@lanes-sh/link 0.7.2 → 0.9.0

package/src/cli/commands/operate/pair.ts

@@ -0,0 +1,324 @@
+import { randomBytes } from 'node:crypto';
+import {
+  ConfigError,
+  PAIR_CERT_REF,
+  PAIR_KEY_REF,
+  PAIR_TOKEN_REF,
+  loadWorkspaceProfiles,
+  openTarget,
+  type LoadedProfile,
+  resolveWorkspaceRoot,
+} from '#profile';
+import type { ResolvedTarget } from '#profile';
+import { deployedUrl } from '../../endpoint-url.ts';
+import { ensureCertificate } from './pair-certificate.ts';
+import { recordConfigChange } from '../../audit-change.ts';
+import { ok, print, style } from '../../output.ts';
+import type { SecretStore } from '#secrets';
+import { openSecretStoreFor, type GlobalFlags } from '../../runtime.ts';
+
+/**
+ * `lanes link pair` — let the Lanes dashboard read this machine (ADR-063).
+ *
+ * Three things, and each is the operator's to decline. It installs a locally
+ * trusted certificate, mints a credential that reads the whole workspace, and
+ * hands the browser a link carrying it. None of that happens without being
+ * asked for, and none of it is implied by `start`.
+ *
+ * **The certificate is the largest side effect any command in this CLI has.**
+ * It is a persistent change to the machine's trust store, made by a CLI, and
+ * ADR-053's precedent applies unchanged: offer it, name what it is, and stop if
+ * declined. A run with nobody at the terminal is refused rather than assumed.
+ *
+ * **The token travels in a fragment.** `#pair=` is never sent to a server, so a
+ * credential for a surface whose entire point is that Lanes cannot see it does
+ * not end up in a Lanes access log, a proxy, or a referrer header.
+ *
+ * **A deployed workspace pairs too, and skips all of that** (ADR-064). The
+ * certificate was the whole of the old refusal — installing one for an address
+ * this machine does not answer on is meaningless — and it is the one piece a
+ * deployed endpoint does not need, because the platform terminates TLS with a
+ * certificate a browser already trusts. What remains is a token and an address.
+ *
+ * **It names a workspace, not a profile**, because that is what it pairs. The
+ * surface it opens lists every connection and every profile the workspace holds,
+ * and the credential it mints reads all of them — so asking which profile was
+ * asking a question with no answer, and implying a per-profile pairing that does
+ * not exist. `--profile` is still accepted, and picks the port when profiles
+ * disagree about one.
+ */
+
+/**
+ * Where the three pieces live in the credential store.
+ *
+ * Declared in `#profile` rather than here, because three components read these
+ * names now and only one of them is the CLI — the server opens the read surface
+ * with them and a deploy binds the token so the revision may read it. Importing
+ * a *command* module for a string constant pulled the CLI's output and prompt
+ * handling into the container's runtime graph. Re-exported because a year of
+ * callers spell them from here.
+ */
+export { PAIR_CERT_REF, PAIR_KEY_REF, PAIR_TOKEN_REF };
+
+/** Where the dashboard lives, overridable so `lanes dev` can pair against it. */
+const DASHBOARD_URL = process.env['LANES_WEB_URL'] ?? 'https://lanes.sh';
+
+export interface PairFlags extends GlobalFlags {
+  /** Print the link for an existing pairing and change nothing. */
+  readonly print?: boolean | undefined;
+  /** Mint a fresh token, invalidating whatever a browser already holds. */
+  readonly rotate?: boolean | undefined;
+  /** Do not ask before installing mkcert. */
+  readonly yes?: boolean | undefined;
+}
+
+export interface PairDeps {
+  readonly which?: (binary: string) => string | null;
+  readonly run?: (command: readonly string[]) => Promise<string | null>;
+  readonly confirm?: (question: string) => Promise<boolean>;
+  readonly interactive?: boolean;
+}
+
+export async function pair(flags: PairFlags, deps: PairDeps = {}): Promise<void> {
+  const target = flags.target!;
+  const root = resolveWorkspaceRoot();
+  const resolved = await openTarget(root, target);
+  const { loaded: profiles } = await loadWorkspaceProfiles(resolved.workspaceRoot);
+
+  if (profiles.length === 0) {
+    throw new ConfigError(
+      `Workspace "${target}" holds no profiles, so there is no endpoint to pair.\n` +
+        `  Create one with: lanes link profile add <name> --workspace ${target}`,
+    );
+  }
+
+  // One endpoint serves every profile in a workspace, so they normally agree on
+  // a port and the choice is not a choice. Where they do not, the ambiguity is
+  // real and `--profile` is how it is settled — refused rather than guessed,
+  // because pairing the wrong port produces a dashboard that says "not
+  // connected" with everything working.
+  const named = flags.profile
+    ? profiles.find((one: LoadedProfile) => one.profile === flags.profile)
+    : undefined;
+
+  if (flags.profile && !named) {
+    throw new ConfigError(
