@lanes-sh/link 0.8.0 → 0.9.1

package/src/cli/commands/secrets.ts

@@ -44,8 +44,8 @@ export async function secretsPush(flags: SecretsFlags): Promise<void> {
   const { selection, config } = await resolveProfileOnly(flags);
   announceProfile(selection);
 
-  const source = await openSecretStoreFor(config, selection.workspaceRoot, flags.from);
-  const destination = await openSecretStoreFor(config, selection.workspaceRoot, flags.to);
+  const source = await openSecretStoreFor(selection.workspaceRoot, flags.from);
+  const destination = await openSecretStoreFor(selection.workspaceRoot, flags.to);
 
   const refs = await source.list();
   if (refs.length === 0) {
@@ -143,7 +143,7 @@ export async function secretsSet(ref: string | undefined, flags: GlobalFlags): P
     );
   }
 
-  const credentials = await openSecretStoreFor(config, resolution.workspaceRoot, target);
+  const credentials = await openSecretStoreFor(resolution.workspaceRoot, target);
   const replacing = await credentials.has(ref);
   await credentials.set(ref, value);
 
@@ -165,7 +165,7 @@ export async function secretsList(flags: GlobalFlags): Promise<void> {
   });
   announceWorkspace(resolution);
 
-  const credentials = await openSecretStoreFor(config, resolution.workspaceRoot, target);
+  const credentials = await openSecretStoreFor(resolution.workspaceRoot, target);
   const refs = await credentials.list();
 
   heading(`Credential references in workspace ${target} (${refs.length})`);

package/src/cli/commands/update-migration.ts

@@ -0,0 +1,54 @@
+import type { Contract3Migration } from '../contract3.ts';
+import type { Contract4Migration } from '../contract4.ts';
+
+/**
+ * What each contract migration did, as `update` reports it.
+ *
+ * Split from `update.ts` so that file stays inside the size budget, and on the
+ * seam it already had: that file decides *whether* to migrate and this says
+ * *what happened*. Kept beside it rather than beside the migrations, because
+ * `doctor --fix` renders the same facts its own way and the two are allowed to
+ * read differently — what they may not do is disagree about which of them is
+ * worth mentioning.
+ */
+
+/**
+ * What contract 4 did, and the one part of it that is the operator's.
+ *
+ * `update` reported nothing, so the shared-store duplication happened in
+ * silence — a decision the migration calls the owner's, and which `doctor --fix`
+ * prints. Two paths disagreeing on that is how one becomes the wrong one to run.
+ */
+export function sayContract4(migration: Contract4Migration, say: (line: string) => void): void {
+  say(
+    `migrated ${migration.profiles.length} profile(s) to contract 4 — a profile owns its data ` +
+      'again, and Lanes\u2019 own surfaces are lanes_memory, lanes_tasks and the rest',
+  );
+  for (const change of migration.changes) say(`  ${change}`);
+
+  if (migration.shared.length > 0) {
+    say('  A store more than one profile granted was copied into each, and the original kept.');
+    say('  Deleting what you do not want is the one step here that is yours.');
+  }
+
+  if (migration.orphaned.length > 0) {
+    say('  What no profile grants was left exactly where it is, and named above.');
+  }
+
+  say('  Every registered client caches its tool list, so re-add them: lanes link mcp add');
+}
+
+export function sayContract3(migration: Contract3Migration, say: (line: string) => void): void {
+  say(
+    `migrated ${migration.profiles.length} profile(s) to contract 3 — connections belong to the ` +
+      'workspace now, and a profile grants them one by one',
+  );
+  for (const change of migration.changes) say(`  ${change}`);
+
+  if (migration.renames.length > 0) {
+    say('  Two profiles named different accounts with the same id, so one was renamed.');
+    say('  Check the grants in each profile before running an agent against them.');
+  }
+
+  say(`  The old per-profile credential stores are left in place; remove them once this works.`);
+}

