@lanes-sh/link 0.6.8 → 0.6.9

package/src/cli/commands/operate/inspect.ts

@@ -1,11 +1,12 @@
-import { credentialRefFor, formatPlan, planIsNoop, planReconcile } from '#registry';
+import { formatPlan, planIsNoop, planReconcile } from '#registry';
 import { DEFAULT_SURFACES } from '../../config-repair.ts';
 import { announce, announceProfile, emit, fail, ok, print, warn } from '../../output.ts';
 import { staleNudge } from '../../release.ts';
 import { openRuntime, resolveProfileOnly, type GlobalFlags, type Runtime } from '../../runtime.ts';
 import type { FetchLike } from '#deployments/knowledge.ts';
 import { unboundRotatableRefs } from '#deployments/bind.ts';
-import { credentialAge, reportCapabilityDrift } from './findings.ts';
+import { reportCapabilityDrift } from './findings.ts';
+import { probeConnections } from './auth.ts';
 import { migratedContract, migratedRenamedProviders } from './migrate.ts';
 
 /**
@@ -65,7 +66,16 @@ export interface DoctorFinding {
   readonly fix?: string;
 }
 
-/** Read-only external checks: credentials resolve, stores reachable. */
+/**
+ * External checks: credentials still authenticate, stores reachable.
+ *
+ * Not read-only, and that changed when the credential check stopped guessing
+ * from a stored date and started attempting the renewal. A refresh that
+ * succeeds persists the new token, which on a deployed target is a secret-store
+ * write. It is the same write serving a request makes, and it warms the token
+ * for the next real call — but `check` and `plan` above are still the two that
+ * touch nothing.
+ */
 export async function doctor(flags: DoctorFlags): Promise<void> {
   // The one check that cannot use a runtime, because it answers for the profiles
   // that cannot open one. A provider rename left in the config refuses at load,
@@ -108,47 +118,56 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
       });
     }
 
-    for (const connection of runtime.config.connections) {
-      const key = `${connection.provider}.${connection.id}`;
-      const ref = credentialRefFor(connection, runtime.manifestFor(connection.provider));
-      if (!ref) {
-        checks.push(`${key} needs no credential`);
-        continue;
-      }
-      if (await runtime.credentials.has(ref)) {
-        const staleness = await credentialAge(runtime.credentials, ref);
+    // Whether each credential still works, asked rather than dated.
+    //
+    // This used to warn from the *age* of a stored credential, on the theory
+    // that a Google app left in "Testing" expires refresh tokens at seven days.
+    // The heuristic was wrong in both directions — it dated a credential from
+    // its last refresh, so an untouched healthy connection read as stale and a
+    // grant revoked an hour ago read as fresh — and its own guard made it worse:
+    // it skipped brokered credentials because "the hosted client is in
+    // production", which `providers/google/shared/oauth.ts` now says outright is
+    // not so. The hosted client is under review and carries the same weekly
+    // expiry, so the warning was silenced for exactly the population that has
+    // the problem.
+    //
+    // `probeConnections` answers it by attempting the renewal, which is the only
+    // thing that actually knows. Same classifier as `lanes link auth`, so the two
+    // cannot drift apart again.
+    const probed = await probeConnections(runtime, runtime.config.connections, forSelection);
 
