 'content-type': 'application/x-www-form-urlencoded' },
       body: new URLSearchParams({ token }).toString(),
     });
-    if (posted) return posted;
+    if (posted || !endpoint.explicit) return posted;
 
-    const url = new URL(endpoint);
+    const url = new URL(endpoint.url);
     url.searchParams.set('access_token', token);
     return this.#ask(url.toString(), { method: 'GET' });
   }
@@ -167,6 +204,22 @@ export class OidcVerifier {
   }
 }
 
+function isHttps(candidate: string): boolean {
+  try {
+    return new URL(candidate).protocol === 'https:';
+  } catch {
+    return false;
+  }
+}
+
+function sameOrigin(candidate: string, issuer: string): boolean {
+  try {
+    return new URL(candidate).origin === new URL(issuer).origin;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * One shape out of several spellings of the same three facts.
  *

package/src/cli/brand.ts

@@ -2,9 +2,10 @@
  * The Lanes design tokens, and the pieces every page this repository serves is
  * built from.
  *
- * Three surfaces render HTML — the authorization consent screen, the page a
- * connect flow lands on, and the dashboard — and until this file existed each
- * carried its own approximation of the brand. They had drifted: two greens and
+ * Two surfaces render HTML — the authorization consent screen and the page a
+ * connect flow lands on. There were three until ADR-053 retired the dashboard,
+ * and until this file existed each carried its own approximation of the brand.
+ * They had drifted: two greens and
  * two ambers that are not tokens at all, nine different alphas standing in for
  * one border colour, a destructive red with a dark variant the token does not
  * have, and the system font stack where Geist belongs.
@@ -154,21 +155,27 @@ a { color: inherit; }
  *
  * The font stylesheet and the faces it names are the only two origins any of
  * them reaches; `default-src 'none'` closes the rest. No `script-src`, because
- * these pages have no script — the dashboard, which has one listener, extends
- * this rather than replacing it.
+ * a page here has no script by default — the consent screen, which has one
+ * listener for its submit spinner, extends this rather than replacing it.
  */
 export const PAGE_CSP =
   "frame-ancestors 'none'; default-src 'none'; " +
+  // `form-action` does **not** fall back to `default-src`, so `'none'` above
+  // says nothing about where a form may post. One page here posts the owner's
+  // endpoint token, and its `action` is built from the request's own `Host` —
+  // this is the second lock on that, so a form target that ever came from
+  // somewhere else is refused by the browser rather than followed.
+  "form-action 'self'; " +
   "style-src 'unsafe-inline' https://fonts.googleapis.com; " +
   'font-src https://fonts.gstatic.com';
 
 /**
  * Headers every page here answers with.
  *
- * `frame-ancestors` in both spellings: one of these pages asks for the endpoint
- * token and another lists the owner's accounts, and framing either is the cheap
- * half of a UI-redress attack. The URLs carry a `client_id`, a `redirect_uri`,
- * or a one-time key, none of which belongs in a Referer.
+ * `frame-ancestors` in both spellings: one of these pages is a consent screen
+ * with a submit button, and framing it is the cheap half of a UI-redress
+ * attack. The URLs carry a `client_id` and a `redirect_uri`, neither of which
+ * belongs in a Referer.
  */
 export const PAGE_HEADERS: Readonly<Record<string, string>> = {
   'content-type': 'text/html; charset=utf-8',