+      `Workspace "${target}" has no profile "${flags.profile}".\n` +
+        `  It holds: ${profiles.map((one: LoadedProfile) => one.profile).join(', ')}`,
+    );
+  }
+
+  const ports = new Set(profiles.map((one: LoadedProfile) => one.config.instance.port));
+  if (!named && ports.size > 1) {
+    throw new ConfigError(
+      `The profiles in "${target}" do not agree on a port, so it is not clear which endpoint to pair.\n` +
+        profiles
+          .map((one: LoadedProfile) => `    ${one.profile}  ${one.config.instance.port}`)
+          .join('\n') +
+        '\n  Name one: lanes link pair --profile <name>',
+    );
+  }
+
+  const chosen = named ?? profiles[0]!;
+  const host = chosen.config.instance.host;
+  const credentials = await openSecretStoreFor(root, target);
+
+  // A workspace that declares a deployment is paired over the address the
+  // platform gave it, not over loopback — which is what `declared.deploy`
+  // answers and what `instance.host` does not: a deployed revision takes its
+  // host from the container's environment, so a profile bound to `127.0.0.1`
+  // in config is still serving `0.0.0.0` on Cloud Run.
+  if (resolved.declared.deploy) {
+    await pairDeployed({ flags, target, chosen, root, credentials, deploy: resolved.declared.deploy });
+    return;
+  }
+
+  if (!isLoopback(host)) {
+    // Not deployed, and not on this machine either. There is no certificate
+    // this command could install for an address this machine does not answer
+    // on, and no platform URL to hand the browser instead.
+    throw new ConfigError(
+      `"${target}" is bound to ${host}, which is neither loopback nor a deployment.\n` +
+        '  Pairing reaches an endpoint on *this* machine, or one `lanes link deploy` put\n' +
+        '  somewhere with an address of its own.',
+    );
+  }
+
+  const readPort = chosen.config.instance.port + 1;
+
+  // `127.0.0.1` rather than `instance.host`, even though `localhost` and `::1`
+  // are equally loopback and equally covered by the certificate. It is one
+  // address for one machine, and the browser has to agree with `open.ts` about
+  // which spelling it is: two pairings of the same endpoint under two names
+  // would be two entries in the switcher, both working, neither wrong.
+  const address = `https://127.0.0.1:${readPort}`;
+
+  if (flags.print === true) {
+    const existing = await credentials.get(PAIR_TOKEN_REF);
+    if (existing === null) throw new ConfigError('Not paired yet. Run: lanes link pair');
+    print(pairingLink(existing, address));
+    return;
+  }
+
+  const certificate = await ensureCertificate(credentials, flags, deps);
+
+  const rotating = flags.rotate === true;
+  const existing = rotating ? null : await credentials.get(PAIR_TOKEN_REF);
+  const token = existing ?? `llp_${randomBytes(32).toString('base64url')}`;
+  if (existing === null) await credentials.set(PAIR_TOKEN_REF, token);
+
+  // The token itself never goes in, obviously. What is worth recording is that
+  // a credential reading the whole workspace now exists, and when — and for a
+  // rotation, that whatever a browser was holding stopped working at that
+  // moment.
+  if (existing === null) {
+    await recordConfigChange(chosen.config, root, target, {
+      capability: rotating ? 'config.pair.rotate' : 'config.pair.mint',
+      scope: target,
+      arguments: { readPort, certificate },
+    });
+  }
+
+  print(ok(certificate === 'reused' ? 'certificate already installed' : 'certificate installed'));
+  if (rotating) {
+    print(style.dim('      The previous pairing link no longer works. Re-open the new one.'));
+  }
+  print('');
+  print(ok(`the dashboard may now read ${style.bold(address)}`));
+  print('');
+  print(pairingLink(token, address));
+  print('');
+  print(
+    style.dim(
+      '      Open that in a browser on this machine. The token is in the URL fragment,\n' +
+        '      so it never reaches a Lanes server.\n' +
+        '      It reads every connection, profile and audit entry in this workspace, and\n' +
+        '      can change nothing. Take it back with: lanes link pair --rotate\n' +
+        '\n' +
+        `      The endpoint has to be running: lanes link start --workspace ${target}`,
+    ),
+  );
+}
+
+/**
+ * Pairing a workspace that lives somewhere with an address of its own (ADR-064).
+ *
+ * The half of `pair` that is *not* shared with loopback is the certificate, and
+ * that was always the whole of the old refusal: installing one for an address
+ * this machine does not answer on is meaningless, and it is still meaningless.
+ * What was never the thing being refused is the credential and the address —
+ * the endpoint terminates TLS with a certificate a browser already trusts, so
+ * the two pieces that remain are a token and a URL.
+ *
+ * So there is no `mkcert` here, nothing is installed, and nothing is asked. The
+ * command writes one secret and prints a link.
