@lanes-sh/link 0.9.1 → 0.9.2

package/instructions/agents/lanes-link-scout.md

@@ -38,10 +38,10 @@ then a narrower fragment, before concluding something is not there.
 Tasks are worth the second look rather than an afterthought: an open one is often
 the actual answer to "what do we already know about X", and it carries something
 memory cannot — that the matter is unfinished. Say so when it is, and say which
-status: *blocked since June* is a different answer from *open*. `tasks.list`
+status: *blocked since June* is a different answer from *open*. `lanes_tasks_list`
 hides finished work by default, so ask for `done` when the question is historical.
 
-**Assets are a listing, not a corpus.** `assets.list` tells you a file exists,
+**Assets are a listing, not a corpus.** `lanes_assets_list` tells you a file exists,
 its type and its size; only a text one reads back. Report that a document is
 there and let the main thread decide what to do with it — do not try to get at
 the contents of a binary, and never ask for it as base64.
@@ -67,7 +67,7 @@ to every future session.
 stops a write is policy on the endpoint:
 
 ```console
-$ lanes link policy deny memory.write --connection memory.main --profile <name> --workspace <name>
+$ lanes link policy deny lanes_memory.write --connection lanes_memory.lan1 --profile <name> --workspace <name>
 $ lanes link policy list --profile <name> --workspace <name>
 ```
 

package/instructions/skills/lanes-link/SKILL.md

@@ -43,6 +43,12 @@ workspace*. A profile lives in exactly one, so `personal` on `local` and
 `personal` on `cloud` are two profiles that share a name rather than one profile
 in two places.
 
+**A profile owns its data.** Two profiles granting the same connection — every
+profile grants `lanes_memory.lan1` — still read and write different notes,
+tasks, files and entities, because the profile is part of where they are kept.
+So there is nothing to be found in one by asking another, and a note taken under
+`work` is not available under `personal`.
+
 **What a command must be told is never inferred from a profile — but the
 workspace may have a default.** `lanes set-workspace <name>` writes one, every
 command that uses it echoes the name it resolved, and the commands where being
@@ -74,12 +80,19 @@ disagree with it.
 When you write a command out for the owner, fill in what that command needs or
 leave it as `<name>` for them to complete — never drop a required one.
 
-A `connection` names an account the profile grants. One profile may grant
-several of the same kind and govern each differently, so `gmail.work` may be
-readable where `gmail.personal` is writable. Naming a connection the profile does
-not grant is refused rather than guessed at, and a connection it does not grant
-is absent from the enum entirely: if you cannot see it there, it was not
-withheld by accident.
+A `connection` names an account the profile grants, and it is a **fully
+qualified** `<provider>.<id>` — `lanes_memory.lan1`, not `lan1`. The bare id is
+refused, so take the value out of the enum rather than assembling one.
+
+Ids are opaque: `con1`, `con2` for accounts and `lan1`, `lan2` for Lanes' own
+surfaces. They carry no meaning and are not worth guessing at — the enum prints
+each one's account and label beside it, and that is what tells `con1` from
+`con2`. One profile may grant several of the same kind and govern each
+differently, so `gmail.con1` may be readable where `gmail.con2` is writable.
+
+Naming a connection the profile does not grant is refused rather than guessed
+at, and one it does not grant is absent from the enum entirely: if you cannot
+see it there, it was not withheld by accident.
 
 ## Which store a thing goes in
 
@@ -107,7 +120,7 @@ when Y", that is a skill they should write, not a memory entry describing it.
 
 ## Reach for memory before answering from nothing
 
-`lanes_memory.search` before concluding you do not know something about this person or
+`lanes_memory_search` before concluding you do not know something about this person or
 their work. It is a substring search over their own notes, not a ranked index —
 try more than one wording before deciding it is not there.
 
@@ -118,7 +131,7 @@ entries with `lanes link memory list --profile <name> --workspace <name>` and a
 
 ## Tasks have a status, so finish them rather than deleting them
 
-`lanes_tasks.list` answers what is outstanding. It shows `in_progress`, `open` and
+`lanes_tasks_list` answers what is outstanding. It shows `in_progress`, `open` and
 `blocked` and hides the rest, so a listing is what is left to do rather than
 everything that ever was — name a status to see more.
 
