@lanes-sh/link 0.7.2 → 0.9.0

package/src/cli/commands/operate.ts

@@ -11,6 +11,7 @@
  *   outputs.ts   what an agent harness needs, and proving the short form works
  *   desktop.ts   opening the Lanes app, on the page that drives this CLI
  *   serve.ts     start
+ *   pair.ts      pair — the dashboard's read surface (ADR-063)
  *   audit.ts     audit tail and verify, and the Markdown rendering of tail
  *   token.ts     token show, token rotate
  *   policy.ts    policy list/allow/deny, config show
@@ -25,6 +26,7 @@ export { status } from './operate/status.ts';
 export { outputs, type OutputsFlags } from './operate/outputs.ts';
 export { tools, type ToolsFlags } from './operate/tools.ts';
 export { start } from './operate/serve.ts';
+export { pair, PAIR_CERT_REF, PAIR_KEY_REF, PAIR_TOKEN_REF, type PairFlags } from './operate/pair.ts';
 export { desktop, settingsUrl, type DesktopFlags } from './operate/desktop.ts';
 export { auditTail, auditVerify, markdownCell } from './operate/audit.ts';
 export { attachFile } from './operate/attach.ts';

package/src/cli/commands/owner/assets.ts

@@ -127,6 +127,6 @@ export async function assetsRemove(name: string | undefined, flags: OwnerFlags):
  * it is built from the same two functions rather than spelled as a path.
  */
 export function assetsStore(runtime: Runtime, flags: OwnerFlags): BlobStore {
-  const connection = ownerConnection(runtime.config, 'assets', flags);
-  return scopeBlobStore(runtime.storage, scopeNamespace('assets', connection));
+  const connection = ownerConnection(runtime.config, 'lanes_assets', flags);
+  return scopeBlobStore(runtime.storage, scopeNamespace('lanes_assets', connection));
 }

package/src/cli/commands/owner/entities.ts

@@ -239,6 +239,6 @@ export async function entitiesReindex(flags: OwnerFlags): Promise<void> {
  * `memoryStore` gives: a path spelled out again is a path that can differ.
  */
 export function entitiesStore(runtime: Runtime, flags: OwnerFlags): BlobStore {
-  const connection = ownerConnection(runtime.config, 'entities', flags);
-  return scopeBlobStore(runtime.storage, scopeNamespace('entities', connection));
+  const connection = ownerConnection(runtime.config, 'lanes_entities', flags);
+  return scopeBlobStore(runtime.storage, scopeNamespace('lanes_entities', connection));
 }

package/src/cli/commands/owner/memory.ts

@@ -105,6 +105,6 @@ export async function memoryForget(id: string | undefined, flags: OwnerFlags): P
  * again, so the CLI cannot address a different directory from the provider.
  */
 export function memoryStore(runtime: Runtime, flags: OwnerFlags): BlobStore {
-  const connection = ownerConnection(runtime.config, 'memory', flags);
-  return scopeBlobStore(runtime.storage, scopeNamespace('memory', connection));
+  const connection = ownerConnection(runtime.config, 'lanes_memory', flags);
+  return scopeBlobStore(runtime.storage, scopeNamespace('lanes_memory', connection));
 }

package/src/cli/commands/owner/shared.ts

@@ -73,7 +73,15 @@ export async function withRuntime(
  * the candidates rather than picking.
  */
 export function ownerConnection(config: Config, provider: string, flags: OwnerFlags): string {
-  const candidates = config.connections.filter((connection) => connection.provider === provider);
+  // Derived from the grants, not from the workspace's connections. The question
+  // is which store *this profile* may reach, and a workspace holding
+  // `memory.acme` that this profile does not grant is not a candidate — offering
+  // it would let the CLI write somewhere the endpoint would refuse to read
+  // (ADR-057, ADR-058).
+  const prefix = `${provider}.`;
+  const candidates = config.grants
+    .filter((grant) => grant.connection.startsWith(prefix))
+    .map((grant) => ({ id: grant.connection.slice(prefix.length) }));
 
