@lanes-sh/link 0.9.0 → 0.9.2

package/README.md

@@ -12,10 +12,7 @@ that speaks MCP — reaches all of it through that one endpoint. Change your AI
 context, because none of it ever lived in the agent. Open source, self-hostable, no vendor in the
 middle of your data.
 
-<picture>
-  <source media="(prefers-color-scheme: dark)" srcset="docs/images/lanes-link-dark.svg">
-  <img alt="Claude, Codex, and Gemini all reach one Lanes Link endpoint, which you run yourself. Beneath it sit the profiles it serves: personal, holding Gmail, Memory, and Skills; and work, holding Gmail, Calendar, and Docs." src="docs/images/lanes-link-light.svg">
-</picture>
+![Left: every agent wired directly to every account, each line crossing the others. Right: the same three agents reaching one Lanes Link endpoint, which fans out to Gmail, GitHub, Slack, memory, skills, and a task list through an Access Profile named engineering.](docs/images/lanes-link-hero.png)
 
 ## Why
 
@@ -81,27 +78,6 @@ tool and worth stating plainly; what it is not is a dependency per request. The
 to sign in and to refresh, and a machine offline for a day keeps serving. `lanes link token
 show` still mints a static token for CI, which has no browser to sign in with.
 
-## In the Lanes desktop app
-
-Prefer not to use a terminal? The [Lanes desktop app](https://lanes.sh/desktop) drives this CLI from
-a settings page. **Settings → Integrations → Lanes Link** installs it, holds the profile and
-workspace every command runs against, starts and stops the endpoint, and registers it with Claude
-Code or Codex. From 0.8.0 your connections, profiles and audit log are on the
-[Lanes dashboard](https://lanes.sh/dashboard/link) instead, which reads your endpoint directly over
-loopback: run `lanes link pair` once to let it.
-
-![The Lanes Link page in the Lanes desktop app: the CLI status card and its version, the workspace and profile selectors, the endpoint row with its running state, and the list of connected accounts.](docs/images/lanes-link-desktop.png)
-
-It runs the commands above rather than reimplementing them, so consent and the token stay here where
-they belong, and an endpoint set up in the app is the same one you get from a shell. Available from
-Lanes v0.47.0, as a research preview.
-
-```console
-$ lanes link desktop     # opens the app on that page, installing it if it is not there
-```
-
-**[How to use it →](https://lanes.sh/docs/desktop/lanes-link)**
-
 ## What you keep in it
 
 Not "what your agent gets" — the distinction is the whole point. These are yours. An agent is a

package/instructions/agents/lanes-link-scout.md

@@ -38,10 +38,10 @@ then a narrower fragment, before concluding something is not there.
 Tasks are worth the second look rather than an afterthought: an open one is often
 the actual answer to "what do we already know about X", and it carries something
 memory cannot — that the matter is unfinished. Say so when it is, and say which
-status: *blocked since June* is a different answer from *open*. `tasks.list`
+status: *blocked since June* is a different answer from *open*. `lanes_tasks_list`
 hides finished work by default, so ask for `done` when the question is historical.
 
-**Assets are a listing, not a corpus.** `assets.list` tells you a file exists,
+**Assets are a listing, not a corpus.** `lanes_assets_list` tells you a file exists,
 its type and its size; only a text one reads back. Report that a document is
 there and let the main thread decide what to do with it — do not try to get at
 the contents of a binary, and never ask for it as base64.
@@ -67,7 +67,7 @@ to every future session.
 stops a write is policy on the endpoint:
 
 ```console
-$ lanes link policy deny memory.write --connection memory.main --profile <name> --workspace <name>
+$ lanes link policy deny lanes_memory.write --connection lanes_memory.lan1 --profile <name> --workspace <name>
 $ lanes link policy list --profile <name> --workspace <name>
 ```
 

package/instructions/skills/lanes-link/SKILL.md

@@ -43,6 +43,12 @@ workspace*. A profile lives in exactly one, so `personal` on `local` and
 `personal` on `cloud` are two profiles that share a name rather than one profile
 in two places.
 
