@lanes-sh/link 0.4.1 → 0.5.0

package/src/cli/dispatch-owner.ts

@@ -1,4 +1,8 @@
 import {
+  assetsAdd,
+  assetsGet,
+  assetsList,
+  assetsRemove,
   memoryForget,
   memoryGet,
   memoryList,
@@ -11,18 +15,23 @@ import {
   vaultKeyGenerate,
   vaultList,
   vaultRemove,
+  tasksAdd,
+  tasksGet,
+  tasksList,
+  tasksRemove,
+  tasksUpdate,
   vaultSet,
   type OwnerFlags,
 } from './commands/owner.ts';
 
 /**
- * The three commands over the owner's own data: memory, skills, and the vault.
+ * The commands over the owner's own data: memory, tasks, assets, skills, vault.
  *
  * Split out of `main.ts` for the reason the budget in `src/architecture.test.ts`
- * exists to find, rather than to satisfy a line count. These three are one
- * subject — what the owner put here themselves, as against what a provider
- * holds on their behalf — they already live together in `commands/owner/`, and
- * they are the only commands in the grammar sharing a flag shape of their own.
+ * exists to find, rather than to satisfy a line count. These are one subject —
+ * what the owner put here themselves, as against what a provider holds on their
+ * behalf — they already live together in `commands/owner/`, and they are the
+ * only commands in the grammar sharing a flag shape of their own.
  *
  * `main.ts` keeps the grammar. This keeps one branch of it.
  */
@@ -49,6 +58,38 @@ export function dispatchOwner(
           throw new Error(`Unknown: ${program} memory ${second}`);
       }
 
+    case 'tasks':
+      switch (second) {
+        case 'list':
+        case undefined:
+          return tasksList(owner);
+        case 'get':
+          return tasksGet(rest[0], owner);
+        case 'add':
+          return tasksAdd(rest[0], owner);
+        case 'update':
+          return tasksUpdate(rest[0], owner);
+        case 'remove':
+          return tasksRemove(rest[0], owner);
+        default:
+          throw new Error(`Unknown: ${program} tasks ${second}`);
+      }
+
+    case 'assets':
+      switch (second) {
+        case 'list':
+        case undefined:
+          return assetsList(owner);
+        case 'get':
+          return assetsGet(rest[0], owner);
+        case 'add':
+          return assetsAdd(rest[0], owner);
+        case 'remove':
+          return assetsRemove(rest[0], owner);
+        default:
+          throw new Error(`Unknown: ${program} assets ${second}`);
+      }
+
     case 'skills':
       switch (second) {
         case 'list':
@@ -85,9 +126,9 @@ export function dispatchOwner(
       }
 
     default:
-      // Unreachable: `main.ts` narrows to the three above before calling. Kept
-      // so that adding a fourth case there and forgetting it here is a thrown
-      // error rather than a command that silently does nothing.
+      // Unreachable: `main.ts` narrows to the nouns above before calling. Kept
+      // so that adding one there and forgetting it here is a thrown error rather
+      // than a command that silently does nothing.
       throw new Error(`Unknown: ${program} ${first}`);
   }
 }

package/src/cli/lanes.ts

@@ -18,7 +18,7 @@ import { version } from './version.ts';
  */
 
 const AREAS: Record<string, string> = {
-  link: 'a self-hostable MCP gateway for all your connections, memory, skills, and secrets',
+  link: 'a self-hostable MCP gateway for all your connections, memory, tasks, files, and secrets',
 };
 
 function areasUsage(): string {

package/src/cli/main.ts

@@ -1,5 +1,6 @@
 import { connect } from './commands/connect/index.ts';
 import { connectCustom } from './commands/connect/custom/index.ts';
+import { disconnect, relabel } from './commands/connection.ts';
 import {
   attachFile,
   auditTail,
@@ -246,17 +247,20 @@ export async function run(argv: readonly string[]): Promise<void> {
       if (second !== 'show' && second !== undefined) throw new Error(`Unknown: ${PROGRAM} config ${second}`);
       return configShow(global);
 
