@vibelord/lanes 1.0.4 → 1.1.0

package/payload/lanes/libexec/web_tokens.py

@@ -0,0 +1,315 @@
+"""Zellij web login tokens for `lanes web --token` and `lanes token …`, each attributed to the device it was minted for.
+
+Zellij 0.45.1 cannot name a token, and its naming rule makes a single revocation hazardous. MEASURED 2026-10-05 from the
+pinned binary (inner sha256 d006c521…19dd) in a scratch HOME / XDG_DATA_HOME / --config-dir, never the real database:
+  - `web --create-token --token-name NAME` is refused by the argument parser (exit 2: `--create-token` "cannot be used
+    with one or more of the other specified arguments"), in either order; `--create-read-only-token` likewise;
+  - each new token is named `token_<number of tokens + 1>`, so after revoking any token but the newest the next
+    `--create-token` fails ("Token name 'token_N' already exists", exit 2) until enough tokens are revoked;
+  - `--list-tokens` prints names and creation times only (`token_2: created at 2026-10-05 16:06:27`), never a token;
+  - `--revoke-token NAME` also deletes that token's sign-in sessions (`session_tokens` rows); `--revoke-all-tokens`
+    deletes every token and session;
+  - the database is $XDG_DATA_HOME/zellij/tokens.db (default ~/.local/share/zellij/tokens.db); `--data-dir` does not
+    move it.
+
+So lanes records, in STATE/web-tokens.json, which device each token was minted for: under a lock it lists the names
+before and after running `--create-token` on the caller's terminal (stdin/stdout/stderr inherited, nothing captured —
+lanes never reads, prints or logs a token) and attributes the one new name — to the view, and, when the view belongs
+to another machine (`lanes-launch web phone` opens `<device>-phone` for `<device>`), to that machine as `base`.
+`revoke <device>` revokes that device's tokens only when doing so leaves creation working, and otherwise refuses and
+names `revoke-all`, the coarse fallback. `lanes offboard <device>` (offboard below) signs the whole machine out: the
+tokens of the device, of its windows and of every view minted with it as `base` — also when that leaves creation
+blocked, because the departing machine comes first; it then names `revoke-all`, which repairs creation.
+
+`env` (bin/lanes token_env) carries XDG_DATA_HOME=<account home>/.local/share, the root systemd/lanes-web.service pins
+as `%h/.local/share`, never the caller's; bin/lanes refuses every call here while the RUNNING server's environment
+names another database (token_db_refusal), and `lanes doctor` reports the comparison.
+"""
+import fcntl
+import json
+import re
+import subprocess
+import sys
+import time
+from contextlib import contextmanager
+
+import lanes_lib as L
+
+USAGE = 'usage: lanes token list | revoke <device> | revoke --name NAME | revoke-all [--yes]'
+LISTED = re.compile(r'^(\S+): created at (.+)$')
+NAME = re.compile(r'^[A-Za-z0-9_.-]{1,64}$')
+VERSION = 1
+REVOKE_ALL = 'lanes token revoke-all --yes'
+SIGN_IN_AGAIN = 'every browser and phone view must sign in again with a new token (`lanes web <device> --token`)'
+
+
+def map_path():
+    return L.STATE / 'web-tokens.json'
+
+
+@contextmanager
+def token_lock(timeout=5):
+    """One mint or revocation at a time: the before/after name diff is exact only when no other lanes mint runs."""
+    L.STATE.mkdir(parents=True, exist_ok=True)
+    with (L.STATE / 'web-tokens.lock').open('a') as handle:
+        deadline = time.monotonic() + timeout
+        while True:
+            try:
+                fcntl.flock(handle, fcntl.LOCK_EX | fcntl.LOCK_NB)
+                break
+            except BlockingIOError:
+                if time.monotonic() >= deadline:
+                    raise L.LanesError('another web token is being created or revoked; try again shortly')
+                time.sleep(0.05)
+        try:
+            yield
+        finally:
+            fcntl.flock(handle, fcntl.LOCK_UN)
+
+
+def listing(base, env):
