@lanes-sh/link 0.4.0 → 0.5.0

package/README.md

@@ -4,10 +4,10 @@
 [![license Apache-2.0](https://img.shields.io/github/license/lanes-sh/link?style=flat-square&color=black)](LICENSE)
 [![ci](https://img.shields.io/github/actions/workflow/status/lanes-sh/link/ci.yml?branch=main&style=flat-square&label=ci)](https://github.com/lanes-sh/link/actions/workflows/ci.yml)
 
-**One secure endpoint between your AI agents and all your connections, memory, skills, and secrets.**
+**One secure endpoint between your AI agents and all your connections, memory, tasks, files, and secrets.**
 
-Connect your mail, calendar, files, and notes once, and add the memory and skills that only you
-have. Every agent you use — Claude, ChatGPT, and anything else that speaks MCP — reaches them
+Connect your mail, calendar, files, and notes once, and add the memory, tasks, and procedures that
+only you have. Every agent you use — Claude, ChatGPT, and anything else that speaks MCP — reaches them
 through a single MCP endpoint that you own and run. Open source, self-hostable, no vendor sitting in
 the middle of your data.
 
@@ -38,6 +38,9 @@ the middle of your data.
 - **One set of notes behind every agent.** What you have Claude Code write down, claude.ai reads
   back later — your accumulated context follows you between tools instead of being trapped in
   whichever one recorded it.
+- **A to-do list your agents share.** "Remind me to chase the invoice" lands somewhere with a
+  status, so whichever agent you are talking to next knows it is still open — and knows when it
+  is done.
 - **Your own procedures, followed rather than guessed.** How a standup update reads, where an
   invoice gets filed, who gets cc'd on a contract — written down once, and every agent you use
   follows the same one.
@@ -62,9 +65,9 @@ ok    registered lanes-link with Claude Code (user scope)
 ok    registered lanes-link with Codex
 ```
 
-Your agents can now use it. Memory, skills, and the vault hold your own material rather than an
-account, so switching them on costs nothing — one command each, no credentials, no browser. Mail and
-calendar are the next step. **[Full quickstart →](docs/quickstart.md)**
+Your agents can now use it. Memory, tasks, files, skills, and the vault hold your own material
+rather than an account, so they are already there — nothing to connect, no credentials, no browser.
+Mail and calendar are the next step. **[Full quickstart →](docs/quickstart.md)**
 
 ## What your agent gets
 
@@ -72,11 +75,19 @@ calendar are the next step. **[Full quickstart →](docs/quickstart.md)**
 |---|---|---|
 | **Connections** | your external accounts — mail, calendar, files, issues | `lanes link connect` |
 | **Memory** | what you want remembered between sessions | `lanes link memory` |
+| **Tasks** | what you have to do, each with a status | `lanes link tasks` |
+| **Assets** | files you want kept, by name | `lanes link assets` |
 | **Skills** | your own procedures, handed to an agent as instructions | `lanes link skills` |
 | **Vault** | passwords and API keys, released only where you allow it | `lanes link vault` |
 
-Memory and skills are plain Markdown files, so a text editor and an agent reach the same bytes. All
-four belong to one profile: what you add under `work` is invisible under `personal`.
+The first five arrive switched on: they hold your own material rather than an account, so there was
+never anything to authorise. Memory, tasks, and skills are plain Markdown files and an asset is
+stored under its own filename, so a text editor and an agent reach the same bytes. Every one of them
+belongs to a single profile: what you add under `work` is invisible under `personal`.
+
+Which store a thing goes in is the one thing worth knowing. **Memory is what is true, tasks is what
+is to be done, assets is a file.** "Remember to chase the invoice" is a task — filed as memory it
+becomes a note nothing can ever close. Your agents are told this too.
 
 Keep those two in a private GitHub repository instead of on this machine, and get history, diffs,
 and the same notes from anywhere you run this:
@@ -100,7 +111,7 @@ One command per account. Run it again to add a second mailbox, a second calendar
 | Google Sheets | `lanes link connect sheets` |
 | Google Docs | `lanes link connect docs` |
 | Google Calendar | `lanes link connect calendar` |
-| Google Tasks | `lanes link connect tasks` |
+| Google Tasks | `lanes link connect google_tasks` |
 | Google Contacts | `lanes link connect contacts` |
 | iCloud Mail | `lanes link connect icloud_mail` |
 | iCloud Calendar | `lanes link connect icloud_calendar` |

package/instructions/agents/lanes-link-scout.md

@@ -1,6 +1,6 @@
 ---
 name: lanes-link-scout
-description: Use when answering a question needs a wide read across someone's Lanes Link context — searching their memory, mail, files, and issues for the same thing and reporting back what is there. Good for "have I discussed X anywhere", "find everything about this client", "what do we already know about Y". Not for acting on what it finds: this agent reads and reports, and every write stays in the main thread.
