@lanes-sh/link 0.9.2 → 0.9.3

package/src/cli/commands/connection-list.ts

@@ -1,12 +1,15 @@
 import { RESERVED_PROVIDER_IDS } from '#connectivity';
+import { PROVIDER_MANIFESTS } from '#providers/index.ts';
 import {
   connectionRefOf,
+  defaultConnectionLabel,
   listProfiles,
   loadProfileConfig,
   readConnections,
   resolveTargetWorkspace,
   resolveWorkspaceRoot,
 } from '#profile';
+import { RESERVED_SURFACES } from '../config-repair.ts';
 import { emit, heading, print, style, table } from '../output.ts';
 import type { GlobalFlags } from '../runtime.ts';
 
@@ -104,6 +107,20 @@ export async function connectionList(flags: GlobalFlags & { json?: boolean }): P
   });
 }
 
+/**
+ * What each provider is called, by id.
+ *
+ * The catalogue's manifests plus the owner layer, which is registered separately
+ * and is deliberately absent from `PROVIDERS`. A workspace-local manifest is not
+ * here: this command reads files rather than building a registry, and one custom
+ * provider falling back to its account is a smaller price than a registry build
+ * on a listing.
+ */
+const PROVIDER_NAMES = new Map<string, string>([
+  ...PROVIDER_MANIFESTS.map((manifest): [string, string] => [manifest.id, manifest.name]),
+  ...Object.entries(RESERVED_SURFACES),
+]);
+
 function row(one: ConnectionSummary): string[] {
   // "granted to nobody" is said rather than left blank, because a blank column
   // reads as "not loaded yet" and this is a fact about the config.
@@ -112,5 +129,12 @@ function row(one: ConnectionSummary): string[] {
       ? style.dim('no profile grants it')
       : one.grantedTo.join(', ');
 
-  return [`  ${style.bold(one.key)}`, one.label ?? one.account, reach];
+  // The account was this column's fallback, which meant an unlabelled row read
+  // as its address and said nothing about which service the address is at. The
+  // derived name says both, and is the one the dashboard and the connect prompt
+  // show for the same row.
+  const named = PROVIDER_NAMES.get(one.provider);
+  const label = one.label ?? (named ? defaultConnectionLabel(named, one.account) : one.account);
+
+  return [`  ${style.bold(one.key)}`, label, reach];
 }

package/src/cli/commands/mcp/harnesses.ts

@@ -45,14 +45,17 @@ export interface AddInput {
   readonly tokenEnv: string;
   readonly scope: string;
   /**
-   * Which selection this registration is for.
+   * Which workspace this registration is for.
    *
-   * Not part of the URL — a deployed endpoint serves every profile in its bucket
-   * and each call names one. It is here because the shell commands a harness is
-   * told to run afterwards do need it, and a `lanes link token show` without it
-   * substitutes to nothing.
+   * Not part of the URL — one endpoint serves every profile in the workspace and
+   * each call names one in its `profile` argument. It is here because the shell
+   * commands a harness is told to run afterwards do need it, and a `lanes link
+   * token show` without it substitutes to nothing.
+   *
+   * There is no `profile` beside it any more (ADR-068). It was here for exactly
+   * one reader — the `export` line below — and what that line names is a token,
+   * which is the workspace's.
    */
-  readonly profile: string;
   readonly target: string;
 }
 