-        // A Google project left in "Testing" expires refresh tokens after seven
-        // days. That is a policy setting rather than a fault, but it presents
-        // as an authentication failure mid-task — so say it before the call
-        // fails rather than after.
-        //
-        // Only for a client the operator registered. The hosted one is in
-        // production and does not expire refresh tokens weekly, so this warning
-        // would simply be false there — and a warning that is wrong once is a
-        // warning that gets scrolled past every time after.
-        if (staleness !== null && !staleness.brokered && staleness.days >= 7) {
+    for (const result of probed) {
+      switch (result.verdict) {
+        case 'reauth':
           warnings.push({
-            kind: 'stale_credential',
-            key,
+            kind: 'needs_reauth',
+            key: result.key,
             message:
-              `${key} credential is ${staleness.days} days old — a Google app in "Testing" expires at 7. ` +
-              `Run: lanes link connect ${key}`,
-            fix: forSelection(`lanes link connect ${key}`),
+              `${result.key} is signed out and cannot renew itself — run: lanes link connect ${result.key}` +
+              (result.detail ? `\n      ${result.detail}` : ''),
+            fix: forSelection(`lanes link connect ${result.key}`),
           });
-        } else {
-          const age = staleness
-            ? ` (${staleness.days}d old${staleness.brokered ? ', hosted client' : ''})`
-            : '';
-          checks.push(`${key} credential resolves${age}`);
-        }
-      } else {
-        problems.push({
-          kind: 'missing_credential',
-          key,
-          message: `${key} has no stored credential — run: lanes link connect ${key}`,
-          fix: forSelection(`lanes link connect ${key}`),
-        });
+          break;
+        case 'missing':
+          problems.push({
+            kind: 'missing_credential',
+            key: result.key,
+            message: `${result.key} has no stored credential — run: lanes link connect ${result.key}`,
+            fix: forSelection(`lanes link connect ${result.key}`),
+          });
+          break;
+        case 'none':
+          checks.push(`${result.key} needs no credential`);
+          break;
+        case 'unknown':
+          warnings.push({
+            kind: 'auth_uncheckable',
+            key: result.key,
+            message: `${result.key} could not be checked${result.detail ? `: ${result.detail}` : ''}`,
+          });
+          break;
+        default:
+          checks.push(`${result.key} credential resolves`);
       }
     }
 

package/src/cli/commands/operate/serve.ts

@@ -45,9 +45,6 @@ export async function start(
     port: flags.port,
     only: flags.only,
     mintToken: true,
-    // Local, so there is a browser and a person at it. `container.ts` does not
-    // pass this — see `#server/dashboard.ts`.
-    dashboard: true,
     // Stderr, not stdout: `--json` and `--raw` callers parse the other stream.
     // A refused credential is the event worth seeing while this runs in the
     // foreground, and until now nothing printed it.

package/src/cli/commands/operate.ts

@@ -2,13 +2,14 @@
  * Running an instance and looking at it — everything that is neither
  * `connect` nor the owner layer.
  *
- * Seven files, one per verb group, because every private helper here served
+ * Eight files, one per verb group, because every private helper here served
  * exactly one command and nothing crossed between them:
  *
  *   inspect.ts   check, plan, doctor — the gate order, cheapest failure first
+ *   auth.ts      whether each connection can still authenticate, by asking
  *   status.ts    connections, reachable capabilities, endpoint
  *   outputs.ts   what an agent harness needs, and proving the short form works
- *   dashboard.ts opening the page a local endpoint serves, with the key it needs
+ *   desktop.ts   opening the Lanes app, on the page that drives this CLI
  *   serve.ts     start
  *   audit.ts     audit tail and verify, and the Markdown rendering of tail
  *   token.ts     token show, token rotate
@@ -19,11 +20,12 @@
  */
 
 export { check, doctor, plan } from './operate/inspect.ts';
+export { auth, classifyOAuth, type AuthFlags, type AuthVerdict, type ConnectionAuth } from './operate/auth.ts';
 export { status } from './operate/status.ts';
 export { outputs, type OutputsFlags } from './operate/outputs.ts';
 export { tools, type ToolsFlags } from './operate/tools.ts';
 export { start } from './operate/serve.ts';
-export { dashboard, type DashboardFlags } from './operate/dashboard.ts';
+export { desktop, settingsUrl, type DesktopFlags } from './operate/desktop.ts';
 export { auditTail, auditVerify, markdownCell } from './operate/audit.ts';
 export { attachFile } from './operate/attach.ts';
 export { tokenRotate, tokenShow } from './operate/token.ts';

