@lanes-sh/link 0.9.0 → 0.9.1

package/README.md

@@ -12,10 +12,7 @@ that speaks MCP — reaches all of it through that one endpoint. Change your AI
 context, because none of it ever lived in the agent. Open source, self-hostable, no vendor in the
 middle of your data.
 
-<picture>
-  <source media="(prefers-color-scheme: dark)" srcset="docs/images/lanes-link-dark.svg">
-  <img alt="Claude, Codex, and Gemini all reach one Lanes Link endpoint, which you run yourself. Beneath it sit the profiles it serves: personal, holding Gmail, Memory, and Skills; and work, holding Gmail, Calendar, and Docs." src="docs/images/lanes-link-light.svg">
-</picture>
+![Left: every agent wired directly to every account, each line crossing the others. Right: the same three agents reaching one Lanes Link endpoint, which fans out to Gmail, GitHub, Slack, memory, skills, and a task list through an Access Profile named engineering.](docs/images/lanes-link-hero.png)
 
 ## Why
 
@@ -81,27 +78,6 @@ tool and worth stating plainly; what it is not is a dependency per request. The
 to sign in and to refresh, and a machine offline for a day keeps serving. `lanes link token
 show` still mints a static token for CI, which has no browser to sign in with.
 
-## In the Lanes desktop app
-
-Prefer not to use a terminal? The [Lanes desktop app](https://lanes.sh/desktop) drives this CLI from
-a settings page. **Settings → Integrations → Lanes Link** installs it, holds the profile and
-workspace every command runs against, starts and stops the endpoint, and registers it with Claude
-Code or Codex. From 0.8.0 your connections, profiles and audit log are on the
-[Lanes dashboard](https://lanes.sh/dashboard/link) instead, which reads your endpoint directly over
-loopback: run `lanes link pair` once to let it.
-
-![The Lanes Link page in the Lanes desktop app: the CLI status card and its version, the workspace and profile selectors, the endpoint row with its running state, and the list of connected accounts.](docs/images/lanes-link-desktop.png)
-
-It runs the commands above rather than reimplementing them, so consent and the token stay here where
-they belong, and an endpoint set up in the app is the same one you get from a shell. Available from
-Lanes v0.47.0, as a research preview.
-
-```console
-$ lanes link desktop     # opens the app on that page, installing it if it is not there
-```
-
-**[How to use it →](https://lanes.sh/docs/desktop/lanes-link)**
-
 ## What you keep in it
 
 Not "what your agent gets" — the distinction is the whole point. These are yours. An agent is a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanes-sh/link",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "A self-hostable MCP gateway for all your connections, memory, tasks, files, and secrets",
   "license": "Apache-2.0",
   "homepage": "https://lanes.sh/link",

package/src/cli/brand.ts

@@ -13,17 +13,19 @@
  * Values are transcribed from https://lanes.sh/design/foundations. The rules
  * they express, which the CSS below encodes rather than restates:
  *
- * - **Gold is the only accent.** "Gold for positive, neutral tokens otherwise."
- *   That is why there is no green here: a connection that works is `positive`,
- *   which is gold, and everything else is one of two neutrals. `--destructive`
- *   is for errors, not for a state that merely needs attention.
+ * - **Emerald is the only accent.** "Accent for positive, neutral tokens
+ *   otherwise." A connection that works is `positive`, which is the accent, and
+ *   everything else is one of two neutrals. `--destructive` is for errors, not
+ *   for a state that merely needs attention. The accent was gold until emerald
+ *   replaced it site-wide; there is still only one.
  * - **Two weights, 400 and 500.** Nothing else is available in the loaded faces,
  *   so a heavier rule would silently synthesise.
  * - **Lora heads, Geist speaks, Geist Mono for code and eyebrow labels.**
  *
- * `--border`, `--accent-gold` and `--destructive` are constant across themes.
- * Only the five neutrals swap, which is why the dark block below is five lines
- * rather than a second stylesheet.
+ * `--border` and `--destructive` are constant across themes. The five neutrals
+ * swap, and so does `--accent-brand`: the deep emerald goes illegible on the
+ * dark ground, so dark mode takes the brighter value. That is why the dark block
+ * below is six lines rather than a second stylesheet.
  */
 
 /**
@@ -61,7 +63,7 @@ export const FONTS =
 
 /** The one-row footer, identical to the one the Lanes API's own pages carry. */
 export const FOOTER =
-  '<div class="footer"><p>Your unfair advantage in parallel AI coding. ' +
+  '<div class="footer"><p>Run many agents at once. Connect them to your tools once - ' +
   '<a href="https://lanes.sh/">lanes.sh</a></p></div>';
 
