@lanes-sh/link 0.5.3 → 0.6.0

package/instructions/agents/lanes-link-scout.md

@@ -68,7 +68,7 @@ stops a write is policy on the endpoint:
 
 ```console
 $ lanes link policy deny memory.write --profile <name> --target <name>
-$ lanes link policy list --profile <name>
+$ lanes link policy list --profile <name> --target <name>
 ```
 
 If you are running against a profile that grants writes, that is the owner's

package/instructions/skills/lanes-link/SKILL.md

@@ -22,7 +22,9 @@ and personal apart; they share no database and no credential store.
 **Ask which profile is meant when it is ambiguous. Do not default to whichever
 is listed first.** Quietly picking one crosses the line the profile exists to
 draw. There is no "current profile" to switch — the choice is made per call, and
-`lanes link profile list` shows what exists.
+`lanes link profile list --target <name>` shows what exists *in that target*. A
+profile lives in exactly one, so `personal` on `local` and `personal` on `cloud`
+are two profiles that share a name rather than one profile in two places.
 
 **What a command must be told is never inferred — but it is not always both.**
 Nothing resolves from an environment variable or a config default, so a command
@@ -30,12 +32,11 @@ missing what it needs refuses rather than acting somewhere else. Passing a flag
 command does not read is refused too, which makes "add both to be safe" its own
 failure. Four levels:
 
-- **Neither.** `lanes link profile list`, `lanes link mcp list`,
+- **Neither.** `lanes link target list`, `lanes link mcp list`,
   `lanes link version`.
-- **`--profile` alone.** `lanes link check`, `lanes link config show`,
-  `lanes link policy list`, `lanes link target list --profile <name>`,
-  `lanes link identity list`. Each is target-independent — one declaration in the
-  YAML that applies wherever the profile runs.
+- **`--target` alone.** `lanes link profile list`, `lanes link profile add`,
+  `lanes link profile remove`, `lanes link target show`. A profile lives inside
+  one target's workspace, so listing or creating one names which workspace.
 - **`--target`, with the profiles derived from it.** `lanes link status`,
   `lanes link deploy` and `lanes link sync targets` act on one endpoint serving
   every profile that declares that target. `--profile` is accepted and *narrows*
@@ -222,7 +223,7 @@ granted, and retrying will not reveal it. A call that *is* refused was refused b
 policy on purpose.
 
 Report it plainly and let the owner decide whether to widen the grant —
-`lanes link policy list --profile <name>` shows the rules, `lanes link policy allow <capability> --profile <name> --target <name>`
+`lanes link policy list --profile <name> --target <name>` shows the rules, `lanes link policy allow <capability> --profile <name> --target <name>`
 changes them, and that is their call, not yours. **Do not look for another route
 to the same data.** Every call is audited either way; `lanes link audit tail --profile <name> --target <name>`
 shows what was attempted, refusals included.
@@ -299,10 +300,12 @@ key on — do not treat the absence of JSON as a failure. `status`, `doctor`,
 `config show`, `audit tail` and every `mcp` subcommand do not.
 
 **A profile is created and removed, never switched.** `lanes link profile add
-<name>` writes a new one and takes `--target <name>`, repeated once per target it
-should declare. `lanes link profile remove <name>` takes `--dry-run` and then
-`--yes`; given a `--target` it decommissions that one target's stores and leaves
-the profile file in place. Neither reads `--profile`.
+<name> --target <name>` writes a new one *into that target's workspace* — one
+target, not a list, because a profile lives in exactly one.
+`lanes link profile remove <name> --target <name>` takes `--dry-run` and then
+`--yes`, and removes the profile itself along with its stores: the file is in
+that workspace, so there is nowhere left for it to survive. Neither reads
+`--profile`; both name the profile positionally.
 
