@mean-weasel/lineage 0.1.4 → 0.1.5

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.1.5
+
+- Add graph orientation controls for lineage views and CLI flows, including browser coverage for orientation behavior.
+- Improve agent claim visibility with workspace/content occupancy badges, claim lifecycle controls, and release claim smoke coverage.
+- Harden lineage claim enforcement for explicit child workspaces and `project_channel` claims so scoped claims cannot authorize broader writes.
+- Make local startup helpers durable with tmux-backed Makefile commands.
+
 ## 0.1.4
 
 - Implement target-scoped agent claims for lineage and content-post agent writes, including claim lifecycle CLI/API commands, heartbeat/release/revoke/transfer controls, and token-redacted read APIs.

package/README.md

@@ -54,6 +54,12 @@ lineage agent claim --project demo-project --scope lineage_workspace --target de
 export LINEAGE_CLAIM_TOKEN='claim_abc.secret_xyz'
 ```
 
+Agents can inspect the current lineage graph without a claim:
+
+```bash
+lineage agent graph --project demo-project --root <root-asset-id> --json
+```
+
 Keep the claim fresh and pass it to mutating commands:
 
 ```bash
@@ -127,12 +133,13 @@ For local release validation:
 
 ```bash
 npm run release:dry-run -- --tag next
+npm run release:claim-smoke -- --package @mean-weasel/lineage@next
 npm run release:next
 npm run release:dry-run -- --tag latest
 npm run release:latest
 ```
 
-The release script verifies package metadata, changelog version coverage, public-readiness scans, install smoke, browser smoke, audit, and package contents before publishing. GitHub Actions runs CI on pull requests and `main`; publishing is manual through the Release workflow.
+The release script verifies package metadata, changelog version coverage, public-readiness scans, install smoke, browser smoke, audit, and package contents before publishing. Promotion also installs the candidate package and runs a claim lifecycle smoke that creates a target claim, proves missing-token writes fail, proves matching-token writes succeed, verifies read surfaces do not expose the raw token, and proves release invalidates the token. GitHub Actions runs CI on pull requests and `main`; publishing is manual through the Release workflow.
 
 Use the Release workflow operations this way:
 