+description: Use when answering a question needs a wide read across someone's Lanes Link context — searching their memory, tasks, files, mail, and issues for the same thing and reporting back what is there. Good for "have I discussed X anywhere", "find everything about this client", "what do we already know about Y". Not for acting on what it finds: this agent reads and reports, and every write stays in the main thread.
 ---
 
 # Lanes Link scout
@@ -30,11 +30,22 @@ that answers the question, not the surrounding thread.
 Ask the endpoint what it has rather than assuming. Its instructions name the
 profiles and connections that are actually reachable.
 
-**Start with memory.** It is the only source that is already the owner's own
-distillation, and it is small enough to search several ways cheaply. Substring
+**Start with memory, then tasks.** Both are already the owner's own
+distillation, and both are small enough to search several ways cheaply. Substring
 matching, not ranked relevance — so try the obvious phrasing, then a synonym,
 then a narrower fragment, before concluding something is not there.
 
+Tasks are worth the second look rather than an afterthought: an open one is often
+the actual answer to "what do we already know about X", and it carries something
+memory cannot — that the matter is unfinished. Say so when it is, and say which
+status: *blocked since June* is a different answer from *open*. `tasks.list`
+hides finished work by default, so ask for `done` when the question is historical.
+
+**Assets are a listing, not a corpus.** `assets.list` tells you a file exists,
+its type and its size; only a text one reads back. Report that a document is
+there and let the main thread decide what to do with it — do not try to get at
+the contents of a binary, and never ask for it as base64.
+
 **Then the accounts,** narrowing by whatever the provider gives you — a date
 range, a label, a folder. A broad query returning two hundred results and a
 narrow one returning none are both failures; move between them deliberately

package/instructions/skills/lanes-link/SKILL.md

@@ -40,9 +40,10 @@ failure. Four levels:
   `lanes link deploy` and `lanes link sync targets` act on one endpoint serving
   every profile that declares that target. `--profile` is accepted and *narrows*
   the answer; it does not choose the subject.
-- **Both.** Everything acting on one account: `lanes link connect`,
-  `lanes link token rotate`, `lanes link secrets set`, `lanes link policy allow`,
-  `lanes link memory list`, `lanes link mcp add`.
+- **Both.** Everything acting on one account, and everything reaching the
+  owner's own stores: `lanes link connect`, `lanes link token rotate`,
+  `lanes link secrets set`, `lanes link policy allow`, `lanes link memory list`,
+  `lanes link tasks list`, `lanes link assets list`, `lanes link mcp add`.
 
 `lanes link profile add` and `lanes link profile remove` **reject** `--profile`.
 Both name their profile positionally, so a flag naming a second one could only
@@ -55,6 +56,30 @@ A `connection` names an account within that profile. One profile may hold
 several of the same kind, and naming a connection belonging to a *different*
 profile is refused rather than guessed at.
 
+## Which store a thing goes in
+
+Three of them hold what the owner keeps, and they divide by what a thing *is*.
+Getting this wrong is the most common way to be unhelpful here, because nothing
+refuses it — the write succeeds, in the wrong place, and stays there.
+
+- **memory** — what is *true*. A fact, a preference, a decision, how something
+  works. It has no state, because a fact does not finish.
+- **tasks** — what is to be *done*. It carries a status, so it can be closed.
+- **assets** — a *file*. Bytes, kept under a name.
+
+**"Remember to…" is a task, not a memory entry.** So are "add a todo", "don't
+let me forget", "put this on my list", and anything with a deadline in it. Filed
+as memory it becomes a note that nothing can ever close, and it will be read
+back to them as a fact forever. The give-away is a verb: *chase the invoice* is
+a task, *invoices are paid on the 1st* is memory.
+
+The reverse matters too. **A fact with no action in it is not a task.** Filing
+one as a task puts something on a list that can never legitimately be marked
+done.
+
+And **a procedure is neither** — see the next section. If they say "always do X
+when Y", that is a skill they should write, not a memory entry describing it.