 There is no current profile and no default target. `lanes link profile default`
 and `lanes link target use` are gone and now refuse with an explanation — if you
@@ -312,9 +315,9 @@ replacement to find. The choice is made per command, on purpose.
 ## Deploying, and what it decides
 
 `lanes link deploy` builds an image and rolls a revision. Its subject is a
-**target**, and the profiles behind it are every profile declaring that target,
-so one deploy serves all of them — there is no per-profile deploy to run and no
-reason to loop over them.
+**target**, and the profiles behind it are every profile *in* that target's
+workspace, so one deploy serves all of them — there is no per-profile deploy to
+run and no reason to loop over them.
 
 **Always `--dry-run` first, and show what it printed.** It creates cloud
 resources that cost money, it implements no `--json` to inspect instead, and that
@@ -326,9 +329,9 @@ Two things it refuses to guess, and both are the owner's to answer:
 - **Whose bearer token opens the endpoint.** One token reaches every profile
   behind that target, so this decides who gets in. With several candidates and
   nothing recorded, it refuses and prints the command that names one.
-- **A first deploy.** A target no profile declares yet has no set to derive from,
-  so `--profile` is required there. It may be repeated, and the first one named
-  is the primary.
+- **A first deploy.** A target that does not exist yet has no workspace to derive
+  a set from, so `--profile` is required there. It may be repeated, and the first
+  one named is the primary.
 
 **Never pass `--yes`, `--non-interactive`, `--access public` or
 `--service-account` yourself.** Each settles a question about who can reach their
@@ -338,22 +341,23 @@ this file already applies to `--accept-broad-scopes`.
 Deploying is how new code reaches the endpoint. It is not how an account gets
 connected and not how a config change lands; both of those publish themselves.
 
-## When the workspace and the endpoint disagree
+## When a machine has lost track of a deployment
 
-A deployment records where it lives, and a workspace can lose that record — a new
-machine, a reinstall, a profile file restored from something older. The endpoint
-is still serving; what went missing is the config that describes it. The symptom
-is a `lanes link status` that reports nothing deployed for a target you know is
-up.
+A workspace holds a *pointer* to each target it does not itself hold, and a
+machine can lose one — a new laptop, a reinstall, a workspace file restored from
+something older. The endpoint is still serving; what went missing is the line
+saying where it lives. The symptom is a `lanes link status` that reports nothing
+for a target you know is up.
 
-`lanes link sync targets` reconciles the two. `--discover` looks for a deployment
-the workspace has no record of, `--from <location>` names one directly, and
-`--dry-run` reports what it would merge without merging it. Run the dry run and
+`lanes link sync targets` adopts it. `--discover` looks for a deployment the
+workspace has no pointer to, `--from <location>` names one directly, and
+`--dry-run` reports what it would write without writing it. Run the dry run and
 show it.
 
-**`--prefer local` or `--prefer remote` is their answer, not yours.** It decides
-which side wins where the two disagree, and the losing value is the one nobody
-was asked about. Report what differs and let them pick.
+**It cannot lose anything.** Adopting writes one line — the pointer — and the
+workspace at the other end stays authoritative for everything else. There is no
+`--prefer` any more and passing one is refused: it chose a winner when a profile
+existed in two copies that could disagree, and there is one copy now.
 
 ## Registering it, and re-registering it
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanes-sh/link",
-  "version": "0.5.3",
+  "version": "0.6.0",
   "description": "A self-hostable MCP gateway for all your connections, memory, tasks, files, and secrets",
   "license": "Apache-2.0",
   "homepage": "https://lanes.sh/link",
@@ -66,6 +66,7 @@
     "#dispatch": "./src/dispatch/index.ts",
     "#policy": "./src/policy/index.ts",
     "#profile": "./src/profile/index.ts",
+    "#profile/*": "./src/profile/*",
     "#providers/*": "./src/providers/*",
     "#registry": "./src/registry/index.ts",
     "#secrets": "./src/secrets/index.ts",