+**A profile owns its data.** Two profiles granting the same connection — every
+profile grants `lanes_memory.lan1` — still read and write different notes,
+tasks, files and entities, because the profile is part of where they are kept.
+So there is nothing to be found in one by asking another, and a note taken under
+`work` is not available under `personal`.
+
 **What a command must be told is never inferred from a profile — but the
 workspace may have a default.** `lanes set-workspace <name>` writes one, every
 command that uses it echoes the name it resolved, and the commands where being
@@ -74,12 +80,19 @@ disagree with it.
 When you write a command out for the owner, fill in what that command needs or
 leave it as `<name>` for them to complete — never drop a required one.
 
-A `connection` names an account the profile grants. One profile may grant
-several of the same kind and govern each differently, so `gmail.work` may be
-readable where `gmail.personal` is writable. Naming a connection the profile does
-not grant is refused rather than guessed at, and a connection it does not grant
-is absent from the enum entirely: if you cannot see it there, it was not
-withheld by accident.
+A `connection` names an account the profile grants, and it is a **fully
+qualified** `<provider>.<id>` — `lanes_memory.lan1`, not `lan1`. The bare id is
+refused, so take the value out of the enum rather than assembling one.
+
+Ids are opaque: `con1`, `con2` for accounts and `lan1`, `lan2` for Lanes' own
+surfaces. They carry no meaning and are not worth guessing at — the enum prints
+each one's account and label beside it, and that is what tells `con1` from
+`con2`. One profile may grant several of the same kind and govern each
+differently, so `gmail.con1` may be readable where `gmail.con2` is writable.
+
+Naming a connection the profile does not grant is refused rather than guessed
+at, and one it does not grant is absent from the enum entirely: if you cannot
+see it there, it was not withheld by accident.
 
 ## Which store a thing goes in
 
@@ -107,7 +120,7 @@ when Y", that is a skill they should write, not a memory entry describing it.
 
 ## Reach for memory before answering from nothing
 
-`lanes_memory.search` before concluding you do not know something about this person or
+`lanes_memory_search` before concluding you do not know something about this person or
 their work. It is a substring search over their own notes, not a ranked index —
 try more than one wording before deciding it is not there.
 
@@ -118,7 +131,7 @@ entries with `lanes link memory list --profile <name> --workspace <name>` and a
 
 ## Tasks have a status, so finish them rather than deleting them
 
-`lanes_tasks.list` answers what is outstanding. It shows `in_progress`, `open` and
+`lanes_tasks_list` answers what is outstanding. It shows `in_progress`, `open` and
 `blocked` and hides the rest, so a listing is what is left to do rather than
 everything that ever was — name a status to see more.
 
@@ -133,7 +146,7 @@ Six of them, and the two that are easy to confuse are worth learning:
 | `done` | finished |
 | `dropped` | decided against, which is not the same as finished |
 
-**Closing a task is `lanes_tasks.update` with a status, never `lanes_tasks.remove`.** The
+**Closing a task is `lanes_tasks_update` with a status, never `lanes_tasks_remove`.** The
 record of having done it is the useful half, and it is what stops the same thing
 being suggested again next week. Remove is for something recorded by mistake.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanes-sh/link",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "A self-hostable MCP gateway for all your connections, memory, tasks, files, and secrets",
   "license": "Apache-2.0",
   "homepage": "https://lanes.sh/link",

