@lanes-sh/link 0.7.2 → 0.8.0

package/src/cli/commands/operate/serve.ts

@@ -1,9 +1,11 @@
+import { readSession } from '#auth/lanes/session.ts';
+import { ConfigError } from '#profile';
 import { startEndpoint } from '#server/endpoint.ts';
 import { streamLogger } from '#server/logging.ts';
 import { repairOwnerLayer } from '../../config-repair.ts';
 import { announce, ok, print, style, warn } from '../../output.ts';
 import { staleNudge } from '../../release.ts';
-import { resolveProfile, type GlobalFlags } from '../../runtime.ts';
+import { primaryProfile, resolveProfile, type GlobalFlags } from '../../runtime.ts';
 
 /** `lanes link start` — reconcile, then serve every profile on one endpoint. */
 
@@ -14,9 +16,24 @@ export async function start(
     only?: boolean | undefined;
   },
 ): Promise<void> {
-  const { resolution } = await resolveProfile(flags);
+  // One endpoint serves every profile in the workspace, so the workspace is the
+  // subject and a profile is not required. What `--profile` picks is the
+  // *primary*: whose token opens the endpoint and whose port it binds (ADR-009).
+  // `--only` is the flag that narrows what is served, and it has nothing to
+  // narrow unless a profile was named.
+  if (flags.only === true && flags.profile === undefined) {
+    throw new ConfigError(
+      '--only serves one profile, so it needs to be told which.\n' +
+        '  Add --profile <name>, or drop --only to serve every profile in the workspace.',
+    );
+  }
+
+  const resolved = { ...flags, profile: await primaryProfile(flags) };
+  const { resolution } = await resolveProfile(resolved);
   announce(resolution);
 
+  await requireSignIn();
+
   // Before the bootstrap, and only here.
   //
   // This is the one command an existing install runs without being told to, so
@@ -41,7 +58,7 @@ export async function start(
   // entrypoint. What stays here is what a terminal wants: the plan, printed as
   // it is applied, and the endpoint at the end.
   const endpoint = await startEndpoint({
-    flags,
+    flags: resolved,
     port: flags.port,
     only: flags.only,
     mintToken: true,
@@ -56,7 +73,7 @@ export async function start(
         print(ok(`reconciled ${ofMany ? profile : ''}`.trim()));
       },
       tokenMinted({ target }) {
-        print(warn(`minted a token — run: lanes link outputs --show --target ${target}`));
+        print(warn(`minted a token — run: lanes link outputs --show --workspace ${target}`));
       },
     },
   });
@@ -81,3 +98,34 @@ export async function start(
 
   await new Promise(() => {});
 }
+
+/**
+ * Refuse to serve without a Lanes session.
+ *
+ * A local endpoint requires this as much as a deployed one does, which is the
+ * uncomfortable half of ADR-060 and worth stating plainly: **a self-hostable
+ * tool now needs an account to start.** The alternative was worse. A profile
+ * declares who may consume it, and there is no way to check that against
+ * anybody if the endpoint has no idea who is asking — so "local is exempt"
+ * means local profiles cannot express delegation at all, and the model would be
+ * two models.
+ *
+ * What is *not* required is the network per request. A machine offline for a
+ * day keeps serving; the session is needed to sign in and to refresh, and
+ * `lanes auth status` says how long that has left to run.
+ *
+ * The CI token is the exception and stays one (ADR-009): a headless runner has
+ * no browser, presents `llk_…`, and reaches the whole workspace.
+ */
+async function requireSignIn(): Promise<void> {
+  if ((await readSession()) !== null) return;
+
+  throw new ConfigError(
+    'Not signed in, so there is nobody for this endpoint to serve.\n' +
+      '  Run: lanes auth login\n' +
+      '\n' +
+      '  A profile reaches you only where its members list your subject, which is why\n' +
+      '  this is required for a local endpoint too. See:\n' +
+      '    lanes link profile members add --me --profile <name>',
+  );
+}

package/src/cli/commands/operate/status.ts

@@ -1,3 +1,4 @@
+import { wasDefaulted } from '../../selection-require.ts';
 import {
   isPointer,
   listProfiles,
@@ -11,7 +12,7 @@ import {
 import { oneProfile, visibleCapabilities } from '#server/mcp';
 import { toPolicyDocument } from '#registry';
 import { announce, emit, heading, print, style, table } from '../../output.ts';
-import { openRuntime, ownerPrincipal, type GlobalFlags } from '../../runtime.ts';
+import { grantedConnections, openRuntime, ownerPrincipal, type GlobalFlags } from '../../runtime.ts';
 import { deploymentIdentity } from '../../endpoint-url.ts';
 