   if (flags.connection) {
     const match = candidates.find((connection) => connection.id === flags.connection);
@@ -90,7 +98,10 @@ export function ownerConnection(config: Config, provider: string, flags: OwnerFl
 
   if (candidates.length === 0) {
     throw new ConfigError(
-      `This profile has no ${provider} connection. Add one with: lanes link connect ${provider}`,
+      `This profile grants no ${provider} connection.\n` +
+        `  Connect one to the workspace, then grant it:\n` +
+        `    lanes link connect ${provider}\n` +
+        `    lanes link grant ${provider}.<id> --profile ${config.instance.profile}`,
     );
   }
   if (candidates.length > 1) {

package/src/cli/commands/owner/skills.ts

@@ -1,4 +1,5 @@
-import { ConfigError } from '#profile';
+import { ConfigError, type Config } from '#profile';
+import type { BlobStore } from '#stores/blobs';
 import {
   loadProfileSkills,
   readSkill,
@@ -10,9 +11,28 @@ import { agreed, readStdin, required, withRuntime, type OwnerFlags } from './sha
 
 /** `lanes link skills` — the reusable procedures agents can invoke. */
 
+/**
+ * The store, or a refusal naming why there is none.
+ *
+ * A profile grants at most one `skills` connection and may grant none
+ * (ADR-059), so `store(runtime)` is genuinely absent rather than empty. The two
+ * are worth telling apart: "you have no skills" invites writing one, and
+ * "this profile is not granted skills" is a config fact the operator has to fix
+ * before writing one would do anything.
+ */
+function store(runtime: { skills: BlobStore | undefined; config: Config }): BlobStore {
+  if (runtime.skills) return runtime.skills;
+  throw new ConfigError(
+    `Profile "${runtime.config.instance.profile}" grants no skills connection.\n` +
+      `  Grant one, then try again:\n` +
+      `    lanes link grant skills.main --profile ${runtime.config.instance.profile}`,
+  );
+}
+
+
 export async function skillsList(flags: OwnerFlags): Promise<void> {
   await withRuntime(flags, async (runtime) => {
-    const skills = await loadProfileSkills(runtime.skills);
+    const skills = await loadProfileSkills(store(runtime));
 
     heading(`Skills (${skills.length})`);
     if (skills.length === 0) {
@@ -43,10 +63,10 @@ export async function skillsShow(name: string | undefined, flags: OwnerFlags): P
   const skillName = required(name, 'lanes link skills show <name>');
 
   await withRuntime(flags, async (runtime) => {
-    const skill = await readSkill(runtime.skills, skillName);
+    const skill = await readSkill(store(runtime), skillName);
     if (!skill) throw new ConfigError(`No skill "${skillName}" in this workspace.`);
 
-    const bytes = await runtime.skills.get(skill.path);
+    const bytes = await store(runtime).get(skill.path);
     print('');
     print(bytes ? new TextDecoder().decode(bytes) : skill.body);
   });
@@ -63,8 +83,8 @@ export async function skillsAdd(name: string | undefined, flags: OwnerFlags): Pr
       );
 
   await withRuntime(flags, async (runtime) => {
-    const existing = await readSkill(runtime.skills, skillName);
-    const skill = await writeSkill(runtime.skills, skillName, text);
+    const existing = await readSkill(store(runtime), skillName);
+    const skill = await writeSkill(store(runtime), skillName, text);
 
     print(ok(`${existing ? 'replaced' : 'added'} skill ${style.bold(skill.name)}`));
     print(
@@ -79,14 +99,14 @@ export async function skillsRemove(name: string | undefined, flags: OwnerFlags):
   const skillName = required(name, 'lanes link skills remove <name>');
 
   await withRuntime(flags, async (runtime) => {
-    const skill = await readSkill(runtime.skills, skillName);
+    const skill = await readSkill(store(runtime), skillName);
     if (!skill) throw new ConfigError(`No skill "${skillName}" in this workspace.`);
 
     print(`  ${style.bold(skill.name)}  ${skill.description}`);
     print(style.dim(`  ${skill.path}`));
     if (!(await agreed(flags, 'Remove this skill?'))) return;
 