-    // memory, skills and vault — one subject, dispatched together.
+    // The owner's own data — one subject, dispatched together.
     // `vault key generate` is synchronous, so this returns the result rather
     // than testing it for truthiness.
     case 'memory':
+    case 'tasks':
+    case 'assets':
     case 'skills':
     case 'vault':
       return dispatchOwner(first, second, rest, owner, PROGRAM);
 
     // Beside `memory` and `skills` because it is the question they raise next:
     // those two say what is stored, and this says where it is kept. Not one of
-    // them, though — it takes its own flags rather than the owner set.
+    // them, though — it takes its own flags rather than the owner set, and it
+    // moves those two only (ADR-041), not tasks or assets.
     case 'knowledge':
       switch (second) {
         case 'show':
@@ -329,6 +333,21 @@ export async function run(argv: readonly string[]): Promise<void> {
         default:
           throw new Error(`Unknown: ${PROGRAM} mcp ${second}`);
       }
+    case 'disconnect':
+      return disconnect(second, {
+        ...global,
+        yes: flags['yes'] === true,
+        keepCredential: flags['keep-credential'] === true,
+        json: flags['json'] === true,
+      });
+    // The new label is joined rather than taken as `rest[0]`, so an unquoted
+    // multi-word name works: `relabel gmail.main Work Mail` is what someone
+    // types before they think about quoting, and refusing it teaches nothing.
+    case 'relabel':
+      return relabel(second, rest.length > 0 ? rest.join(' ') : undefined, {
+        ...global,
+        json: flags['json'] === true,
+      });
     case 'start':
       return start({
         ...global,

package/src/cli/provider-marks.ts

@@ -41,5 +41,5 @@ export const PROVIDER_MARKS: Readonly<Record<string, string>> = {
   linear: 'M2.886 4.18A11.982 11.982 0 0 1 11.99 0C18.624 0 24 5.376 24 12.009c0 3.64-1.62 6.903-4.18 9.105L2.887 4.18ZM1.817 5.626l16.556 16.556c-.524.33-1.075.62-1.65.866L.951 7.277c.247-.575.537-1.126.866-1.65ZM.322 9.163l14.515 14.515c-.71.172-1.443.282-2.195.322L0 11.358a12 12 0 0 1 .322-2.195Zm-.17 4.862 9.823 9.824a12.02 12.02 0 0 1-9.824-9.824Z',
   notion: 'M4.459 4.208c.746.606 1.026.56 2.428.466l13.215-.793c.28 0 .047-.28-.046-.326L17.86 1.968c-.42-.326-.981-.7-2.055-.607L3.01 2.295c-.466.046-.56.28-.374.466zm.793 3.08v13.904c0 .747.373 1.027 1.214.98l14.523-.84c.841-.046.935-.56.935-1.167V6.354c0-.606-.233-.933-.748-.887l-15.177.887c-.56.047-.747.327-.747.933zm14.337.745c.093.42 0 .84-.42.888l-.7.14v10.264c-.608.327-1.168.514-1.635.514-.748 0-.935-.234-1.495-.933l-4.577-7.186v6.952L12.21 19s0 .84-1.168.84l-3.222.186c-.093-.186 0-.653.327-.746l.84-.233V9.854L7.822 9.76c-.094-.42.14-1.026.793-1.073l3.456-.233 4.764 7.279v-6.44l-1.215-.139c-.093-.514.28-.887.747-.933zM1.936 1.035l13.31-.98c1.634-.14 2.055-.047 3.082.7l4.249 2.986c.7.513.934.653.934 1.213v16.378c0 1.026-.373 1.634-1.68 1.726l-15.458.934c-.98.047-1.448-.093-1.962-.747l-3.129-4.06c-.56-.747-.793-1.306-.793-1.96V2.667c0-.839.374-1.54 1.447-1.632z',
   sheets: 'M11.318 12.545H7.91v-1.909h3.41v1.91zM14.728 0v6h6l-6-6zm1.363 10.636h-3.41v1.91h3.41v-1.91zm0 3.273h-3.41v1.91h3.41v-1.91zM20.727 6.5v15.864c0 .904-.732 1.636-1.636 1.636H4.909a1.636 1.636 0 0 1-1.636-1.636V1.636C3.273.732 4.005 0 4.909 0h9.318v6.5h6.5zm-3.273 2.773H6.545v7.909h10.91v-7.91zm-6.136 4.636H7.91v1.91h3.41v-1.91z',
-  tasks: 'M11.383.617C5.097.617 0 5.714 0 12c0 6.286 5.097 11.383 11.383 11.383 6.286 0 11.38-5.097 11.38-11.383a11.34 11.34 0 0 0-.878-4.389l-3.203 3.203c.062.387.1.782.1 1.186a7.398 7.398 0 1 1-7.4-7.398c1.499 0 2.889.448 4.054 1.214l2.857-2.857a11.325 11.325 0 0 0-6.91-2.342zm9.674.756c-.292 0-.583.112-.805.334-2.97 2.965-5.934 5.934-8.9 8.902L9.596 8.854a1.139 1.139 0 0 0-1.61 0l-1.775 1.773a1.139 1.139 0 0 0 0 1.61l4.166 4.163a1.421 1.421 0 0 0 2.012 0L23.666 5.121a1.136 1.136 0 0 0 0-1.61l-1.805-1.804a1.136 1.136 0 0 0-.804-.334z',
+  google_tasks: 'M11.383.617C5.097.617 0 5.714 0 12c0 6.286 5.097 11.383 11.383 11.383 6.286 0 11.38-5.097 11.38-11.383a11.34 11.34 0 0 0-.878-4.389l-3.203 3.203c.062.387.1.782.1 1.186a7.398 7.398 0 1 1-7.4-7.398c1.499 0 2.889.448 4.054 1.214l2.857-2.857a11.325 11.325 0 0 0-6.91-2.342zm9.674.756c-.292 0-.583.112-.805.334-2.97 2.965-5.934 5.934-8.9 8.902L9.596 8.854a1.139 1.139 0 0 0-1.61 0l-1.775 1.773a1.139 1.139 0 0 0 0 1.61l4.166 4.163a1.421 1.421 0 0 0 2.012 0L23.666 5.121a1.136 1.136 0 0 0 0-1.61l-1.805-1.804a1.136 1.136 0 0 0-.804-.334z',
 };