package/src/cli/commands/update.ts

@@ -1,9 +1,11 @@
 import { homedir } from 'node:os';
 import { join, sep } from 'node:path';
 import { installRoot, resolveWorkspaceRoot } from '#profile';
-import { repairOwnerLayer } from '../config-repair.ts';
-import { migrateToCurrentContract, type ContractMigration } from '../workspace-migrate.ts';
-import type { Contract3Migration } from '../contract3.ts';
+import { repairOwnerLayer } from '../config-repair-sweep.ts';
+import { migrateToCurrentContract, needsMigration, type ContractMigration } from '../workspace-migrate.ts';
+import { needsContract3, type Contract3Migration } from '../contract3.ts';
+import { needsContract4 } from '../contract4.ts';
+import { sayContract3, sayContract4 } from './update-migration.ts';
 import { emit, fail, ok, print, printErr, progress, style, warn } from '../output.ts';
 import { PACKAGE, release, type ReleaseState } from '../release.ts';
 import { version } from '../version.ts';
@@ -184,11 +186,17 @@ export async function update(flags: UpdateFlags): Promise<void> {
     // a contract it does not implement until someone redeploys. `deploy` is what
     // migrates a bucket, because it is the command that ships the image in the
     // same breath.
-    await migrateLocal(root, flags.json === true ? progress : print);
-
-    await repairOwnerLayer(root, undefined, {
-      ...(flags.json === true ? { report: progress } : {}),
-    });
+    const migrated = await migrateLocal(root, flags.json === true ? progress : print);
+
+    // Only on a workspace that is actually at the current contract — see
+    // `migrateLocal`. The repair writes contract-3 shapes, and writing them
+    // after a refusal that said nothing had been written is what left a stray
+    // `connections.yaml` in a contract-2 workspace.
+    if (migrated) {
+      await repairOwnerLayer(root, undefined, {
+        ...(flags.json === true ? { report: progress } : {}),
+      });
+    }
   }
 
   const report = {
@@ -315,22 +323,8 @@ async function runInstall(argv: readonly string[], json: boolean): Promise<boole
  * fifteen accounts were merged into one store should see that happen rather than
  * discover it from a directory listing.
  */
-function sayContract3(migration: Contract3Migration, say: (line: string) => void): void {
-  say(
-    `migrated ${migration.profiles.length} profile(s) to contract 3 — connections belong to the ` +
-      'workspace now, and a profile grants them one by one',
-  );
-  for (const change of migration.changes) say(`  ${change}`);
-
-  if (migration.renames.length > 0) {
-    say('  Two profiles named different accounts with the same id, so one was renamed.');
-    say('  Check the grants in each profile before running an agent against them.');
-  }
-
-  say(`  The old per-profile credential stores are left in place; remove them once this works.`);
-}
 
-async function migrateLocal(root: string, say: (line: string) => void): Promise<void> {
+async function migrateLocal(root: string, say: (line: string) => void): Promise<boolean> {
   try {
     // One call, both steps, in order — a workspace that predates both walks
     // through them rather than jumping, so each step's reasoning applies to the
@@ -347,11 +341,30 @@ async function migrateLocal(root: string, say: (line: string) => void): Promise<
 
     if (migration.legacy) sayLegacyTargets(migration.legacy, say);
     if (migration.contract3) sayContract3(migration.contract3, say);
+    if (migration.contract4) sayContract4(migration.contract4, say);
+    return true;
   } catch (error) {
     say(`could not migrate this workspace: ${error instanceof Error ? error.message : String(error)}`);
+
+    // **Still behind, not "something threw".** Keying the repair on the throw
+    // suppressed it for the whole workspace when one profile failed to
+    // migrate — so the others, already current, never received a newly shipped
+    // surface, which is the case `update` runs the repair for at all. One
+    // unreadable profile is a per-profile warning, which the repair already
+    // gives it.
+    const behind = await stillBehind(root);
+    if (behind) say('  the owner-layer repair is skipped until it does');
+    return !behind;
   }
 }
 