 /** `lanes link status` — connections, what is reachable through them, and where. */
@@ -29,7 +30,7 @@ export interface StatusFlags extends GlobalFlags {
  *
  * Which is why a deployed target prints its *identity* rather than its address.
  * This used to print `http://<host>:<port>/mcp` unconditionally, so
- * `status --target cloud` named a loopback port with nothing behind it — the
+ * `status --workspace cloud` named a loopback port with nothing behind it — the
  * bug `endpoint-url.ts` records having already fixed in `mcp add`. Reaching for
  * `endpointUrl` here would fix the lie by surrendering the property above: it
  * shells out to `gcloud`, costs seconds, needs the CLI installed and
@@ -48,7 +49,7 @@ export async function status(flags: StatusFlags): Promise<void> {
     const records = await runtime.state.connections.list();
     const byKey = new Map(records.map((record) => [`${record.provider}.${record.id}`, record]));
 
-    const connections = runtime.config.connections.map((connection) => {
+    const connections = grantedConnections(runtime).map((connection) => {
       const key = `${connection.provider}.${connection.id}`;
       return {
         key,
@@ -142,7 +143,7 @@ export async function status(flags: StatusFlags): Promise<void> {
           print(
             style.dim(
               '  the address is the platform\'s to assign — run: ' +
-                `lanes link outputs --target ${runtime.target}`,
+                `lanes link outputs --workspace ${runtime.target}`,
             ),
           );
         }
@@ -197,12 +198,12 @@ async function workspaceStatus(flags: StatusFlags): Promise<void> {
     unreachable = error instanceof Error ? error.message : String(error);
   }
 
-  const root = resolved?.workspaceRoot ?? (isPointer(entry) ? entry.workspace : localRoot);
+  const root = resolved?.workspaceRoot ?? (isPointer(entry) ? entry.at : localRoot);
   const workspace = resolved ? await loadWorkspaceProfiles(root) : undefined;
 
   const profiles = (workspace?.loaded ?? []).map((loaded) => ({
     name: loaded.profile,
-    connections: loaded.config.connections.length,
+    grants: loaded.config.grants.length,
   }));
 
   const deployment = deploymentIdentity(resolved?.declared.deploy);
@@ -220,7 +221,14 @@ async function workspaceStatus(flags: StatusFlags): Promise<void> {
       unreadable: workspace?.unreadable ?? [],
     },
     () => {
-      print(style.dim(`workspace ${style.bold(root)}  target ${style.bold(target)}`));
+      // The same shape `announce` prints, including whether the workspace was
+      // typed or defaulted — a command that reported it differently would make
+      // ADR-061's echo a thing an operator has to learn twice.
+      print(
+        style.dim(
+          `workspace ${style.bold(target)}${wasDefaulted(target) ? ' (default)' : ''}  ${root}`,
+        ),
+      );
 
       if (unreachable !== undefined) {
         heading('Unreachable');
@@ -234,12 +242,12 @@ async function workspaceStatus(flags: StatusFlags): Promise<void> {
       heading('Profiles');
       if (profiles.length === 0) {
         print(style.dim('  None yet.'));
-        print(style.dim(`  Create one with: lanes link profile add <name> --target ${target}`));
+        print(style.dim(`  Create one with: lanes link profile add <name> --workspace ${target}`));
       } else {
         table(
           profiles.map((profile) => [
             `  ${style.bold(profile.name)}`,
-            style.dim(`${profile.connections} connection(s)`),
+            style.dim(`${profile.grants} grant(s)`),
           ]),
         );
       }
@@ -257,7 +265,7 @@ async function workspaceStatus(flags: StatusFlags): Promise<void> {
       print(
         style.dim(
           "  the address is the platform's to assign — run: " +
-            `lanes link outputs --target ${target} --profile ${profiles[0]?.name ?? '<name>'}`,
+            `lanes link outputs --workspace ${target} --profile ${profiles[0]?.name ?? '<name>'}`,
         ),
       );
     },