package/src/cli/commands/connect/custom/index.ts

@@ -49,6 +49,7 @@ export interface ConnectCustomOptions extends GlobalFlags, CustomFlags {
   /** Forwarded to `connect` untouched. */
   readonly id?: string | undefined;
   readonly displayName?: string | undefined;
+  readonly label?: string | undefined;
   readonly replace?: boolean | undefined;
   readonly nonInteractive?: boolean | undefined;
   readonly acceptBroadScopes?: boolean | undefined;
@@ -170,6 +171,7 @@ export async function connectCustom(
       quiet: options.quiet ?? false,
       ...(options.id ? { id: options.id } : {}),
       ...(options.displayName ? { displayName: options.displayName } : {}),
+      ...(options.label ? { label: options.label } : {}),
       ...(options.replace ? { replace: options.replace } : {}),
       ...(options.nonInteractive ? { nonInteractive: options.nonInteractive } : {}),
       ...(options.acceptBroadScopes ? { acceptBroadScopes: options.acceptBroadScopes } : {}),

package/src/cli/commands/connect/custom/spec.ts

@@ -227,6 +227,7 @@ export const CONNECT_CUSTOM_FLAGS: readonly string[] = [
   // and a broker's, and a synthesized manifest never declares a broker.
   'id',
   'display-name',
+  'label',
   'replace',
   'non-interactive',
   'accept-broad-scopes',

package/src/cli/commands/connect/declare.ts

@@ -0,0 +1,76 @@
+import type { ConnectionConfig } from '#profile';
+import type { ConfigDocument } from '../../config-edit.ts';
+
+/**
+ * Writing the connection row — the one edit `connect` makes to the profile.
+ *
+ * Its own file because it answers its own question: given an account, an id and
+ * a name, which lines of YAML change? The five numbered steps around it are
+ * about vendors, browsers and credential stores, and none of that reaches here.
+ *
+ * Two fields, and the difference between them is the whole subject. `account` is
+ * an identity the provider reported, and three things read it as one — the
+ * reconnect match in `settleIdentity`, the id derived from it, and the `From`
+ * header `gmail.send_message` writes. `label` is what the operator calls the
+ * same row, addressed by nothing and displayed everywhere.
+ */
+export function declareConnection(input: {
+  readonly document: ConfigDocument;
+  /** The profile as it stands, which says whether this is an add or a repair. */
+  readonly connections: readonly ConnectionConfig[];
+  readonly providerId: string;
+  readonly connectionId: string;
+  readonly account: string;
+  readonly label: string;
+  /** Which route in, where the provider offered a choice. */
+  readonly method: string | undefined;
+}): readonly string[] {
+  const { document, connections, providerId, connectionId, account, label, method } = input;
+
+  const key = `${providerId}.${connectionId}`;
+  const index = connections.findIndex((c) => `${c.provider}.${c.id}` === key);
+  const changes: string[] = [];
+
+  if (index === -1) {
+    // No `credential_ref`: it derives to `<provider>/<id>`, which is exactly
+    // where the OAuth provider already looks. Writing it would add a line per
+    // connection that can only ever agree or be a bug.
+    //
+    // No `label` either, when it is the account. Pressing Enter at the prompt is
+    // the common answer, and a line repeating the address above it is a line to
+    // read past forever.
+    document.addTo(['connections'], {
+      id: connectionId,
+      provider: providerId,
+      account,
+      ...(label === account ? {} : { label }),
+    });
+    changes.push(`connections += ${key} (${account})`);
+    return changes;
+  }
+
+  // A reconnect. The credential was just replaced; the declaration stays as it
+  // is, so re-running connect after an expiry is a no-op on the file rather than
+  // a second row.
+  const declared = connections[index];
+
+  if (declared?.account !== account) {
+    document.setIn(['connections', index, 'account'], account);
+    changes.push(`connections.${key}.account = ${account}`);
+  }
+
+  // Compared against what the row is *called*, which is the account until
+  // somebody names it otherwise. Without the fallback, every reconnect of an
+  // unlabelled connection writes a label that says what the line above it says.
+  if ((declared?.label ?? declared?.account) !== label) {
+    document.setIn(['connections', index, 'label'], label);
+    changes.push(`connections.${key}.label = ${label}`);
+  }
+
+  // Named where the provider offered a choice, because this is the line an
+  // operator reads to see that a re-connect swapped the route rather than
+  // refreshed it — and `--auth` reaches here having asked nothing. Unnamed for a
+  // provider with one way in, whose output is unchanged.
+  changes.push(`re-authorised ${key}${method ? ` with ${method}` : ''}`);
+  return changes;
+}