@@ -133,7 +146,7 @@ Six of them, and the two that are easy to confuse are worth learning:
 | `done` | finished |
 | `dropped` | decided against, which is not the same as finished |
 
-**Closing a task is `lanes_tasks.update` with a status, never `lanes_tasks.remove`.** The
+**Closing a task is `lanes_tasks_update` with a status, never `lanes_tasks_remove`.** The
 record of having done it is the useful half, and it is what stops the same thing
 being suggested again next week. Remove is for something recorded by mistake.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanes-sh/link",
-  "version": "0.9.1",
+  "version": "0.9.2",
   "description": "A self-hostable MCP gateway for all your connections, memory, tasks, files, and secrets",
   "license": "Apache-2.0",
   "homepage": "https://lanes.sh/link",

package/src/cli/commands/mcp/register.ts

@@ -45,6 +45,41 @@ export interface McpAddOptions extends GlobalFlags {
   readonly headless?: boolean | undefined;
 }
 
+/**
+ * What to say about the token, which depends on whether one was actually stored.
+ *
+ * **`token`, not `harness.storesToken`.** The harness property says the client
+ * *can* hold a token; whether one was passed is a different question, and only
+ * the headless path passes one — the ordinary path registers the bare URL and
+ * lets the client discover the protected-resource document and run the
+ * authorization itself. Keyed on the property, this told an operator who had
+ * just registered against a deployed endpoint that "the token was stored" and
+ * that a rotate meant re-registering, when nothing had been stored and a rotate
+ * would not touch that entry at all.
+ *
+ * A separate function so the decision can be tested without spawning a client
+ * binary, which is the only reason the branch above it cannot be.
+ */
+export function tokenNote(
+  harness: { readonly storesToken: boolean; readonly label: string },
+  token: string | undefined,
+): readonly string[] {
+  if (!harness.storesToken) return [];
+
+  if (token) {
+    return [
+      'The token was stored as a value, not a command, so "lanes link token rotate"',
+      'means running this again with --force.',
+    ];
+  }
+
+  return [
+    `No token was stored: ${harness.label} reads the endpoint's own`,
+    'protected-resource document and signs you in. A "lanes link token rotate"',
+    'does not affect this registration.',
+  ];
+}
+
 export async function mcpAdd(target: string | undefined, options: McpAddOptions): Promise<void> {
   // No harness named: every one that is actually installed. Registering with
   // whatever is present is what someone means by "add my mcp", and naming one
@@ -174,14 +209,7 @@ async function register(
 
   if (!options.noSkill) await installFor(harness, input.scope, {});
 
-  if (harness.storesToken) {
-    print(
-      style.dim(
-        '      The token was stored as a value, not a command, so "lanes link token rotate"\n' +
-          '      means running this again with --force.',
-      ),
-    );
-  }
+  for (const line of tokenNote(harness, input.token)) print(style.dim(`      ${line}`));
 
   const after = harness.afterAdd?.(input);
   if (after) {

package/src/deployments/adapters/audit-blob.ts

@@ -59,6 +59,25 @@ const TAIL_YEAR_WINDOW = 10;
 
 const MARKER_PREFIX = 'runs.closed/';
 
+/**
+ * Whether a key is something this store wrote, rather than something the OS did.
+ *
+ * `verify` enumerates the whole prefix and feeds every non-marker key to the
+ * chain, so a `.DS_Store` that Finder dropped in the audit directory arrived as
+ * a record, failed to decode, and was reported as `malformed run ? at seq -1` —
+ * the whole log **BROKEN** because somebody opened the folder. Seen on a real
+ * workspace, where the file had ridden through two contract migrations.
+ *
+ * A dotfile is the narrowest rule that covers it: no key this store writes
+ * begins with a dot, in either segment. Deliberately not "does it look like an
+ * event" — a corrupt event must still fail loudly, because reporting `ok` for a
+ * record it could not read is the one thing `verify` must never do.
+ */
+function isOurs(key: string): boolean {
+  return !key.split('/').some((segment) => segment.startsWith('.'));
+}
+
+
 export interface BlobAuditOptions {
   /** Scoped to the audit root — `data/<profile>/audit.log` or its bucket prefix. */
   readonly storage: BlobStore;
@@ -113,7 +132,7 @@ export function createBlobAuditStore(options: BlobAuditOptions): AuditStore {
       for (let year = start; year >= floor && found.length < limit; year -= 1) {
         const keys = (await storage.list(`${year}/`))
           .map((entry) => entry.key)
-          .filter((key) => !key.startsWith(MARKER_PREFIX))
+          .filter((key) => !key.startsWith(MARKER_PREFIX) && isOurs(key))
           // Keys are compact ISO within a day and the day is in the path, so
           // lexicographic order is chronological — no parsing to sort.
           .sort((a, b) => (a < b ? 1 : a > b ? -1 : 0));
@@ -160,6 +179,8 @@ export function createBlobAuditStore(options: BlobAuditOptions): AuditStore {
       const markers: RunMarker[] = [];
 
       for (const entry of await storage.list('')) {
+        if (!isOurs(entry.key)) continue;
+
         const bytes = await storage.get(entry.key);
         if (bytes === null) continue;