@lanes-sh/link 0.7.1 → 0.8.0

package/src/profile/testing.ts

@@ -58,7 +58,7 @@ export function workspaceYaml(
   return (
     `contract: ${SUPPORTED_CONTRACT}\n` +
     (options.defaultProfile ? `default_profile: ${options.defaultProfile}\n` : '') +
-    `targets:\n${blocks}\n`
+    `workspaces:\n${blocks}\n`
   );
 }
 
@@ -73,6 +73,73 @@ export function pointerYaml(
   return (
     `contract: ${SUPPORTED_CONTRACT}\n` +
     (options.defaultProfile ? `default_profile: ${options.defaultProfile}\n` : '') +
-    `targets:\n${local}  ${target}:\n    workspace: ${workspace}\n`
+    `workspaces:\n${local}  ${target}:\n    at: ${workspace}\n`
+  );
+}
+
+/**
+ * A `connections.yaml` holding the owner layer plus whatever a test names.
+ *
+ * Every fixture that opens a runtime needs one now: a profile's grants name rows
+ * in this file, and `assertGrantsResolve` refuses a grant with nothing behind it
+ * (ADR-057). Thirty tests writing the seven owner-layer rows by hand is how a
+ * fixture ends up subtly different from what `newConnectionsTemplate` writes.
+ */
+export function connectionsYaml(
+  extra: readonly { id: string; provider: string; account: string }[] = [],
+): string {
+  const owner = [
+    { id: 'main', provider: 'memory', account: 'Memory' },
+    { id: 'main', provider: 'tasks', account: 'Tasks' },
+    { id: 'main', provider: 'assets', account: 'Assets' },
+    { id: 'main', provider: 'skills', account: 'Skills' },
+    { id: 'main', provider: 'vault', account: 'Vault' },
+    { id: 'main', provider: 'setup', account: 'Setup' },
+    { id: 'main', provider: 'entities', account: 'Entities' },
+  ];
+
+  const rows = [...owner, ...extra]
+    .map((row) => `  - { id: ${row.id}, provider: ${row.provider}, account: ${row.account} }`)
+    .join('\n');
+
+  return `contract: ${SUPPORTED_CONTRACT}\nconnections:\n${rows}\noauth_apps: {}\n`;
+}
+
+/** The owner-layer grant rows a fresh profile carries, plus whatever a test names. */
+export function grantsYaml(
+  extra: readonly { connection: string; allow?: readonly string[]; deny?: readonly string[] }[] = [],
+): string {
+  const owner = ['memory', 'tasks', 'assets', 'skills', 'vault', 'setup', 'entities'].map(
+    (provider) => ({ connection: `${provider}.main`, allow: [`${provider}.*`], deny: [] }),
+  );
+
+  return [...owner, ...extra]
+    .map(
+      (grant) =>
+        `  - { connection: ${grant.connection}, allow: [${(grant.allow ?? []).join(', ')}], ` +
+        `deny: [${(grant.deny ?? []).join(', ')}] }`,
+    )
+    .join('\n');
+}
+
+/** A whole profile document at the current contract, for a test that needs one. */
+export function profileYaml(
+  profile: string,
+  options: {
+    port?: number;
+    grants?: readonly { connection: string; allow?: readonly string[]; deny?: readonly string[] }[];
+    members?: readonly string[];
+  } = {},
+): string {
+  const members = (options.members ?? [])
+    .map((subject) => `  - { subject: ${subject}, role: owner }`)
+    .join('\n');
+
+  return (
+    `contract: ${SUPPORTED_CONTRACT}\n` +
+    `instance:\n  profile: ${profile}\n  port: ${options.port ?? 7337}\n  host: 127.0.0.1\n` +
+    `auth:\n  mode: bearer\n  token_ref: profile/token\n` +
+    `grants:\n${grantsYaml(options.grants ?? [])}\n` +
+    `members:${members ? `\n${members}` : ' []'}\n`
   );
 }

package/src/profile/workspace.ts

@@ -5,7 +5,16 @@ import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { homedir } from 'node:os';
 import { parse as parseYaml } from 'yaml';
 import { ConfigError } from './load.ts';
-import { workspaceSchema, type Config, type WorkspaceConfig } from './schema.ts';
+import {
+  SUPPORTED_CONTRACT,
+  connectionsFileSchema,
+  workspaceSchema,
+  type Config,
+  type ConnectionsFile,
+  type WorkspaceConfig,
+} from './schema.ts';
+import { assertConnectionsUnique, assertNoRenamedProviders } from './connections.ts';
+import { findSecrets, formatSecretFindings } from './secret-detection.ts';
 