package/src/cli/commands/connect/family.ts

@@ -48,8 +48,13 @@ export function familyMembers(registry: ProviderRegistry, name: string): readonl
  * the target belongs to the account, not to each service under it, so it is
  * printed once here and suppressed in every member. Three copies of it is three
  * times nothing new.
+ *
+ * The label travels on the same argument: it too belongs to the account, so the
+ * first member asks what to call it and the rest are told.
  */
-export async function connectFamily<Options extends { readonly id?: string | undefined }>(input: {
+export async function connectFamily<
+  Options extends { readonly id?: string | undefined; readonly label?: string | undefined },
+>(input: {
   readonly name: string;
   readonly members: readonly string[];
   readonly options: Options;
@@ -64,9 +69,20 @@ export async function connectFamily<Options extends { readonly id?: string | und
 
   progress(style.dim(familyNote(name, members)));
 
-  const inherited = { ...options, id: options.id ?? namedId };
+  let inherited = { ...options, id: options.id ?? namedId };
   const outcomes: ConnectOutcome[] = [];
-  for (const member of members) outcomes.push(await connect(member, inherited, true));
+
+  for (const member of members) {
+    const outcome = await connect(member, inherited, true);
+    outcomes.push(outcome);
+
+    // One account, one name. Without this, connecting iCloud asks what to call
+    // it three times — and three different answers is three rows that read as
+    // three accounts.
+    if (inherited.label === undefined && outcome.label !== undefined) {
+      inherited = { ...inherited, label: outcome.label };
+    }
+  }
 
   return familyOutcome(outcomes);
 }

package/src/cli/commands/connect/index.ts

@@ -6,6 +6,7 @@ import { nonInteractivePrompter, terminalPrompter, type Prompter } from '../../p
 import { openRuntime, type GlobalFlags } from '../../runtime.ts';
 import { moveCredential, siblingAccountId } from './accounts.ts';
 import { grantProvider } from './grant.ts';
+import { declareConnection } from './declare.ts';
 import { discoverCapabilities } from './discover.ts';
 import { connectFamily, familyMembers } from './family.ts';
 import { authoriseWithKey } from './assertion.ts';
@@ -38,6 +39,14 @@ import { unknownProvider } from './unknown.ts';
 export interface ConnectOptions extends GlobalFlags {
   readonly id?: string | undefined;
   readonly displayName?: string | undefined;
+  /**
+   * `--label`: what to call this connection, instead of being asked.
+   *
+   * Distinct from `--display-name`, which answers *whose account this is* for a
+   * provider that cannot report it. This one never touches the identity, so it
+   * is safe to pass anything a person would say out loud.
+   */
+  readonly label?: string | undefined;
   /** Ask for the stored credential again — a key rotated, or a password revoked. */
   readonly replace?: boolean | undefined;
   /**
@@ -272,11 +281,12 @@ export async function runConnect(
     //    adding a new one. Without it, a retried connect appends a second row
     //    rather than repairing the first — which is how `main2` and `main3`
     //    ended up in a config describing two mailboxes.
-    const { connectionId, account } = await settleIdentity({
+    const { connectionId, account, label } = await settleIdentity({
       manifest,
       provisionalId,
       explicitId: named,
       account: options.displayName,
+      label: options.label,
       runtime,
       prompter,
     });
@@ -306,31 +316,18 @@ export async function runConnect(
     });
 