+
 ## Reach for memory before answering from nothing
 
 `memory.search` before concluding you do not know something about this person or
@@ -66,6 +91,51 @@ every later session, including to a different agent, so **write when you are
 asked to remember something, not as a habit.** The owner reaches the same
 entries with `lanes link memory list --profile <name> --target <name>` and a text editor.
 
+## Tasks have a status, so finish them rather than deleting them
+
+`tasks.list` answers what is outstanding. It shows `in_progress`, `open` and
+`blocked` and hides the rest, so a listing is what is left to do rather than
+everything that ever was — name a status to see more.
+
+Six of them, and the two that are easy to confuse are worth learning:
+
+| | |
+|---|---|
+| `in_progress` | started |
+| `open` | not started |
+| `blocked` | waiting on something that is not the owner |
+| `muted` | deliberately not being surfaced — they asked not to be reminded |
+| `done` | finished |
+| `dropped` | decided against, which is not the same as finished |
+
+**Closing a task is `tasks.update` with a status, never `tasks.remove`.** The
+record of having done it is the useful half, and it is what stops the same thing
+being suggested again next week. Remove is for something recorded by mistake.
+
+Do not mute a task on your own initiative. It means "stop telling me about
+this", which is the owner's judgement, not yours.
+
+They manage these with `lanes link tasks list --profile <name> --target <name>`.
+
+## Assets are files kept by name
+
+Storing one names a source and the endpoint reads the bytes — the same five
+sources the attachments section below describes, and the same rule: **never
+encode a file into the call.** The name is the address; there is no id and no
+description, so what a file is *for* belongs in memory, next to its name.
+
+Reading gives you text when the file is text. Anything else comes back described
+— name, type, size, digest — and that is not a refusal to work around. There is
+no form of a read that hands you a PDF, and a megabyte of base64 in the
+conversation would not help you if there were.
+
+To attach a stored file to something you are sending, ask the owner to run
+`lanes link attach <file> --profile <name> --target <name> --connection <provider>.<account>`,
+which prints a handle the send tools take. An asset's own store is not reachable
+from a mailbox's, deliberately.
+
+They manage these with `lanes link assets list --profile <name> --target <name>`.
+
 ## Skills are theirs, not yours
 
 A skill is a procedure the owner wrote down. They arrive as prompts — slash
@@ -164,6 +234,13 @@ before suggesting that anything be connected. It names the accounts reachable in
 profile and the providers that are not connected yet. `setup_provider` then gives
 one provider's console steps, the values it will ask for, and the exact command.
 
+**Memory, tasks, assets, skills and the vault need no setup at all.** They hold
+the owner's own material rather than an account, so a profile arrives with all
+five already reachable — there is no command to run and nothing to connect. If
+one is missing, it was switched off with a `deny`, which is their decision; do not
+offer to connect it. What setup is for is accounts: mail, calendar, files,
+issues.
+
 **Take the command from `setup_provider`; never compose one yourself.** It carries
 the right profile and, where the provider stores a credential per account, the
 `--id` it needs. A command you assembled is one the owner pastes and watches fail.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lanes-sh/link",
-  "version": "0.4.0",
-  "description": "A self-hostable MCP gateway for all your connections, memory, skills, and secrets",
+  "version": "0.5.0",
+  "description": "A self-hostable MCP gateway for all your connections, memory, tasks, files, and secrets",
   "license": "Apache-2.0",
   "homepage": "https://lanes.sh/link",
   "repository": {

package/src/cli/argv.ts

@@ -117,6 +117,13 @@ export function ownerFlags(flags: Flags): OwnerFlags {
     tag: text(flags, 'tag'),
     description: text(flags, 'description'),
     file: text(flags, 'file'),
+    status: text(flags, 'status'),
+    // `text` keeps an empty string, which matters for exactly this flag:
+    // `--due ""` is how `tasks update` clears a date, and `undefined` is how it
+    // leaves one alone. The two are different intentions.
+    due: text(flags, 'due'),
+    name: text(flags, 'name'),
+    contentType: text(flags, 'content-type'),
     yes: flags['yes'] === true,
   };
 }

package/src/cli/commands/connect/index.ts

@@ -1,6 +1,6 @@
 import { credentialRefForConnection, WRITE_BUNDLE } from '#connectivity';
 import { ConfigDocument } from '../../config-edit.ts';
-import { ensureSetupConnection, repaired } from '../../config-repair.ts';
+import { ensureOwnerLayer, repaired } from '../../config-repair.ts';
 import { emit, print } from '../../output.ts';
 import { nonInteractivePrompter, terminalPrompter, type Prompter } from '../../prompt.ts';
 import { openRuntime, type GlobalFlags } from '../../runtime.ts';
@@ -334,26 +334,29 @@ export async function runConnect(
     // 5. Grant it — one rule per provider; `grant.ts` says why not per capability.
     const granted = grantProvider(document, runtime.config.policy.allow, providerId);
 
-    // 6. Repair the setup surface if this profile predates it.