package/src/cli/main.ts

@@ -5,9 +5,10 @@ import {
   attachFile,
   auditTail,
   auditVerify,
+  auth,
   check,
   configShow,
-  dashboard,
+  desktop,
   doctor,
   outputs,
   plan,
@@ -282,6 +283,11 @@ export async function run(argv: readonly string[]): Promise<void> {
       return plan(global);
     case 'doctor':
       return doctor({ ...global, json, fix: flags['fix'] === true });
+
+    // Beside `doctor` because it answers half of what `doctor` used to guess at,
+    // and answers it by asking rather than by dating a credential.
+    case 'auth':
+      return auth({ ...global, json, connection: text(flags, 'connection') });
     case 'status':
       return status({ ...global, json });
     case 'outputs':
@@ -289,10 +295,19 @@ export async function run(argv: readonly string[]): Promise<void> {
 
     // Beside `outputs` for the same reason `tools` is: it answers the next
     // question a person has rather than the next one an agent has. `outputs`
-    // hands a harness a URL and a token; this opens the one page a person can
-    // read, and only a local endpoint serves it.
+    // hands a harness a URL and a token; this opens the app a person drives all
+    // of this from.
+    //
+    // Two spellings, one behaviour, as `skill` is for `mcp skill`. `dashboard`
+    // is what this was called when it opened a page the endpoint served, and
+    // that name is in a year of notes; `desktop` is what it does now (ADR-053).
+    // Both are in `USAGE`, unlike the `skill` alias, because nobody has learned
+    // the new one yet.
+    //
+    // No `...global`: this resolves nothing, so there is nothing to select.
     case 'dashboard':
-      return dashboard({ ...global, print: flags['print'] === true });
+    case 'desktop':
+      return desktop({ print: flags['print'] === true, yes: flags['yes'] === true });
 
     // Beside `outputs` because it answers the next question. `outputs` says
     // where the endpoint is; this says what it would hand a client that asked

package/src/cli/selection.ts

@@ -129,13 +129,18 @@ export const SELECTION: Record<string, Requires> = {
   secrets: 'profile+target',
   plan: 'profile+target',
   doctor: 'profile+target',
+  auth: 'profile+target',
   // Target-scoped: see the note above. `--profile` narrows each to one profile.
   status: 'target',
   outputs: 'profile+target',
   tools: 'profile+target',
-  // It reads which target it is rendering for before it decides anything: a
-  // deployed one has no page to open, and the refusal has to name it.
-  dashboard: 'profile+target',
+  // It resolves nothing and opens nothing — it hands macOS a URL (ADR-053).
+  // `target list` is the precedent for a `'none'` command that still takes a
+  // flag of its own. Both spellings need a row: `selection.test.ts` reads
+  // `main.ts` for `case` labels, and a label with no row here falls through to
+  // the `profile+target` default.
+  dashboard: 'none',
+  desktop: 'none',
   attach: 'profile+target',
   start: 'profile+target',
   deploy: 'target',
@@ -267,6 +272,9 @@ const ACCEPTS: Record<string, readonly string[]> = {
   // it undoes a provider rename this project shipped, and every other finding
   // there is something only the operator can decide.
   doctor: ['fix'],
+  // A filter, not a second subject: it narrows the answer to one connection so
+  // a caller can re-ask about the row it just repaired. Same shape as `attach`.
+  auth: ['connection'],
   relabel: [],
   'target list': ['urls', 'target'],
   'target show': ['target'],
@@ -281,7 +289,10 @@ const ACCEPTS: Record<string, readonly string[]> = {
   'mcp add': ['name', 'scope', 'token-env', 'dry-run', 'force', 'no-skill'],
   'mcp skill': ['print', 'force'],
   'mcp list': ['name', 'scope'],
-  dashboard: ['print'],
+  // `--yes` because it installs the app when nothing answers the scheme, and
+  // that is the one prompt in this CLI that puts an application on the machine.
+  dashboard: ['print', 'yes'],
+  desktop: ['print', 'yes'],
   skill: ['print', 'force'],
   deploy: ['dry-run', 'iam', 'access', 'service-account', 'tag', 'yes', 'non-interactive'],
   'secrets push': ['from', 'to', 'overwrite', 'dry-run'],