     // 4. Declare the connection, or update the one this account already has.
-    const existingIndex = runtime.config.connections.findIndex(
-      (c) => `${c.provider}.${c.id}` === connectionKey,
+    changes.push(
+      ...declareConnection({
+        document,
+        connections: runtime.config.connections,
+        providerId,
+        connectionId,
+        account,
+        label,
+        method: method.id,
+      }),
     );
 
-    if (existingIndex === -1) {
-      // No `credential_ref`: it derives to `<provider>/<id>`, which is exactly
-      // where the OAuth provider already looks. Writing it would add a line per
-      // connection that can only ever agree or be a bug.
-      document.addTo(['connections'], { id: connectionId, provider: providerId, account });
-      changes.push(`connections += ${connectionKey} (${account})`);
-    } else {
-      // A reconnect. The credential was just replaced above; the declaration
-      // stays as it is, so re-running connect after an expiry is a no-op on the
-      // file rather than a second row.
-      if (runtime.config.connections[existingIndex]?.account !== account) {
-        document.setIn(['connections', existingIndex, 'account'], account);
-        changes.push(`connections.${connectionKey}.account = ${account}`);
-      }
-      // Named where the provider offered a choice, because this is the line an
-      // operator reads to see that a re-connect swapped the route rather than
-      // refreshed it — and `--auth` reaches here having asked nothing. Unnamed
-      // for a provider with one way in, whose output is unchanged.
-      changes.push(`re-authorised ${connectionKey}${method.id ? ` with ${method.id}` : ''}`);
-    }
-
     // 5. Grant it — one rule per provider; `grant.ts` says why not per capability.
     const granted = grantProvider(document, runtime.config.policy.allow, providerId);
 
@@ -365,6 +362,7 @@ export async function runConnect(
         ok: true,
         key: connectionKey,
         account,
+        label,
         ...where(runtime),
         discovered: discovered.length,
         next: ALREADY,
@@ -381,6 +379,7 @@ export async function runConnect(
       ok: true,
       key: connectionKey,
       account,
+      label,
       ...where(runtime),
       changes,
       granted,

package/src/cli/commands/connect/outcome.ts

@@ -17,6 +17,14 @@ export interface ConnectOutcome {
   readonly ok: boolean;
   readonly key?: string;
   readonly account?: string;
+  /**
+   * What the connection is called, where that is not just the account.
+   *
+   * Reported so the family path can carry it: `connect icloud` is three runs on
+   * one account, and the name belongs to the account rather than to each
+   * service under it.
+   */
+  readonly label?: string;
   /** The profile written to, for a caller that cannot see the announce line. */
   readonly profile?: string;
   /** The target written to — which credential store now holds this account. */

package/src/cli/commands/connect/settle.ts

@@ -5,7 +5,7 @@ import type { Config } from '#profile';
 import type { AnyConnector, ProviderManifest } from '#connectivity';
 import { idFromAccount, resolveAccount } from '../../identity.ts';
 import { style } from '../../output.ts';
-import { terminalPrompter, type Prompter } from '../../prompt.ts';
+import { PromptCancelled, terminalPrompter, type Prompter } from '../../prompt.ts';
 import { accountSiblings } from './accounts.ts';
 
 /**
@@ -16,12 +16,26 @@ import { accountSiblings } from './accounts.ts';
  * connection already holds that account, we reuse *its* id, which is what turns
  * a re-run of `connect` into a repair rather than a duplicate. Only when
  * identity cannot be resolved at all do we ask.
+ *
+ * The *label* is settled last and separately, because it is the one thing here
+ * the provider cannot answer. `account` is load-bearing three times over — the
+ * reconnect match above, the id derived from it, and the `From` header
+ * `gmail.send_message` writes — so the operator's own words for a connection
+ * cannot be put there, and `label` is where they go instead.
  */
 export async function settleIdentity(input: {
   manifest: ProviderManifest;
   provisionalId: string;
   explicitId: string | undefined;
   account: string | undefined;
+  /**
+   * The label, where the caller already has one.
+   *
+   * `--label`, and the family path: `connect icloud` is three `connect` runs on
+   * one account, and asking what to call it once per service is asking the same
+   * question three times.
+   */
+  label?: string | undefined;
   runtime: {
     config: Config;
     credentials: SecretStore;
@@ -30,7 +44,7 @@ export async function settleIdentity(input: {
     authorizeRequest(providerId: string, connectionId: string, request: Request): Promise<Request>;
   };
   prompter?: Prompter;
-}): Promise<{ connectionId: string; account: string }> {
+}): Promise<{ connectionId: string; account: string; label: string }> {
   const { manifest, provisionalId, explicitId, runtime } = input;
   const prompter = input.prompter ?? terminalPrompter;
 