+ */
+async function pairDeployed(input: {
+  flags: PairFlags;
+  target: string;
+  chosen: LoadedProfile;
+  root: string;
+  credentials: SecretStore;
+  deploy: NonNullable<ResolvedTarget['declared']['deploy']>;
+}): Promise<void> {
+  const { flags, target, chosen, root, credentials } = input;
+
+  // `deployedUrl` asks the platform where the service ended up and degrades to
+  // null for every reason that is not this command's business — no driver, not
+  // deployed yet, no credentials for the project. A link with no address in it
+  // reads nothing, so this refuses rather than printing half of one.
+  const mcpUrl = await deployedUrl(input.deploy);
+  if (mcpUrl === null) {
+    throw new ConfigError(
+      `Could not find the address of "${target}".\n` +
+        '  The service may not be deployed yet, or the platform CLI may not be signed in.\n' +
+        `  Check it with: lanes link outputs --workspace ${target}`,
+    );
+  }
+
+  // The read surface answers on the endpoint's own origin, beside `/mcp` rather
+  // than on a port of its own — Cloud Run routes exactly one.
+  const endpoint = mcpUrl.replace(/\/mcp$/, '');
+
+  if (flags.print === true) {
+    const existing = await credentials.get(PAIR_TOKEN_REF);
+    if (existing === null || existing === '') {
+      throw new ConfigError(`Not paired yet. Run: lanes link pair --workspace ${target}`);
+    }
+    print(pairingLink(existing, endpoint));
+    return;
+  }
+
+  const rotating = flags.rotate === true;
+  const held = rotating ? null : await credentials.get(PAIR_TOKEN_REF);
+
+  // An empty string, not just a missing ref: `lanes link deploy` creates this
+  // secret with no version so the revision's IAM binding has something to
+  // attach to, and a secret that exists with no version reads back as null
+  // here and as `unpaired` there. Either shape means nobody has paired yet.
+  const existing = held === '' ? null : held;
+  const token = existing ?? `llp_${randomBytes(32).toString('base64url')}`;
+  if (existing === null) await credentials.set(PAIR_TOKEN_REF, token);
+
+  if (existing === null) {
+    await recordConfigChange(chosen.config, root, target, {
+      capability: rotating ? 'config.pair.rotate' : 'config.pair.mint',
+      scope: target,
+      arguments: { endpoint },
+    });
+  }
+
+  print(ok('no certificate needed — this endpoint already has one a browser trusts'));
+  if (rotating) {
+    print(style.dim('      The previous pairing link no longer works. Re-open the new one.'));
+  }
+  print('');
+  print(ok(`the dashboard may now read ${style.bold(endpoint)}`));
+  print('');
+  print(pairingLink(token, endpoint));
+  print('');
+  print(
+    style.dim(
+      '      Open that in any browser, on any machine. The token is in the URL fragment,\n' +
+        '      so it never reaches a Lanes server.\n' +
+        '      It reads every connection, profile and audit entry in this workspace, and\n' +
+        '      can change nothing. Take it back with:\n' +
+        `        lanes link pair --workspace ${target} --rotate\n` +
+        '\n' +
+        '      A rotation takes up to five seconds to be refused, because the endpoint\n' +
+        '      caches what it read rather than calling Secret Manager per request.',
+    ),
+  );
+}
+
+/**
+ * The link the browser opens.
+ *
+ * The token rides in the fragment, which is never sent to a server — so a
+ * credential for a surface whose entire point is that Lanes cannot see this
+ * data does not land in a Lanes access log, a proxy, or a referrer header. The
+ * address rides beside it for the same reason and one more: it is the only
+ * thing telling the page which of several paired endpoints this link is for,
+ * and a query parameter would put a workspace's public address in that log.
+ *
+ * **A loopback link carries its address too**, and the parameter is required so
+ * that it cannot quietly stop. It used to be omitted here on the reasoning that
+ * loopback is derivable — and it is not: the read listener sits one port above
+ * whatever `instance.port` says, so an endpoint on any port but the default
+ * printed a link the dashboard then read at `7338`, reported unreachable, and
+ * gave no way to correct. The page still treats a link with no `at=` as
+ * loopback on the default port, because every link minted before this is that
+ * shape.
+ *
+ * Exported for `pair.test.ts` and for nothing else. The whole of the defect
+ * above was a shape nothing asserted on, in a command whose output no test
+ * reads, so the fix is not worth much without something that fails when the
+ * address goes missing again.
+ */
+export function pairingLink(token: string, endpoint: string): string {
+  return `${DASHBOARD_URL}/dashboard/link#pair=${token}&at=${encodeURIComponent(endpoint)}`;
+}
+
+function isLoopback(host: string): boolean {
+  return host === '127.0.0.1' || host === 'localhost' || host === '::1';
+}