+    """[(name, created)] in zellij's order, from `web --list-tokens`. Raises when zellij did not answer."""
+    rc, out, err = L.run_bounded(base + ['web', '--list-tokens'], 20, env=env)
+    if rc != 0:
+        raise L.LanesError('zellij web --list-tokens: ' + ('no answer in 20 s' if rc is None
+                                                           else err.strip() or out.strip() or f'exit {rc}'))
+    return [m.groups() for m in map(LISTED.match, out.splitlines()) if m]
+
+
+def next_name(names):
+    return f'token_{len(names) + 1}'
+
+
+def wedged(names):
+    """True when zellij 0.45.1 cannot create another token: the name it would choose is taken."""
+    return next_name(names) in names
+
+
+def load_map():
+    """{name: {device, created, minted_at[, base]}} from web-tokens.json ({} when absent). A file lanes cannot read is
+    refused, never overwritten: it holds the only record of which device holds which token."""
+    path = map_path()
+    if not path.exists():
+        return {}
+    document = L.read_json(path)
+    tokens = document.get('tokens') if isinstance(document, dict) and document.get('version') == VERSION else None
+    if not isinstance(tokens, dict) or not all(isinstance(v, dict) for v in tokens.values()):
+        raise L.LanesError(f'{path} is not a version {VERSION} token map; move it aside (only attribution is lost: '
+                           f'`{REVOKE_ALL}` still revokes every token)')
+    return tokens
+
+
+def save_map(tokens):
+    L.atomic_write(map_path(), json.dumps({'version': VERSION, 'tokens': tokens}, indent=1, sort_keys=True) + '\n')
+
+
+def attributed(tokens, listed):
+    """The map entries that still describe a listed token: same name AND same creation time (zellij reuses a name
+    after a revocation, so a name alone can point at a token minted later, outside lanes)."""
+    created = dict(listed)
+    return {name: entry for name, entry in tokens.items() if created.get(name) == entry.get('created')}
+
+
+def wedge_advice(names):
+    return (f'zellij 0.45.1 names the next token {next_name(names)}, which exists, so it cannot create one; '
+            f'`{REVOKE_ALL}` repairs this — {SIGN_IN_AGAIN}')
+
+
+def run_attached(argv, timeout, env):
+    """argv on the caller's terminal: stdin, stdout and stderr inherited, nothing captured (the token zellij prints
+    goes to the terminal only). -> exit code, None when it did not finish in `timeout` s (killed; one bounded wait)."""
+    try:
+        child = subprocess.Popen(argv, env=env)
+    except OSError as error:
+        print(f'lanes: {error}', file=sys.stderr)
+        return 127
+    try:
+        return child.wait(timeout)
+    except subprocess.TimeoutExpired:
+        child.kill()
+        try:
+            child.wait(2)
+        except subprocess.TimeoutExpired:
+            pass
+        return None
+
+
+def mint(device, base, env, machine=None):
+    """`lanes web <device> --token`: create a login token on the caller's terminal and attribute it to `device` —
+    and to `machine` (recorded as `base`) when the view is another machine's (bin/lanes view_machine)."""
+    with token_lock():
+        tokens = load_map()
+        before = listing(base, env)
+        names = [name for name, _created in before]
+        if wedged(names):
+            print(f'lanes: {wedge_advice(names)}', file=sys.stderr)
+            return 1
+        print('\nZellij prints the new token below as NAME: TOKEN. Paste only TOKEN into the sign-in screen.\n',
+              flush=True)
+        rc = run_attached(base + ['web', '--create-token'], 60, env)
+        after = listing(base, env)
+        new = [pair for pair in after if pair not in before]
+        kept = attributed(tokens, after)
+        if len(new) == 1:
+            name, created = new[0]
+            kept[name] = {'device': device, 'created': created, 'minted_at': round(time.time(), 3)}
+            if machine and machine != device:
+                kept[name]['base'] = machine