@@ -112,6 +126,11 @@ export async function settleIdentity(input: {
   const unaccounted = !account && manifest.auth.kind === 'none';
   if (unaccounted) account = manifest.name;
 
+  // Whether the name we hold is one the operator has just typed, rather than one
+  // a provider reported. It settles the label below: a name someone chose a
+  // second ago does not need confirming against itself.
+  let typed = false;
+
   if (!account) {
     // Nothing to go on. Asking beats inventing `main2`, and the answer is the
     // one piece of information the file cannot reconstruct later — which is
@@ -125,32 +144,85 @@ export async function settleIdentity(input: {
     }
 
     account =
-      (await prompter.ask(`Which account is this? ${style.dim('(label for this connection)')}`)) ||
+      (await prompter.ask(`Which account is this? ${style.dim('(the address or handle)')}`)) ||
       `${manifest.name} ${provisionalId}`;
+    typed = true;
   }
 
-  if (explicitId) return { connectionId: explicitId, account };
+  const taken = siblings.map((candidate) => candidate.id);
 
-  if (unaccounted) {
-    return {
-      connectionId: idFromAccount(
-        'main',
-        siblings.map((candidate) => candidate.id),
-      ),
-      account: account!,
-    };
-  }
-
-  const already = siblings.find(
-    (candidate) => candidate.account.toLowerCase() === account.toLowerCase(),
-  );
-  if (already) return { connectionId: already.id, account };
+  const connectionId =
+    explicitId ??
+    (unaccounted
+      ? idFromAccount('main', taken)
+      : (siblings.find(
+          (candidate) => candidate.account.toLowerCase() === account!.toLowerCase(),
+        )?.id ?? idFromAccount(account, taken)));
 
   return {
-    connectionId: idFromAccount(
-      account,
-      siblings.map((candidate) => candidate.id),
-    ),
+    connectionId,
     account,
+    label: await settleLabel({
+      given: input.label,
+      // What the row this is about to land on is already called. Looked up
+      // across the whole vendor account rather than this provider alone, for the
+      // reason `accountSiblings` exists: `connect icloud_calendar` adopts iCloud
+      // Mail's id, and should adopt the name that goes with it too.
+      declared: siblings.find((candidate) => candidate.id === connectionId)?.label,
+      account,
+      typed,
+      prompter,
+    }),
   };
 }
+
+/**
+ * What to call this connection, offering what it is already called.
+ *
+ * Asked on every interactive connect, not only where identity resolution failed.
+ * That was the old behaviour and it had the case exactly backwards: the run that
+ * could not name the account is the run where the operator has least to add,
+ * and the run that resolved `ada@example.com` — where they may well want "Work
+ * mail" — never asked at all.
+ *
+ * The suggestion is in the question and an empty answer takes it, so the cost of
+ * always asking is one keystroke. Nothing addresses a connection by its label,
+ * so there is no answer here that can break anything.
+ */
+async function settleLabel(input: {
+  given: string | undefined;
+  declared: string | undefined;
+  account: string;
+  typed: boolean;
+  prompter: Prompter;
+}): Promise<string> {
+  const { given, declared, account, typed, prompter } = input;
+
+  if (given) return given;
+
+  // A label already chosen wins over the account, so re-authorising an expired
+  // credential does not quietly undo the operator's own word for the row.
+  const suggestion = declared ?? account;
+
+  if (typed || !prompter.interactive) return suggestion;
+
+  try {
+    return (
+      (await prompter.ask(`What should this be called? ${style.dim(`[${suggestion}]`)}`)) ||
+      suggestion
+    );
+  } catch (refusal) {
+    // Ctrl-C is an answer: the operator stopped the command, and swallowing it
+    // here would finish a connect they interrupted.
+    if (refusal instanceof PromptCancelled) throw refusal;
+
+    // Anything else is `terminalPrompter` discovering there is no terminal —
+    // it reports itself interactive and finds out only when asked, so a piped
+    // `lanes link connect gmail` reaches this line having already opened a
+    // browser and stored a credential. Failing there for want of a display name
+    // would undo none of that. A label is worth having and never worth failing
+    // a connect over; the account above it is the identity, and that one still
+    // refuses rather than inventing a name.
+    return suggestion;
+  }
+}

