@lanes-sh/link 0.5.4 → 0.6.1

package/src/cli/migrate-plan.ts

@@ -0,0 +1,160 @@
+import { ConfigError, layout, isRemoteWorkspace, type LegacyTarget, type WorkspaceTarget } from '#profile';
+import { deployedWorkspace } from '#deployments/upload.ts';
+
+/**
+ * What one contract-1 target block becomes, and where.
+ *
+ * Apart from `workspace-migrate.ts`, which reads and writes: this is the
+ * decision, and it is the half that has been wrong twice. Both times the shape
+ * was right and the *perspective* was not — the same `cloud:` block is a pointer
+ * seen from a laptop and a declaration seen from inside the bucket, and a
+ * migration that cannot tell which end it is on writes `gs://b` pointing at
+ * `gs://b`.
+ *
+ * So the workspace being migrated is an argument to every function here, and the
+ * tests drive them directly.
+ */
+
+/**
+ * Every profile's target blocks, folded into one registry.
+ *
+ * Two refusals rather than guesses, because both are cases where one target
+ * would need two different answers and picking either silently is the class of
+ * bug this whole change is about.
+ */
+export async function hoist(
+  legacy: readonly { profile: string; targets: Record<string, LegacyTarget> }[],
+  workspaceRoot: string,
+): Promise<Record<string, WorkspaceTarget>> {
+  const registry: Record<string, WorkspaceTarget> = {};
+  const seenFrom: Record<string, string> = {};
+
+  for (const { profile, targets } of legacy) {
+    for (const [name, declared] of Object.entries(targets)) {
+      const entry = toEntry(name, declared, profile, workspaceRoot);
+      if (entry === null) continue;
+      const previous = registry[name];
+
+      if (previous === undefined) {
+        registry[name] = entry;
+        seenFrom[name] = profile;
+        continue;
+      }
+
+      if (JSON.stringify(previous) !== JSON.stringify(entry)) {
+        throw new ConfigError(
+          `Profiles "${seenFrom[name]}" and "${profile}" both declare target "${name}", and they ` +
+            `do not agree.\n` +
+            `  A target is declared once by the workspace it lives in (ADR-052), so one of these\n` +
+            `  has to win and this cannot pick.\n\n` +
+            `    ${seenFrom[name]}: ${summarise(previous)}\n` +
+            `    ${profile}: ${summarise(entry)}\n\n` +
+            `  Edit one of them to match the other, then run this again.`,
+        );
+      }
+    }
+  }
+
+  return registry;
+}
+
+/**
+ * One contract-1 target block as a registry entry.
+ *
+ * A block whose storage names a bucket becomes a pointer: that bucket is a
+ * workspace, it holds the profiles served there, and under ADR-052 it is the
+ * thing that declares the target. The adapters are not copied into the pointer —
+ * they travel to the bucket on the next `deploy`, which is the only command that
+ * can write there and roll an image that understands what it wrote.
+ *
+ * Per-profile paths are dropped when they are the layout defaults, which is the
+ * ordinary case: `./data/<profile>` and `./data/<profile>/credentials.enc` are
+ * exactly what `layout.ts` derives, so a workspace-level target that omits them
+ * addresses the same bytes. A genuinely custom path cannot be hoisted — one
+ * target cannot hold a different path per profile — and is refused by name.
+ */
+export function toEntry(
+  name: string,
+  declared: LegacyTarget,
+  profile: string,
+  workspaceRoot: string,
+): WorkspaceTarget | null {
+  const remote = deployedWorkspace(declared);
+
+  // **A target whose bucket is the workspace being migrated declares itself.**
+  //
+  // Migrating happens on both ends, and the second one is inside the bucket: the
+  // profile there carries the same `cloud` block, and deriving a pointer from it
+  // produces `gs://b` pointing at `gs://b`. That is a loop, and `openTarget`
+  // refuses it — which made `deploy` unable to run against the bucket it had
+  // just migrated, on the one command the refusal names as the fix.
+  if (remote && remote !== workspaceRoot) return { workspace: remote };
+
+  // **A filesystem target is dropped from a remote workspace.**
+  //
+  // The bucket's copy of a profile was uploaded from a laptop, so it carries
+  // that laptop's `local:` block — paths under `./data/` that address a disk the
+  // endpoint has never seen. Hoisting it would leave the bucket declaring a
+  // target it can never open, and `workspacePath` refuses that combination the
+  // moment anything tries.
+  //
+  // Nothing is lost: the machine that owns `local` has its own copy, and that is
+  // the one that was ever real.
+  if (isRemoteWorkspace(workspaceRoot) && declared.storage.adapter === 'filesystem') return null;
+
+  const storagePath = declared.storage.path;
+  const credentialsPath = declared.credentials.path;
+
+  const defaultStorage = `./${layout.blobs(profile)}`;
+  const defaultCredentials = `./${layout.credentials(profile)}`;
+
+  refuseCustomPath(name, profile, workspaceRoot, 'storage.path', storagePath, defaultStorage);
+  refuseCustomPath(
+    name,
+    profile,
+    workspaceRoot,
+    'credentials.path',
+    credentialsPath,
+    defaultCredentials,
+  );
+
+  const { path: _storage, ...storage } = declared.storage;
+  const { path: _credentials, ...credentials } = declared.credentials;
+
+  return {
+    credentials,
+    storage,
+    ...(declared.audit ? { audit: declared.audit } : {}),
+    ...(declared.vault ? { vault: declared.vault } : {}),
+    ...(declared.deploy ? { deploy: declared.deploy } : {}),
+  };
+}
+
+function refuseCustomPath(
+  target: string,
+  profile: string,
+  workspaceRoot: string,
+  field: string,
+  value: string | undefined,
+  expected: string,
+): void {
+  if (value === undefined) return;
+  // Both spellings of the same directory: `./data/personal` and `data/personal`
+  // resolve identically and the template has written each at different times.
+  if (value === expected || value === expected.replace(/^\.\//, '')) return;
+
+  throw new ConfigError(
+    `Profile "${profile}" declares target "${target}" with a custom ${field}:\n` +
+      `    ${value}\n` +
+      `  A target is declared once for the whole workspace now (ADR-052), so it cannot hold a\n` +
+      `  different path per profile. The default it would get is ${expected}.\n\n` +
+      `  Move the data there and delete the line, or keep this profile in a workspace of its\n` +
+      `  own: LANES_LINK_HOME=${workspaceRoot}/<somewhere> lanes link profile add ${profile} --target ${target}`,
+  );
+}
+
+export function summarise(entry: WorkspaceTarget): string {
+  if (entry.workspace !== undefined) return `points at ${entry.workspace}`;
+  const parts = [entry.credentials?.adapter, entry.storage?.adapter].filter(Boolean);
+  return `${parts.join(' + ')}${entry.deploy ? `, deploys ${entry.deploy.service}` : ''}`;
+}