+        if kept != tokens:
+            save_map(kept)
+    if len(new) == 1:
+        print(f'\ntoken-name: {new[0][0]} (for {device}; `lanes token revoke {device}` signs it out, '
+              '`lanes token list` shows every token)')
+        return 0
+    if rc != 0:
+        print('lanes: zellij web --create-token ' + ('did not finish in 60 s' if rc is None else f'failed (exit {rc})'),
+              file=sys.stderr)
+        return 1
+    print(f'lanes: {len(new)} new tokens appeared while this one was created (another `zellij web --create-token` '
+          f'ran at the same time?), so none is attributed to {device}; `lanes token list` shows them as not attributed',
+          file=sys.stderr)
+    return 0
+
+
+def cmd_list(base, env):
+    listed = listing(base, env)
+    kept = attributed(load_map(), listed)
+    if not listed:
+        print('no web login tokens')
+    for name, created in listed:
+        owner = kept[name]['device'] if name in kept else \
+            '(not attributed: created before LNS-50, or outside `lanes web --token`)'
+        print(f'{name:<10} {created}  {owner}')
+    names = [name for name, _created in listed]
+    if wedged(names):
+        print(f'⚠ {wedge_advice(names)}')
+    return 0
+
+
+def revoke(names, base, env):
+    """Revoke each name; a name zellij no longer knows counts as already revoked. -> [(name, outcome)]."""
+    done = []
+    for name in names:
+        rc, out, err = L.run_bounded(base + ['web', '--revoke-token', name], 20, env=env)
+        if rc == 0:
+            done.append((name, 'revoked'))
+        elif 'does not exist' in err + out:
+            done.append((name, 'already gone'))
+        else:
+            raise L.LanesError(f'zellij web --revoke-token {name}: ' + (
+                'no answer in 20 s' if rc is None else err.strip() or out.strip() or f'exit {rc}'))
+    return done
+
+
+def cmd_revoke(args, base, env):
+    if len(args) == 2 and args[0] == '--name' and NAME.match(args[1]):
+        device, wanted = None, args[1]
+    elif len(args) == 1 and not args[0].startswith('-'):
+        if not L.IDENT.match(args[0]) or len(args[0]) > 32:
+            raise L.LanesError('Invalid device name')
+        device, wanted = args[0], None
+    else:
+        raise L.LanesError(USAGE)
+    with token_lock():
+        tokens = load_map()
+        listed = listing(base, env)
+        names = [name for name, _created in listed]
+        kept = attributed(tokens, listed)
+        targets = [wanted] if wanted in names else [] if wanted else \
+            [name for name in names if kept.get(name, {}).get('device') == device]
+        if not targets:
+            if kept != tokens:
+                save_map(kept)
+            print(f'no token named {wanted} exists (`lanes token list`)' if wanted else
+                  f'no token is attributed to {device}: nothing was revoked. `lanes token list` shows the tokens; one '
+                  'that is not attributed is revoked with `lanes token revoke --name NAME`')
+            return 0
+        remaining = [name for name in names if name not in targets]
+        if wedged(remaining) and not wedged(names):
+            raise L.LanesError(
+                f"revoking {', '.join(targets)} alone would leave zellij 0.45.1 unable to create the next token (it "
+                f'would be named {next_name(remaining)}, which stays) — revoke every token instead: `{REVOKE_ALL}` '
+                f'({SIGN_IN_AGAIN})')
+        done = revoke(targets, base, env)
+        for name, _outcome in done:
+            kept.pop(name, None)
+        save_map(kept)
+    for name, outcome in done:
+        print(f'{name}: {outcome}' + (f' ({device})' if device else '')
+              + (' — its sign-in sessions are deleted: that browser signs in again' if outcome == 'revoked' else ''))
+    if wedged(remaining):
+        print(f'⚠ {wedge_advice(remaining)}')
+    return 0
+
+