package/src/cli/commands/connect/target-note.ts

@@ -1,4 +1,4 @@
-import type { Config, Resolution } from '#profile';
+import type { Resolution } from '#profile';
 import { announce } from '../../output.ts';
 
 /**
@@ -21,7 +21,7 @@ import { announce } from '../../output.ts';
  * is the same mistake caught where it is still cheap.
  */
 export function announceConnectTarget(
-  runtime: { readonly resolution: Resolution; readonly config: Pick<Config, 'targets'> },
+  runtime: { readonly resolution: Resolution },
   json?: boolean | undefined,
 ): void {
   // `emit`'s early return only protects lines printed *at* the emit, and this

package/src/cli/commands/connection.ts

@@ -297,9 +297,18 @@ export async function disconnect(key: string | undefined, flags: DisconnectFlags
   })
 }
 
+/**
+ * Rename a connection, writing `label` and never `account`.
+ *
+ * It wrote `account` until it was noticed that `account` is not a display name:
+ * `settleIdentity` matches on it to tell a repair from a new account,
+ * `idFromAccount` derives the id from it, and `gmail.send_message` writes it
+ * into a `From` header. Renaming through it therefore un-recognised the account
+ * it renamed — the next `connect` added a second row beside it.
+ */
 export async function renameConnection(
   key: string,
-  account: string,
+  label: string,
   flags: RelabelFlags,
 ): Promise<{ resolution: Resolution; relabelled: Relabelled }> {
   const runtime = await openRuntime(flags);
@@ -309,7 +318,7 @@ export async function renameConnection(
     const located = locate(config, key, resolution.profile);
     const document = await ConfigDocument.open(resolution.workspaceRoot, resolution.profile);
 
-    document.setIn(['connections', located.index, 'account'], account);
+    document.setIn(['connections', located.index, 'label'], label);
     await document.save();
 
     return {
@@ -318,8 +327,10 @@ export async function renameConnection(
         profile: resolution.profile,
         target,
         key,
-        from: located.connection.account,
-        to: account,
+        // What it was called a moment ago, which is the account only until the
+        // first rename.
+        from: located.connection.label ?? located.connection.account,
+        to: label,
         published: nextAfterEdit(await publishProfileEdit({ resolution, config, target })),
       },
     };
@@ -330,13 +341,13 @@ export async function renameConnection(
 
 export async function relabel(
   key: string | undefined,
-  account: string | undefined,
+  label: string | undefined,
   flags: RelabelFlags,
 ): Promise<void> {
   if (!key) throw new Error('Which connection? Run: lanes link status');
-  if (!account) throw new Error(`What should ${key} be called? Run: lanes link relabel ${key} "New name"`);
+  if (!label) throw new Error(`What should ${key} be called? Run: lanes link relabel ${key} "New name"`);
 
-  const { resolution, relabelled: result } = await renameConnection(key, account, flags);
+  const { resolution, relabelled: result } = await renameConnection(key, label, flags);
 
   return emit(flags.json, result, () => {
     announce(resolution);