package/src/cli/runtime/registry.ts

@@ -7,12 +7,14 @@ import { loadProfileProviders } from '#providers/custom/index.ts';
 import { loadProfileSkills, type LoadedSkill } from '#providers/skills/store.ts';
 import { exampleProvider } from '#providers/example/provider.ts';
 import {
+  assetsProvider,
   createIdentityProvider,
   createMemoryVaultStore,
   createSetupProvider,
   createSkillsProvider,
   createVaultProvider,
   memoryProvider,
+  tasksProvider,
   type IdentityProviderOptions,
   type SetupProviderOptions,
   type VaultStore,
@@ -84,8 +86,8 @@ export interface OwnerLayerOptions {
  * Statically imported for now; the registry does not care where a manifest came
  * from, which is what lets workspace YAML register alongside these.
  *
- * `allowReserved` is what admits `memory`, `skills`, `vault`, `setup`, and
- * `identity`. The guard
+ * `allowReserved` is what admits `memory`, `tasks`, `assets`, `skills`, `vault`,
+ * `setup`, and `identity`. The guard
  * stays rather than being retired: it exists so a *third-party* provider cannot
  * claim a namespace whose policy rules would then silently mean something else,
  * and that reason survives the owner layer shipping. Only this one construction
@@ -95,7 +97,13 @@ export function buildRegistry(owner: OwnerLayerOptions = {}): ProviderRegistry {
   const registry = new ProviderRegistry({ allowReserved: true });
 
   registry.register(exampleProvider);
+  // The three that hold what the owner keeps. All module-level constants rather
+  // than factories: each reads and writes through `context.storage`, which core
+  // scopes per call, so there is nothing to hand in at construction time and
+  // nothing for `OwnerLayerOptions` to carry.
   registry.register(memoryProvider);
+  registry.register(tasksProvider);
+  registry.register(assetsProvider);
   registry.register(skillsProviderFor(owner));
   registry.register(
     createVaultProvider({