+def cmd_revoke_all(args, base, env):
+    if args not in ([], ['--yes']):
+        raise L.LanesError(USAGE)
+    if args != ['--yes']:
+        names = [name for name, _created in listing(base, env)]
+        print(f"would revoke {len(names)} web login token{'s' if len(names) != 1 else ''}"
+              + (f" ({', '.join(names)})" if names else '') + f': {SIGN_IN_AGAIN}.')
+        print('nothing was changed: re-run with --yes')
+        return 2
+    with token_lock():
+        rc, out, err = L.run_bounded(base + ['web', '--revoke-all-tokens'], 20, env=env)
+        if rc != 0:
+            raise L.LanesError('zellij web --revoke-all-tokens: ' + (
+                'no answer in 20 s' if rc is None else err.strip() or out.strip() or f'exit {rc}'))
+        save_map({})
+    print(f'revoked every web login token: {SIGN_IN_AGAIN}')
+    return 0
+
+
+def offboard(devices, base, env):
+    """`lanes offboard <device>` step 3 (bin/lanes revoke_web_token) -> (status, sentence). `devices` is the offboarded
+    device first, then its windows (devices/<view>.json `base` names it). Revokes every token attributed to one of
+    them or minted with the device as its machine (`base`), and leaves every other machine's alone. Status: 'done'
+    (revoked, or nothing to revoke), 'warn' (as done, but a token nobody can attribute may be this machine's, or
+    zellij 0.45.1 cannot create the next token — the sentence names the step); a zellij that does not answer, an
+    unreadable map or the lock raise L.LanesError for the caller to report as a failed step.
+    Unlike `revoke <device>`, a revocation that blocks token creation (DEF-1711) is made anyway: the departing
+    machine is signed out first, and `revoke-all --yes` repairs creation when the next token is needed."""
+    device, wanted = devices[0], set(devices)
+    with token_lock():
+        tokens = load_map()
+        listed = listing(base, env)
+        names = [name for name, _created in listed]
+        kept = attributed(tokens, listed)
+        targets = [name for name in names if name in kept
+                   and (kept[name].get('device') in wanted or kept[name].get('base') == device)]
+        unattributed = [name for name in names if name not in kept]
+        done = revoke(targets, base, env) if targets else []
+        for name, _outcome in done:
+            kept.pop(name, None)
+        if kept != tokens:
+            save_map(kept)
+    remaining = [name for name in names if name not in targets]
+    views = f" or its views {', '.join(devices[1:])}" if len(devices) > 1 else ''
+    if done:
+        said = 'revoked ' + ', '.join(f"{name} ({tokens[name]['device']}"
+                                      + ('' if outcome == 'revoked' else ', already gone') + ')' for name, outcome in done)
+        said += ': those browsers and phones are signed out'
+    else:
+        said = f'no web login token is attributed to {device}{views}'
+    warnings = []
+    if unattributed:
+        count = len(unattributed)
+        warnings.append(f"{count} web login token{'s are' if count > 1 else ' is'} not attributed to any device "
+                        f"({', '.join(unattributed)}: minted before LNS-50, or outside `lanes web --token`); if this "
+                        'machine signed in with one, `lanes token revoke --name NAME`, or `lanes token revoke-all '
+                        f'--yes`: {SIGN_IN_AGAIN}')
+    if wedged(remaining):
+        warnings.append(wedge_advice(remaining))
+    return ('warn' if warnings else 'done'), '; '.join([said] + warnings)
+
+
+def main(args, base, env):
+    """`lanes token …` (bin/lanes cmd_token): `base` is the pinned zellij argv, `env` the token environment."""
+    if args == ['list']:
+        return cmd_list(base, env)
+    if args[:1] == ['revoke']:
+        return cmd_revoke(args[1:], base, env)
+    if args[:1] == ['revoke-all']:
+        return cmd_revoke_all(args[1:], base, env)
+    raise L.LanesError(USAGE)