package/src/cli/usage.ts

@@ -37,7 +37,9 @@ ${style.bold('Everyday')}
                                         from the credential store, or say what is missing
   ${PROGRAM} start [--only]             reconcile and serve every profile on one endpoint
   ${PROGRAM} outputs [--show] [--json]  the endpoint an agent needs
-  ${PROGRAM} dashboard [--print]        open the local endpoint's page in a browser
+  ${PROGRAM} desktop [--print] [--yes]  open the Lanes app on its Lanes Link page,
+                                        installing it first if it is not there
+  ${PROGRAM} dashboard                  the older spelling of the line above
   ${PROGRAM} mcp add [claude|codex]     register this endpoint, and install the agent skill
   ${PROGRAM} mcp add --no-skill         register only, leaving the agent's own files alone
   ${PROGRAM} mcp list                   where it is registered, and whether the skill is current
@@ -129,6 +131,8 @@ ${style.bold('Inspection')}
   ${PROGRAM} doctor [--json]            credentials resolve, stores reachable
   ${PROGRAM} doctor --fix               apply a repair it can make itself, such as
                                         a provider this project renamed under you
+  ${PROGRAM} auth [--json]              whether each connection can still sign in
+  ${PROGRAM} auth --connection <key>    just this one
   ${PROGRAM} tools [--json]             what the endpoint advertises to a client
   ${PROGRAM} plan                       what reconcile would change
   ${PROGRAM} audit tail [--limit N] [--denied-only] [--format md]

package/src/connectivity/auth/index.ts

@@ -19,6 +19,7 @@
 
 export { credentialResolver, type ResolvedCredential } from './resolve.ts';
 export { requestAuthorizer } from './authorize.ts';
+export { ReauthRequired, statusMeansGrantIsDead } from './reauth.ts';
 export { basicCredential } from './basic/index.ts';
 export { bearerToken, bearerTokenAsStored } from './token.ts';
 export {

package/src/connectivity/auth/oauth-authcode/provider.ts

@@ -1,5 +1,6 @@
 import type { SecretStore } from '#secrets';
 import type { ProviderManifest } from '#connectivity';
+import { ReauthRequired } from '../reauth.ts';
 
 /**
  * The SDK's `OAuthClientProvider`, backed by our `SecretStore`.
@@ -69,6 +70,20 @@ export class CredentialOAuthProvider {
     return `${this.#options.manifest.id}/${this.#options.connectionId}`;
   }
 
+  /**
+   * Which connection this provider speaks for, as `provider.id`.
+   *
+   * Public because a refusal has to name it: `refresh.ts` builds the same key
+   * for a `ReauthRequired`, and a caller holding several connections needs to
+   * know which one to send someone to rather than parsing it back out of a
+   * sentence. Note the separator differs from `#tokensRef` on purpose — that
+   * one is a credential ref (`gmail/main`), this one is the addressing form
+   * (`gmail.main`).
+   */
+  get connectionId(): string {
+    return this.#options.connectionId;
+  }
+
   // --- OAuthClientProvider ----------------------------------------------
 
   get redirectUrl(): string | undefined {
@@ -131,7 +146,8 @@ export class CredentialOAuthProvider {
 
   async redirectToAuthorization(authorizationUrl: URL): Promise<void> {
     if (!this.#options.openBrowser) {
-      throw new Error(
+      throw new ReauthRequired(
+        `${this.#options.manifest.id}.${this.#options.connectionId}`,
         `Connection ${this.#options.manifest.id}.${this.#options.connectionId} needs re-authorisation, ` +
           `which requires a browser. Connect ${this.#options.manifest.id}.${this.#options.connectionId} again for this profile and target.`,
       );

package/src/connectivity/auth/oauth-authcode/refresh.ts

@@ -1,6 +1,7 @@
 import type { ProviderManifest } from '#connectivity';
 import type { SecretStore } from '#secrets';
 import { BROKERED, BrokerError, brokerRefresh } from './broker.ts';
+import { ReauthRequired, statusMeansGrantIsDead } from '../reauth.ts';
 import type { CredentialOAuthProvider } from './provider.ts';
 