-    await removeSkill(runtime.skills, skillName);
+    await removeSkill(store(runtime), skillName);
     print(ok(`removed skill ${style.bold(skillName)}`));
   });
 }

package/src/cli/commands/owner/tasks.ts

@@ -189,6 +189,6 @@ function assertStatus(raw: string | undefined): TaskStatus | undefined {
  * CLI cannot address a different directory from the provider.
  */
 export function tasksStore(runtime: Runtime, flags: OwnerFlags): BlobStore {
-  const connection = ownerConnection(runtime.config, 'tasks', flags);
-  return scopeBlobStore(runtime.storage, scopeNamespace('tasks', connection));
+  const connection = ownerConnection(runtime.config, 'lanes_tasks', flags);
+  return scopeBlobStore(runtime.storage, scopeNamespace('lanes_tasks', connection));
 }

package/src/cli/commands/owner/vault.ts

@@ -50,7 +50,7 @@ export async function vaultGet(id: string | undefined, flags: OwnerFlags): Promi
   const itemId = required(id, 'lanes link vault get <id> [--show]');
 
   await withRuntime(flags, async (runtime) => {
-    const connection = ownerConnection(runtime.config, 'vault', flags);
+    const connection = ownerConnection(runtime.config, 'lanes_vault', flags);
     const item = await runtime.vault.get(connection, itemId);
     if (!item) throw new ConfigError(`No vault item "${itemId}" in this profile.`);
 
@@ -77,7 +77,7 @@ export async function vaultSet(id: string | undefined, flags: OwnerFlags): Promi
   const value = await readStdin(`lanes link vault set ${itemId}`, 'the secret');
 
   await withRuntime(flags, async (runtime) => {
-    const connection = ownerConnection(runtime.config, 'vault', flags);
+    const connection = ownerConnection(runtime.config, 'lanes_vault', flags);
     const replacing = (await runtime.vault.get(connection, itemId)) !== null;
 
     await runtime.vault.put(connection, {
@@ -104,7 +104,7 @@ export async function vaultRemove(id: string | undefined, flags: OwnerFlags): Pr
   const itemId = required(id, 'lanes link vault remove <id>');
 
   await withRuntime(flags, async (runtime) => {
-    const connection = ownerConnection(runtime.config, 'vault', flags);
+    const connection = ownerConnection(runtime.config, 'lanes_vault', flags);
     const item = await runtime.vault.get(connection, itemId);
     if (!item) throw new ConfigError(`No vault item "${itemId}" in this profile.`);
 