@@ -142,14 +145,18 @@ export const HARNESSES: readonly Harness[] = [
     scoped: false,
     storesToken: false,
     home: CODEX_HOME,
-    add: ({ name, url, tokenEnv }) => [
+    // The env var only under `--headless`, which is what the header comment
+    // above claims and this did not do: it was passed unconditionally, so every
+    // Codex registration was a token registration while `storesToken: false`
+    // said otherwise and `afterAdd` told the operator to export a variable an
+    // OAuth-capable client would never read.
+    add: ({ name, url, tokenEnv, token }) => [
       'mcp',
       'add',
       name,
       '--url',
       url,
-      '--bearer-token-env-var',
-      tokenEnv,
+      ...(token ? ['--bearer-token-env-var', tokenEnv] : []),
     ],
     get: (name) => ['mcp', 'get', name],
     remove: (name) => ['mcp', 'remove', name],
@@ -157,19 +164,26 @@ export const HARNESSES: readonly Harness[] = [
     // installs to both unchanged. Codex has no subagent directory, so it gets
     // the skill and not the scout — and `mcp add` says which it did.
     skills: () => join(CODEX_HOME(), 'skills'),
-    afterAdd: ({ tokenEnv, profile, target }) => [
-      `Codex reads the token from $${tokenEnv} when it starts, so set it where Codex will see it:`,
-      '',
-      // Both flags, and this line is the reason they matter more here than
-      // anywhere else: an unresolvable substitution yields the empty string, the
-      // header becomes "Bearer ", and the only symptom is a 401 that reads as a
-      // bad token rather than a command that refused.
-      `    export ${tokenEnv}="$(lanes link token show --raw --profile ${profile} --workspace ${target})"`,
-      '',
-      'Add that to your shell profile. This is the better half of the bargain: the token never',
-      'reaches ~/.codex/config.toml, and a "lanes link token rotate" is picked up on next launch',
-      'with no re-registration.',
-    ],
+    afterAdd: ({ tokenEnv, target, token }) =>
+      // Nothing to say unless a token is actually in play. Without `--headless`
+      // this registration is a bare URL like Claude Code's, and telling somebody
+      // to export a variable nothing reads was the instruction that made
+      // `storesToken: false` read as a contradiction.
+      token === undefined
+        ? []
+        : [
+            `Codex reads the token from $${tokenEnv} when it starts, so set it where Codex will see it:`,
+            '',
+            // `--workspace`, and this line is the reason it matters more here
+            // than anywhere else: an unresolvable substitution yields the empty
+            // string, the header becomes "Bearer ", and the only symptom is a
+            // 401 that reads as a bad token rather than a command that refused.
+            `    export ${tokenEnv}="$(lanes link token show --raw --workspace ${target})"`,
+            '',
+            'Add that to your shell profile. This is the better half of the bargain: the token never',
+            'reaches ~/.codex/config.toml, and a "lanes link token rotate" is picked up on next launch',
+            'with no re-registration.',
+          ],
   },
 ];
 

package/src/cli/commands/mcp/register.ts

@@ -1,6 +1,7 @@
+import { anyIssuedToken } from '#profile';
 import { endpointUrl } from '../../endpoint-url.ts';
 import { fail, ok, print, style, warn } from '../../output.ts';
-import { ensureProfileToken, openRuntime, type GlobalFlags } from '../../runtime.ts';
+import { openWorkspaceRuntime, type GlobalFlags } from '../../runtime.ts';
 import { installFor } from './assets.ts';
 import { HARNESSES, type AddInput, type Harness } from './harnesses.ts';
 
@@ -114,13 +115,32 @@ export async function mcpAdd(target: string | undefined, options: McpAddOptions)
   const scope = options.scope ?? 'user';
   const tokenEnv = options.tokenEnv ?? 'LANES_LINK_TOKEN';
 
-  const runtime = await openRuntime(options);
+  // **The workspace, not a profile** (ADR-068). One endpoint serves every
+  // profile in the workspace and each call names one in its `profile` argument,
+  // so a registration was never per-profile: two different `--profile` values
+  // produced byte-identical harness commands. What kept the flag required was
+  // that the endpoint's token lived at `auth.token_ref` on a profile — a ref
+  // whose default was the same constant for all of them — and reading it meant
+  // resolving one. The token is the workspace's now, so there is nothing left
+  // to ask. `--profile` is still accepted, and narrows nothing here.
+  const runtime = await openWorkspaceRuntime(options);
 
   try {
-    // Minted either way. The endpoint needs one to serve at all, and `outputs`
-    // prints it; what `--headless` decides is whether it is written into
-    // somebody's agent config.
-    const { token } = await ensureProfileToken(runtime.credentials, runtime.config.auth.token_ref);
+    // **Only for `--headless`, and only if one has been issued.** The ordinary
+    // path registers a bare URL and the client authorises itself (ADR-062).
+    // Nothing is minted here: a token names the person it was issued to, and
+    // `mcp add` does not know who — which is what `token issue` is for.
+    const token = options.headless === true
+      ? (await anyIssuedToken(runtime.resolution.workspaceRoot, runtime.credentials))?.value
+      : undefined;
+
+    if (options.headless === true && token === undefined) {
+      throw new Error(
+        'No static token is issued in this workspace, so --headless has nothing to write.\n' +
+          `  Issue one: lanes link token issue --me --workspace ${runtime.target}\n` +
+          '  Without --headless the client signs in for itself and needs none.',
+      );
+    }
 