 /** What a stored OAuth credential carries beyond the tokens themselves. */
@@ -23,7 +24,10 @@ export async function refreshDirectly(
   const refreshToken = existing?.refresh_token;
 
   if (!refreshToken) {
-    throw new Error(
+    // Nothing to renew with, so this can only be settled by signing in again —
+    // the same remedy as a dead grant, and reported as the same thing.
+    throw new ReauthRequired(
+      `${manifest.id}.${provider.connectionId}`,
       `No refresh token stored for ${manifest.id}. Connecting it again for this profile and target would store one.`,
     );
   }
@@ -38,9 +42,19 @@ export async function refreshDirectly(
   const broker = auth?.broker;
   const brokered = broker !== undefined && existing?.authorized_via === BROKERED;
 
+  const connectionKey = `${manifest.id}.${provider.connectionId}`;
+
   const refreshed = brokered
-    ? await viaBroker(manifest, broker.url, refreshToken, existing, fetchImpl)
-    : await viaStoredClient(manifest, auth?.app, tokenUrl, refreshToken, credentials, fetchImpl);
+    ? await viaBroker(manifest, connectionKey, broker.url, refreshToken, existing, fetchImpl)
+    : await viaStoredClient(
+        manifest,
+        connectionKey,
+        auth?.app,
+        tokenUrl,
+        refreshToken,
+        credentials,
+        fetchImpl,
+      );
 
   // `existing` first, so what the response does not mention survives it. Neither
   // the vendor nor the broker echoes `refresh_token`, `id_token`, or
@@ -53,6 +67,7 @@ export async function refreshDirectly(
 
 async function viaBroker(
   manifest: ProviderManifest,
+  connectionKey: string,
   url: string,
   refreshToken: string,
   existing: StoredTokens,
@@ -70,17 +85,27 @@ async function viaBroker(
     // next step. Same shape as the stored-client message below, deliberately:
     // where the credential came from is not the reader's problem here.
     const notice = cause instanceof BrokerError && cause.notice ? `\n${cause.notice}` : '';
-    throw new Error(
+    const message =
       `The credential for ${manifest.id} could not be refreshed. ` +
-        `Re-authorise ${manifest.id} for this profile and target.\n${String(
-          cause instanceof Error ? cause.message : cause,
-        ).slice(0, 200)}${notice}`,
-    );
+      `Re-authorise ${manifest.id} for this profile and target.\n${String(
+        cause instanceof Error ? cause.message : cause,
+      ).slice(0, 200)}${notice}`;
+
+    // Only the broker refusing *this* credential means a person is needed. A
+    // broker that is down, or rate-limiting, says nothing about the grant, and
+    // reporting it as "sign in again" would send someone through a consent
+    // screen to fix an outage. A `cause` that is not a `BrokerError` never
+    // reached the broker at all, so it is the same case.
+    if (cause instanceof BrokerError && statusMeansGrantIsDead(cause.status)) {
+      throw new ReauthRequired(connectionKey, message);
+    }
+    throw new Error(message);
   }
 }
 
 async function viaStoredClient(
   manifest: ProviderManifest,
+  connectionKey: string,
   app: string | undefined,
   tokenUrl: string,
   refreshToken: string,
@@ -108,10 +133,17 @@ async function viaStoredClient(
   if (!response.ok) {
     // A revoked or expired refresh token is the common case here, and the fix
     // is always the same, so say it rather than surfacing the raw grant error.
-    throw new Error(
+    const message =
       `The credential for ${manifest.id} could not be refreshed (${response.status}). ` +
-        `Re-authorise ${manifest.id} for this profile and target.\n${text.slice(0, 200)}`,
-    );
+      `Re-authorise ${manifest.id} for this profile and target.\n${text.slice(0, 200)}`;
+
+    // 4xx is the authorization server rejecting this credential; 5xx is it
+    // being unwell. Only the first is something a person can fix, and only the
+    // first may be reported as such.
+    if (statusMeansGrantIsDead(response.status)) {
+      throw new ReauthRequired(connectionKey, message);
+    }
+    throw new Error(message);
   }
 