package/src/cli/commands/profile/disposition.ts

@@ -0,0 +1,236 @@
+import { ConfigError } from '#profile';
+import type { Prompter } from '../../prompt.ts';
+
+/**
+ * What becomes of the bytes a removed profile owns.
+ *
+ * Split from `removal.ts` and `remove.ts` on the seam the question already has:
+ * both files grew past the size budget when this arrived, and it is one
+ * decision — asked once, answered once, and then applied by the plan and the
+ * execution without either re-deciding anything.
+ */
+
+/**
+ * What to do with the bytes a profile owns.
+ *
+ * There has to be an answer and there is no safe default, which is why this is
+ * a discriminated choice rather than a flag with a fallback. Deleting by
+ * default destroys the material somebody kept; migrating by default puts one
+ * profile's notes into another without being asked, which is the thing ADR-066
+ * exists to stop happening by accident.
+ */
+export type Disposition =
+  | { readonly kind: 'delete' }
+  | { readonly kind: 'migrate'; readonly into: string };
+
+/**
+ * `note.md` becomes `note-2.md`, before the extension rather than after it.
+ *
+ * An asset's key is whatever the file was called, and `note.md-2` is a file
+ * nothing will open. Memory entries and tasks are `<id>.md`, so the same rule
+ * keeps the id readable.
+ */
+export function suffixed(key: string, taken: (candidate: string) => boolean): string {
+  const dot = key.lastIndexOf('.');
+  const cut = dot <= key.lastIndexOf('/') ? key.length : dot;
+  const [stem, extension] = [key.slice(0, cut), key.slice(cut)];
+
+  for (let n = 2; ; n += 1) {
+    const candidate = `${stem}-${n}${extension}`;
+    if (!taken(candidate)) return candidate;
+  }
+}
+
+/**
+ * What to do with the bytes, decided before anything is planned.
+ *
+ * **`--yes` does not imply a disposition.** Everything else `--yes` skips is a
+ * confirmation of something the command was already told to do; this is a
+ * question it has not been asked, and picking either answer silently is a way
+ * to lose somebody's notes — or to put them somewhere they did not ask for
+ * them, which under ADR-066 is the failure the whole change exists to prevent.
+ * So a non-interactive caller must say, and one that does not is refused with
+ * both spellings named.
+ */
+export async function settleDisposition(
+  profile: string,
+  flags: { readonly deleteData?: boolean | undefined; readonly migrateTo?: string | undefined },
+  prompter: Prompter,
+  someoneToAsk: boolean,
+): Promise<Disposition | null> {
+  if (flags.migrateTo !== undefined && flags.deleteData === true) {
+    throw new ConfigError(
+      '--delete-data and --migrate-to say opposite things about the same bytes. Pass one.',
+    );
+  }
+
+  if (flags.migrateTo !== undefined) return { kind: 'migrate', into: flags.migrateTo };
+  if (flags.deleteData === true) return { kind: 'delete' };
+
+  if (!someoneToAsk) {
+    throw new ConfigError(
+      `"${profile}" owns memory, tasks, assets and skills, and this does not guess at what ` +
+        'becomes of them.\n' +
+        '  Say which: --delete-data, or --migrate-to <profile>',
+    );
+  }
+
+  const answer = (
+    await prompter.ask(
+      `What becomes of ${profile}'s memory, tasks, assets and skills?\n` +
+        `  [d] delete them   [m] move them into another profile   [anything else] stop: `,
+    )
+  ).trim().toLowerCase();
+
+  if (answer === 'd') return { kind: 'delete' };
+  if (answer !== 'm') return null;
+
+  const into = (await prompter.ask('  Move them into which profile? ')).trim();
+  return into.length === 0 ? null : { kind: 'migrate', into };
+}
+
+
+/**
+ * The skill a key belongs to, or null when the key is not a skill's.
+ *
+ * Both layouts: `<name>/SKILL.md` and whatever it ships beside it, and the flat
+ * `<name>.md`.
+ */
+export function skillNameIn(key: string): string | null {
+  const parts = key.split('/');
+  if (parts[0] !== 'skills.d' || parts.length < 3) return null;
+
+  const third = parts[2]!;
+  return parts.length > 3 ? third : third.replace(/\.md$/, '');
+}
+
+/**
+ * Two skills of one name have no union either, so this refuses like the vault.
+ *
+ * A skill's name is not a filename — it becomes the capability id
+ * `skills.<name>`, which is what a policy rule grants and what an MCP prompt is
+ * called. So the suffix that resolves a colliding note resolves nothing here: a
+ * skill arriving as `proc-b-2` is granted by no rule the destination holds and
+ * offered to no client, which is `refuseSealedVault`'s argument — a copy under a
+ * name no command opens — reached by a different route. Renaming only the
+ * directory is worse still, because the frontmatter keeps declaring the old
+ * name: two skills then claim one capability id and `skills list` refuses for
+ * the whole profile rather than for the one skill.
+ *
+ * Which of the two to keep is a decision about the operator's procedures, and
+ * they are the only one who can make it.
+ */
+export function refuseCollidingSkill(into: string, name: string): never {