+    // 6. Repair the owner layer if this profile predates it.
     //
     //    Connecting is the moment it matters: the operator is adding something
     //    an agent will be asked about, and a profile with no `setup` row serves
     //    no `setup_overview` — so the agent has nothing to read and invents a
     //    command instead. `doctor` reports this, but a deployed operator never
-    //    runs it, which is how it stayed broken.
+    //    runs it, which is how it stayed broken. The same argument now covers
+    //    memory, tasks, assets, skills and the vault (ADR-050): a profile
+    //    written before they were default has no rows for them, and none of them
+    //    reaches an account, so there is nothing for the operator to decide.
     //    Each half goes to the field that is for it. `emit` serialises both
     //    verbatim under `--json`: `changes` is a list of config edits, so a
     //    sentence in it is something a caller counting edits has to recognise
     //    and skip, and `granted` is the field that answers "what did this widen"
     //    — an audit reading it would have missed `setup.*` entirely.
-    const repair = ensureSetupConnection(document);
+    const repair = ensureOwnerLayer(document);
     changes.push(...repair.changes);
     granted.push(...repair.granted);
 
     // The explanation is prose, so it goes where prose goes. Without it the
-    // operator has two lines naming a provider they never asked for.
+    // operator has a block of lines naming providers they never asked for.
     const notes = repaired(repair)
-      ? ['that is the setup surface — it lets an agent see what is connected here']
+      ? ['that is your own memory, tasks, assets, skills and vault — no account, nothing stored until you use them']
       : [];
 
     if (changes.length === 0 && granted.length === 0) {

package/src/cli/commands/connection.ts

@@ -0,0 +1,298 @@
+import { RESERVED_PROVIDER_IDS } from '#connectivity';
+import { credentialRefFor } from '#registry';
+import type { ConnectionConfig, Config, Resolution } from '#profile';
+import { ConfigDocument } from '../config-edit.ts';
+import { announce, emit, ok, print, style, warn } from '../output.ts';
+import { openRuntime, type GlobalFlags } from '../runtime.ts';
+import { nextAfterEdit, publishProfileEdit } from '../publish.ts';
+import { confirm, isInteractive } from '../prompt.ts';
+
+/**
+ * `lanes link disconnect` and `lanes link relabel` — the two edits to an
+ * existing connection that were not possible without opening the YAML.
+ *
+ * Both are control-plane commands under ADR-007: they write the profile config,
+ * and `disconnect` also deletes from the target's credential store. Neither is
+ * reachable through MCP, for the same reason `connect` is not.
+ *
+ * `disconnect` is the counterpart to `connect`, and deliberately not "delete":
+ * the state record is left alone. Reconcile marks an undeclared connection
+ * `disabled` rather than deleting it so the audit log keeps meaning something,
+ * and a command that reached past that to erase the record would be undoing the
+ * one guarantee the audit log offers.
+ *
+ * Each command is a data function plus a printing wrapper, the shape
+ * `commands/identity.ts` uses: `--json` needs the facts without the rendering.
+ */
+
+/** Where a connection is, and what it says, before anything is changed. */
+interface Located {
+  readonly index: number;
+  readonly connection: ConnectionConfig;
+}
+
+export interface Disconnected {
+  readonly profile: string;
+  readonly target: string;
+  readonly key: string;
+  readonly account: string;
+  /**
+   * The credential reference this removed, if it removed one. `null` when the
+   * provider has none (the owner layer), when `--keep-credential` was passed, or
+   * when a sibling connection still resolves to the same reference.
+   */
+  readonly credential: string | null;
+  /** Set when the credential was left because something else still needs it. */
+  readonly credentialSharedWith: readonly string[];
+  readonly remaining: number;
+  readonly published: string;
+}
+
+export interface Relabelled {
+  readonly profile: string;
+  readonly target: string;
+  readonly key: string;
+  readonly from: string;
+  readonly to: string;
+  readonly published: string;
+}
+
+export interface DisconnectFlags extends GlobalFlags {
+  readonly yes?: boolean | undefined;
+  readonly keepCredential?: boolean | undefined;
+  readonly json?: boolean | undefined;
+}
+
+export interface RelabelFlags extends GlobalFlags {
+  readonly json?: boolean | undefined;
+}
+
+/**
+ * Find the one connection a key names.