     // The target's own address, not the local one. This built
     // `http://<host>:<port>/mcp` unconditionally, so `mcp add --workspace cloud`
@@ -130,10 +150,9 @@ export async function mcpAdd(target: string | undefined, options: McpAddOptions)
     const input: AddInput = {
       name,
       url,
-      ...(options.headless === true ? { token } : {}),
+      ...(token === undefined ? {} : { token }),
       tokenEnv,
       scope,
-      profile: runtime.resolution.profile,
       target: runtime.resolution.target,
     };
 

package/src/cli/commands/mcp/stdio.ts

@@ -48,7 +48,6 @@ export async function mcpStdio(
       reconciled: ({ profile, plan, ofMany }) =>
         printErr(`${ofMany ? `${profile}\n` : ''}${plan}`),
       // Unreachable: this path never mints a token, because it never needs one.
-      tokenMinted: () => {},
     },
     log: {
       debug() {},

package/src/cli/commands/operate/inspect.ts

@@ -1,5 +1,5 @@
 import { formatPlan, planIsNoop, planReconcile } from '#registry';
-import type { ConnectionConfig, SelectedConnection } from '#profile';
+import { readEndpointTokens, type ConnectionConfig, type SelectedConnection } from '#profile';
 import { DEFAULT_SURFACES } from '../../config-repair.ts';
 import { announce, announceProfile, emit, fail, ok, print, warn } from '../../output.ts';
 import { staleNudge } from '../../release.ts';
@@ -120,16 +120,27 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
     checks.push('config is valid');
     checks.push('state store is reachable');
 
-    const token = await runtime.credentials.get(runtime.config.auth.token_ref);
-    if (token) {
-      checks.push(`profile token present (${runtime.config.auth.token_ref})`);
-    } else {
-      // Not a failure: `lanes link start` mints one. Reporting it as a problem would
-      // make every fresh profile fail doctor for something that fixes itself.
+    // **A row whose value is missing, not a missing token** (ADR-068). Having
+    // issued none is the healthy default — a client signs in for itself — so
+    // reporting that as a problem would make every working workspace fail
+    // doctor. What is genuinely broken is a row pointing at nothing: it matches
+    // no credential, and from the client's side reads exactly like a wrong
+    // token. That is what a half-finished `secrets push` leaves behind.
+    const issued = await readEndpointTokens(runtime.resolution.workspaceRoot);
+    const orphaned: string[] = [];
+    for (const row of issued) {
+      if ((await runtime.credentials.get(row.ref)) === null) orphaned.push(row.id);
+    }
+
+    if (issued.length > 0 && orphaned.length === 0) {
+      checks.push(`${issued.length} endpoint token(s) present`);
+    }
+
+    for (const id of orphaned) {
       warnings.push({
-        kind: 'no_profile_token',
-        message: 'no profile token yet — lanes link start will mint one, or run: lanes link token rotate',
-        fix: forSelection('lanes link token rotate'),
+        kind: 'orphaned_endpoint_token',
+        message: `token "${id}" has a row but no value in this workspace's store — it matches nothing`,
+        fix: `lanes link token rotate --id ${id} --workspace ${runtime.resolution.target}`,
       });
     }
 

package/src/cli/commands/operate/outputs.ts

@@ -1,8 +1,8 @@
-import { listProfiles } from '#profile';
+import { anyIssuedToken, listProfiles } from '#profile';
 import { fileURLToPath } from 'node:url';
 import { deployedUrl, endpointHealth, localUrl } from '../../endpoint-url.ts';
-import { announce, heading, print, style, warn } from '../../output.ts';
-import { ensureProfileToken, openRuntime, type GlobalFlags } from '../../runtime.ts';
+import { announceWorkspace, heading, print, style, warn } from '../../output.ts';
+import { openWorkspaceRuntime, type GlobalFlags } from '../../runtime.ts';
 
 export interface OutputsFlags extends GlobalFlags {
   readonly show?: boolean | undefined;
@@ -23,18 +23,27 @@ export interface OutputsFlags extends GlobalFlags {
  * the harness's business.
  */
 export async function outputs(flags: OutputsFlags): Promise<void> {
-  const runtime = await openRuntime(flags);
+  // The workspace, matching what this command's own subject has always been
+  // (ADR-068). It asked for a profile only to find the endpoint's token, and
+  // that token is the workspace's.
+  const runtime = await openWorkspaceRuntime(flags);
 
   try {
-    const { token } = await ensureProfileToken(runtime.credentials, runtime.config.auth.token_ref);
+    // Whatever has been issued, or nothing — which is the ordinary state.
+    // Nothing is minted: `outputs` reports, and a token names a person.
+    const held = await anyIssuedToken(runtime.resolution.workspaceRoot, runtime.credentials);
+    const token = held?.value;
     const declared = runtime.declared.deploy;
     const deployed = await deployedUrl(declared);
     // Not `endpointUrl`, which would ask the platform a second time for an
     // answer this line already has.
     const url = deployed ?? localUrl(runtime.config);
 