   return JSON.parse(text) as Record<string, unknown>;

package/src/connectivity/auth/oauth-jwt/index.ts

@@ -1,4 +1,5 @@
 import type { ProviderManifest } from '#connectivity';
+import { ReauthRequired, statusMeansGrantIsDead } from '../reauth.ts';
 import type { SecretStore } from '#secrets';
 import { credentialRefForConnection } from '../../manifest/credential-ref.ts';
 import { parseAssertionKey, signAssertion } from './key.ts';
@@ -170,7 +171,17 @@ export async function resolveAssertionToken(input: {
   const body = (await response.json().catch(() => ({}))) as TokenResponse;
 
   if (!response.ok || !body.access_token) {
-    throw new Error(refusalMessage(manifest, stored, body, response.status));
+    const message = refusalMessage(manifest, stored, body, response.status);
+
+    // A key is refused for the same two reasons a refresh token is: the grant
+    // behind it is gone, or the token endpoint is unwell. The remedy differs
+    // from a consent screen — it is an admin grant in a console, or `connect
+    // --replace` — but "the owner has to re-authorise this connection" is the
+    // same claim, and `refusalMessage` already writes the specific sentence.
+    if (statusMeansGrantIsDead(response.status)) {
+      throw new ReauthRequired(`${manifest.id}.${connectionId}`, message);
+    }
+    throw new Error(message);
   }
 
   minted.set(cacheKey, {

package/src/connectivity/auth/reauth.ts

@@ -0,0 +1,48 @@
+/**
+ * The one failure a person has to fix, told apart from every other one.
+ *
+ * A stored credential stops working for two very different reasons, and until
+ * this existed they arrived as the same `Error`:
+ *
+ *   - the grant is gone — revoked, or expired because the client's publishing
+ *     status expires refresh tokens on a timer. Nothing retries its way out of
+ *     this; somebody has to sign in again.
+ *   - the token endpoint had a bad afternoon — a 502, a reset connection, DNS.
+ *     Retrying is exactly right, and telling the owner to re-authorise would be
+ *     a lie that costs them a consent screen.
+ *
+ * Both used to read as "could not be refreshed", so anything trying to *report*
+ * connection health had to match on the message text. That is why this is a
+ * class and not a string: `auth.ts` classifies on `instanceof`, and the messages
+ * stay free to be rewritten for whoever is reading them.
+ *
+ * The message is deliberately unchanged from what each throw site said before —
+ * this is a widening, not a rewrite. What is new is that the type now carries
+ * *which* connection, so a caller holding several can say which one to fix
+ * without parsing the sentence.
+ */
+export class ReauthRequired extends Error {
+  /** `provider.id`, e.g. `gmail.main`. The addressing form used everywhere. */
+  readonly connectionKey: string;
+
+  constructor(connectionKey: string, message: string) {
+    super(message);
+    this.name = 'ReauthRequired';
+    this.connectionKey = connectionKey;
+  }
+}
+
+/**
+ * Whether an HTTP status from a token endpoint means the grant itself is dead.
+ *
+ * 4xx is the authorization server saying no to *this credential* — `invalid_grant`
+ * for a revoked or expired refresh token, `invalid_client` for a client that no
+ * longer exists. Signing in again is the fix.
+ *
+ * 5xx is the server saying no to *everyone*, and 429 is it saying "not now".
+ * Neither is a statement about the credential, so neither may be reported as
+ * needing a human. 429 sits in the 4xx range and is excluded for that reason.
+ */
+export function statusMeansGrantIsDead(status: number): boolean {
+  return status >= 400 && status < 500 && status !== 429;
+}