+/** Anything still below the current contract. Unreadable counts as behind. */
+function stillBehind(root: string): Promise<boolean> {
+  return needsMigration(root)
+    .then(async (one) => one || (await needsContract3(root)) || (await needsContract4(root)))
+    .catch(() => true);
+}
+
 /** Contract 1 to contract 2: targets move from the profile to the workspace. */
 function sayLegacyTargets(
   migration: NonNullable<ContractMigration['legacy']>,

package/src/cli/config-edit.ts

@@ -1,9 +1,10 @@
 import { rename, writeFile } from 'node:fs/promises';
-import { Document, parseDocument, type Node } from 'yaml';
+import { Document, parseDocument, YAMLSeq, type Node } from 'yaml';
 import {
   CONNECTIONS_FILE,
   ConfigError,
   WORKSPACE_FILE,
+  LEGACY_WORKSPACE_FILE,
   workspaceSchema,
   assertConnectionsUnique,
   connectionsFileSchema,
@@ -15,6 +16,7 @@ import {
   validateConfigShape,
   workspaceFiles,
   writeWorkspaceFile,
+  layout,
 } from '#profile';
 
 /**
@@ -42,9 +44,13 @@ function validateDocument(
   raw: unknown,
   path: string,
   key: string | undefined,
-  options: { shapeOnly?: boolean },
+  options: { shapeOnly?: boolean; contract?: number },
 ): void {
-  if (key === WORKSPACE_FILE) {
+  // Either name. The contract-3 migration rewrites the registry under the name
+  // it still has, and a document checked against the wrong schema fails with
+  // "instance: expected object" — which reads as a corrupt profile rather than
+  // as a registry being validated as one.
+  if (key === WORKSPACE_FILE || key === LEGACY_WORKSPACE_FILE) {
     const parsed = workspaceSchema.safeParse(raw);
     if (!parsed.success) {
       throw new ConfigError(
@@ -74,8 +80,10 @@ function validateDocument(
     return;
   }
 
-  if (options.shapeOnly === true) validateConfigShape(raw, path);
-  else validateConfig(raw, path);
+  // `contract` is the one a migration is *producing*, and it is only ever
+  // passed by one: every other caller writes the newest.
+  if (options.shapeOnly === true) validateConfigShape(raw, path, options.contract);
+  else validateConfig(raw, path, options.contract);
 }
 
 export class ConfigDocument {
@@ -101,7 +109,7 @@ export class ConfigDocument {
    * `gs://` URL produces something that addresses nothing.
    */
   static async open(workspaceRoot: string, profile: string): Promise<ConfigDocument> {
-    return ConfigDocument.openKey(workspaceRoot, `profiles/${profile}.yaml`);
+    return ConfigDocument.openKey(workspaceRoot, layout.profileConfig(profile));
   }
 
   /**
@@ -199,7 +207,20 @@ export class ConfigDocument {
     // difference decided whether a command explained itself or crashed.
     const existing = this.#document.getIn(path as (string | number)[]);
     if (existing === undefined || existing === null) {
-      this.#document.setIn(path as (string | number)[], [node]);
+      // A `YAMLSeq` rather than the plain `[node]` this used to set. The array
+      // is not a collection the document API will traverse — the same hazard
+      // `setIn` above documents — so the *first* append landed and the second
+      // found a value with no `.add` and threw `existing.add is not a
+      // function`. `#expand` below reads `.items` and was silently a no-op for
+      // the same reason, leaving the sequence in flow style.
+      //
+      // Latent until contract 3: every path this was called with
+      // (`connections`, `policy.allow`) already existed, so the branch ran at
+      // most once per document. `grants:` is genuinely absent on a profile
+      // being repaired, which is what made the second append reachable.
+      const created = new YAMLSeq();
+      created.add(node);
+      this.#document.setIn(path as (string | number)[], created);
     } else {
       (existing as { add(item: unknown): void }).add(node);
     }
@@ -262,7 +283,7 @@ export class ConfigDocument {
    * The half it keeps is the half that matters for a write: the schema, and the
    * scan that stops a credential value being written into config.
    */
-  async save(options: { shapeOnly?: boolean } = {}): Promise<void> {
+  async save(options: { shapeOnly?: boolean; contract?: number } = {}): Promise<void> {
     const rendered = this.toString();
 