package/src/cli/publish.ts

@@ -1,5 +1,5 @@
 import type { SecretStore } from '#secrets';
-import type { Config } from '#profile';
+import { openTarget, type Config } from '#profile';
 import { publishWorkspace } from '#deployments/upload.ts';
 import { openSecretStoreFor, type Runtime } from './runtime.ts';
 import { endpointUrl } from './endpoint-url.ts';
@@ -117,6 +117,7 @@ export async function publishProfileEdit(input: {
 /** Ask a running endpoint to re-read its config. Never throws. */
 async function notifyReload(input: {
   readonly config: Config;
+  readonly workspaceRoot: string;
   readonly target: string;
   readonly credentials: SecretStore;
 }): Promise<PublishOutcome> {
@@ -125,7 +126,8 @@ async function notifyReload(input: {
     // Answers for a deployed target as well as a local one — a loopback URL
     // sent to a deployment reaches a port with nothing behind it, which is the
     // bug this function's own doc comment records.
-    url = (await endpointUrl(input.config, input.target)).replace(/\/mcp$/, '/reload');
+    const { declared } = await openTarget(input.workspaceRoot, input.target);
+    url = (await endpointUrl(input.config, declared)).replace(/\/mcp$/, '/reload');
   } catch (error) {
     return { served: false, reason: `could not work out where the endpoint is: ${message(error)}` };
   }