+ *
+ * The key must be exact — `gmail.main`, never `gmail`. `connect` accepts the
+ * bare provider because it can then create an account and choose the id; there
+ * is nothing to choose here, and a bare `gmail` with two accounts declared would
+ * be a command guessing which one to throw away.
+ */
+function locate(config: Config, key: string, profile: string): Located {
+  if (!key.includes('.')) {
+    const matches = config.connections.filter((one) => one.provider === key);
+    throw new Error(
+      `"${key}" names a provider, not a connection.\n` +
+        (matches.length > 0
+          ? `  This profile declares ${matches.map((one) => `${one.provider}.${one.id}`).join(', ')}.\n`
+          : '') +
+        `  Run: lanes link status --profile ${profile}`,
+    );
+  }
+
+  const index = config.connections.findIndex((one) => `${one.provider}.${one.id}` === key);
+  if (index === -1) {
+    throw new Error(
+      `Profile "${profile}" does not declare "${key}".\n` +
+        `  Run: lanes link status --profile ${profile}`,
+    );
+  }
+
+  return { index, connection: config.connections[index] as ConnectionConfig };
+}
+
+/**
+ * Refuse for a reserved provider, and say what to do instead.
+ *
+ * `memory`, `skills`, `vault`, `setup` and `identity` are not accounts — they are
+ * what the profile is *for*, they hold no credential, and each is granted by a
+ * policy line this command does not touch. Removing the connection alone would
+ * leave the policy granting `memory.*` against nothing: a config that is wrong
+ * rather than merely untidy, which is the same reason `knowledge use` takes its
+ * own block back. Hand-editing is the honest path and the file says so.
+ */
+function refuseReserved(key: string, provider: string, path: string): void {
+  if (!RESERVED_PROVIDER_IDS.includes(provider)) return;
+  throw new Error(
+    `"${key}" is part of what this profile is, not an account it holds.\n` +
+      `  ${provider} keeps no credential, and its policy grant is a separate line this command does not touch.\n` +
+      `  To remove it, delete both from ${path} by hand.`,
+  );
+}
+
+/**
+ * Which other connections resolve to the same credential reference.
+ *
+ * The check exists because a reference is not always per connection. An OAuth
+ * provider derives `<provider>/<id>` and is safe, but a manifest declaring
+ * `credential_ref: mything/api_key` shares one reference across every connection
+ * of that provider — so deleting it while a sibling still resolves to it would
+ * take that sibling's credential with it, and the sibling would report
+ * `unauthorized` for a `connect` nobody ran.
+ */
+export function connectionsSharingCredential(
+  config: Config,
+  ref: string,
+  exceptIndex: number,
+  manifestFor: (provider: string) => Parameters<typeof credentialRefFor>[1],
+): string[] {
+  return config.connections
+    .filter((one, i) => i !== exceptIndex && credentialRefFor(one, manifestFor(one.provider)) === ref)
+    .map((one) => `${one.provider}.${one.id}`);
+}
+
+export async function removeConnection(
+  key: string,
+  flags: DisconnectFlags,
+): Promise<{ resolution: Resolution; disconnected: Disconnected } | null> {
+  const runtime = await openRuntime(flags);
+
+  try {
+    const { resolution, config, target } = runtime;
+    const located = locate(config, key, resolution.profile);
+    const document = await ConfigDocument.open(resolution.workspaceRoot, resolution.profile);
+
+    refuseReserved(key, located.connection.provider, document.path);
+
+    if (!(await confirmed(key, flags))) return null;
+
+    const manifestFor = (provider: string) => runtime.registry.get(provider)?.manifest;
+    const ref = credentialRefFor(located.connection, manifestFor(located.connection.provider));
+    const shared = ref ? connectionsSharingCredential(config, ref, located.index, manifestFor) : [];
+
+    // The config edit first. If deleting the credential fails, a connection left
+    // declared with no credential reports `unauthorized`, which is recoverable by
+    // running `connect`. The reverse — credential gone, declaration kept, edit
+    // failed — is the same state, so ordering costs nothing either way; doing the
+    // edit first means the file is right even if the store is unreachable.