     // Throws on any validation failure, including a credential value that has

package/src/cli/config-repair-sweep.ts

@@ -0,0 +1,183 @@
+import {
+  CONNECTIONS_FILE,
+  listProfiles,
+  SUPPORTED_CONTRACT,
+  WORKSPACE_FILE,
+  workspaceFiles,
+  writeWorkspaceFile,
+} from '#profile';
+import { newConnectionsTemplate } from './config-templates.ts';
+import { ConfigDocument } from './config-edit.ts';
+import { ok, print, style, warn } from './output.ts';
+import { DEFAULT_SURFACES, ensureOwnerLayer, repairLines, repaired } from './config-repair.ts';
+
+/**
+ * Applying the owner-layer repair across a whole workspace.
+ *
+ * Split from `config-repair.ts` when that file outgrew the budget, on the seam
+ * it already had: that file decides what one profile is missing, and this one
+ * walks the workspace applying it. The decision is a pure function of two
+ * documents and is tested as one; the sweep is all filesystem, ordering and
+ * what to say when a profile will not open.
+ */
+
+/**
+ * Stamp the registry with the contract the workspace is actually in.
+ *
+ * `renameRegistry` copies `lanes-link.yaml` to `workspaces.yaml` byte for byte,
+ * which is what makes an interruption survivable — but it carried the old
+ * `contract:` across with everything else, so a migrated workspace sat at 3
+ * while every profile in it said 4, and a workspace `profile add` created said
+ * 4 from the start. Two workspaces at the same contract disagreeing about which
+ * one they are in.
+ *
+ * Cosmetic in most commands, which read the profiles. Not in `isUnmigrated`
+ * (`src/profile/registry.ts`), the one place a registry's own contract is read:
+ * it compares against `SUPPORTED_CONTRACT` to tell a pointer at an out-of-date
+ * bucket from a pointer at the wrong target, so a stale stamp there answers a
+ * question about contract 4 with a refusal naming *contract 1* and sends the
+ * operator to a `deploy` that changes nothing.
+ *
+ * Called from the migration, so its output needs no repair, and from the sweep,
+ * for the workspaces 0.9.0 already migrated. One spelling, for the reason the
+ * template and `ensureOwnerLayer` share one: two would have to agree forever.
+ */
+export async function ensureRegistryContract(workspaceRoot: string): Promise<boolean> {
+  const files = workspaceFiles(workspaceRoot);
+  if (!(await files.has(WORKSPACE_FILE))) return false;
+
+  const document = await ConfigDocument.openKey(workspaceRoot, WORKSPACE_FILE);
+  if (document.getIn(['contract']) === SUPPORTED_CONTRACT) return false;
+
+  document.setIn(['contract'], SUPPORTED_CONTRACT);
+  await document.save();
+  return true;
+}
+
+/**
+ * The first line of an error that actually says something.
+ *
+ * `message.split('\n')[0]` was the whole of this, and a `ConfigError` from a
+ * schema failure is `<path>:\n  <field>: <reason>` — so the warning rendered as
+ * "could not give personal its owner layer: /…/personal.yaml:" and named no
+ * reason at all. Seen for real on an upgrade, twice, with nothing after the
+ * colon.
+ */
+function reasonOf(error: unknown): string {
+  if (!(error instanceof Error)) return String(error);
+
+  const lines = error.message.split('\n').map((line) => line.trim());
+  const said = lines.find((line) => line !== '' && !line.endsWith(':'));
+  return said ?? lines.find((line) => line !== '') ?? error.message;
+}
+
+/** `memory, tasks, assets, skills, vault, setup and entities`, in repair order. */
+function listSurfaces(): string {
+  const names = [...DEFAULT_SURFACES];
+  const last = names.pop();
+  return names.length === 0 ? String(last) : `${names.join(', ')} and ${last}`;
+}
+
+/** The workspace's connections document, written from the template if missing. */
+async function openOrCreateConnections(workspaceRoot: string): Promise<ConfigDocument> {
+  try {
+    return await ConfigDocument.openKey(workspaceRoot, CONNECTIONS_FILE);
+  } catch {
+    await writeWorkspaceFile(
+      workspaceFiles(workspaceRoot),
+      CONNECTIONS_FILE,
+      newConnectionsTemplate(),
+    );
+    return ConfigDocument.openKey(workspaceRoot, CONNECTIONS_FILE);
+  }
+}
+
+/**
+ * Apply that repair across a workspace, saving and reporting what changed.
+ *
+ * Here rather than in `#deployments`, where it was, because `start` needs it as