+    // Unauthenticated when nothing is issued. `/health` answers either way; what
+    // it withholds without a credential is the profile list, so `mine` below is
+    // then decided by the endpoint answering at all.
     const live = await endpointHealth(url, token);
-    const mine = live?.profile === runtime.resolution.profile;
+    const mine = live !== null;
 
     // Live if it is up, otherwise every profile in this target's workspace.
     // Those are the same set now: a profile lives in exactly one target
@@ -51,9 +60,8 @@ export async function outputs(flags: OutputsFlags): Promise<void> {
             running: mine,
             deployed: deployed !== null,
             target: runtime.target,
-            primary: runtime.resolution.profile,
             profiles,
-            ...(flags.show ? { token } : {}),
+            ...(flags.show && token !== undefined ? { token } : {}),
           },
           null,
           2,
@@ -62,7 +70,7 @@ export async function outputs(flags: OutputsFlags): Promise<void> {
       return;
     }
 
-    announce(runtime.resolution);
+    announceWorkspace(runtime.resolution);
 
     heading('Endpoint');
     print(
@@ -75,21 +83,19 @@ export async function outputs(flags: OutputsFlags): Promise<void> {
       print(style.dim(`  ${declared.platform} service "${declared.service}" for target "${runtime.target}".`));
     }
 
-    if (live && !mine) {
-      // Two workspaces can assign the same port. Saying so beats reporting an
-      // endpoint as up when it belongs to something else entirely.
-      print(warn(`something else is serving this port: profile "${live.profile}"`));
-    }
-
-    heading(`Profiles reachable through it (${profiles.length})`);
-    for (const profile of profiles) {
-      print(`  ${profile}${profile === runtime.resolution.profile ? style.dim('  (endpoint owner)') : ''}`);
-    }
-    print(style.dim('  Each call names one, in its `profile` argument.'));
+    heading(`Profiles served by it (${profiles.length})`);
+    for (const profile of profiles) print(`  ${profile}`);
+    print(
+      style.dim(
+        '  Each call names one, in its `profile` argument. Which of these a client\n' +
+          '  actually reaches is decided by who signs in — every profile whose members\n' +
+          '  list them, and no others.',
+      ),
+    );
 
-    if (flags.show) {
+    if (flags.show && token !== undefined) {
       heading('Token');
-      print(`  ${token}`);
+      print(`  ${token}  ${style.dim(`(${held?.id})`)}`);
     }
 
     heading('Register with your agent');
@@ -100,36 +106,59 @@ export async function outputs(flags: OutputsFlags): Promise<void> {
     );
     print('');
 