package/payload/lanes/site/README.md

@@ -16,11 +16,23 @@ workspace-server ssh-ed25519 AAAA...verified-public-host-key...
 Use the alias from `LANES_SERVER_ALIAS`. Get the key from the administrator or an already trusted server
 session (`/etc/ssh/ssh_host_ed25519_key.pub`); a network key scan alone does not authenticate it.
 
+`LANES_SERVER_NAME` is the server's MagicDNS name. When it ends in `.ts.net`, the client installer checks that the
+machine is in the tailnet before it tries the server: it names the Tailscale install command when Tailscale is
+missing and opens `tailscale login` when the machine is logged out. Leave it out for a server outside a tailnet.
+When the client resolves the name, its SSH alias `lanes` uses it, with `LANES_SERVER_HOST` kept as the fallback alias
+`lanes-ip`. The server's enrolment service answers under it too (`https://<name>:8443/enrol/`).
+
+`LANES_SITE_CODE` (optional, 1-8 letters) is the prefix of this site's invite codes (`LN` for `beyondwork`). The npm
+package picks a bundled profile by it (`npx @vibelord/lanes --invite LN-…`), and the installer refuses a code with
+another prefix. Keep it unique among the profiles you distribute.
+
 For the existing Beyond Work server, select `./install.sh --site site/beyondwork/site.conf` explicitly.
 That directory preserves the existing deployment address and pinned public key as one named profile.
 
 The installer saves a client-owned copy of the profile and key in `~/.config/lanes/client-site.conf` and
-`client-known-hosts`. Updates and `--check` reuse them. To switch deployments, pass `--site` again.
+`client-known-hosts`, and remembers the choice in `~/.config/lanes/install-options` (`SITE=`: a profile bundled
+with the package by its directory name, so an update copies the new package's profile and pinned key; your own file
+by its absolute path). Updates and `--check` reuse them. To switch deployments, pass `--site` again.
 SSH refuses changed host keys until the administrator's new fingerprint has been verified.
 
 Server-side board catalogs belong in `~/.config/lanes/workspaces/`; real workspaces, credentials and generated

package/payload/lanes/site/beyondwork/site.conf

@@ -3,6 +3,9 @@
 # fallback address) is fetched from the server once the client is authorized:  lanes client-config
 LANES_SITE_SCHEMA=1
 LANES_SITE=beyondwork
+# invite codes for this site start with this prefix (LN-xxxx-xxxxxxxxxxxx): `npx @vibelord/lanes --invite LN-…` picks
+# this profile by it, and install.sh refuses a code with another prefix
+LANES_SITE_CODE=LN
 # known_hosts alias the server's host key is pinned under (site/known_hosts)
 LANES_SERVER_ALIAS=ceobox
 # Tailscale address of the server (the address is only meaningful inside the tailnet) and its MagicDNS name

package/payload/lanes/site/site.example.conf

@@ -2,8 +2,13 @@
 # Plain data, not a shell script. Put the matching public host key in site/known_hosts.
 LANES_SITE_SCHEMA=1
 LANES_SITE=my-team
+# Optional: the prefix of this site's invite codes (letters; the server's `lanes invite` mints <CODE>-xxxx-xxxxxxxxxxxx).
+# A profile bundled with the npm package is chosen by it (`npx @vibelord/lanes --invite <CODE>-…`); install.sh
+# refuses a code with another prefix. One prefix per site.
+# LANES_SITE_CODE=MT
 LANES_SERVER_ALIAS=workspace-server
 LANES_SERVER_HOST=workspace-server.example.ts.net
+# MagicDNS name; a *.ts.net name makes the installer check Tailscale (and open its login) before the server
 LANES_SERVER_NAME=workspace-server.example.ts.net
 LANES_SERVER_USER=workspace
 # Optional public SSH fallback (use only if your server exposes SSH there):

package/payload/lanes/sudo/one-time-root.sh

@@ -29,4 +29,4 @@ if [ "$keepalive" = 1 ]; then
         fi
     fi
 fi
-printf 'Next, as %s: sh ~/.local/share/lanes/current/install/enable-phone.sh --local\n' "$user"
+printf 'Next, as %s in your own terminal: lanes web phone --mobile --token (or any device; --desktop for a browser)\n' "$user"