+    document.removeFrom(['connections'], located.index);
+    await document.save();
+
+    let removed: string | null = null;
+    if (ref && shared.length === 0 && flags.keepCredential !== true) {
+      await runtime.credentials.delete(ref);
+      removed = ref;
+    }
+
+    return {
+      resolution,
+      disconnected: {
+        profile: resolution.profile,
+        target,
+        key,
+        account: located.connection.account,
+        credential: removed,
+        credentialSharedWith: shared,
+        remaining: config.connections.length - 1,
+        published: nextAfterEdit(await publishProfileEdit({ resolution, config, target })),
+      },
+    };
+  } finally {
+    await runtime.close();
+  }
+}
+
+/** A plain y/N. Not `profile remove`'s type-the-name, which guards the
+ *  destruction of whole stores; this takes back one authorisation that `connect`
+ *  can grant again. */
+async function confirmed(key: string, flags: DisconnectFlags): Promise<boolean> {
+  if (flags.yes === true) return true;
+  if (!isInteractive()) {
+    throw new Error(
+      `Disconnecting "${key}" deletes its credential, and stdin is not a terminal, so there is nobody to ask.\n` +
+        `  Pass --yes to proceed.`,
+    );
+  }
+  // Defaults to no: this deletes a credential, and a stray return should not.
+  return confirm(`Disconnect ${key} and delete its credential?`, false);
+}
+
+export async function disconnect(key: string | undefined, flags: DisconnectFlags): Promise<void> {
+  if (!key) throw new Error('Which connection? Run: lanes link status');
+
+  const outcome = await removeConnection(key, flags);
+  if (outcome === null) {
+    print(warn('nothing was changed'));
+    return;
+  }
+  const { resolution, disconnected: result } = outcome;
+
+  return emit(flags.json, result, () => {
+    announce(resolution);
+    print(ok(`disconnected ${style.bold(result.key)}${result.account ? ` (${result.account})` : ''}`));
+
+    if (result.credential) {
+      print(`      credential  ${style.dim(result.credential)} deleted`);
+    } else if (result.credentialSharedWith.length > 0) {
+      // Named rather than silent: the operator asked for a credential to go and
+      // it did not, and the reason is a fact about their config.
+      print(
+        `      credential  kept — ${result.credentialSharedWith.join(', ')} still ${
+          result.credentialSharedWith.length === 1 ? 'resolves' : 'resolve'
+        } to it`,
+      );
+    }
+
+    print(style.dim(`      ${result.remaining} connection(s) left in this profile.`));
+    // The state record survives on purpose, and the next reconcile is what marks
+    // it disabled. Saying so stops "it is still in `status`" reading as a failure.
+    print(
+      style.dim(
+        '      The state record stays until the next reconcile, which marks it disabled rather than deleting it.',
+      ),
+    );
+    if (result.published) print(style.dim(`      ${result.published}`));
+  })
+}
+
+export async function renameConnection(
+  key: string,
+  account: string,
+  flags: RelabelFlags,
+): Promise<{ resolution: Resolution; relabelled: Relabelled }> {
+  const runtime = await openRuntime(flags);
+
+  try {
+    const { resolution, config, target } = runtime;
+    const located = locate(config, key, resolution.profile);
+    const document = await ConfigDocument.open(resolution.workspaceRoot, resolution.profile);
+
+    document.setIn(['connections', located.index, 'account'], account);
+    await document.save();
+
+    return {
+      resolution,
+      relabelled: {
+        profile: resolution.profile,
+        target,
+        key,
+        from: located.connection.account,
+        to: account,
+        published: nextAfterEdit(await publishProfileEdit({ resolution, config, target })),
+      },
+    };
+  } finally {
+    await runtime.close();
+  }
+}
+
+export async function relabel(
+  key: string | undefined,
+  account: string | undefined,
+  flags: RelabelFlags,
+): Promise<void> {
+  if (!key) throw new Error('Which connection? Run: lanes link status');
+  if (!account) throw new Error(`What should ${key} be called? Run: lanes link relabel ${key} "New name"`);
+
+  const { resolution, relabelled: result } = await renameConnection(key, account, flags);
+
+  return emit(flags.json, result, () => {
+    announce(resolution);
+    print(ok(`${style.bold(result.key)} is now ${style.bold(result.to)}`));
+    if (result.from) print(`      was     ${style.dim(result.from)}`);
+    // The label is a display name in two places, and only one of them changed.
+    print(
+      style.dim(
+        '      The state store keeps the old name until the next reconcile, which updates it.',
+      ),
+    );
+    if (result.published) print(style.dim(`      ${result.published}`));
+  })
+}