 /**
@@ -85,13 +87,13 @@ export const TOKENS = `
   --foreground: #171717;
   --muted-foreground: #202329;
   --border: rgba(120,113,108,0.2);
-  --accent-gold: #A1845A;
+  --accent-brand: #059669;
   --destructive: #A06060;
   /* The two tints the badge variants need. Spelled as rgba rather than
      color-mix because the consent screen opens in whatever browser a phone
      happens to use, and both accents are constant across themes anyway. */
-  --gold-fill: rgba(161,132,90,0.1);
-  --gold-ring: rgba(161,132,90,0.25);
+  --brand-fill: rgba(5,150,105,0.1);
+  --brand-ring: rgba(5,150,105,0.25);
   --destructive-fill: rgba(160,96,96,0.1);
   --destructive-ring: rgba(160,96,96,0.25);
   --sans: "Geist", -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
@@ -105,6 +107,9 @@ export const TOKENS = `
     --muted: #202329;
     --foreground: #EBEAE7;
     --muted-foreground: #A8A29E;
+    --accent-brand: #34D399;
+    --brand-fill: rgba(52,211,153,0.1);
+    --brand-ring: rgba(52,211,153,0.25);
   }
 }
 * { box-sizing: border-box; }
@@ -124,21 +129,21 @@ a { color: inherit; }
 /* Surfaces are dashed and 10px; controls are 6px; pills are round. */
 .surface { background: var(--card); border: 1px dashed var(--border); border-radius: 10px; }
 
-/* The four badge variants, as the design system defines them: gold for
+/* The four badge variants, as the design system defines them: the accent for
    positive, neutral tokens otherwise, destructive for an error only. The ring
    is an inset shadow so it costs no layout, exactly as \`ring-inset\` does. */
 .pill { display: inline-flex; align-items: center; flex: none; white-space: nowrap;
         font-size: 11px; font-weight: 500; letter-spacing: 0.02em;
         padding: 2px 8px; border-radius: 999px; box-shadow: inset 0 0 0 1px var(--border); }
-.pill.positive { background: var(--gold-fill); color: var(--accent-gold);
-                 box-shadow: inset 0 0 0 1px var(--gold-ring); }
+.pill.positive { background: var(--brand-fill); color: var(--accent-brand);
+                 box-shadow: inset 0 0 0 1px var(--brand-ring); }
 .pill.neutral { background: var(--muted); color: var(--muted-foreground); }
 .pill.quiet { background: transparent; color: var(--muted-foreground); opacity: 0.7; }
 .pill.negative { background: var(--destructive-fill); color: var(--destructive);
                  box-shadow: inset 0 0 0 1px var(--destructive-ring); }
 
 /* Ghost is the variant every button on these pages is: muted until it is
-   wanted, and never gold, because gold is reserved for saying a thing is good. */
+   wanted, and never the accent, which is reserved for saying a thing is good. */
 .btn { font: inherit; font-size: 12px; font-weight: 500; line-height: 1;
        padding: 6px 9px; border-radius: 6px; cursor: pointer;
        background: transparent; color: var(--muted-foreground);

package/src/cli/callback-page.ts

@@ -16,11 +16,12 @@
  *   hardcoded `#0d1117` that read as a black rectangle on a light machine. The
  *   system names a background per mode, so the fix is now to paint the right
  *   one. `color-scheme` stays, for form controls and scrollbars.
- * - **The success mark is gold, not green.** It was lucide's `check` at
- *   `#059669`, chosen to match the tick the Lanes app puts against a connected
- *   integration. The design system is explicit that gold is the only accent and
- *   "gold for positive, neutral tokens otherwise", so the green was the odd one
- *   out rather than the match it was meant to be.
+ * - **The success mark carries the accent.** It is lucide's `check` at
+ *   `--accent-brand`, which matches the tick the Lanes app puts against a
+ *   connected integration. This went the long way round: the mark was `#059669`,
+ *   was changed to gold because the design system allowed one accent and gold
+ *   was it, and is emerald again now that emerald is that one accent. The rule
+ *   never moved, only the colour it points at.
  *
  * What has not changed is that colour is reserved for status and spent nowhere
  * else — not on emphasis, and not on the heading.
@@ -49,14 +50,14 @@ body { display: flex; align-items: center; justify-content: center;
 .label { margin: 0 0 6px; font-size: 15px; font-weight: 500; color: var(--muted-foreground); }
 h1 { margin: 0 0 18px; }
 .detail { margin: 0; font-size: 15px; line-height: 1.6; color: var(--muted-foreground); }
-.icon { display: block; margin: 0 auto 18px; color: var(--accent-gold); }
+.icon { display: block; margin: 0 auto 18px; color: var(--accent-brand); }
 .err h1 { color: var(--destructive); }
 `.trim();
 