package/src/cli/commands/operate/tools.ts

@@ -50,7 +50,7 @@ export async function tools(flags: ToolsFlags): Promise<void> {
       {
         url,
         target: runtime.target,
-        // Both, because `--target cloud` reaching loopback is indistinguishable
+        // Both, because `--workspace cloud` reaching loopback is indistinguishable
         // from success without them.
         deployed: deployed !== null,
         answering: mine,
@@ -297,7 +297,7 @@ export function parse(text: string): Record<string, unknown> {
  * `capabilityIdForToolName` answers it exactly against a set of known ids, and
  * falls back to that first-underscore split when it recognises none — which is
  * reachable here, because the registry is the *invoking profile's* while the
- * endpoint may serve several, and under `--target cloud` may run an image this
+ * endpoint may serve several, and under `--workspace cloud` may run an image this
  * checkout does not have. So the fallback is detected rather than trusted: a
  * name that resolves to nothing known is grouped as unattributed, because a
  * guessed heading with a confident count is worse than an honest "these did not

package/src/cli/commands/operate.ts

@@ -11,6 +11,7 @@
  *   outputs.ts   what an agent harness needs, and proving the short form works
  *   desktop.ts   opening the Lanes app, on the page that drives this CLI
  *   serve.ts     start
+ *   pair.ts      pair — the dashboard's read surface (ADR-063)
  *   audit.ts     audit tail and verify, and the Markdown rendering of tail
  *   token.ts     token show, token rotate
  *   policy.ts    policy list/allow/deny, config show
@@ -25,6 +26,7 @@ export { status } from './operate/status.ts';
 export { outputs, type OutputsFlags } from './operate/outputs.ts';
 export { tools, type ToolsFlags } from './operate/tools.ts';
 export { start } from './operate/serve.ts';
+export { pair, PAIR_CERT_REF, PAIR_KEY_REF, PAIR_TOKEN_REF, type PairFlags } from './operate/pair.ts';
 export { desktop, settingsUrl, type DesktopFlags } from './operate/desktop.ts';
 export { auditTail, auditVerify, markdownCell } from './operate/audit.ts';
 export { attachFile } from './operate/attach.ts';

package/src/cli/commands/owner/shared.ts

@@ -73,7 +73,15 @@ export async function withRuntime(
  * the candidates rather than picking.
  */
 export function ownerConnection(config: Config, provider: string, flags: OwnerFlags): string {
-  const candidates = config.connections.filter((connection) => connection.provider === provider);
+  // Derived from the grants, not from the workspace's connections. The question
+  // is which store *this profile* may reach, and a workspace holding
+  // `memory.acme` that this profile does not grant is not a candidate — offering
+  // it would let the CLI write somewhere the endpoint would refuse to read
+  // (ADR-057, ADR-058).
+  const prefix = `${provider}.`;
+  const candidates = config.grants
+    .filter((grant) => grant.connection.startsWith(prefix))
+    .map((grant) => ({ id: grant.connection.slice(prefix.length) }));
 
   if (flags.connection) {
     const match = candidates.find((connection) => connection.id === flags.connection);
@@ -90,7 +98,10 @@ export function ownerConnection(config: Config, provider: string, flags: OwnerFl
 
   if (candidates.length === 0) {
     throw new ConfigError(
-      `This profile has no ${provider} connection. Add one with: lanes link connect ${provider}`,
+      `This profile grants no ${provider} connection.\n` +
+        `  Connect one to the workspace, then grant it:\n` +
+        `    lanes link connect ${provider}\n` +
+        `    lanes link grant ${provider}.<id> --profile ${config.instance.profile}`,
     );
   }
   if (candidates.length > 1) {

package/src/cli/commands/owner/skills.ts

@@ -1,4 +1,5 @@
-import { ConfigError } from '#profile';
+import { ConfigError, type Config } from '#profile';
+import type { BlobStore } from '#stores/blobs';
 import {
   loadProfileSkills,
   readSkill,
@@ -10,9 +11,28 @@ import { agreed, readStdin, required, withRuntime, type OwnerFlags } from './sha
 