package/src/cli/commands/operate/auth.ts

@@ -0,0 +1,333 @@
+import { credentialResolver, ReauthRequired } from '#connectivity/auth/index.ts';
+import type { ResolvedCredential } from '#connectivity/auth/credential.ts';
+import { credentialRefFor } from '#registry';
+import { announce, emit, fail, ok, print, warn } from '../../output.ts';
+import { openRuntime, type GlobalFlags, type Runtime } from '../../runtime.ts';
+
+/**
+ * Whether each connection could still authenticate, asked rather than guessed.
+ *
+ * `doctor` used to answer a version of this from the *age* of a stored
+ * credential, which is wrong in both directions: it dates a credential from
+ * when its access token was last refreshed, so a healthy connection nobody has
+ * called in a fortnight reads as stale, and a grant revoked an hour ago reads
+ * as fresh because nothing has tried to use it since.
+ *
+ * So this attempts the renewal instead. That is the only thing that actually
+ * knows, and it is cheap in the case that matters: resolving an OAuth
+ * credential short-circuits on the stored `expires_at` (`oauth-authcode/provider.ts`),
+ * so a connection whose access token is still live costs no network at all. The
+ * cost is one token-endpoint round trip per connection that has genuinely
+ * lapsed — which is exactly the set worth asking about.
+ *
+ * **This command writes.** A successful refresh persists the new token, which on
+ * a deployed target is a secret-store version per refreshed connection. That is
+ * deliberate — it is the same write the serve path makes, and it warms the token
+ * for the next real call — but it is why the read-only wording `check`, `plan`
+ * and `doctor` carry does not appear here.
+ */
+
+/** What can be said about one connection's ability to authenticate. */
+export type AuthVerdict =
+  /** Resolved. The vendor accepted it just now, or its access token is still live. */
+  | 'ok'
+  /** Stored, and cannot be renewed without a person. The signal this exists for. */
+  | 'reauth'
+  /** Nothing at the credential ref. */
+  | 'missing'
+  /** A static secret is present, and nothing here can exercise it. */
+  | 'stored'
+  /** `auth.kind: none` — the owner layer. Can never need signing in. */
+  | 'none'
+  /** The probe could not complete: a timeout, a network fault, an unexpected throw. */
+  | 'unknown';
+
+export interface ConnectionAuth {
+  readonly key: string;
+  readonly provider: string;
+  readonly id: string;
+  /** The manifest's `auth.kind`, so a reader can tell why a verdict is what it is. */
+  readonly method: string;
+  readonly verdict: AuthVerdict;
+  /** Whether answering cost a token-endpoint round trip. */
+  readonly refreshed: boolean;
+  readonly detail?: string;
+  readonly fix?: string;
+}
+
+/**
+ * What the probe observed, before it means anything.
+ *
+ * Separated from the verdict so the classification can be tested without a
+ * network, a credential store, or a runtime — every interesting case here is a
+ * question about *mapping*, and the mapping is where the mistakes are.
+ */
+export type ProbeResult =
+  /** A credential came back. `staleAccessToken` is the silent-failure case below. */
+  | { readonly outcome: 'resolved'; readonly staleAccessToken: boolean }
+  /** The resolver returned `resolveNone()` — there was nothing to resolve. */
+  | { readonly outcome: 'none' }
+  | { readonly outcome: 'timeout' }
+  | { readonly outcome: 'threw'; readonly error: unknown };
+
+/**
+ * One OAuth probe result, as a verdict.
+ *
+ * The two rules worth stating out loud, because both are ways this feature
+ * could lie:
+ *
+ * **An unexpected throw is `unknown`, never `reauth`.** Only `ReauthRequired`
+ * means a person is needed. Anything else — DNS, a 500, a bug in here — must
+ * not send someone through a consent screen, and a warning that is wrong once
+ * is a warning that gets scrolled past every time after.
+ *
+ * **A resolved token is not automatically `ok`.** `upstreamAccessToken` hands
+ * back the *stale* access token when there is no refresh token to renew with,
+ * and again when a refresh returns no `access_token`. Both are deliberate on
+ * the serve path, where letting the vendor's own 401 surface is the truthful
+ * instruction — but a health check that reported them as working would be
+ * saying the opposite of what the next real call will find. So the stored
+ * expiry is checked here rather than that behaviour being changed.
+ */