package/src/server/cors.ts

@@ -217,9 +217,9 @@ function withCors(response: Response, headers: Record<string, string>): Response
  *
  * Wrapped at `serve()` rather than inside the router, which is also where the
  * policy is decided: cross-origin access is a property of the address this is
- * bound to, exactly as `allowedHostnames` and the dashboard are, and putting all
- * three in one function is what makes the loopback exclusion legible instead of
- * an invariant spread across two files.
+ * bound to, exactly as `allowedHostnames` is, and putting both in one function
+ * is what makes the loopback exclusion legible instead of an invariant spread
+ * across two files.
  *
  * It is what makes the ordering safe, too. A preflight answered here never
  * reaches the rebinding guard inside `inner` — and does not need to, because a

package/src/server/endpoint.ts

@@ -77,16 +77,6 @@ export interface EndpointOptions {
   readonly reporter?: EndpointReporter | undefined;
   /** Operational events. Silent when absent, which is what the tests want. */
   readonly log?: Logger | undefined;
-  /**
-   * Serve the dashboard at `/dashboard`.
-   *
-   * True for `lanes link start`, absent in a container — the same split as
-   * `mintToken`, and for a related reason. A deployed instance has no door a
-   * browser can come through (ADR-018), so a page there would be either
-   * unreachable or unguarded depending on `deploy.access`, and both are worse
-   * than not having one.
-   */
-  readonly dashboard?: boolean | undefined;
 }
 
 export interface RunningEndpoint {
@@ -184,12 +174,6 @@ function profileRuntimes(runtimes: ReadonlyMap<string, Runtime>): Map<string, Pr
         // through `skills.manage.write`, or by `lanes link skills add` in another
         // terminal — is a prompt without a restart (ADR-014).
         refreshSkills: runtime.refreshSkills,
-        // For a surface that reports rather than dispatches. A thunk rather
-        // than a snapshot because a reconcile lands between requests, and the
-        // dashboard reading a list captured at boot would keep showing an
-        // account as unauthorized after the connect that fixed it.
-        target: runtime.target,
-        connections: () => runtime.state.connections.list(),
       },
     ]),
   );
@@ -336,7 +320,6 @@ export async function startEndpoint(options: EndpointOptions): Promise<RunningEn
         : primary.authenticator,
       log,
       ...(gate ? { authorization: gate.surface } : {}),
-      ...(options.dashboard ? { dashboard: true } : {}),
       ...(options.port !== undefined ? { port: options.port } : {}),
       ...(options.host !== undefined ? { host: options.host } : {}),
     });

package/src/server/harness.ts

@@ -116,8 +116,6 @@ export interface HarnessOptions {
    * serving the old generation" case is reached; absent means nothing new.
    */
   reopen?: () => Promise<ReadonlyMap<string, ProfileRuntime>>;
-  /** Serve `/dashboard`, as `lanes link start` does and a container never does. */
-  dashboard?: boolean;
 }
 
 /**
@@ -178,10 +176,6 @@ export function wireProfiles(options: HarnessOptions): WiredProfiles {
       dispatcher,
       policy,
       ...(options.refreshSkills ? { refreshSkills: () => options.refreshSkills!(registry) } : {}),
-      // As `profileRuntimes` supplies them for real. A harness that claims to
-      // be the real wiring and omits a field leaves that field untested.
-      target: 'local',
-      connections: () => state.connections.list(),
     }),
   );
 
@@ -260,7 +254,6 @@ export function startHarness(options: HarnessOptions): Harness {
     primary: options.profile,
     authenticator: gate ? new AuthenticatorChain([bearer, gate.authenticator]) : bearer,
     ...(gate ? { authorization: gate.surface } : {}),
-    ...(options.dashboard ? { dashboard: true } : {}),
     log,
   });