 /** `lanes link skills` — the reusable procedures agents can invoke. */
 
+/**
+ * The store, or a refusal naming why there is none.
+ *
+ * A profile grants at most one `skills` connection and may grant none
+ * (ADR-059), so `store(runtime)` is genuinely absent rather than empty. The two
+ * are worth telling apart: "you have no skills" invites writing one, and
+ * "this profile is not granted skills" is a config fact the operator has to fix
+ * before writing one would do anything.
+ */
+function store(runtime: { skills: BlobStore | undefined; config: Config }): BlobStore {
+  if (runtime.skills) return runtime.skills;
+  throw new ConfigError(
+    `Profile "${runtime.config.instance.profile}" grants no skills connection.\n` +
+      `  Grant one, then try again:\n` +
+      `    lanes link grant skills.main --profile ${runtime.config.instance.profile}`,
+  );
+}
+
+
 export async function skillsList(flags: OwnerFlags): Promise<void> {
   await withRuntime(flags, async (runtime) => {
-    const skills = await loadProfileSkills(runtime.skills);
+    const skills = await loadProfileSkills(store(runtime));
 
     heading(`Skills (${skills.length})`);
     if (skills.length === 0) {
@@ -43,10 +63,10 @@ export async function skillsShow(name: string | undefined, flags: OwnerFlags): P
   const skillName = required(name, 'lanes link skills show <name>');
 
   await withRuntime(flags, async (runtime) => {
-    const skill = await readSkill(runtime.skills, skillName);
+    const skill = await readSkill(store(runtime), skillName);
     if (!skill) throw new ConfigError(`No skill "${skillName}" in this workspace.`);
 
-    const bytes = await runtime.skills.get(skill.path);
+    const bytes = await store(runtime).get(skill.path);
     print('');
     print(bytes ? new TextDecoder().decode(bytes) : skill.body);
   });
@@ -63,8 +83,8 @@ export async function skillsAdd(name: string | undefined, flags: OwnerFlags): Pr
       );
 
   await withRuntime(flags, async (runtime) => {
-    const existing = await readSkill(runtime.skills, skillName);
-    const skill = await writeSkill(runtime.skills, skillName, text);
+    const existing = await readSkill(store(runtime), skillName);
+    const skill = await writeSkill(store(runtime), skillName, text);
 
     print(ok(`${existing ? 'replaced' : 'added'} skill ${style.bold(skill.name)}`));
     print(
@@ -79,14 +99,14 @@ export async function skillsRemove(name: string | undefined, flags: OwnerFlags):
   const skillName = required(name, 'lanes link skills remove <name>');
 
   await withRuntime(flags, async (runtime) => {
-    const skill = await readSkill(runtime.skills, skillName);
+    const skill = await readSkill(store(runtime), skillName);
     if (!skill) throw new ConfigError(`No skill "${skillName}" in this workspace.`);
 
     print(`  ${style.bold(skill.name)}  ${skill.description}`);
     print(style.dim(`  ${skill.path}`));
     if (!(await agreed(flags, 'Remove this skill?'))) return;
 
-    await removeSkill(runtime.skills, skillName);
+    await removeSkill(store(runtime), skillName);
     print(ok(`removed skill ${style.bold(skillName)}`));
   });
 }

package/src/cli/commands/profile/removal.ts

@@ -1,4 +1,4 @@
-import { layout, profilePath, workspacePath, type Config, type TargetConfig } from '#profile';
+import { layout, profilePath, vaultRef, workspacePath, type Config, type TargetConfig } from '#profile';
 import type { SecretStore } from '#secrets';
 import type { BlobStore } from '#stores/blobs';
 import { credentialRefFor, ownClientRefsFor, type ProviderRegistry } from '#registry';
@@ -32,37 +32,69 @@ import { print, style, warn } from '../../output.ts';
  */
 export function declaredRefs(
   config: Config,
-  registry: ProviderRegistry,
   declared: TargetConfig,
+  /**
+   * What the profiles that are staying declare.
+   *
+   * Nothing in here is deleted, however plainly the profile being removed also
+   * declares it. The credential store is one file per *workspace* since
+   * contract 3, and every profile takes the template default
+   * `token_ref: profile/token` — so removing one profile deleted the endpoint
+   * token the others are served by, and the deployed revision then refused every
+   * request with "No profile token in this target's credential store". The vault
+   * ref is read off the target and is identical for every profile there, which
+   * made the sibling's sealed items unrecoverable in the same command.
+   */
+  survivors: readonly Config[] = [],
 ): string[] {
   const refs = new Set<string>([config.auth.token_ref]);
 