 /**
  * The success mark, above the label.
  *
- * lucide's `check`, in `--accent-gold` — which is what "gold for positive"
+ * lucide's `check`, in `--accent-brand` - which is what "accent for positive"
  * means when the positive thing is a connection that now works. It carries no
  * colour of its own; `.icon` sets it, so it follows the token if the token moves.
  *

package/src/cli/config-repair-sweep.ts

@@ -1,4 +1,11 @@
-import { CONNECTIONS_FILE, listProfiles, workspaceFiles, writeWorkspaceFile } from '#profile';
+import {
+  CONNECTIONS_FILE,
+  listProfiles,
+  SUPPORTED_CONTRACT,
+  WORKSPACE_FILE,
+  workspaceFiles,
+  writeWorkspaceFile,
+} from '#profile';
 import { newConnectionsTemplate } from './config-templates.ts';
 import { ConfigDocument } from './config-edit.ts';
 import { ok, print, style, warn } from './output.ts';
@@ -14,6 +21,56 @@ import { DEFAULT_SURFACES, ensureOwnerLayer, repairLines, repaired } from './con
  * what to say when a profile will not open.
  */
 
+/**
+ * Stamp the registry with the contract the workspace is actually in.
+ *
+ * `renameRegistry` copies `lanes-link.yaml` to `workspaces.yaml` byte for byte,
+ * which is what makes an interruption survivable — but it carried the old
+ * `contract:` across with everything else, so a migrated workspace sat at 3
+ * while every profile in it said 4, and a workspace `profile add` created said
+ * 4 from the start. Two workspaces at the same contract disagreeing about which
+ * one they are in.
+ *
+ * Cosmetic in most commands, which read the profiles. Not in `isUnmigrated`
+ * (`src/profile/registry.ts`), the one place a registry's own contract is read:
+ * it compares against `SUPPORTED_CONTRACT` to tell a pointer at an out-of-date
+ * bucket from a pointer at the wrong target, so a stale stamp there answers a
+ * question about contract 4 with a refusal naming *contract 1* and sends the
+ * operator to a `deploy` that changes nothing.
+ *
+ * Called from the migration, so its output needs no repair, and from the sweep,
+ * for the workspaces 0.9.0 already migrated. One spelling, for the reason the
+ * template and `ensureOwnerLayer` share one: two would have to agree forever.
+ */
+export async function ensureRegistryContract(workspaceRoot: string): Promise<boolean> {
+  const files = workspaceFiles(workspaceRoot);
+  if (!(await files.has(WORKSPACE_FILE))) return false;
+
+  const document = await ConfigDocument.openKey(workspaceRoot, WORKSPACE_FILE);
+  if (document.getIn(['contract']) === SUPPORTED_CONTRACT) return false;
+
+  document.setIn(['contract'], SUPPORTED_CONTRACT);
+  await document.save();
+  return true;
+}
+
+/**
+ * The first line of an error that actually says something.
+ *
+ * `message.split('\n')[0]` was the whole of this, and a `ConfigError` from a
+ * schema failure is `<path>:\n  <field>: <reason>` — so the warning rendered as
+ * "could not give personal its owner layer: /…/personal.yaml:" and named no
+ * reason at all. Seen for real on an upgrade, twice, with nothing after the
+ * colon.
+ */
+function reasonOf(error: unknown): string {
+  if (!(error instanceof Error)) return String(error);
+
+  const lines = error.message.split('\n').map((line) => line.trim());
+  const said = lines.find((line) => line !== '' && !line.endsWith(':'));
+  return said ?? lines.find((line) => line !== '') ?? error.message;
+}
+
 /** `memory, tasks, assets, skills, vault, setup and entities`, in repair order. */
 function listSurfaces(): string {
   const names = [...DEFAULT_SURFACES];
@@ -109,11 +166,18 @@ export async function repairOwnerLayer(
     } catch (error) {
       say(
         warn(
-          `could not give ${name} its owner layer: ${error instanceof Error ? error.message.split('\n')[0] : String(error)}`,
+          `could not give ${name} its owner layer: ${reasonOf(error)}`,
         ),
       );
     }
   }
 
   if (connectionsChanged) await connections.save();
+
+  // After the profiles, so a workspace that could not be repaired is not told
+  // it is current. The stamp says what the workspace is; the profiles are what
+  // makes it true.
+  if (await ensureRegistryContract(workspaceRoot)) {
+    say(ok(`stamped ${style.bold(WORKSPACE_FILE)} as contract ${SUPPORTED_CONTRACT}`));
+  }
 }

package/src/cli/contract4.ts

@@ -14,6 +14,7 @@ import { ConfigDocument } from './config-edit.ts';
 import { C3 } from './contract3-layout.ts';
 import { grantingProfiles, planMoves, type DataPlan, type Renames } from './contract4-data.ts';
 import { planRenames } from './contract4-rename.ts';
+import { ensureRegistryContract } from './config-repair-sweep.ts';
 import {
   assertConnectionsSavable,
   readConnectionRows,
@@ -153,6 +154,12 @@ export async function migrateToContract4(
   }
 
   await renameRegistry(workspaceRoot);
+
+  // The registry's own stamp, which the byte-for-byte rename carries across
+  // unchanged. Here rather than inside `renameRegistry` because that function
+  // returns early on a workspace already holding `workspaces.yaml`, which is
+  // exactly the workspace whose stamp is stale.
+  await ensureRegistryContract(workspaceRoot);
   await applyMoves(files, plan.moves);
 
   // Credentials before the rows: a ref is derived from the id, so the rows must