package/src/cli/selection.ts

@@ -111,6 +111,11 @@ export const SELECTION: Record<string, Requires> = {
   'identity list': 'profile',
 
   connect: 'profile+target',
+  // Both edit the profile config, and `disconnect` also opens the target's
+  // credential store to delete from it. Same requirement as `connect` for the
+  // same reasons.
+  disconnect: 'profile+target',
+  relabel: 'profile+target',
   // Its own row rather than an inheritance from `connect`. Both need the same
   // two things, but the row is what makes `selectionKey` return the two-word
   // key — and that is what keeps thirty declaration flags off
@@ -153,6 +158,8 @@ export const SELECTION: Record<string, Requires> = {
   'mcp add': 'profile+target',
   'mcp stdio': 'profile+target',
   memory: 'profile+target',
+  tasks: 'profile+target',
+  assets: 'profile+target',
   skills: 'profile+target',
   vault: 'profile+target',
   // Both halves open the target's adapters — `show` counts what is in the
@@ -181,6 +188,8 @@ const SUBCOMMANDS: Record<string, readonly string[]> = {
   config: ['show'],
   setup: ['plan'],
   memory: ['list', 'get', 'write', 'forget'],
+  tasks: ['list', 'get', 'add', 'update', 'remove'],
+  assets: ['list', 'get', 'add', 'remove'],
   skills: ['list', 'show', 'add', 'remove'],
   vault: ['list', 'get', 'set', 'remove', 'key'],
   mcp: ['skill', 'add', 'stdio', 'list'],
@@ -310,6 +319,8 @@ const ACCEPTS: Record<string, readonly string[]> = {
   // `removalPlan`, and was refused here — the flag existed everywhere except in
   // the list that decides whether it may be typed.
   'profile remove': ['dry-run', 'yes', 'target'],
+  disconnect: ['yes', 'keep-credential'],
+  relabel: [],
   'target list': ['urls', 'target'],
   'target show': ['target'],
   'token show': ['show', 'raw'],
@@ -332,6 +343,9 @@ const ACCEPTS: Record<string, readonly string[]> = {
   update: ['check'],
   'identity add': ['note'],
   memory: ['connection', 'title', 'description', 'file', 'tag'],
+  // `--yes` on both, because both have a delete that asks first.
+  tasks: ['connection', 'title', 'status', 'due', 'tag', 'yes'],
+  assets: ['connection', 'name', 'content-type', 'yes'],
   skills: ['connection', 'title', 'description', 'file'],
   vault: ['connection'],
   // `no-migrate` is listed beside `migrate` because they are three states

package/src/cli/usage.ts

@@ -16,7 +16,7 @@ import { style } from './output.ts';
 /** How this CLI is invoked — the `link` area of the `lanes` command. */
 export const PROGRAM = 'lanes link';
 
-export const USAGE = `${style.bold(PROGRAM)} — a self-hostable MCP gateway for all your connections, memory, skills, and secrets
+export const USAGE = `${style.bold(PROGRAM)} — a self-hostable MCP gateway for all your connections, memory, tasks, files, and secrets
 
 ${style.bold('Everyday')}
   ${PROGRAM} setup plan [--json]        what each provider needs, and which are connected
@@ -26,6 +26,9 @@ ${style.bold('Everyday')}
   ${PROGRAM} connect <...> --replace    ask for the stored password or key again
   ${PROGRAM} connect <...> --auth <method>  pick how, where there is a choice
   ${PROGRAM} connect <...> --non-interactive [--json]
+  ${PROGRAM} disconnect <provider>.<id>  remove an account, and delete its credential
+  ${PROGRAM} disconnect <...> --keep-credential   leave the credential in the store
+  ${PROGRAM} relabel <provider>.<id> <name>      rename what an account is called
   ${PROGRAM} connect custom <id> --connector <kind> --auth <method>
                                  declare a service that is not built in, and connect it.
                                  kinds: mcp, http, imap, dav, fs. Omit a value and it is
@@ -78,6 +81,18 @@ ${style.bold('Your own context')}
   ${PROGRAM} memory write <id> --title <t> [--tag t]   body on stdin
   ${PROGRAM} memory forget <id>
 