package/src/cli/brand.ts

@@ -13,17 +13,19 @@
  * Values are transcribed from https://lanes.sh/design/foundations. The rules
  * they express, which the CSS below encodes rather than restates:
  *
- * - **Gold is the only accent.** "Gold for positive, neutral tokens otherwise."
- *   That is why there is no green here: a connection that works is `positive`,
- *   which is gold, and everything else is one of two neutrals. `--destructive`
- *   is for errors, not for a state that merely needs attention.
+ * - **Emerald is the only accent.** "Accent for positive, neutral tokens
+ *   otherwise." A connection that works is `positive`, which is the accent, and
+ *   everything else is one of two neutrals. `--destructive` is for errors, not
+ *   for a state that merely needs attention. The accent was gold until emerald
+ *   replaced it site-wide; there is still only one.
  * - **Two weights, 400 and 500.** Nothing else is available in the loaded faces,
  *   so a heavier rule would silently synthesise.
  * - **Lora heads, Geist speaks, Geist Mono for code and eyebrow labels.**
  *
- * `--border`, `--accent-gold` and `--destructive` are constant across themes.
- * Only the five neutrals swap, which is why the dark block below is five lines
- * rather than a second stylesheet.
+ * `--border` and `--destructive` are constant across themes. The five neutrals
+ * swap, and so does `--accent-brand`: the deep emerald goes illegible on the
+ * dark ground, so dark mode takes the brighter value. That is why the dark block
+ * below is six lines rather than a second stylesheet.
  */
 
 /**
@@ -61,7 +63,7 @@ export const FONTS =
 
 /** The one-row footer, identical to the one the Lanes API's own pages carry. */
 export const FOOTER =
-  '<div class="footer"><p>Your unfair advantage in parallel AI coding. ' +
+  '<div class="footer"><p>Run many agents at once. Connect them to your tools once - ' +
   '<a href="https://lanes.sh/">lanes.sh</a></p></div>';
 
 /**
@@ -85,13 +87,13 @@ export const TOKENS = `
   --foreground: #171717;
   --muted-foreground: #202329;
   --border: rgba(120,113,108,0.2);
-  --accent-gold: #A1845A;
+  --accent-brand: #059669;
   --destructive: #A06060;
   /* The two tints the badge variants need. Spelled as rgba rather than
      color-mix because the consent screen opens in whatever browser a phone
      happens to use, and both accents are constant across themes anyway. */
-  --gold-fill: rgba(161,132,90,0.1);
-  --gold-ring: rgba(161,132,90,0.25);
+  --brand-fill: rgba(5,150,105,0.1);
+  --brand-ring: rgba(5,150,105,0.25);
   --destructive-fill: rgba(160,96,96,0.1);
   --destructive-ring: rgba(160,96,96,0.25);
   --sans: "Geist", -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
@@ -105,6 +107,9 @@ export const TOKENS = `
     --muted: #202329;
     --foreground: #EBEAE7;
     --muted-foreground: #A8A29E;
+    --accent-brand: #34D399;
+    --brand-fill: rgba(52,211,153,0.1);
+    --brand-ring: rgba(52,211,153,0.25);
   }
 }
 * { box-sizing: border-box; }
@@ -124,21 +129,21 @@ a { color: inherit; }
 /* Surfaces are dashed and 10px; controls are 6px; pills are round. */
 .surface { background: var(--card); border: 1px dashed var(--border); border-radius: 10px; }
 
-/* The four badge variants, as the design system defines them: gold for
+/* The four badge variants, as the design system defines them: the accent for
    positive, neutral tokens otherwise, destructive for an error only. The ring
    is an inset shadow so it costs no layout, exactly as \`ring-inset\` does. */
 .pill { display: inline-flex; align-items: center; flex: none; white-space: nowrap;
         font-size: 11px; font-weight: 500; letter-spacing: 0.02em;
         padding: 2px 8px; border-radius: 999px; box-shadow: inset 0 0 0 1px var(--border); }
-.pill.positive { background: var(--gold-fill); color: var(--accent-gold);
-                 box-shadow: inset 0 0 0 1px var(--gold-ring); }
+.pill.positive { background: var(--brand-fill); color: var(--accent-brand);
+                 box-shadow: inset 0 0 0 1px var(--brand-ring); }
 .pill.neutral { background: var(--muted); color: var(--muted-foreground); }
 .pill.quiet { background: transparent; color: var(--muted-foreground); opacity: 0.7; }
 .pill.negative { background: var(--destructive-fill); color: var(--destructive);
                  box-shadow: inset 0 0 0 1px var(--destructive-ring); }
 