package/dist/cli/lineage-dev.js

@@ -1297,6 +1297,37 @@ function activeLineageWorkspaceRoot(project) {
   }
 }
 
+// src/server/lineageClaimGuards.ts
+function channelOverlaps2(left, right) {
+  return !left || !right || left === right;
+}
+function hasActiveLineageWorkspaceClaim(project, targetId, channel) {
+  return listAgentClaims(project).claims.some((claim) => {
+    if (claim.project !== project || claim.status !== "active" || claim.derived_state === "expired") return false;
+    if (claim.scope_type === "lineage_workspace") return claim.target_id === targetId;
+    return claim.scope_type === "project_channel" && channelOverlaps2(channel, claim.channel);
+  });
+}
+function requireLineageWorkspaceClaimForWrite(fields) {
+  if (!fields.confirmWrite) return;
+  const targetId = lineageWorkspaceId(fields.project, fields.rootAssetId);
+  if (!fields.claimToken && !hasActiveLineageWorkspaceClaim(fields.project, targetId, fields.channel)) return;
+  const validation = validateAgentClaimForWrite({
+    channel: fields.channel,
+    claimToken: fields.claimToken,
+    confirmWrite: fields.confirmWrite,
+    dangerLevel: "enforce",
+    project: fields.project,
+    scopeType: "lineage_workspace",
+    targetId,
+    writeKind: fields.writeKind
+  });
+  if (!validation.ok) {
+    const status = validation.code === "claim_required" || validation.code === "claim_token_invalid" ? 401 : 409;
+    throw new AgentClaimError(validation.message, status, validation.code, validation.conflicts);
+  }
+}
+
 // src/server/assetLineage.ts
 var LineageError = class extends Error {
   constructor(message, status = 400) {
@@ -1324,6 +1355,45 @@ function rootFor(database, project, assetId) {
   }
   return assetId;
 }
+function explicitWorkspaceRoot(database, project, assetId) {
+  const row = database.prepare(`
+    select root_asset_id from lineage_workspaces
+    where project_id = ? and root_asset_id = ? and status != 'archived'
+  `).get(project, assetId);
+  return row?.root_asset_id;
+}
+function nearestWorkspaceRoot(database, project, assetId) {
+  let current = assetId;
+  const seen = /* @__PURE__ */ new Set();
+  while (!seen.has(current)) {
+    seen.add(current);
+    const explicit = explicitWorkspaceRoot(database, project, current);
+    if (explicit) return explicit;
+    const parent = parentOf(database, project, current);
+    if (!parent) return current;
+    current = parent;
+  }
+  return assetId;
+}
+function assetChannel(database, project, assetId) {
+  const row = database.prepare("select channel from assets where project_id = ? and id = ?").get(project, assetId);
+  return row?.channel;
+}
+function lineageWriteClaimContext(database, project, assetId) {
+  return {
+    channel: assetChannel(database, project, assetId),
+    rootAssetId: nearestWorkspaceRoot(database, project, assetId)
+  };
+}
+function getLineageWriteClaimContext(project, assetId) {
+  const database = lineageDb();
+  try {
+    requireAsset(database, project, assetId);
+    return lineageWriteClaimContext(database, project, assetId);
+  } finally {
+    database.close();
+  }
+}
 function latestSelectedRoot(database, project) {
   const row = database.prepare("select root_asset_id from asset_selections where project_id = ? order by selected_at desc limit 1").get(project);
   return row?.root_asset_id;
@@ -1354,6 +1424,20 @@ function linkLineageAssets(project, fields) {
   requireAsset(database, project, fields.parentAssetId);
   requireAsset(database, project, fields.childAssetId);
   if (fields.parentAssetId === fields.childAssetId) throw new LineageError("Lineage link cannot point to itself");
+  const claimContext = lineageWriteClaimContext(database, project, fields.parentAssetId);
+  try {
+    requireLineageWorkspaceClaimForWrite({
+      channel: claimContext.channel,
+      claimToken: fields.claimToken,
+      confirmWrite: fields.confirmWrite,
+      project,
+      rootAssetId: claimContext.rootAssetId,
+      writeKind: "lineage_link"
+    });
+  } catch (error) {
+    database.close();
+    throw error;
+  }
   const edge = {
     id: edgeId(project, fields.parentAssetId, fields.childAssetId),
     parent_asset_id: fields.parentAssetId,
@@ -1390,7 +1474,7 @@ function descendants(database, project, root) {
 function getLineageSnapshot(project, assetId) {
   const database = lineageDb();
   requireAsset(database, project, assetId);
-  const root = rootFor(database, project, assetId);
+  const root = explicitWorkspaceRoot(database, project, assetId) || rootFor(database, project, assetId);
   const edges = descendants(database, project, root);
   const ids = [.../* @__PURE__ */ new Set([root, ...edges.flatMap((edge) => [edge.parent_asset_id, edge.child_asset_id])])];
   const placeholders = ids.map(() => "?").join(",");
@@ -1566,14 +1650,15 @@ function linkSelectedLineageChild(project, fields) {
   const next = getLineageNextAsset(project, fields.rootAssetId);
   if (!next.next_asset) throw new LineageError("Cannot link child until a next base is selected or unambiguous");
   if (fields.confirmWrite) {
+    const claimContext = getLineageWriteClaimContext(project, next.next_asset.asset_id);
     const validation = validateAgentClaimForWrite({
-      channel: next.next_asset.channel,
+      channel: claimContext.channel,
       claimToken: fields.claimToken,
       confirmWrite: fields.confirmWrite,
       dangerLevel: "enforce",
       project,
       scopeType: "lineage_workspace",
-      targetId: lineageWorkspaceId(project, next.root_asset_id),
+      targetId: lineageWorkspaceId(project, claimContext.rootAssetId),
       writeKind: "link_child"
     });
     if (!validation.ok) throw new AgentClaimError(validation.message, validation.code === "claim_required" ? 401 : 403, validation.code, validation.conflicts);
@@ -1649,6 +1734,7 @@ Usage:
   ${config.binName} inspect --asset-id <asset-id> [--project <project>] [--db <path>] [--json]
   ${config.binName} link-child --root <asset-id> --child <asset-id> [--project <project>] [--claim-token <claim-id.secret>] [--confirm-write] [--db <path>] [--json]
   ${config.binName} agent claim --project <project> --scope <scope> --target <target-id> --agent-name <name> [--channel <channel>] [--ttl 20m] [--json]
+  ${config.binName} agent graph --root <asset-id> [--project <project>] [--db <path>] [--json]
   ${config.binName} agent status [--project <project>] [--json]
   ${config.binName} agent inspect --claim <claim-id> [--project <project>] [--json]
   ${config.binName} agent heartbeat --claim-token <claim-id.secret> [--json]
@@ -1765,6 +1851,11 @@ function runLineageAgentCommand(command, args) {
     });
   }
   if (command === "status") return listAgentClaims(project);
+  if (command === "graph") {
+    const rootAssetId = readOption(args, "--root") || readOption(args, "--asset-id") || positionalArgs(args)[0];
+    if (!rootAssetId) throw new Error("lineage agent graph requires --root");
+    return getLineageSnapshot(project, rootAssetId);
+  }
   if (command === "inspect") {
     if (!claimId) throw new Error("lineage agent inspect requires --claim");
     return inspectAgentClaim(claimId, project);
@@ -1821,8 +1912,37 @@ function printAgentResult(command, result, json) {
     console.log(`${inspected.claim?.id || "claim"} ${inspected.claim?.status || "unknown"} ${inspected.claim?.target_id || ""}`.trim());
     return;
   }
+  if (command === "graph" && result && typeof result === "object" && "nodes" in result) {
+    console.log(formatAgentGraphDigest(result));
+    return;
+  }
   console.log(String(result));
 }
+function formatAgentGraphDigest(snapshot) {
+  const lines = [];
+  const titleFor = (assetId) => {
+    const node = snapshot.nodes.find((item) => item.asset_id === assetId);
+    return node?.title ? `${node.title} (${assetId})` : assetId;
+  };
+  const root = snapshot.nodes.find((node) => node.asset_id === snapshot.root_asset_id);
+  lines.push(`Lineage graph: ${root?.title || snapshot.root_asset_id}`);
+  lines.push(`Root: ${snapshot.root_asset_id}`);
+  lines.push(`Active: ${titleFor(snapshot.active_asset_id)}`);
+  lines.push(`Nodes: ${snapshot.nodes.length}  Edges: ${snapshot.edges.length}`);
+  const selected = snapshot.selected || [];
+  if (selected.length > 0) {
+    lines.push("Next variation:");
+    for (const assetId of selected) lines.push(`- ${titleFor(assetId)}`);
+  }
+  const latest = snapshot.latest || snapshot.nodes.filter((node) => node.is_latest).map((node) => node.asset_id);
+  if (latest.length > 0) {
+    lines.push("Latest leaves:");
+    for (const assetId of latest) lines.push(`- ${titleFor(assetId)}`);
+  }
+  lines.push("Edges:");
+  for (const edge of snapshot.edges) lines.push(`- ${titleFor(edge.parent_asset_id)} -> ${titleFor(edge.child_asset_id)}`);
+  return lines.join("\n");
+}
 function start(config, args) {
   let options;
   const json = args.includes("--json");