+  ${PROGRAM} tasks list [--status s]     what is outstanding; --status all for everything
+  ${PROGRAM} tasks get <id>
+  ${PROGRAM} tasks add <title> [--status s] [--due d] [--tag t]   notes on stdin
+  ${PROGRAM} tasks update <id> --status <s>   closing one is an update, not a remove
+  ${PROGRAM} tasks remove <id>
+                                 statuses: in_progress open blocked muted done dropped
+
+  ${PROGRAM} assets list                files kept in this profile
+  ${PROGRAM} assets get <name>          the bytes, to stdout — redirect them
+  ${PROGRAM} assets add <file> [--name n] [--content-type t]
+  ${PROGRAM} assets remove <name>
+
   ${PROGRAM} skills list                the procedures agents can invoke
   ${PROGRAM} skills show <name>
   ${PROGRAM} skills add <name> [--file f]             document on stdin
@@ -131,7 +146,8 @@ ${style.bold('Naming what a command acts on')}
                                  command that names neither refuses and lists what exists.
 
 ${style.bold('Other flags')}
-  --connection <id>              which memory/skills/vault connection, if a profile has several
+  --connection <id>              which memory/tasks/assets/skills/vault connection, where
+                                 a profile has several of one kind
   --yes                          skip the confirmation a destructive command would ask for
   --json                         machine-readable output, where a command offers it
   --non-interactive              never prompt: connect refuses with what to store,

package/src/connectivity/mail/attachments.ts

@@ -362,7 +362,11 @@ const CONTENT_TYPES: Readonly<Record<string, string>> = {
   // opens by extension anyway. Adding them back will fail the suite.
 };
 
-function guessContentType(filename: string): string {
+/**
+ * Exported because `assets` needs exactly this and the table above must not be
+ * copied — its `.pages`/`.numbers` note is a rule the copy would not carry.
+ */
+export function guessContentType(filename: string): string {
   const extension = filename.split('.').pop()?.toLowerCase();
   return (extension ? CONTENT_TYPES[extension] : undefined) ?? 'application/octet-stream';
 }

package/src/connectivity/mail/index.ts

@@ -21,7 +21,12 @@ export { receiptFor } from './message.ts';
 export { composeMime } from './compose.ts';
 
 export type { AttachmentRef, MailboxAttachmentSource, ResolveOptions } from './attachments.ts';
-export { attachmentRefSchema, attachmentsJsonSchema, resolveAttachments } from './attachments.ts';
+export {
+  attachmentRefSchema,
+  attachmentsJsonSchema,
+  guessContentType,
+  resolveAttachments,
+} from './attachments.ts';
 
 export type { StagedFile, StagedMetadata } from './staging.ts';
 export {

package/src/connectivity/manifest/provider.ts

@@ -64,8 +64,21 @@ export const providerManifestSchema = z.object({
 
 export type ProviderManifest = z.infer<typeof providerManifestSchema>;
 
-/** Provider ids reserved for the owner layer. */
-export const RESERVED_PROVIDER_IDS: readonly string[] = ['memory', 'skills', 'vault', 'setup', 'identity'];
+/**
+ * Provider ids reserved for the owner layer.
+ *
+ * The order is read: `#server/mcp`'s instructions emit one paragraph per
+ * reachable id in this sequence, so it is the order an agent meets them in.
+ */
+export const RESERVED_PROVIDER_IDS: readonly string[] = [
+  'memory',
+  'tasks',
+  'assets',
+  'skills',
+  'vault',
+  'setup',
+  'identity',
+];
 