package/src/cli/commands/operate/policy.ts

@@ -1,6 +1,7 @@
 import { loadConfigFile } from '#profile';
+import { recordConfigChange } from '../../audit-change.ts';
 import { ConfigDocument } from '../../config-edit.ts';
-import { announce, announceProfile, heading, ok, print, style, table } from '../../output.ts';
+import { announce, announceProfile, heading, ok, print, style, table, warn } from '../../output.ts';
 import { resolveProfile, resolveProfileOnly, type GlobalFlags } from '../../runtime.ts';
 import { nextAfterEdit, publishProfileEdit } from '../../publish.ts';
 
@@ -15,56 +16,106 @@ export async function policyList(flags: GlobalFlags): Promise<void> {
   const { selection, config } = await resolveProfileOnly(flags);
   announceProfile(selection);
 
-  if (config.policy.allow.length === 0 && config.policy.deny.length === 0) {
-    print(style.dim('No rules. Default deny is in effect: nothing is reachable.'));
+  if (config.grants.length === 0) {
+    print(style.dim('No grants. Default deny is in effect: nothing is reachable.'));
     return;
   }
 
   const expiry = (rule: { capability: string; expires_at?: string | undefined }) =>
     rule.expires_at ? style.dim(`until ${rule.expires_at}`) : '';
 
-  if (config.policy.allow.length > 0) {
-    heading('Allow');
-    table(config.policy.allow.map((rule) => [`  ${style.green('+')}`, rule.capability, expiry(rule)]));
-  }
+  // Grouped by connection rather than by effect, which reverses how this used to
+  // read. A rule governs one account now (ADR-058), so "what may be done with
+  // the work mailbox" is the question the listing should answer in one place —
+  // and the old shape, two lists of capabilities with the account nowhere in
+  // them, could not answer it at all.
+  for (const grant of config.grants) {
+    heading(grant.connection);
+
+    if (grant.allow.length === 0 && grant.deny.length === 0) {
+      print(style.dim('  Granted nothing. The connection is reachable and no capability is.'));
+      continue;
+    }
 
-  if (config.policy.deny.length > 0) {
-    heading('Deny');
-    print(style.dim('  A deny beats any allow, whatever the order in the file.'));
-    table(config.policy.deny.map((rule) => [`  ${style.red('-')}`, rule.capability, expiry(rule)]));
+    table([
+      ...grant.allow.map((rule) => [`  ${style.green('+')}`, rule.capability, expiry(rule)]),
+      ...grant.deny.map((rule) => [`  ${style.red('-')}`, rule.capability, expiry(rule)]),
+    ]);
   }
 
   print('');
+  print(style.dim('A deny beats any allow on the same connection, whatever the order in the file.'));
   print(
-    style.dim('Rules cover every account of a provider. For different grants, use a second profile.'),
+    style.dim('A connection with no row above is not reachable at all, and is never advertised.'),
   );
 }
 