 /**
  * Workspace and profile resolution.
@@ -152,6 +161,52 @@ export async function loadProfileConfig(
   return parseConfig(text, shown);
 }
 
+/** `connections.yaml` sits beside `lanes-link.yaml`, at the workspace root. */
+export const CONNECTIONS_FILE = 'connections.yaml';
+
+/**
+ * Every account authorised in this workspace (ADR-057).
+ *
+ * Absent is not an error. A workspace that has never connected anything has no
+ * file, and returning an empty set rather than throwing is what lets `profile
+ * add`, `status` and `doctor` answer on a fresh install — the same reasoning
+ * `readWorkspace` uses for returning null.
+ *
+ * Read through the workspace store rather than the filesystem, so a deployed
+ * revision whose root is a bucket URL loads it (ADR-049). That was the exact
+ * bug manifests hit: a filesystem read against a `gs://` root silently found
+ * nothing and every custom provider vanished.
+ */
+export async function readConnections(workspaceRoot: string): Promise<ConnectionsFile> {
+  const path = join(workspaceRoot, CONNECTIONS_FILE);
+  const text = await readWorkspaceFile(workspaceFiles(workspaceRoot), CONNECTIONS_FILE);
+  if (text === null) return { contract: SUPPORTED_CONTRACT, connections: [], oauth_apps: {} };
+
+  const raw = parseYaml(text);
+
+  const secrets = findSecrets(raw);
+  if (secrets.length > 0) {
+    throw new ConfigError(
+      `${path}: ${formatSecretFindings(secrets)}`,
+      secrets.map((finding) => finding.path),
+    );
+  }
+
+  const parsed = connectionsFileSchema.safeParse(raw);
+  if (!parsed.success) {
+    throw new ConfigError(
+      `${path}:\n${parsed.error.issues.map((i) => `  ${i.path.join('.')}: ${i.message}`).join('\n')}`,
+    );
+  }
+
+  assertConnectionsUnique(parsed.data.connections);
+  assertNoRenamedProviders(
+    parsed.data.connections,
+    'lanes link doctor --fix --profile <name> --workspace <name>',
+  );
+  return parsed.data;
+}
+
 export async function readWorkspace(workspaceRoot: string): Promise<WorkspaceConfig | null> {
   const path = join(workspaceRoot, WORKSPACE_FILE);
   const text = await readWorkspaceFile(workspaceFiles(workspaceRoot), WORKSPACE_FILE);
@@ -219,7 +274,7 @@ export function noProfileNamed(
   if (available.length === 0) {
     return new ConfigError(
       `--profile is required, and ${workspaceRoot} holds no profiles yet.\n` +
-        '  Create one with: lanes link profile add <name> --target local',
+        '  Create one with: lanes link profile add <name> --workspace local',
     );
   }
 
@@ -230,7 +285,7 @@ export function noProfileNamed(
       'nothing else selects one.\n\n' +
       `  Profiles in ${workspaceRoot}\n` +
       available.map((name) => `    ${name}`).join('\n') +
-      `\n\n  e.g. lanes link status --profile ${available[0]} --target <target>` +
+      `\n\n  e.g. lanes link status --profile ${available[0]} --workspace <name>` +
       (stale
         ? `\n\n  LANES_LINK_PROFILE=${stale} is set in this shell and is no longer read.\n` +
           '  Unset it, or pass --profile.'

package/src/providers/custom/index.ts

@@ -12,5 +12,5 @@
  * connectivity type; `load.ts` reads and validates them.
  */
 
-export { loadProfileProviders, parseManifest, type LoadedManifest } from './load.ts';
+export { loadWorkspaceProviders, parseManifest, type LoadedManifest } from './load.ts';
 export { manifestTemplate } from './template.ts';

package/src/providers/custom/load.ts

@@ -38,14 +38,13 @@ export interface LoadedManifest {
   readonly path: string;
 }
 