+ * much as `deploy` does — more, in fact: `start` is the one command an existing
+ * install runs without being asked to, so it is the path by which a profile
+ * written before ADR-050 gets the layer at all. Two copies of a function that
+ * widens a policy is not a thing to have.
+ *
+ * **The caller scopes it**, and for `deploy` that is exactly the set being
+ * uploaded: a profile it sends is a profile the endpoint will serve, so
+ * repairing a narrower set would leave a served profile without the surfaces.
+ * Note what a `--profile` flag does not mean — it is the flag alone, so a
+ * profile resolved from the environment leaves it undefined and that reads as
+ * the whole workspace.
+ *
+ * *Which files are profiles* comes from `listProfiles`, never from an allowlist
+ * of what is safe to copy: that would happily hand over a committed
+ * `personal.example.yaml` or a nested `profiles/archive/old.yaml`, and this
+ * opens and validates what it is given — which once turned a template into a
+ * `ConfigError` aborting a deploy after provisioning had made cloud resources.
+ *
+ * A profile that cannot be read is warned about rather than fatal: the repair is
+ * a courtesy on the way past, and the caller's real work should still happen.
+ * Not silent, though — nothing else widens a policy without being asked.
+ *
+ * CLI-side by construction, like everything else in this file: a deployed
+ * revision holds `objectViewer` on `profiles/` (ADR-023) and could not write
+ * this even if the code let it.
+ */
+export async function repairOwnerLayer(
+  workspaceRoot: string,
+  profiles: readonly string[] | undefined,
+  options: { report?: (line: string) => void } = {},
+): Promise<void> {
+  // stdout by default, because every caller but one is printing a report a
+  // person reads. `update --json` passes `progress` instead: what it produces is
+  // a document, and a line of prose in front of it corrupts whatever is parsing.
+  // Routed rather than silenced — nothing else here widens a policy without
+  // saying so, and this must not be the exception.
+  const say = options.report ?? print;
+  const wanted = profiles === undefined ? undefined : new Set(profiles);
+
+  // One connections document for the whole sweep. The owner layer is the
+  // workspace's now (ADR-059), so repairing three profiles must not add three
+  // `memory.main` rows — opening it once and saving it once is what makes the
+  // second profile see what the first one created.
+  // Created if absent rather than refused. A contract-3 workspace always has
+  // one, but a hand-made or half-migrated one may not — and this is the repair,
+  // so the file it needs is a thing to write rather than a reason to stop.
+  const connections = await openOrCreateConnections(workspaceRoot);
+  let connectionsChanged = false;
+
+  for (const name of await listProfiles(workspaceRoot)) {
+    if (wanted !== undefined && !wanted.has(name)) continue;
+
+    try {
+      const document = await ConfigDocument.open(workspaceRoot, name);
+      const repair = ensureOwnerLayer(connections, document);
+      if (!repaired(repair)) continue;
+
+      connectionsChanged = true;
+      await document.save();
+
+      say(ok(`gave ${style.bold(name)} its own owner layer`));
+      for (const change of repairLines(repair)) say(`      ${style.dim(change)}`);
+      // Built from `DEFAULT_SURFACES` rather than typed out. The typed-out
+      // version still named six after a seventh had been added, so a person
+      // watching a deploy was told entities had arrived on the line above and
+      // that the layer was six things on the line below.
+      say(`      ${style.dim(`${listSurfaces()} — your own material, no account behind any of them`)}`);
+    } catch (error) {
+      say(
+        warn(
+          `could not give ${name} its owner layer: ${reasonOf(error)}`,
+        ),
+      );
+    }
+  }
+
+  if (connectionsChanged) await connections.save();
+
+  // After the profiles, so a workspace that could not be repaired is not told
+  // it is current. The stamp says what the workspace is; the profiles are what
+  // makes it true.
+  if (await ensureRegistryContract(workspaceRoot)) {
+    say(ok(`stamped ${style.bold(WORKSPACE_FILE)} as contract ${SUPPORTED_CONTRACT}`));
+  }
+}