package/src/cli/runtime/open.ts

@@ -9,10 +9,10 @@ import {
   KNOWLEDGE_LAYOUT,
   layout,
   listProfiles,
-  undeclaredTarget,
   workspacePath,
   type Config,
   type Resolution,
+  type TargetConfig,
 } from '#profile';
 import { ProviderRegistry, toPolicyDocument } from '#registry';
 import { Dispatcher, createConsoleLogger } from '#dispatch';
@@ -48,6 +48,15 @@ export interface Runtime {
   readonly resolution: Resolution;
   readonly config: Config;
   readonly target: string;
+  /**
+   * The target's adapter set, from the workspace that declares it.
+   *
+   * Here because the config no longer carries it. Every caller that used to
+   * reach `config.targets[target]` — for a `deploy` block, a storage adapter, a
+   * knowledge repository — reads this instead, and reads it without following
+   * the pointer a second time (ADR-052).
+   */
+  readonly declared: TargetConfig;
   readonly state: RuntimeState;
   /** The durable log, for reading. Copies, if any, are write-only and not here. */
   readonly audit: AuditReader;
@@ -133,16 +142,15 @@ export async function openRuntime(
   flags: GlobalFlags,
   options: OpenOptions = {},
 ): Promise<Runtime> {
-  const { resolution, config, target } = await resolveProfile(flags);
-  const declared = config.targets[target];
-  // `resolveProfile` has already checked this, so reaching it means a caller
-  // passed `allowUndeclaredTarget`. Through the shared refusal all the same:
-  // this was a fourth spelling of that sentence with the profile name and the
-  // list of what exists both missing, and the comment on `undeclaredTarget`
-  // says why one copy is the most that survives.
-  if (!declared) throw undeclaredTarget(target, config, resolution.profile);
+  const { resolution, config, target, resolved } = await resolveProfile(flags);
+  // `resolveProfile` returns this for every caller that did not ask to create
+  // the target, and `openRuntime` never does — a runtime for a target that does
+  // not exist yet has nothing to open. The check is what makes that readable at
+  // the type level rather than a comment.
+  if (!resolved) throw new Error(`Target "${target}" has nothing to open yet`);
 
-  const root = resolution.workspaceRoot;
+  const declared = resolved.declared;
+  const root = resolved.workspaceRoot;
   const adapters: TargetInput = { declared, config, root, target };
 
   // Credentials first: an S3 key pair is itself a credential reference, so the
@@ -341,6 +349,7 @@ export async function openRuntime(
     resolution,
     config,
     target,
+    declared,
     state,
     audit,
     credentials,

package/src/cli/runtime/select.ts

@@ -3,11 +3,15 @@ import type { SecretStore } from '#secrets';
 import type { BlobStore } from '#stores/blobs';
 import {
   loadProfileConfig,
+  openTarget,
+  readRegistry,
   resolveSelection,
+  resolveTargetWorkspace,
+  resolveWorkspaceRoot,
   requireTarget,
-  undeclaredTarget,
   type Config,
   type ProfileSelection,
+  type ResolvedTarget,
   type Resolution,
 } from '#profile';
 import { openSecrets, openStorage } from '#deployments/target.ts';
@@ -40,41 +44,78 @@ export async function resolveProfile(
   resolution: Resolution;
   config: Config;
   target: string;
+  /**
+   * The adapter set, already followed to whichever workspace declares it.
+   *
+   * `undefined` only under `allowUndeclaredTarget`, which is `deploy` on a first
+   * run: the target does not exist yet, so there is nothing to follow and
+   * nothing to open. Every other caller can rely on it.
+   */
+  resolved: ResolvedTarget | undefined;
 }> {
   // Spread rather than assigned: `exactOptionalPropertyTypes` makes an explicit
   // `env: undefined` a different type from an absent one, and the absent one is
   // what means "read the real environment".
   const env = options.env !== undefined ? { env: options.env } : {};
 