-export async function loadProfileProviders(
+export async function loadWorkspaceProviders(
   workspaceRoot: string,
-  profile: string,
   /** Injected for tests. A bucket is the case this exists to cover. */
   store?: BlobStore,
 ): Promise<LoadedManifest[]> {
   const files = store ?? workspaceFiles(workspaceRoot);
-  const directory = layout.providers(profile);
+  const directory = layout.providers();
 
   let keys: string[];
   try {

package/src/providers/identity/provider.ts

@@ -128,7 +128,7 @@ function render(
     // Both flags, spelled out. They are required (ADR-037), so a command
     // missing either is one the owner pastes and watches refuse — and this is
     // handed to an agent, which relays it verbatim.
-    const where = `--profile ${profile}${target ? ` --target ${target}` : ''}`;
+    const where = `--profile ${profile}${target ? ` --workspace ${target}` : ''}`;
     return (
       `Profile "${profile}" declares no identity.\n\n` +
       'Nothing here says what name or address to use, so do not invent one — ask. ' +

package/src/providers/memory/provider.ts

@@ -272,8 +272,26 @@ export const memoryProvider: ProviderDefinition = defineLocalProvider({
         tag: z.string().optional().describe('Restrict to entries carrying this tag'),
         limit: z.number().int().min(1).max(50).optional().describe(`Maximum results (default ${DEFAULT_LIMIT})`),
       }),
-      // Nothing kept: a memory query is as revealing as a Gmail search query,
-      // and frequently more so — it is the owner's own material being asked for.
+      // Kept, and this reverses the rule the rest of this file follows.
+      //
+      // The old comment here read "a memory query is as revealing as a Gmail
+      // search query, and frequently more so", which is true and is an argument
+      // about the wrong thing. A search term is not the owner's material: it is
+      // what an *agent* went looking for in that material, which is precisely
+      // the question this log exists to answer. Withholding it leaves a record
+      // saying memory was searched, twice, and matched nothing, with no way to
+      // tell a calendar lookup from a rummage through someone's medical notes.
+      //
+      // The body stays withheld either way — `entry` and `get` keep only `uri`
+      // and `id`, so what was *found* is still not in here. This records the
+      // question, not the answer.
+      //
+      // The reason for the old rule was `audit/fanout.ts`: a workspace may ship
+      // copies to stdout or an OTLP collector, and those leave the machine. That
+      // is a real exposure and it is the operator's to weigh, which is what a
+      // declared sink is. It is not a reason to withhold from the durable log on
+      // the operator's own disk.
+      redact: keepKeys('query', 'tag', 'limit'),
       async handler({ query, tag, limit }, context) {
         const needle = query.toLowerCase();
         const entries = await allEntries(context.storage);

package/src/providers/setup/plan.ts

@@ -137,7 +137,7 @@ export function planFor(
   // missing either is one that refuses, or worse, writes a credential into a
   // store the endpoint that asked for it does not read.
   const command =
-    `lanes link connect ${manifest.id} --profile ${context.profile} --target ${context.target}` +
+    `lanes link connect ${manifest.id} --profile ${context.profile} --workspace ${context.target}` +
     (needsId ? ' --id <name>' : connectionId ? ` --id ${connectionId}` : '');
 
   return {

package/src/providers/slack/index.ts

@@ -105,12 +105,12 @@ export const slack = defineProvider({
       'Open "OAuth & Permissions" and add the scopes you need under USER TOKEN SCOPES — not Bot Token Scopes; the MCP server reads the user token. The full set this provider asks for in the browser is listed in https://lanes.sh/docs/link/slack.',
       'Choose "Install to Workspace" and approve. A Slack admin may have to approve it for you.',
       'Copy the "User OAuth Token". It starts with xoxp- — not the bot token, which starts with xoxb- and will not work here.',
-      'The token does not expire unless you enable token rotation on the app. If you rotate or reinstall, run: lanes link connect slack --profile personal --target local --auth pasted_token --replace.',
+      'The token does not expire unless you enable token rotation on the app. If you rotate or reinstall, run: lanes link connect slack --profile personal --workspace local --auth pasted_token --replace.',
     ],
     troubleshooting:
       'Slack refused the token. The usual causes are a bot token (xoxb-) pasted where the user token (xoxp-) belongs, ' +
       'a scope missing from USER TOKEN SCOPES, or an app that was reinstalled since — reinstalling mints a new token. ' +
-      'Copy the User OAuth Token from https://api.slack.com/apps and re-run: lanes link connect slack --profile personal --target local --auth pasted_token --replace.',
+      'Copy the User OAuth Token from https://api.slack.com/apps and re-run: lanes link connect slack --profile personal --workspace local --auth pasted_token --replace.',
     prompts: [
       {
         key: 'token',

package/src/registry/policy-bridge.ts

@@ -1,21 +1,43 @@
-import type { PolicyDocument, PolicyRule } from '#policy';
-import type { Config } from '#profile';
+import type { PolicyDocument, PolicyRule, ProfilePolicy } from '#policy';
+import type { Config, GrantConfig } from '#profile';
 