+export interface PolicyFlags extends GlobalFlags {
+  readonly connection?: string | undefined;
+}
+
 export async function policyRule(
   effect: 'allow' | 'deny',
   capability: string,
-  flags: GlobalFlags,
+  flags: PolicyFlags,
 ): Promise<void> {
   const { resolution, config, target } = await resolveProfile(flags);
-  const document = await ConfigDocument.open(resolution.workspaceRoot, resolution.profile);
 
-  if (config.policy[effect].some((rule) => rule.capability === capability)) {
-    print(style.dim(`${effect} ${capability} is already declared.`));
+  // Required, and refused rather than guessed. A rule has to land in a row, and
+  // with two mailboxes granted there is no answer to "which one" that is not a
+  // guess about which account the operator meant to widen.
+  const key = flags.connection;
+  if (key === undefined) {
+    throw new Error(
+      `--connection is required. A rule governs one connection (ADR-058).\n` +
+        (config.grants.length > 0
+          ? `  This profile grants: ${config.grants.map((grant) => grant.connection).join(', ')}`
+          : `  This profile grants nothing yet. Run: lanes link status --profile ${resolution.profile}`),
+    );
+  }
+
+  const index = config.grants.findIndex((grant) => grant.connection === key);
+  if (index === -1) {
+    throw new Error(
+      `Profile "${resolution.profile}" does not grant "${key}".\n` +
+        `  Grant it first, then narrow it:\n` +
+        `    lanes link grant ${key} --profile ${resolution.profile}`,
+    );
+  }
+
+  const grant = config.grants[index]!;
+  if (grant[effect].some((rule) => rule.capability === capability)) {
+    print(style.dim(`${effect} ${capability} on ${key} is already declared.`));
     return;
   }
 
+  const document = await ConfigDocument.open(resolution.workspaceRoot, resolution.profile);
+
   // A bare string, because that is what the file should read like. The object
   // form exists for `expires_at` and is not worth writing by default.
-  document.addTo(['policy', effect], capability, { inline: true });
-  // Validation runs before the write, so a rule naming a provider with no
-  // connection fails here rather than silently granting nothing at runtime.
+  document.addTo(['grants', index, effect], capability, { inline: true });
+  // Validation runs before the write, so a rule naming a provider other than the
+  // row's own fails here rather than matching nothing at runtime.
   await document.save();
 
+  await recordConfigChange(
+    config,
+    resolution.workspaceRoot,
+    target,
+    {
+      capability: effect === 'allow' ? 'config.policy.allow' : 'config.policy.deny',
+      scope: resolution.profile,
+      connection: key,
+      arguments: { capability },
+    },
+    (note) => print(warn(note)),
+  );
+
   announce(resolution);
-  print(ok(`${effect} ${style.bold(capability)}`));
+  print(ok(`${effect} ${style.bold(capability)} on ${style.bold(key)}`));
 
-  if (effect === 'deny' && config.policy.allow.some((rule) => rule.capability === '*')) {
-    print(style.dim('  This narrows the catch-all allow; a deny always wins.'));
+  if (effect === 'deny' && grant.allow.some((rule) => rule.capability === '*')) {
+    print(style.dim("  This narrows that row's catch-all allow; a deny always wins."));
   }
 
   // A deny the endpoint has not heard about is still granting what it names, so

package/src/cli/commands/operate/serve.ts

@@ -1,9 +1,11 @@
+import { readSession } from '#auth/lanes/session.ts';
+import { ConfigError } from '#profile';
 import { startEndpoint } from '#server/endpoint.ts';
 import { streamLogger } from '#server/logging.ts';
-import { repairOwnerLayer } from '../../config-repair.ts';
+import { repairOwnerLayer } from '../../config-repair-sweep.ts';
 import { announce, ok, print, style, warn } from '../../output.ts';
 import { staleNudge } from '../../release.ts';
-import { resolveProfile, type GlobalFlags } from '../../runtime.ts';
+import { primaryProfile, resolveProfile, type GlobalFlags } from '../../runtime.ts';
 