 /**
  * Validate a manifest, with the cross-field rules the schema alone cannot

package/src/deployments/deploy.ts

@@ -7,7 +7,8 @@ import { resolveTarget, vaultEnv } from './bootstrap.ts';
 import { printSteps, runSteps } from './steps.ts';
 import { driverFor } from './drivers.ts';
 import { prepareSecrets, readableRefs, rotatableRefs } from './prepare.ts';
-import { deployedWorkspace, repairSetupSurface, uploadWorkspace } from './upload.ts';
+import { repairOwnerLayer } from '#cli/config-repair.ts';
+import { deployedWorkspace, uploadWorkspace } from './upload.ts';
 import { unservableProfiles, unservableRefusal } from './servable.ts';
 import { collidingRefs, collisionRefusal, servingProfiles } from './serving.ts';
 import { healthLine, reachability, registerLine, reportUnauthorised } from './report.ts';
@@ -255,7 +256,7 @@ export async function deploy(flags: DeployFlags): Promise<void> {
       throw new ConfigError(unservableRefusal(unservable, target));
     }
 
-    await repairSetupSurface(resolution.workspaceRoot, serving);
+    await repairOwnerLayer(resolution.workspaceRoot, serving);
 
     // Before the rollout, so the revision that comes up finds a config to read.
     // Uploading after would leave a window where the service is serving and the

package/src/deployments/prepare.ts

@@ -46,7 +46,7 @@ export interface PrepareResult {
  * path derives from the manifest and has never read config for. Sharing one list
  * would silently pick one answer for both.
  *
- * **Scoped exactly as the upload is**, for the reason `repairSetupSurface`
+ * **Scoped exactly as the upload is**, for the reason `repairOwnerLayer`
  * states and one more: a profile this deploy sends is a profile the endpoint may
  * serve, and a connection whose secret nobody bound fails an hour after the
  * revision reports healthy. The asymmetry decides it — an extra binding is a

package/src/deployments/servable.ts

@@ -30,7 +30,7 @@ export interface Unservable {
 /**
  * The profiles this deploy would send that the revision could not open.
  *
- * Scoped exactly as `uploadWorkspace` and `repairSetupSurface` are — by the
+ * Scoped exactly as `uploadWorkspace` and `repairOwnerLayer` are — by the
  * `--profile` flag, absent meaning the whole workspace — because the set that
  * gets uploaded is the set that gets served, and checking a different one would
  * be checking the wrong question.

package/src/deployments/upload.ts

@@ -7,8 +7,6 @@ import {
   type Config,
   type TargetConfig,
 } from '#profile';
-import { ConfigDocument } from '#cli/config-edit.ts';
-import { ensureSetupConnection, repairLines, repaired } from '#cli/config-repair.ts';
 import { ok, print, style, warn } from '#cli/output.ts';
 
 /**
@@ -100,57 +98,6 @@ function authoredAreaOwner(key: string): string | null {
   return area === layout.skills(owner) || area === layout.providers(owner) ? owner : null;
 }
 
-/**
- * Give every profile about to be uploaded its setup surface.
- *
- * **Scoped exactly as the upload is**, because a profile this deploy sends is a
- * profile the endpoint will serve: repairing a narrower set would leave a served
- * profile without the surface, which is this bug one profile over. Note what
- * `flags.profile` does not mean — it is the flag alone, so a profile resolved
- * from `LANES_LINK_PROFILE` leaves it undefined and both this and the upload
- * read that as the whole workspace. Surprising, pre-existing in the upload, and
- * fixed there rather than here so the two cannot drift apart.
- *
- * *Which files are profiles* comes from `listProfiles`, never from
- * `isWorkspaceConfig`: the allowlist decides what is safe to *copy*, so it
- * happily sends a committed `personal.example.yaml` and a nested
- * `profiles/archive/old.yaml` as bytes, while this opens and validates what it
- * is handed — which turned that template into a `ConfigError` aborting the
- * deploy after provisioning had already made cloud resources.
- *
- * A profile that cannot be read is warned about rather than fatal: the repair is
- * a courtesy on the way past, and the upload still sends the file. Not silent,
- * though — nothing else here widens a policy without being asked.
- */
-export async function repairSetupSurface(
-  workspaceRoot: string,
-  profiles: readonly string[] | undefined,
-): Promise<void> {
-  const wanted = profiles === undefined ? undefined : new Set(profiles);
-
-  for (const name of await listProfiles(workspaceRoot)) {
-    if (wanted !== undefined && !wanted.has(name)) continue;
-
-    try {
-      const document = await ConfigDocument.open(workspaceRoot, name);
-      const repair = ensureSetupConnection(document);
-      if (!repaired(repair)) continue;
-
-      await document.save();
-
-      print(ok(`gave ${style.bold(name)} the setup surface`));
-      for (const change of repairLines(repair)) print(`      ${style.dim(change)}`);
-      print(`      ${style.dim('an agent can now see what is connected here, instead of guessing')}`);
-    } catch (error) {
-      print(
-        warn(
-          `could not give ${name} the setup surface: ${error instanceof Error ? error.message.split('\n')[0] : String(error)}`,
-        ),
-      );
-    }
-  }
-}
-
 /**
  * Copy the workspace's config up.
  */