-  const selection = await resolveSelection({ profileFlag: flags.profile, ...env });
-
-  const { config } = await loadProfileConfig(selection.workspaceRoot, selection.profile);
-  const target = requireTarget(config, flags.target, {
+  // **Target first, and the order is the change.** It used to find the profile,
+  // read its config, and ask that config which targets existed — which is why
+  // "is `cloud` declared" had a different answer per profile, and why a profile
+  // rewritten without its cloud block reported a running deployment as gone.
+  //
+  // A target is a workspace now (ADR-052), so it has to be resolved before there
+  // is anywhere to look for a profile: `personal` on `local` and `personal` on
+  // `cloud` are two files, in two workspaces, and only the target says which one
+  // this command means.
+  const localRoot = resolveWorkspaceRoot(env);
+  const registry = await readRegistry(localRoot);
+  const target = requireTarget(registry, flags.target, {
     allowUndeclared: options.allowUndeclaredTarget === true,
-    profile: selection.profile,
+    root: localRoot,
   });
 
-  return { resolution: { ...selection, target }, config, target };
+  // `deploy` on a first run names a target nothing declares yet, and there is no
+  // workspace to follow. It resolves its own adapters from the flags it was
+  // given; everything else follows the pointer here, once.
+  const resolved = options.allowUndeclaredTarget === true && !(target in registry)
+    ? undefined
+    : await openTarget(localRoot, target);
+
+  const root = resolved?.workspaceRoot ?? localRoot;
+  const selection = await resolveSelection({ profileFlag: flags.profile, root, ...env });
+  const { config } = await loadProfileConfig(root, selection.profile);
+
+  return { resolution: { ...selection, target }, config, target, resolved };
 }
 
 /**
- * A profile without a target, for the commands that do not open one.
+ * A profile, without opening any of its stores.
  *
  * `check` validates a YAML file, `config show` prints the whole of it, and
- * `policy list` reads a block that is target-independent by construction. Making
- * those three demand a `--target` would be the ceremony that teaches people to
- * type `--target local` without reading it, which is how a required flag stops
- * being a guard.
+ * `policy list` reads a block that is the same wherever the profile runs. None
+ * of them needs a credential store or a bucket, and opening one would make all
+ * three fail on a target that is merely unreachable.
+ *
+ * It still needs `--target`, which it did not before. That is not ceremony: a
+ * profile lives in exactly one target's workspace now (ADR-052), so without one
+ * there is no file to validate — `personal` on `local` and `personal` on `cloud`
+ * are different documents. What the flag buys here is finding the file; what it
+ * still does not buy is opening anything.
  */
 export async function resolveProfileOnly(
   flags: GlobalFlags,
   options: { env?: Record<string, string | undefined> } = {},
-): Promise<{ selection: ProfileSelection; config: Config }> {
+): Promise<{ selection: ProfileSelection; config: Config; target: string }> {
   const env = options.env !== undefined ? { env: options.env } : {};
-  const selection = await resolveSelection({ profileFlag: flags.profile, ...env });
-  const { config } = await loadProfileConfig(selection.workspaceRoot, selection.profile);
+  const localRoot = resolveWorkspaceRoot(env);
+  const registry = await readRegistry(localRoot);
+  const target = requireTarget(registry, flags.target, { root: localRoot });
+  const root = await resolveTargetWorkspace(localRoot, target);
+
+  const selection = await resolveSelection({ profileFlag: flags.profile, root, ...env });
+  const { config } = await loadProfileConfig(root, selection.profile);
 
-  return { selection, config };
+  return { selection, config, target };
 }
 
 /**
@@ -90,9 +131,16 @@ export async function openSecretStoreFor(
   root: string,
   target: string,
 ): Promise<SecretStore> {
-  const declared = config.targets[target];
-  if (!declared) throw undeclaredTarget(target, config);
-  return openSecrets({ declared, config, root, target });
+  // Resolved here rather than taken from the caller, so `secrets push --from
+  // local --to cloud` can hold two targets that live in two different workspaces
+  // without the caller having to follow either pointer itself.
+  const resolved = await openTarget(root, target);
+  return openSecrets({
+    declared: resolved.declared,
+    config,
+    root: resolved.workspaceRoot,
+    target,
+  });
 }
 