 /* Ghost is the variant every button on these pages is: muted until it is
-   wanted, and never gold, because gold is reserved for saying a thing is good. */
+   wanted, and never the accent, which is reserved for saying a thing is good. */
 .btn { font: inherit; font-size: 12px; font-weight: 500; line-height: 1;
        padding: 6px 9px; border-radius: 6px; cursor: pointer;
        background: transparent; color: var(--muted-foreground);

package/src/cli/callback-page.ts

@@ -16,11 +16,12 @@
  *   hardcoded `#0d1117` that read as a black rectangle on a light machine. The
  *   system names a background per mode, so the fix is now to paint the right
  *   one. `color-scheme` stays, for form controls and scrollbars.
- * - **The success mark is gold, not green.** It was lucide's `check` at
- *   `#059669`, chosen to match the tick the Lanes app puts against a connected
- *   integration. The design system is explicit that gold is the only accent and
- *   "gold for positive, neutral tokens otherwise", so the green was the odd one
- *   out rather than the match it was meant to be.
+ * - **The success mark carries the accent.** It is lucide's `check` at
+ *   `--accent-brand`, which matches the tick the Lanes app puts against a
+ *   connected integration. This went the long way round: the mark was `#059669`,
+ *   was changed to gold because the design system allowed one accent and gold
+ *   was it, and is emerald again now that emerald is that one accent. The rule
+ *   never moved, only the colour it points at.
  *
  * What has not changed is that colour is reserved for status and spent nowhere
  * else — not on emphasis, and not on the heading.
@@ -49,14 +50,14 @@ body { display: flex; align-items: center; justify-content: center;
 .label { margin: 0 0 6px; font-size: 15px; font-weight: 500; color: var(--muted-foreground); }
 h1 { margin: 0 0 18px; }
 .detail { margin: 0; font-size: 15px; line-height: 1.6; color: var(--muted-foreground); }
-.icon { display: block; margin: 0 auto 18px; color: var(--accent-gold); }
+.icon { display: block; margin: 0 auto 18px; color: var(--accent-brand); }
 .err h1 { color: var(--destructive); }
 `.trim();
 
 /**
  * The success mark, above the label.
  *
- * lucide's `check`, in `--accent-gold` — which is what "gold for positive"
+ * lucide's `check`, in `--accent-brand` - which is what "accent for positive"
  * means when the positive thing is a connection that now works. It carries no
  * colour of its own; `.icon` sets it, so it follows the token if the token moves.
  *

package/src/cli/commands/mcp/register.ts

@@ -45,6 +45,41 @@ export interface McpAddOptions extends GlobalFlags {
   readonly headless?: boolean | undefined;
 }
 
+/**
+ * What to say about the token, which depends on whether one was actually stored.
+ *
+ * **`token`, not `harness.storesToken`.** The harness property says the client
+ * *can* hold a token; whether one was passed is a different question, and only
+ * the headless path passes one — the ordinary path registers the bare URL and
+ * lets the client discover the protected-resource document and run the
+ * authorization itself. Keyed on the property, this told an operator who had
+ * just registered against a deployed endpoint that "the token was stored" and
+ * that a rotate meant re-registering, when nothing had been stored and a rotate
+ * would not touch that entry at all.
+ *
+ * A separate function so the decision can be tested without spawning a client
+ * binary, which is the only reason the branch above it cannot be.
+ */
+export function tokenNote(
+  harness: { readonly storesToken: boolean; readonly label: string },
+  token: string | undefined,
+): readonly string[] {
+  if (!harness.storesToken) return [];
+
+  if (token) {
+    return [
+      'The token was stored as a value, not a command, so "lanes link token rotate"',
+      'means running this again with --force.',
+    ];
+  }
+
+  return [
+    `No token was stored: ${harness.label} reads the endpoint's own`,
+    'protected-resource document and signs you in. A "lanes link token rotate"',
+    'does not affect this registration.',
+  ];
+}
+
 export async function mcpAdd(target: string | undefined, options: McpAddOptions): Promise<void> {
   // No harness named: every one that is actually installed. Registering with
   // whatever is present is what someone means by "add my mcp", and naming one
@@ -174,14 +209,7 @@ async function register(
 
   if (!options.noSkill) await installFor(harness, input.scope, {});
 