 /**
- * Turn the config's `policy` block into the document the policy engine
+ * Turn the config's `grants:` rows into the documents the policy engine
  * evaluates.
  *
- * The config format keeps `allow` and `deny` as separate lists because that is
- * what reads clearly in YAML; the engine wants one list carrying an effect,
- * because evaluation must consider both together to make deny win regardless of
- * ordering. Converting here keeps that difference from leaking either way.
+ * Two format differences are reconciled here, and keeping them in one place is
+ * what stops either leaking into the other side.
+ *
+ * The config keeps `allow` and `deny` as separate lists because that is what
+ * reads clearly in YAML; the engine wants one list carrying an effect, because
+ * evaluation must consider both together to make deny win regardless of
+ * ordering.
+ *
+ * And the config is a *sequence* of rows while the engine wants a lookup by
+ * connection (ADR-058). A profile cannot declare the same connection twice —
+ * `assertGrantsResolve` refuses it at load, precisely so that this conversion
+ * has no collision to resolve and no precedence to invent.
+ *
+ * This is the only place `#profile`'s shape meets `#policy`'s. `#policy` may
+ * not import `#profile` and does not need to: it takes a map of rule lists and
+ * knows nothing about YAML, grants, or where a connection was declared.
  */
-export function toPolicyDocument(config: Config): PolicyDocument {
+export function toPolicyDocument(config: Config): ProfilePolicy {
+  const byConnection = new Map<string, PolicyDocument>();
+
+  for (const grant of config.grants) {
+    byConnection.set(grant.connection, { rules: rulesFor(grant) });
+  }
+
+  return { byConnection };
+}
+
+function rulesFor(grant: GrantConfig): PolicyRule[] {
   const rules: PolicyRule[] = [];
 
   for (const [effect, entries] of [
-    ['allow', config.policy.allow],
-    ['deny', config.policy.deny],
+    ['allow', grant.allow],
+    ['deny', grant.deny],
   ] as const) {
     for (const entry of entries) {
       rules.push({
@@ -28,5 +50,5 @@ export function toPolicyDocument(config: Config): PolicyDocument {
     }
   }
 
-  return { rules };
+  return rules;
 }

package/src/registry/reconcile.ts

@@ -144,7 +144,7 @@ export function planIsNoop(plan: ReconcilePlan): boolean {
  * half-configured Gmail account must not stop the other providers from serving.
  */
 export async function planReconcile(
-  config: Config,
+  connections: readonly ConnectionConfig[],
   state: RuntimeState,
   credentials: SecretStore,
   /**
@@ -164,7 +164,7 @@ export async function planReconcile(
   const unauthorized: string[] = [];
   const declared = new Set<string>();
 
-  for (const connection of config.connections) {
+  for (const connection of connections) {
     const key = `${connection.provider}.${connection.id}`;
     declared.add(key);
 
@@ -229,11 +229,11 @@ export async function planReconcile(
 }
 
 export async function applyReconcile(
-  config: Config,
+  connections: readonly ConnectionConfig[],
   state: RuntimeState,
   plan: ReconcilePlan,
 ): Promise<void> {
-  const byKey = new Map(config.connections.map((c) => [`${c.provider}.${c.id}`, c]));
+  const byKey = new Map(connections.map((one) => [`${one.provider}.${one.id}`, one]));
 
   for (const action of plan.actions) {
     if (action.kind === 'unchanged') continue;