 /**
@@ -113,10 +161,9 @@ export async function openBlobStoreFor(
   target: string,
   area?: string,
 ): Promise<BlobStore> {
-  const declared = config.targets[target];
-  if (!declared) throw undeclaredTarget(target, config);
+  const resolved = await openTarget(root, target);
 
-  const input = { declared, config, root, target };
+  const input = { declared: resolved.declared, config, root: resolved.workspaceRoot, target };
   const storage = await openStorage(input, await openSecrets(input));
   return area === undefined ? storage() : storage(area);
 }

package/src/cli/selection-require.ts

@@ -0,0 +1,79 @@
+import {
+  listProfiles,
+  noProfileNamed,
+  noTargetNamed,
+  readRegistry,
+  resolveTargetWorkspace,
+  resolveWorkspaceRoot,
+} from '#profile';
+import type { Flags } from './argv.ts';
+import { dispatchWillRefuse, requirementFor } from './selection.ts';
+import { refuseIfUnmigrated } from './workspace-migrate.ts';
+
+/**
+ * Refusing a command that has not said what it acts on.
+ *
+ * Apart from `selection.ts`, which holds the two tables — what each command
+ * requires, and which flags it accepts — and argues for keeping *those two*
+ * together. This is the third thing: actually resolving a selection, which under
+ * ADR-052 means reading the registry, following a pointer to the workspace that
+ * declares the target, and listing the profiles that live there. Table lookups
+ * and network reads are not the same job, and the file-size budget noticed
+ * before anyone else did.
+ */
+
+/**
+ * Refuse before the command runs, naming what it wants and what there is.
+ *
+ * Async, and it reads the workspace — but only on the way to throwing. The
+ * useful half of "which profile did you mean" is the list of them, and the same
+ * for targets; a refusal that only restates the flag name leaves someone to go
+ * and look it up. Both messages come from `#profile` so this file and the
+ * resolver cannot describe the same refusal differently, and both name an
+ * exported variable that no longer counts — the shell still configured for the
+ * old world is the state hardest to diagnose from the inside.
+ */
+export async function requireSelection(
+  first: string,
+  second: string | undefined,
+  flags: Flags,
+  env?: Record<string, string | undefined>,
+): Promise<void> {
+  if (dispatchWillRefuse(first, second)) return;
+
+  const needs = requirementFor(first, second);
+  if (needs === 'none') return;
+
+  const root = resolveWorkspaceRoot(env ? { env } : {});
+
+  // **Target before profile, for both levels.** It used to ask for the profile
+  // and read that profile's own target list — the ordering ADR-052 inverted,
+  // since the profile lives inside the target and there is nowhere to look for
+  // one until the target is known. `refuseIfUnmigrated` is on the refusal path
+  // only, so it costs nothing when the flag is present.
+  if (typeof flags['target'] !== 'string') {
+    await refuseIfUnmigrated(root);
+    throw noTargetNamed(await readRegistry(root), root, env);
+  }
+
+  // A named target the registry cannot know, because it does not exist yet.
+  if (!(flags['target'] in (await readRegistry(root)))) await refuseIfUnmigrated(root);
+
+  if (needs === 'target') return;
+
+  if (typeof flags['profile'] !== 'string') {
+    // Listed from the target's own workspace, so the names offered are ones that
+    // command could act on. An unreachable pointer degrades to the empty list
+    // rather than failing — "which profile" is still the question being asked.
+    const where = await resolveTargetWorkspace(root, flags['target']).catch(() => root);
+    throw noProfileNamed(where, await listProfiles(where).catch(() => []), env);
+  }
+}
+
+/**
+ * Flags every command accepts, whatever it does.
+ *
+ * `--help` short-circuits before dispatch, and `--json` is offered widely enough
+ * that listing it per command would be noise. `--quiet` is read by `announce`
+ * rather than by any one command.
+ */