-  if (harness.storesToken) {
-    print(
-      style.dim(
-        '      The token was stored as a value, not a command, so "lanes link token rotate"\n' +
-          '      means running this again with --force.',
-      ),
-    );
-  }
+  for (const line of tokenNote(harness, input.token)) print(style.dim(`      ${line}`));
 
   const after = harness.afterAdd?.(input);
   if (after) {

package/src/cli/config-repair-sweep.ts

@@ -1,4 +1,11 @@
-import { CONNECTIONS_FILE, listProfiles, workspaceFiles, writeWorkspaceFile } from '#profile';
+import {
+  CONNECTIONS_FILE,
+  listProfiles,
+  SUPPORTED_CONTRACT,
+  WORKSPACE_FILE,
+  workspaceFiles,
+  writeWorkspaceFile,
+} from '#profile';
 import { newConnectionsTemplate } from './config-templates.ts';
 import { ConfigDocument } from './config-edit.ts';
 import { ok, print, style, warn } from './output.ts';
@@ -14,6 +21,56 @@ import { DEFAULT_SURFACES, ensureOwnerLayer, repairLines, repaired } from './con
  * what to say when a profile will not open.
  */
 
+/**
+ * Stamp the registry with the contract the workspace is actually in.
+ *
+ * `renameRegistry` copies `lanes-link.yaml` to `workspaces.yaml` byte for byte,
+ * which is what makes an interruption survivable — but it carried the old
+ * `contract:` across with everything else, so a migrated workspace sat at 3
+ * while every profile in it said 4, and a workspace `profile add` created said
+ * 4 from the start. Two workspaces at the same contract disagreeing about which
+ * one they are in.
+ *
+ * Cosmetic in most commands, which read the profiles. Not in `isUnmigrated`
+ * (`src/profile/registry.ts`), the one place a registry's own contract is read:
+ * it compares against `SUPPORTED_CONTRACT` to tell a pointer at an out-of-date
+ * bucket from a pointer at the wrong target, so a stale stamp there answers a
+ * question about contract 4 with a refusal naming *contract 1* and sends the
+ * operator to a `deploy` that changes nothing.
+ *
+ * Called from the migration, so its output needs no repair, and from the sweep,
+ * for the workspaces 0.9.0 already migrated. One spelling, for the reason the
+ * template and `ensureOwnerLayer` share one: two would have to agree forever.
+ */
+export async function ensureRegistryContract(workspaceRoot: string): Promise<boolean> {
+  const files = workspaceFiles(workspaceRoot);
+  if (!(await files.has(WORKSPACE_FILE))) return false;
+
+  const document = await ConfigDocument.openKey(workspaceRoot, WORKSPACE_FILE);
+  if (document.getIn(['contract']) === SUPPORTED_CONTRACT) return false;
+
+  document.setIn(['contract'], SUPPORTED_CONTRACT);
+  await document.save();
+  return true;
+}
+
+/**
+ * The first line of an error that actually says something.
+ *
+ * `message.split('\n')[0]` was the whole of this, and a `ConfigError` from a
+ * schema failure is `<path>:\n  <field>: <reason>` — so the warning rendered as
+ * "could not give personal its owner layer: /…/personal.yaml:" and named no
+ * reason at all. Seen for real on an upgrade, twice, with nothing after the
+ * colon.
+ */
+function reasonOf(error: unknown): string {
+  if (!(error instanceof Error)) return String(error);
+
+  const lines = error.message.split('\n').map((line) => line.trim());
+  const said = lines.find((line) => line !== '' && !line.endsWith(':'));
+  return said ?? lines.find((line) => line !== '') ?? error.message;
+}
+
 /** `memory, tasks, assets, skills, vault, setup and entities`, in repair order. */
 function listSurfaces(): string {
   const names = [...DEFAULT_SURFACES];
@@ -109,11 +166,18 @@ export async function repairOwnerLayer(
     } catch (error) {
       say(
         warn(
-          `could not give ${name} its owner layer: ${error instanceof Error ? error.message.split('\n')[0] : String(error)}`,
+          `could not give ${name} its owner layer: ${reasonOf(error)}`,
         ),
       );
     }
   }
 