package/src/profile/load.ts

@@ -107,6 +107,49 @@ function formatZodIssues(error: z.ZodError): string {
  * left to resolve silently it grants nothing, which looks identical to a
  * working rule until the day someone relies on it.
  */
+/**
+ * A connection naming a provider whose id has moved out from under it.
+ *
+ * There is exactly one, and it is the reason this function exists: `tasks` was
+ * Google Tasks until the built-in task list took the plain noun (ADR-051). A row
+ * left saying `provider: tasks` does not fail — it resolves to the *built-in*,
+ * `reconcile` marks it active because a provider needing no credential is
+ * authorized by construction, and the operator is left with their Google Tasks
+ * tools gone, a task list wearing their old label, and nothing anywhere saying
+ * why. Refusing is the only outcome that names the fix.
+ *
+ * **The rule is a positive assertion, not a guess at what a vendor row looks
+ * like.** The built-in's row is written in exactly one spelling, by
+ * `newProfileTemplate` and by `ensureReservedConnection`: `account: Tasks`. So
+ * any other label on a `tasks` row is either a pre-rename Google Tasks row or a
+ * hand-edited built-in one, and the message names both fixes because either is
+ * one word.
+ *
+ * It was very nearly a guess, and the guess was wrong. The first version keyed
+ * on an `@` in the account, reasoning that `connect tasks` recorded the address
+ * the operator typed — Google Tasks publishes no identity, so `connect` asks.
+ * But what it asks for is a *label*: the real profile this was written for holds
+ * `account: personal`, so the check would have passed it and rebound their Google
+ * Tasks to the built-in in silence. That is the exact failure this exists to
+ * prevent, missed by one heuristic.
+ *
+ * Deliberately not a check on the connection *id*. Several task lists in one
+ * profile is a legitimate thing to want, exactly as several memory connections
+ * are, and keying on `id !== 'main'` would refuse a valid profile forever to
+ * catch a one-release migration. Labelling both `Tasks` is consistent with what
+ * the accountless providers already do — every memory connection is `Memory`.
+ */
+function renamedProvider(connection: { provider: string; account: string }): string | null {
+  if (connection.provider !== 'tasks' || connection.account === 'Tasks') return null;
+
+  return (
+    `"tasks" is now the built-in task list, and this row is labelled ` +
+    `"${connection.account}" rather than "Tasks".\n` +
+    '  If it was Google Tasks: set provider to google_tasks here, and rename any "tasks.*" policy rule.\n' +
+    '  If it is your own task list: set account to Tasks.'
+  );
+}
+
 function assertReferentialIntegrity(config: Config, source: string): void {
   const problems: string[] = [];
 
@@ -142,6 +185,9 @@ function assertReferentialIntegrity(config: Config, source: string): void {
       problems.push(`connections[${index}]: duplicate connection "${key}"`);
     }
     connectionKeys.add(key);
+
+    const renamed = renamedProvider(connection);
+    if (renamed) problems.push(`connections[${index}]: ${renamed}`);
   });
 
   // Same reason as a duplicate connection: two entries with the same kind and