-    const invocation = await tokenInvocation(
-      token,
-      runtime.resolution.profile,
-      runtime.resolution.target,
-    );
-
-    print(
-      `  claude mcp add --transport http lanes-link ${url} \\\n` +
-        `    --header "Authorization: Bearer $(${invocation.command})"`,
-    );
+    // **The bare URL, and no header** (ADR-062). This printed the
+    // `Authorization: Bearer $(…)` form unconditionally, which was the shape
+    // before every endpoint ran the authorization flow — a registration that
+    // carries a credential, bypasses consent and expiry, and leaves a long-lived
+    // token in a harness config. The client discovers
+    // `/.well-known/oauth-protected-resource` from the 401 and signs its owner
+    // in instead.
+    print(`  claude mcp add --transport http lanes-link ${url}`);
     print('');
-
-    if (!invocation.onPath) {
-      // The failure this prevents is nasty: an unresolvable command substitutes
-      // to the empty string, the header becomes "Bearer ", and the only symptom
-      // is a 401 that looks like a bad token rather than a missing binary.
-      print(warn('lanes is not on your PATH, so the short form would substitute to nothing.'));
-      print(style.dim('  The command above uses this checkout instead. To shorten it permanently:'));
-      print(`      cd ${process.cwd()} && bun link`);
-      print('');
-    }
-
     print(
       style.dim(
-        '  One registration covers every profile above. The $(…) keeps the token out of your\n' +
-          '  agent\'s context and out of the transcript — but note it is resolved once, when you\n' +
-          '  run the command, and stored as a literal. After "lanes link token rotate" you have to\n' +
-          '  register again. Other harnesses take the same two facts — URL and bearer token.',
+        '  No credential goes into that command. The client reads this endpoint\'s\n' +
+          '  protected-resource document, sends its owner to sign in, and comes back\n' +
+          '  holding a token of its own — so a config file synced to a dotfiles repo\n' +
+          '  is not a leak, and rotating a static token does not invalidate it.',
       ),
     );
+
+    heading('For a machine with no browser');
+    if (token === undefined) {
+      print(style.dim('  No static token is issued in this workspace.'));
+      print(
+        style.dim(
+          `      lanes link token issue --me --workspace ${runtime.target}\n` +
+            '  It reaches the profiles that list your subject as a member, and nothing else.',
+        ),
+      );
+    } else {
+      const invocation = await tokenInvocation(runtime.resolution.target);
+      print(
+        `  claude mcp add --transport http lanes-link ${url} \\\n` +
+          `    --header "Authorization: Bearer $(${invocation.command})"`,
+      );
+      print('');
+      if (!invocation.onPath) {
+        // The failure this prevents is nasty: an unresolvable command
+        // substitutes to the empty string, the header becomes "Bearer ", and
+        // the only symptom is a 401 that looks like a bad token rather than a
+        // missing binary.
+        print(warn('lanes is not on your PATH, so the short form would substitute to nothing.'));
+        print(style.dim('  The command above uses this checkout instead. To shorten it permanently:'));
+        print(`      cd ${process.cwd()} && bun link`);
+        print('');
+      }
+      print(
+        style.dim(
+          '  CI only, and it is narrower than it looks: the token reaches the profiles\n' +
+            '  its subject is a member of. The $(…) keeps it out of your agent\'s context\n' +
+            '  and out of the transcript, but it resolves once and is stored as a literal —\n' +
+            '  so a rotate means registering again.',
+        ),
+      );
+    }
   } finally {
     await runtime.close();
   }
@@ -146,28 +175,32 @@ export async function outputs(flags: OutputsFlags): Promise<void> {
  * checkout, which always works.
  */
 export async function tokenInvocation(
-  expected: string,
-  profile: string,
   target: string,
 ): Promise<{ command: string; onPath: boolean }> {
-  // Both, always, and from the *resolved* selection rather than the flags. A
-  // token is per-target, so `outputs --workspace cloud` printing a bare
-  // `token show --raw` hands over the local one beside a deployed URL — a
-  // credential that looks like an answer and fails as a wrong password. Naming
-  // the profile as well makes the line pasteable into any shell rather than
-  // only into one where the same default happens to resolve.
-  const selection = ` --profile ${profile} --workspace ${target}`;
+  // `--workspace`, always, and from the *resolved* selection rather than the
+  // flags. A token is per-workspace, so `outputs --workspace cloud` printing a
+  // bare `token show --raw` hands over the local one beside a deployed URL — a
+  // credential that looks like an answer and fails as a wrong password.
+  //
+  // No `--profile` any more (ADR-068): `token show` refuses one, so printing it
+  // here would emit a line that cannot be pasted.
+  const selection = ` --workspace ${target}`;
   const short = `lanes link token show --raw${selection}`;
-  const argv = ['link', 'token', 'show', '--raw', '--profile', profile, '--workspace', target];
+  const argv = ['link', 'token', 'show', '--raw', '--workspace', target];
 
   const resolved = Bun.which('lanes');
   if (resolved) {
     try {
       const result = Bun.spawnSync([resolved, ...argv]);
-      // Compared against the token rather than merely checking it exited zero:
-      // a `lanes` on PATH could belong to a different workspace entirely,
-      // and would hand the harness a token this endpoint rejects.
-      if (result.success && new TextDecoder().decode(result.stdout).trim() === expected) {
+      // Exit status and a plausible token, rather than a comparison against a
+      // known value. This used to be handed the expected token and check for
+      // equality, which caught a `lanes` on PATH belonging to a different
+      // workspace. It cannot now: with several rows issued, `token show`
+      // refuses without `--id` — so demanding one value back would reject a
+      // correctly-installed binary. What survives is the check that matters for
+      // the failure this function exists to prevent, which is a substitution
+      // that yields nothing at all.
+      if (result.success && new TextDecoder().decode(result.stdout).trim().startsWith('llk_')) {
         return { command: short, onPath: true };
       }
     } catch {

package/src/cli/commands/operate/serve.ts

@@ -61,7 +61,6 @@ export async function start(
     flags: resolved,
     port: flags.port,
     only: flags.only,
-    mintToken: true,
     // Stderr, not stdout: `--json` and `--raw` callers parse the other stream.
     // A refused credential is the event worth seeing while this runs in the
     // foreground, and until now nothing printed it.
@@ -72,9 +71,6 @@ export async function start(
         print(plan);
         print(ok(`reconciled ${ofMany ? profile : ''}`.trim()));
       },
-      tokenMinted({ target }) {
-        print(warn(`minted a token — run: lanes link outputs --show --workspace ${target}`));
-      },
     },
   });