   // Read off the *target*, not the profile. `vaultTargetSchema` sits inside
-  // `targetSchema`, so two targets may seal the same profile's items in
-  // different places; taking it from the profile would attach one target's
-  // vault to another target's removal.
+  // `targetSchema`, so two targets may seal the same items in different places;
+  // taking it from the profile would attach one target's vault to another
+  // target's removal.
+  //
+  // **Through `vaultRef`, because the name carries the connection.** This said
+  // `vault/document`, the contract-2 constant, while `openVault` seals under
+  // `vault/<connection>` (ADR-059) — so removing a profile queued a ref nothing
+  // had ever written and left the real document behind. Under-deletion rather
+  // than over, since the survivor set was wrong the same way and they cancelled,
+  // but what stayed behind is sealed credential material belonging to a profile
+  // the operator asked to be gone. Per connection also makes the survivor check
+  // mean something: two profiles granting different vaults no longer look like
+  // one document to it.
   if (declared.vault?.adapter === 'secret') {
-    refs.add(declared.vault.ref ?? 'vault/document');
+    refs.add(vaultRef(declared, config));
   }
 
-  for (const connection of config.connections) {
-    const manifest = registry.manifest(connection.provider);
-
-    // `credentialRefFor` rather than `credentialRefForConnection`: it is the
-    // single authority on where a connection's credential lives, and it exists
-    // because two callers once derived the answer differently and disagreed.
-    // Asking the lower-level one here would open that gap again from a third
-    // side — and it would miss a `local` provider, whose only ref is the one
-    // the connection declares itself.
-    const ref = credentialRefFor(connection, manifest);
-    if (ref) refs.add(ref);
-
-    if (manifest) {
-      for (const own of ownClientRefsFor(manifest, config.oauth_apps)) refs.add(own);
-    }
+  // **No connection credentials.** They belong to the workspace now (ADR-057),
+  // and every one of them may be granted by a profile that is staying. Removing
+  // a profile therefore removes no account and no credential — `lanes link
+  // disconnect` is the command that does that, and it is the one that knows how
+  // to check whether anybody else still needs the credential first.
+  //
+  // This is the sharpest edge in the whole decoupling, so `renderPlan` says it
+  // out loud rather than leaving an operator to infer it from a short list:
+  // "remove the work profile" used to mean "revoke what work could reach", and
+  // it does not any more.
+  if (config.auth.authorization?.mode === 'oidc') {
+    refs.add(config.auth.authorization.client_id_ref);
   }
 
-  return [...refs];
+  // Shared with a profile that is staying, so not ours to delete. Computed the
+  // same way for the survivors as for this one, because "what does a profile
+  // declare" has to have one answer.
+  const kept = new Set(
+    survivors.flatMap((other) => [
+      other.auth.token_ref,
+      ...(declared.vault?.adapter === 'secret' ? [vaultRef(declared, other)] : []),
+      ...(other.auth.authorization?.mode === 'oidc'
+        ? [other.auth.authorization.client_id_ref]
+        : []),
+    ]),
+  );
+
+  return [...refs].filter((ref) => !kept.has(ref));
 }
 
 export interface RemovalItem {
@@ -96,6 +128,14 @@ export interface PlanOptions {
   readonly openSecrets: (target: string) => Promise<SecretStore>;
   readonly openBlobs: (target: string, area?: string) => Promise<BlobStore>;
   readonly readDefaultProfile?: (() => Promise<string | undefined>) | undefined;
+  /**
+   * The profiles that are staying.
+   *
+   * So a credential both this one and a survivor declares is left alone — see
+   * `declaredRefs`. Defaulted to empty, which is the single-profile workspace
+   * and the shape every existing caller had.
+   */
+  readonly survivors?: readonly Config[] | undefined;
 }
 
 const reason = (cause: unknown): string => (cause instanceof Error ? cause.message : String(cause));
@@ -144,15 +184,16 @@ export async function removalPlan(
       );
     }
 