+export function classifyOAuth(result: ProbeResult): AuthVerdict {
+  switch (result.outcome) {
+    case 'resolved':
+      return result.staleAccessToken ? 'reauth' : 'ok';
+    case 'none':
+      return 'missing';
+    case 'timeout':
+      return 'unknown';
+    case 'threw':
+      return result.error instanceof ReauthRequired ? 'reauth' : 'unknown';
+  }
+}
+
+/**
+ * How many connections to probe at once.
+ *
+ * Small on purpose. The work is mostly waiting on token endpoints, so some
+ * concurrency is free, but a profile with twenty Google connections hitting one
+ * endpoint at once is a rate limit rather than a speed-up.
+ */
+const CONCURRENCY = 6;
+
+/**
+ * How long one connection may take before it is reported as `unknown`.
+ *
+ * `refreshDirectly` takes no `AbortSignal`, so this races rather than cancels —
+ * the request finishes into nothing. That is acceptable for a read-shaped
+ * command and avoids threading a signal through the refresh path for the
+ * benefit of one caller.
+ */
+const PER_CONNECTION_TIMEOUT_MS = 8_000;
+
+/** `expires_at` from a stored OAuth blob, or null when it is not one. */
+function storedExpiry(raw: string | null): number | null {
+  if (!raw) return null;
+  try {
+    const parsed = JSON.parse(raw) as { expires_at?: number };
+    return typeof parsed.expires_at === 'number' ? parsed.expires_at : null;
+  } catch {
+    return null;
+  }
+}
+
+export interface AuthFlags extends GlobalFlags {
+  readonly json?: boolean | undefined;
+  /** Narrow to one connection, by `provider.id`. A filter, not a second subject. */
+  readonly connection?: string | undefined;
+}
+
+/**
+ * Every connection's verdict, probed concurrently.
+ *
+ * Exported because `doctor` asks the same question and must not answer it a
+ * second, differently-wrong way — that divergence is the bug this replaced.
+ */
+export async function probeConnections(
+  runtime: Runtime,
+  connections: readonly Runtime['config']['connections'][number][],
+  forSelection: (command: string) => string,
+): Promise<ConnectionAuth[]> {
+  const resolve = credentialResolver(runtime.registry, runtime.credentials);
+
+  const probe = async (
+    connection: Runtime['config']['connections'][number],
+  ): Promise<ConnectionAuth> => {
+    const key = `${connection.provider}.${connection.id}`;
+    const manifest = runtime.manifestFor(connection.provider);
+    const method = manifest?.auth.kind ?? 'unknown';
+    const base = { key, provider: connection.provider, id: connection.id, method };
+
+    // A provider holding nothing to authenticate with can never need signing
+    // in, and saying so is more useful than saying nothing: it is the whole
+    // owner layer, and "why is memory not checked" is a real question.
+    if (!manifest || manifest.auth.kind === 'none') {
+      return { ...base, method: 'none', verdict: 'none', refreshed: false };
+    }
+
+    const ref = credentialRefFor(connection, manifest);
+    if (!ref) return { ...base, verdict: 'none', refreshed: false };
+
+    const missing = (): ConnectionAuth => ({
+      ...base,
+      verdict: 'missing',
+      refreshed: false,
+      detail: `Nothing stored at ${ref}.`,
+      fix: forSelection(`lanes link connect ${key}`),
+    });
+
+    if (!(await runtime.credentials.has(ref))) return missing();
+
+    // Everything that is not authcode OAuth is a secret sitting in the store.
+    // There is nothing to renew and no cheap way to exercise it, so presence is
+    // the whole of what can be said — and `strategy` in particular *must* take
+    // this path, because `credentialResolver` refuses it unconditionally (it
+    // signs its own requests) and routing it through would manufacture a
+    // failure that is not there.
+    if (manifest.auth.kind !== 'oauth') {
+      return { ...base, verdict: 'stored', refreshed: false };
+    }
+
+    const before = storedExpiry(await runtime.credentials.get(ref));
+    const lapsed = before !== null && before <= Date.now();
+
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const result = await Promise.race([
+      resolve(connection.provider, connection.id).then(
+        (credential: ResolvedCredential): ProbeResult =>
+          credential.kind === 'none'
+            ? { outcome: 'none' }
+            : { outcome: 'resolved', staleAccessToken: false },
+        (error: unknown): ProbeResult => ({ outcome: 'threw', error }),
+      ),
+      new Promise<ProbeResult>((settle) => {