package/payload/lanes/systemd/lanes-enrold.service

@@ -0,0 +1,22 @@
+[Unit]
+Description=lanes enrolment service (invite redemption, requests, approvals) on loopback 127.0.0.1:8184
+
+# Enabled and restarted by every server install (install/host-install.sh). lanes-mobile's Caddy forwards
+# https://<host>:8443/enrol/* here (web/Caddyfile `handle_path /enrol/*`). It writes the workspace account's
+# ~/.ssh/authorized_keys (the lanes-managed block, libexec/keys.py) and ~/.local/state/lanes/{invites,
+# enrol-requests,members}/, so it has no ProtectHome. Request mode is pinned with `lanes enrol mode request|invite`
+# after the Serve header check (~/.local/state/lanes/enrol-mode, read on every request, kept across restarts and
+# re-installs). Optional settings (LANES_ENROL_DOMAINS, and LANES_ENROL_REQUEST_MODE, which wins over the pin) go in a
+# drop-in, `systemctl --user edit lanes-enrold.service`, which a re-install keeps (RUNBOOK "Enrolment service").
+[Service]
+ExecStart=/usr/bin/python3 -S -E "@REPO@/libexec/enrold.py"
+Restart=on-failure
+RestartSec=10
+NoNewPrivileges=true
+UMask=0077
+MemoryHigh=48M
+MemoryMax=96M
+Slice=lanes.slice
+
+[Install]
+WantedBy=default.target

package/payload/lanes/systemd/lanes-notify.service

@@ -1,10 +1,10 @@
 [Unit]
-Description=lanes push notifications (opt-in: POSTs needs-you transitions from status.json to an ntfy topic)
+Description=lanes push notifications (opt-in: POSTs needs-you transitions and new enrolment requests to an ntfy topic)
 After=lanes-statusd.service
 
-# No installer enables this unit. It sends lane names and agent tasks to the ntfy server in
-# ~/.config/lanes/notify.conf (LANES_NOTIFY_CONF), so switching it on is an operator action:
-# systemctl --user enable --now lanes-notify.service (RUNBOOK "Push notifications (opt-in)").
+# No installer enables this unit. It sends lane names, agent tasks and enrolment requesters' names, logins and
+# device names to the ntfy server in ~/.config/lanes/notify.conf (LANES_NOTIFY_CONF), so switching it on is an
+# operator action: systemctl --user enable --now lanes-notify.service (RUNBOOK "Push notifications (opt-in)").
 [Service]
 ExecStart=/usr/bin/python3 -S -E "@REPO@/libexec/notify.py" --interval 3
 Restart=on-failure

package/payload/lanes/systemd/lanes-web.service

@@ -3,6 +3,10 @@ Description=lanes: zellij web server on loopback only (tailnet exposure is a sep
 
 [Service]
 ExecStart="@SHARE@/bin/zellij-0.45.1" --config-dir "@REPO@/zellij" --config "@REPO@/zellij/config.kdl" web --start --ip 127.0.0.1 --port 8082
+# Zellij validates web sign-ins against $XDG_DATA_HOME/zellij/tokens.db. Pinned here, never left to the user manager's
+# environment block; `lanes web --token` and `lanes token` run zellij with the same root (bin/lanes WEB_DATA_HOME), and
+# `lanes doctor` compares it with this server's running environment.
+Environment=XDG_DATA_HOME=%h/.local/share
 Restart=always
 RestartSec=5
 MemoryHigh=512M

package/payload/lanes/web/Caddyfile

@@ -18,6 +18,16 @@ http://:8083 {
 		header Cache-Control "no-cache"
 		file_server
 	}
+	# lanes-enrold.service (libexec/enrold.py): invite redemption, enrolment requests, /enrol/pending approvals.
+	# handle_path strips /enrol; it must come before the Zellij routes below.
+	handle_path /enrol/* {
+		reverse_proxy 127.0.0.1:8184 {
+			# Tailscale Serve connects from loopback and sets X-Forwarded-For to the client's tailnet address.
+			# Trusting that peer keeps the header (Caddy appends 127.0.0.1), so the redeem rate limit counts per
+			# device; untrusted, Caddy replaces it with 127.0.0.1 and every device shares one bucket. Caddy >= 2.5.
+			trusted_proxies 127.0.0.0/8
+		}
+	}
 	@backend path /assets/* /ws/* /command/* /info/* /session /session-list
 	handle @backend {
 		reverse_proxy 127.0.0.1:8082

package/payload/lanes/web/README.md

@@ -37,8 +37,14 @@ before the control socket opens makes 0.45.1 throw `InvalidStateError` and leave
 