package/src/server/authorization.ts

@@ -0,0 +1,94 @@
+import {
+  IssuedTokenAuthenticator,
+  OAuthServer,
+  OAuthStore,
+  OidcAuthenticator,
+  OidcVerifier,
+  lanesFederation,
+  type Authenticator,
+} from '#auth';
+import type { Logger } from '#connectivity';
+import type { Runtime } from '#cli/runtime.ts';
+import { MCP_PATH } from './index.ts';
+import type { AuthorizationSurface } from './oauth.ts';
+
+/**
+ * Deciding how a remote client proves who it is.
+ *
+ * Its own file, away from the lifecycle in `endpoint.ts`, because the two
+ * answer different questions and only one of them is interesting. Starting an
+ * endpoint is bind, serve, reload, stop. This is which of three models the
+ * profile declared — none, an issuer of its own, or somebody else's — and each
+ * arm carries an argument that has to be read to be changed safely.
+ */
+
+/**
+ * The remote-client gate, if this profile declares one.
+ *
+ * Endpoint-scoped rather than per profile, like the bearer token and for the
+ * same reason (ADR-009): one URL serves every profile in the workspace, so
+ * there is one place a client authorises and one set of tokens.
+ *
+ * Returns null when `auth.authorization` is absent, and everything downstream
+ * treats null as "exactly as before" — no metadata published, no pointer on the
+ * `401`, one authenticator instead of a chain.
+ */
+export async function openAuthorization(
+  primary: Runtime,
+  log: Logger,
+  members: (subject: string) => Promise<readonly string[]>,
+): Promise<{ surface: AuthorizationSurface; authenticator: Authenticator } | null> {
+  const declared = primary.config.auth.authorization;
+  if (!declared) return null;
+
+  const profile = primary.resolution.profile;
+
+  if (declared.mode === 'oidc') {
+    const audience = await primary.credentials.get(declared.client_id_ref);
+    if (!audience) {
+      // Refuse rather than verify without an audience. A verifier that cannot
+      // check who a token was issued for accepts every token the issuer minted
+      // for anything, which is the failure this mode exists to prevent.
+      throw new Error(
+        `auth.authorization.client_id_ref names "${declared.client_id_ref}", which is not in ` +
+          `this target's credential store. Store it with: lanes link secrets set ${declared.client_id_ref}`,
+      );
+    }
+
+    const verifier = new OidcVerifier({
+      issuer: declared.issuer,
+      audience,
+      allowedSubjects: declared.allowed_subjects,
+      ...(declared.introspection_endpoint
+        ? { introspectionEndpoint: declared.introspection_endpoint }
+        : {}),
+    });
+
+    return {
+      // The issuer is somebody else's origin, so it is a constant here rather
+      // than derived from the request.
+      surface: { issuer: () => declared.issuer, mcpPath: MCP_PATH, target: primary.target },
+      authenticator: new OidcAuthenticator(verifier, profile),
+    };
+  }
+
+  const store = new OAuthStore(primary.state.kv);
+
+  const server = new OAuthServer({
+    store,
+    accessTokenTtlMs: declared.access_token_ttl_minutes * 60_000,
+    // So a replayed refresh token leaves a line. It is refused rather than
+    // acted on (ADR-035), and a refusal nobody can see is how a connector
+    // losing its authorization came to need log forensics to explain.
+    log,
+    // Identity comes from lanes.sh, not from a credential pasted into a form on
+    // this machine (ADR-062). What this endpoint decides is the half lanes.sh
+    // cannot know: which of *its* profiles name that person.
+    federation: lanesFederation({ profilesFor: members }),
+  });
+
+  return {
+    surface: { server, issuer: (origin) => origin, mcpPath: MCP_PATH, target: primary.target },
+    authenticator: new IssuedTokenAuthenticator(store, profile),
+  };
+}

package/src/server/edge.ts

@@ -33,11 +33,20 @@ export const FAILED_AUTH_PER_MINUTE = 30;
  *   - `/authorize` compares against the endpoint token, which is another read of
  *     the credential store.
  *   - `/token` reads and writes bucket objects.
+ *   - `/state` and `/audit` verify the pairing token, which on a deployed
+ *     workspace is a Secret Manager call and has no cache behind it at all.
  *
  * `/health` presented with *no* credential is deliberately free: it reads
  * nothing, and it is what a platform probe and `lanes link outputs` send.
  * Metering it would put a ceiling on the one request that costs nothing to
  * answer.
+ *
+ * The read surface is **not** given that exemption, and the asymmetry is the
+ * point: nothing legitimate calls `/state` without a credential — no probe, no
+ * CLI command — so there is no free request to protect. Metering it
+ * unconditionally also means the ceiling does not depend on `readRoutes`
+ * continuing to parse the header before it asks the store anything. That
+ * short-circuit is an optimisation; this is the guarantee.
  */
 export const UNAUTHENTICATED_PER_MINUTE = 30;
 
@@ -141,6 +150,9 @@ export function unauthenticatedRefusal(input: {
   readonly healthPath: string;
   readonly isAuthorizationPath: (pathname: string) => boolean;
   readonly authorizationEnabled: boolean;
+  /** Passed rather than imported, for the reason `isAuthorizationPath` is. */
+  readonly isReadPath: (pathname: string) => boolean;
+  readonly readEnabled: boolean;
 }): Response | undefined {
   // A `/health` carrying no credential reads nothing and is deliberately free —
   // it is what a platform probe and `lanes link outputs` send, and a ceiling on
@@ -149,7 +161,8 @@ export function unauthenticatedRefusal(input: {
   const costly =
     input.pathname === input.healthPath
       ? input.request.headers.get('authorization') !== null
-      : input.authorizationEnabled && input.isAuthorizationPath(input.pathname);
+      : (input.readEnabled && input.isReadPath(input.pathname)) ||
+        (input.authorizationEnabled && input.isAuthorizationPath(input.pathname));
 
   if (!costly) return undefined;