+  throw new ConfigError(
+    `"${into}" already has a skill named "${name}", and the one arriving cannot take another ` +
+      `name: it becomes the capability id "skills.${name}", which policy rules grant and MCP ` +
+      'prompts are called by.\n' +
+      `  Rename one of the two first — lanes link skills show ${name} --profile ${into} — then ` +
+      'run this again, or remove the profile with --delete-data.',
+  );
+}
+
+/**
+ * Rename anything the destination already holds, before a byte moves.
+ *
+ * Resolved while this is still a plan, so the operator sees every rename in the
+ * preview they confirm from and the execution has no decision left to make. A
+ * destination that is occupied holds the *destination profile's* own note, task
+ * or asset — overwriting one would be the quiet half of a migration nobody
+ * asked for, and merging two is not a thing bytes can do.
+ *
+ * Mutates `items` in place because the caller is still assembling the plan;
+ * the warnings come back for it to attach.
+ */
+export async function resolveCollisions(
+  items: { kind: string; movedTo?: readonly [string, string]; note?: string }[],
+  profile: string,
+  into: string,
+  open: (area: string) => Promise<{ list(): Promise<{ key: string }[]> }>,
+): Promise<string[]> {
+  const warnings: string[] = [];
+
+  // **Throws rather than warning.** It returned a warning saying "nothing has
+  // run" and then left every `movedTo` in place — and `executeRemoval` writes
+  // each one without checking, on the stated ground that "a collision was
+  // resolved while this was still a plan". With `--yes` there is no prompt to
+  // stop at, so an unreadable destination meant the destination profile's own
+  // notes were overwritten by the removed profile's files of the same name, and
+  // the command reported success. A plan that cannot be made safe must not
+  // become one.
+  let held: Set<string>;
+  try {
+    held = new Set((await (await open(into)).list()).map((blob) => blob.key));
+  } catch (cause) {
+    throw new ConfigError(
+      `"${profile}"'s storage could not be read (${
+        cause instanceof Error ? cause.message : String(cause)
+      }), so a name it already holds cannot be found — and migrating into it ` +
+        'would overwrite one.\n  Nothing has run. Fix the store and try again, or pass ' +
+        '--delete-data instead.',
+    );
+  }
+
+  for (let index = 0; index < items.length; index += 1) {
+    const item = items[index]!;
+    if (item.kind !== 'blob' || item.movedTo === undefined) continue;
+
+    const key = item.movedTo[1];
+    if (!held.has(key)) {
+      held.add(key);
+      continue;
+    }
+
+    // Before the suffix, because for one kind of key there is no suffix that
+    // works and the answer is to stop rather than to invent one.
+    const skill = skillNameIn(key);
+    if (skill !== null) refuseCollidingSkill(profile, skill);
+
+    const renamed = suffixed(key, (candidate) => held.has(candidate));
+    held.add(renamed);
+    items[index] = {
+      ...item,
+      movedTo: [into, renamed] as const,
+      note: `renamed — ${profile} already holds ${key}`,
+    };
+    warnings.push(`${key} is already in "${profile}", so it arrives as ${renamed}.`);
+  }
+
+  return warnings;
+}
+
+/**
+ * Whether one key inside a profile's directory can cross into another profile.
+ *
+ * Only the owner's material can. The prompt asks about memory, tasks, assets
+ * and skills; the directory holds two more things and neither may travel.
+ *
+ * `state.kv/` is derived and disposable, and adopting it would hand the
+ * destination another profile's cursor — resuming a mailbox from a position it
+ * never read and never seeing the messages in between, which is the
+ * cross-profile cursor sharing ADR-066 exists to remove.
+ *
+ * `vault.d/` is refused by `refuseSealedVault` rather than copied. Because the
+ * owner layer merges to one row per surface, both profiles hold
+ * `vault.d/lan5.enc` — so a copy always collided, landed as `lan5-2.enc`, and
+ * had its source deleted, leaving every item in it unreachable by any command.
+ */
+export function migratesAcross(key: string): boolean {
+  return !key.startsWith('state.kv/') && !key.startsWith('vault.d/');
+}
+
+/**
+ * Two sealed documents have no union, so the command says so and stops.
+ *
+ * Deleting one silently is the outcome nobody would accept, and a copy under
+ * another name is one no command opens — so neither is offered. The refusal
+ * names the two ways forward, which is the rule every refusal here follows.
+ */
+export function refuseSealedVault(profile: string, into: string): never {
+  throw new ConfigError(
+    `"${profile}" holds a sealed vault, and a vault cannot be merged into "${into}"'s: two ` +
+      'encrypted documents have no union, and a copy under another name is one no command opens.\n' +
+      `  Move what you need first — lanes link vault list --profile ${profile} — then remove it ` +
+      'with --delete-data.',
+  );
+}