   if (connectionsChanged) await connections.save();
+
+  // After the profiles, so a workspace that could not be repaired is not told
+  // it is current. The stamp says what the workspace is; the profiles are what
+  // makes it true.
+  if (await ensureRegistryContract(workspaceRoot)) {
+    say(ok(`stamped ${style.bold(WORKSPACE_FILE)} as contract ${SUPPORTED_CONTRACT}`));
+  }
 }

package/src/cli/contract4.ts

@@ -14,6 +14,7 @@ import { ConfigDocument } from './config-edit.ts';
 import { C3 } from './contract3-layout.ts';
 import { grantingProfiles, planMoves, type DataPlan, type Renames } from './contract4-data.ts';
 import { planRenames } from './contract4-rename.ts';
+import { ensureRegistryContract } from './config-repair-sweep.ts';
 import {
   assertConnectionsSavable,
   readConnectionRows,
@@ -153,6 +154,12 @@ export async function migrateToContract4(
   }
 
   await renameRegistry(workspaceRoot);
+
+  // The registry's own stamp, which the byte-for-byte rename carries across
+  // unchanged. Here rather than inside `renameRegistry` because that function
+  // returns early on a workspace already holding `workspaces.yaml`, which is
+  // exactly the workspace whose stamp is stale.
+  await ensureRegistryContract(workspaceRoot);
   await applyMoves(files, plan.moves);
 
   // Credentials before the rows: a ref is derived from the id, so the rows must

package/src/deployments/adapters/audit-blob.ts

@@ -59,6 +59,25 @@ const TAIL_YEAR_WINDOW = 10;
 
 const MARKER_PREFIX = 'runs.closed/';
 
+/**
+ * Whether a key is something this store wrote, rather than something the OS did.
+ *
+ * `verify` enumerates the whole prefix and feeds every non-marker key to the
+ * chain, so a `.DS_Store` that Finder dropped in the audit directory arrived as
+ * a record, failed to decode, and was reported as `malformed run ? at seq -1` —
+ * the whole log **BROKEN** because somebody opened the folder. Seen on a real
+ * workspace, where the file had ridden through two contract migrations.
+ *
+ * A dotfile is the narrowest rule that covers it: no key this store writes
+ * begins with a dot, in either segment. Deliberately not "does it look like an
+ * event" — a corrupt event must still fail loudly, because reporting `ok` for a
+ * record it could not read is the one thing `verify` must never do.
+ */
+function isOurs(key: string): boolean {
+  return !key.split('/').some((segment) => segment.startsWith('.'));
+}
+
+
 export interface BlobAuditOptions {
   /** Scoped to the audit root — `data/<profile>/audit.log` or its bucket prefix. */
   readonly storage: BlobStore;
@@ -113,7 +132,7 @@ export function createBlobAuditStore(options: BlobAuditOptions): AuditStore {
       for (let year = start; year >= floor && found.length < limit; year -= 1) {
         const keys = (await storage.list(`${year}/`))
           .map((entry) => entry.key)
-          .filter((key) => !key.startsWith(MARKER_PREFIX))
+          .filter((key) => !key.startsWith(MARKER_PREFIX) && isOurs(key))
           // Keys are compact ISO within a day and the day is in the path, so
           // lexicographic order is chronological — no parsing to sort.
           .sort((a, b) => (a < b ? 1 : a > b ? -1 : 0));
@@ -160,6 +179,8 @@ export function createBlobAuditStore(options: BlobAuditOptions): AuditStore {
       const markers: RunMarker[] = [];
 
       for (const entry of await storage.list('')) {
+        if (!isOurs(entry.key)) continue;
+
         const bytes = await storage.get(entry.key);
         if (bytes === null) continue;