 /** `lanes link start` — reconcile, then serve every profile on one endpoint. */
 
@@ -14,9 +16,24 @@ export async function start(
     only?: boolean | undefined;
   },
 ): Promise<void> {
-  const { resolution } = await resolveProfile(flags);
+  // One endpoint serves every profile in the workspace, so the workspace is the
+  // subject and a profile is not required. What `--profile` picks is the
+  // *primary*: whose token opens the endpoint and whose port it binds (ADR-009).
+  // `--only` is the flag that narrows what is served, and it has nothing to
+  // narrow unless a profile was named.
+  if (flags.only === true && flags.profile === undefined) {
+    throw new ConfigError(
+      '--only serves one profile, so it needs to be told which.\n' +
+        '  Add --profile <name>, or drop --only to serve every profile in the workspace.',
+    );
+  }
+
+  const resolved = { ...flags, profile: await primaryProfile(flags) };
+  const { resolution } = await resolveProfile(resolved);
   announce(resolution);
 
+  await requireSignIn();
+
   // Before the bootstrap, and only here.
   //
   // This is the one command an existing install runs without being told to, so
@@ -41,7 +58,7 @@ export async function start(
   // entrypoint. What stays here is what a terminal wants: the plan, printed as
   // it is applied, and the endpoint at the end.
   const endpoint = await startEndpoint({
-    flags,
+    flags: resolved,
     port: flags.port,
     only: flags.only,
     mintToken: true,
@@ -56,7 +73,7 @@ export async function start(
         print(ok(`reconciled ${ofMany ? profile : ''}`.trim()));
       },
       tokenMinted({ target }) {
-        print(warn(`minted a token — run: lanes link outputs --show --target ${target}`));
+        print(warn(`minted a token — run: lanes link outputs --show --workspace ${target}`));
       },
     },
   });
@@ -81,3 +98,34 @@ export async function start(
 
   await new Promise(() => {});
 }
+
+/**
+ * Refuse to serve without a Lanes session.
+ *
+ * A local endpoint requires this as much as a deployed one does, which is the
+ * uncomfortable half of ADR-060 and worth stating plainly: **a self-hostable
+ * tool now needs an account to start.** The alternative was worse. A profile
+ * declares who may consume it, and there is no way to check that against
+ * anybody if the endpoint has no idea who is asking — so "local is exempt"
+ * means local profiles cannot express delegation at all, and the model would be
+ * two models.
+ *
+ * What is *not* required is the network per request. A machine offline for a
+ * day keeps serving; the session is needed to sign in and to refresh, and
+ * `lanes auth status` says how long that has left to run.
+ *
+ * The CI token is the exception and stays one (ADR-009): a headless runner has
+ * no browser, presents `llk_…`, and reaches the whole workspace.
+ */
+async function requireSignIn(): Promise<void> {
+  if ((await readSession()) !== null) return;
+
+  throw new ConfigError(
+    'Not signed in, so there is nobody for this endpoint to serve.\n' +
+      '  Run: lanes auth login\n' +
+      '\n' +
+      '  A profile reaches you only where its members list your subject, which is why\n' +
+      '  this is required for a local endpoint too. See:\n' +
+      '    lanes link profile members add --me --profile <name>',
+  );
+}

package/src/cli/commands/operate/status.ts

@@ -1,3 +1,4 @@
+import { wasDefaulted } from '../../selection-require.ts';
 import {
   isPointer,
   listProfiles,
@@ -11,7 +12,7 @@ import {
 import { oneProfile, visibleCapabilities } from '#server/mcp';
 import { toPolicyDocument } from '#registry';
 import { announce, emit, heading, print, style, table } from '../../output.ts';
-import { openRuntime, ownerPrincipal, type GlobalFlags } from '../../runtime.ts';
+import { grantedConnections, openRuntime, ownerPrincipal, type GlobalFlags } from '../../runtime.ts';
 import { deploymentIdentity } from '../../endpoint-url.ts';
 
 /** `lanes link status` — connections, what is reachable through them, and where. */
@@ -29,7 +30,7 @@ export interface StatusFlags extends GlobalFlags {
  *
  * Which is why a deployed target prints its *identity* rather than its address.
  * This used to print `http://<host>:<port>/mcp` unconditionally, so
- * `status --target cloud` named a loopback port with nothing behind it — the
+ * `status --workspace cloud` named a loopback port with nothing behind it — the
  * bug `endpoint-url.ts` records having already fixed in `mcp add`. Reaching for
  * `endpointUrl` here would fix the lie by surrendering the property above: it
  * shells out to `gcloud`, costs seconds, needs the CLI installed and
@@ -48,7 +49,7 @@ export async function status(flags: StatusFlags): Promise<void> {
     const records = await runtime.state.connections.list();
     const byKey = new Map(records.map((record) => [`${record.provider}.${record.id}`, record]));
 