+        timer = setTimeout(() => settle({ outcome: 'timeout' }), PER_CONNECTION_TIMEOUT_MS);
+      }),
+    ]);
+    if (timer) clearTimeout(timer);
+
+    // The silent-failure check. An expiry that is *still* in the past after
+    // resolving means the resolver went out and came back with nothing better,
+    // which is the case `classifyOAuth` documents.
+    const after = storedExpiry(await runtime.credentials.get(ref));
+    const stillLapsed = after !== null && after <= Date.now();
+
+    const settled: ProbeResult =
+      result.outcome === 'resolved'
+        ? { outcome: 'resolved', staleAccessToken: stillLapsed }
+        : result;
+
+    const verdict = classifyOAuth(settled);
+    const detail =
+      result.outcome === 'threw' && result.error instanceof Error
+        ? result.error.message
+        : result.outcome === 'timeout'
+          ? `Timed out after ${PER_CONNECTION_TIMEOUT_MS / 1000}s.`
+          : settled.outcome === 'resolved' && settled.staleAccessToken
+            ? 'The stored access token is expired and could not be renewed.'
+            : undefined;
+
+    return {
+      ...base,
+      verdict,
+      // Whether answering cost a round trip: a live token means the resolver
+      // short-circuited and never went out.
+      refreshed: lapsed,
+      ...(detail ? { detail } : {}),
+      ...(verdict === 'reauth' || verdict === 'missing'
+        ? { fix: forSelection(`lanes link connect ${key}`) }
+        : {}),
+    };
+  };
+
+  return mapWithLimit(connections, CONCURRENCY, probe);
+}
+
+export async function auth(flags: AuthFlags): Promise<void> {
+  const runtime = await openRuntime(flags);
+
+  try {
+    const { profile, target } = runtime.resolution;
+    const forSelection = (command: string) => `${command} --profile ${profile} --target ${target}`;
+
+    const wanted = flags.connection;
+    const connections = wanted
+      ? runtime.config.connections.filter((c) => `${c.provider}.${c.id}` === wanted)
+      : runtime.config.connections;
+
+    if (wanted && connections.length === 0) {
+      throw new Error(
+        `No connection "${wanted}" in profile ${profile}. Run: ${forSelection('lanes link status')}`,
+      );
+    }
+
+    const results = await probeConnections(runtime, connections, forSelection);
+    const needsSomeone = results.filter((r) => r.verdict === 'reauth' || r.verdict === 'missing');
+
+    // Always zero, and this is load-bearing rather than an oversight: the
+    // desktop app discards stdout when the CLI exits non-zero, which is exactly
+    // why it cannot read `doctor`. A connection needing a person is the answer
+    // this command was asked for, not a failure to produce one.
+    return emit(flags.json, { profile, target, ok: needsSomeone.length === 0, connections: results }, () => {
+      announce(runtime.resolution);
+
+      for (const result of results) {
+        const line = `${result.key} — ${describe(result.verdict)}`;
+        if (result.verdict === 'reauth') print(fail(`${line}\n      ${result.fix}`));
+        else if (result.verdict === 'missing') print(warn(`${line}\n      ${result.fix}`));
+        else print(ok(line));
+      }
+
+      if (needsSomeone.length > 0) {
+        print();
+        print(fail(`${needsSomeone.length} connection(s) need you to sign in again`));
+      }
+    });
+  } finally {
+    await runtime.close();
+  }
+}
+
+function describe(verdict: AuthVerdict): string {
+  switch (verdict) {
+    case 'ok':
+      return 'authenticated';
+    case 'reauth':
+      return 'signed out, and cannot renew itself';
+    case 'missing':
+      return 'no credential stored';
+    case 'stored':
+      return 'credential stored, not exercised';
+    case 'none':
+      return 'needs no credential';
+    case 'unknown':
+      return 'could not be checked';
+  }
+}
+
+/**
+ * `Promise.all` with a ceiling, in the ten lines it takes.
+ *
+ * A pool rather than chunks: chunking would make every batch wait for its
+ * slowest member, which is the shape this command is trying to avoid.
+ */
+async function mapWithLimit<T, R>(
+  items: readonly T[],
+  limit: number,
+  run: (item: T) => Promise<R>,
+): Promise<R[]> {
+  const results = new Array<R>(items.length);
+  let next = 0;
+
+  const worker = async (): Promise<void> => {
+    for (;;) {
+      const index = next++;
+      if (index >= items.length) return;
+      results[index] = await run(items[index]!);
+    }
+  };
+
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+  return results;
+}