package/src/cli/selection.ts

@@ -1,14 +1,4 @@
-import {
-  ConfigError,
-  listProfiles,
-  loadProfileConfig,
-  loadWorkspaceProfiles,
-  noProfileNamed,
-  noTargetInWorkspace,
-  noTargetNamed,
-  resolveWorkspaceRoot,
-  targetsByName,
-} from '#profile';
+import { ConfigError } from '#profile';
 import type { Flags } from './argv.ts';
 import { CONNECT_CUSTOM_FLAGS } from './commands/connect/custom/spec.ts';
 import { nearest } from './nearest.ts';
@@ -39,11 +29,17 @@ import { nearest } from './nearest.ts';
  * What a command must be told before it can act.
  *
  * `target` is not a weaker `profile+target`. It says the command's subject *is*
- * the target, and that the profiles behind it are every profile declaring it
- * rather than one the operator picks (ADR-043). `--profile` stays accepted
+ * the target, and that the profiles behind it are every profile *in* it rather
+ * than one the operator picks (ADR-043, ADR-052). `--profile` stays accepted
  * there, as a filter.
+ *
+ * There is no `profile`-alone level any more. Five commands sat there — the ones
+ * that read a profile's file and open nothing — and it stopped being reachable
+ * when a profile came to live inside one target's workspace: without a target
+ * there is no file to read. The level is gone rather than left empty, so nobody
+ * adds a sixth command to a level that cannot resolve.
  */
-export type Requires = 'none' | 'profile' | 'target' | 'profile+target';
+export type Requires = 'none' | 'target' | 'profile+target';
 
 /**
  * The rule, per command path.
@@ -87,28 +83,33 @@ export const SELECTION: Record<string, Requires> = {
   'mcp list': 'none',
   // The bare forms, which each dispatch to a `case undefined` in `main.ts`.
   // `lanes link profile` is `profile list`, and needs the same as it.
-  profile: 'none',
   mcp: 'none',
-  'profile list': 'none',
-  'profile add': 'none',
   'profile default': 'none',
   'target use': 'none',
   'vault key': 'none',
+  // Listing the registry is what you run to find out what `--target` accepts, so
+  // requiring the answer as input would be circular (ADR-052).
+  target: 'none',
+  'target list': 'none',
+
+  // A profile lives in one target's workspace, so listing or creating one names
+  // which workspace. `target show` follows the pointer, which `list` does not.
+  profile: 'target',
+  'profile list': 'target',
+  'profile add': 'target',
+  'profile remove': 'target',
+  'target show': 'target',
 
-  check: 'profile',
-  config: 'profile',
-  policy: 'profile',
-  target: 'profile',
-  'config show': 'profile',
-  'policy list': 'profile',
-  'target list': 'profile',
-  'target show': 'profile',
-  'secrets push': 'profile',
-  'profile remove': 'none',
-  // Target-independent for the same reason `policy list` is: the block is
-  // declared once in the YAML and applies to every target the profile has.
-  identity: 'profile',
-  'identity list': 'profile',
+  // These read one profile's file and open nothing. The target is what says
+  // which workspace holds it — required to *locate* the profile, not to open it.
+  check: 'profile+target',
+  config: 'profile+target',
+  'config show': 'profile+target',
+  policy: 'profile+target',
+  'policy list': 'profile+target',
+  identity: 'profile+target',
+  'identity list': 'profile+target',
+  'secrets push': 'profile+target',
 
   connect: 'profile+target',
   // Both edit the profile config, and `disconnect` also opens the target's
@@ -205,7 +206,7 @@ const SUBCOMMANDS: Record<string, readonly string[]> = {
  * bogus" is the useful sentence, and a complaint about `--profile` on a command
  * that does not exist sends someone off to fix the wrong thing.
  */
-function dispatchWillRefuse(first: string, second: string | undefined): boolean {
+export function dispatchWillRefuse(first: string, second: string | undefined): boolean {
   const known = SUBCOMMANDS[first];
   if (!known || second === undefined) return false;
   return !known.includes(second);
@@ -228,65 +229,6 @@ export function requirementFor(first: string, second: string | undefined): Requi
   return SELECTION[selectionKey(first, second)] ?? 'profile+target';
 }
 