 `lanes-mobile.service` runs a separate, loopback-only Caddy on port 8083 with its admin API disabled.
 It does not change the system Caddy. Tailscale Serve forwards private HTTPS on 8443 to this frontend;
-the original Zellij service stays on 8082. Caddy must already be installed on the host.
-Run `sh install/enable-phone.sh --host lanes` from an installed client, or `--local` on the server.
+the original Zellij service stays on 8082. Caddy (2.5 or later) must already be installed on the host. `/enrol/*` is
+the one route that is neither these assets nor Zellij: `handle_path` strips `/enrol` and forwards to the enrolment
+service on 127.0.0.1:8184 (`lanes-enrold.service`, [runbook](../docs/RUNBOOK.md#enrolment-service-lanes-enrold-w8-a3));
+it must stay before the Zellij routes, and its `trusted_proxies 127.0.0.0/8` keeps the `X-Forwarded-For` Tailscale
+Serve sets (the client's tailnet address), so the redeem rate limit counts per device.
+Run `lanes web <device> --token` on the server (it also adds that Tailscale Serve mapping when it is missing),
+`lanes-launch web phone|laptop` from an installed client, or `sh install/enable-phone.sh --host lanes` (`--local` on
+the server).
 The [installation guide](../docs/INSTALL.md) covers Caddy, Tailscale operator permission and the selected SSH key.
 Service registration supplies `LANES_REPO` so Caddy serves the actual checkout from any installation path.
 

package/payload/lanes/workspaces.example/README.md

@@ -6,7 +6,12 @@ The server reads its boards from a **site directory**, not from the package:
 2. `~/.config/lanes/workspaces/` on the server, if it contains a `catalog.json`;
 3. `workspaces/` inside the checkout (what a single-site checkout uses).
 
-Copy this folder to `~/.config/lanes/workspaces/` and edit it.
+Copy this folder to `~/.config/lanes/workspaces/` and edit it, or let the server write a one-repository board for you:
+`lanes workspaces add <id> --container <name> --repo /home/coder/<repo> [--title T] [--write]` appends the board to
+`catalog.json` (keeping a `catalog.json.bak-<UTC>Z` copy on the first write) and creates its `workspaces.<id>.json`.
+It is a dry run until `--write`. An id that is already in the catalog is checked and never rewritten. A repository
+belongs to one board: one that another board already declares is refused, since `lanes cursor-sync` rewrites a
+repository's `terminals.json` (and a `cursor` file) for every board that names it. Keep that rule when editing by hand.
 
 | File | What it says |
 |---|---|

package/payload/manifest.json

@@ -1,8 +1,8 @@
 {
  "name": "@vibelord/lanes",
- "version": "1.0.4",
- "commit": "6b92bcb292e4123f2d723f0fe9da209642c2f2a2",
- "digest": "sha256:130e2da52ee8a4999a51e351c4bf3faef4a1d9e309ebd946e04c861742dfa719",
+ "version": "1.1.0",
+ "commit": "3d79500ae78bdd95a81cc9ef59f1cdcef1cde5cc",
+ "digest": "sha256:690fa7bb4e929589101ca519afea682f3084ca977b3244d1567e653f9aa172ba",
  "executables": [
   "bin/lanes",
   "client/install.sh",
@@ -32,5 +32,8 @@
  ],
  "sites": [
   "beyondwork"
- ]
+ ],
+ "site_codes": {
+  "LN": "beyondwork"
+ }
 }