-    const connections = runtime.config.connections.map((connection) => {
+    const connections = grantedConnections(runtime).map((connection) => {
       const key = `${connection.provider}.${connection.id}`;
       return {
         key,
@@ -142,7 +143,7 @@ export async function status(flags: StatusFlags): Promise<void> {
           print(
             style.dim(
               '  the address is the platform\'s to assign — run: ' +
-                `lanes link outputs --target ${runtime.target}`,
+                `lanes link outputs --workspace ${runtime.target}`,
             ),
           );
         }
@@ -197,12 +198,12 @@ async function workspaceStatus(flags: StatusFlags): Promise<void> {
     unreachable = error instanceof Error ? error.message : String(error);
   }
 
-  const root = resolved?.workspaceRoot ?? (isPointer(entry) ? entry.workspace : localRoot);
+  const root = resolved?.workspaceRoot ?? (isPointer(entry) ? entry.at : localRoot);
   const workspace = resolved ? await loadWorkspaceProfiles(root) : undefined;
 
   const profiles = (workspace?.loaded ?? []).map((loaded) => ({
     name: loaded.profile,
-    connections: loaded.config.connections.length,
+    grants: loaded.config.grants.length,
   }));
 
   const deployment = deploymentIdentity(resolved?.declared.deploy);
@@ -220,7 +221,14 @@ async function workspaceStatus(flags: StatusFlags): Promise<void> {
       unreadable: workspace?.unreadable ?? [],
     },
     () => {
-      print(style.dim(`workspace ${style.bold(root)}  target ${style.bold(target)}`));
+      // The same shape `announce` prints, including whether the workspace was
+      // typed or defaulted — a command that reported it differently would make
+      // ADR-061's echo a thing an operator has to learn twice.
+      print(
+        style.dim(
+          `workspace ${style.bold(target)}${wasDefaulted(target) ? ' (default)' : ''}  ${root}`,
+        ),
+      );
 
       if (unreachable !== undefined) {
         heading('Unreachable');
@@ -234,12 +242,12 @@ async function workspaceStatus(flags: StatusFlags): Promise<void> {
       heading('Profiles');
       if (profiles.length === 0) {
         print(style.dim('  None yet.'));
-        print(style.dim(`  Create one with: lanes link profile add <name> --target ${target}`));
+        print(style.dim(`  Create one with: lanes link profile add <name> --workspace ${target}`));
       } else {
         table(
           profiles.map((profile) => [
             `  ${style.bold(profile.name)}`,
-            style.dim(`${profile.connections} connection(s)`),
+            style.dim(`${profile.grants} grant(s)`),
           ]),
         );
       }
@@ -257,7 +265,7 @@ async function workspaceStatus(flags: StatusFlags): Promise<void> {
       print(
         style.dim(
           "  the address is the platform's to assign — run: " +
-            `lanes link outputs --target ${target} --profile ${profiles[0]?.name ?? '<name>'}`,
+            `lanes link outputs --workspace ${target} --profile ${profiles[0]?.name ?? '<name>'}`,
         ),
       );
     },

package/src/cli/commands/operate/tools.ts

@@ -50,7 +50,7 @@ export async function tools(flags: ToolsFlags): Promise<void> {
       {
         url,
         target: runtime.target,
-        // Both, because `--target cloud` reaching loopback is indistinguishable
+        // Both, because `--workspace cloud` reaching loopback is indistinguishable
         // from success without them.
         deployed: deployed !== null,
         answering: mine,
@@ -297,7 +297,7 @@ export function parse(text: string): Record<string, unknown> {
  * `capabilityIdForToolName` answers it exactly against a set of known ids, and
  * falls back to that first-underscore split when it recognises none — which is
  * reachable here, because the registry is the *invoking profile's* while the
- * endpoint may serve several, and under `--target cloud` may run an image this
+ * endpoint may serve several, and under `--workspace cloud` may run an image this
  * checkout does not have. So the fallback is detected rather than trusted: a
  * name that resolves to nothing known is grouped as unattributed, because a
  * guessed heading with a confident count is worse than an honest "these did not