-/**
- * Refuse before the command runs, naming what it wants and what there is.
- *
- * Async, and it reads the workspace — but only on the way to throwing. The
- * useful half of "which profile did you mean" is the list of them, and the same
- * for targets; a refusal that only restates the flag name leaves someone to go
- * and look it up. Both messages come from `#profile` so this file and the
- * resolver cannot describe the same refusal differently, and both name an
- * exported variable that no longer counts — the shell still configured for the
- * old world is the state hardest to diagnose from the inside.
- */
-export async function requireSelection(
-  first: string,
-  second: string | undefined,
-  flags: Flags,
-  env?: Record<string, string | undefined>,
-): Promise<void> {
-  if (dispatchWillRefuse(first, second)) return;
-
-  const needs = requirementFor(first, second);
-  if (needs === 'none') return;
-
-  // Asked before the profile requirement, because for these there is none. The
-  // refusal has to describe the workspace rather than one profile's targets,
-  // since the command was never going to act on only one.
-  if (needs === 'target') {
-    if (typeof flags['target'] === 'string') return;
-    const root = resolveWorkspaceRoot(env ? { env } : {});
-    throw noTargetInWorkspace(targetsByName(await loadWorkspaceProfiles(root)), root, env);
-  }
-
-  const profile = flags['profile'];
-  if (typeof profile !== 'string') {
-    const root = resolveWorkspaceRoot(env ? { env } : {});
-    throw noProfileNamed(root, await listProfiles(root), env);
-  }
-
-  if (needs !== 'profile+target' || typeof flags['target'] === 'string') return;
-
-  // The profile is known by here, so the target list is the one belonging to it
-  // rather than a guess. A profile that does not exist is a different refusal,
-  // and `resolveSelection` gives it a better one a moment later.
-  const root = resolveWorkspaceRoot(env ? { env } : {});
-  try {
-    const { config } = await loadProfileConfig(root, profile);
-    throw noTargetNamed(config, profile, env);
-  } catch (error) {
-    if (error instanceof ConfigError) throw error;
-    throw new ConfigError(`--target is required for "${[first, second].filter(Boolean).join(' ')}".`);
-  }
-}
-
-/**
- * Flags every command accepts, whatever it does.
- *
- * `--help` short-circuits before dispatch, and `--json` is offered widely enough
- * that listing it per command would be noise. `--quiet` is read by `announce`
- * rather than by any one command.
- */
 const UNIVERSAL = ['help', 'json', 'quiet'];
 
 /**
@@ -367,6 +309,16 @@ const ACCEPTS: Record<string, readonly string[]> = {
  * `parseArgv` returns every `--anything` it sees and no command ever inspected
  * the leftovers. A typo was swallowed the same way on every command in the CLI.
  */
+/**
+ * Commands that name their profile as an argument, and so refuse the flag.
+ *
+ * A `--profile` here could only name a *second* profile and disagree with the
+ * positional one. They needed no exception while both sat at `none`; ADR-052
+ * moved them to `target`, which made them inherit `--profile` from the rule
+ * below.
+ */
+const POSITIONAL_PROFILE = new Set(['profile add', 'profile remove']);
+
 export function assertKnownFlags(first: string, second: string | undefined, flags: Flags): void {
   if (dispatchWillRefuse(first, second)) return;
 
@@ -378,7 +330,7 @@ export function assertKnownFlags(first: string, second: string | undefined, flag
     ...(ACCEPTS[key] ?? []),
     // `target` accepts both: the target is what it acts on, and `--profile`
     // narrows it to one of the profiles behind it.
-    ...(needs !== 'none' ? ['profile'] : []),
+    ...(needs !== 'none' && !POSITIONAL_PROFILE.has(key) ? ['profile'] : []),
     ...(needs === 'target' || needs === 'profile+target' ? ['target'] : []),
   ]);