-    // Secrets first, and this ordering is load-bearing rather than tidy:
-    // `layout.credentials(p)` is `data/<p>/credentials.enc`, *inside* the blob
-    // root `data/<p>`. For the file adapter the credential store is itself a
-    // blob, so blobs-first would delete the store the secret deletions read
-    // through and turn every one of them into a failure.
+    // Secrets, and there is nothing left to order them against. This used to
+    // run before a blob sweep because `layout.credentials(p)` was
+    // `data/<p>/credentials.enc`, *inside* the blob root `data/<p>`, so
+    // blobs-first deleted the store the secret deletions read through. Both the
+    // sweep and the per-profile root are gone (ADR-057, ADR-059) — see the note
+    // below — and the credential store is the workspace's now.
     try {
       const secrets = await options.openSecrets(name);
       const present = await secrets.list();
-      const mine = new Set(declaredRefs(config, registry, declared));
+      const mine = new Set(declaredRefs(config, declared, options.survivors ?? []));
 
       for (const ref of present) if (mine.has(ref)) items.push({ target: name, kind: 'secret', id: ref });
 
@@ -164,54 +205,16 @@ export async function removalPlan(
       );
     }
 
-    try {
-      const blobs = await options.openBlobs(name);
-      for (const blob of await blobs.list()) items.push({ target: name, kind: 'blob', id: blob.key });
-    } catch (cause) {
-      warnings.push(
-        `Target "${name}": its storage could not be opened (${reason(cause)}), so nothing in it will be removed.`,
-      );
-    }
-
-    // The blob store's root is the profile's own directory, and an adapter must
-    // never delete the root it was configured with — so emptying it leaves the
-    // directory. `layout.ts` frames that directory as the unit ("rm -r
-    // data/work is exactly remove the work profile's data"), and one left
-    // behind is silently reused by a later `profile add` of the same name.
-    if (declared.storage.adapter === 'filesystem') {
-      const blobRoot = declared.storage.path ?? layout.blobs(profile);
-      items.push({
-        target: name,
-        kind: 'file',
-        id: blobRoot,
-        note: 'the profile directory, once emptied',
-      });
-
-      // Skills and manifests sit at fixed areas under `data/<profile>/`, the
-      // same way state and the log do — an explicit area, so a profile that
-      // declares its own `storage.path` moves its provider blobs and leaves
-      // these where `layout` says they are. The sweep above walks the blob root
-      // and would then walk straight past them, so they are named. Ordinary
-      // case: both are already inside `blobRoot` and the sweep has them, which
-      // is why this only fires when the two have been pointed apart.
-      //
-      // Resolved before comparing, because they are not compared as paths
-      // otherwise: `newProfileTemplate` writes `./data/<profile>` and
-      // `layout.blobs` returns `data/<profile>`, which is one directory spelled
-      // two ways — the same leading `./` that `profile/layout.ts` has a
-      // paragraph about. Comparing the strings names every default profile's
-      // skills twice in the preview an operator confirms.
-      if (workspacePath(root, blobRoot) !== workspacePath(root, layout.blobs(profile))) {
-        for (const area of [layout.skills(profile), layout.providers(profile)]) {
-          items.push({
-            target: name,
-            kind: 'file',
-            id: area,
-            note: 'outside the declared storage path, so not swept with it',
-          });
-        }
-      }
-    }
+    // **No blob sweep, and no profile directory.** Both existed because a
+    // profile owned `data/<profile>/`, and `rm -r` on it was exactly "what could
+    // this profile reach". It owns nothing now (ADR-057, ADR-059): the blob root
+    // is the workspace's, and the stores under it belong to connections other
+    // profiles may grant. Listing it here would queue every byte in the
+    // workspace for deletion because one profile is going.
+    //
+    // What replaces it is `lanes link disconnect`, which takes one connection,
+    // its grants, and its credential — after checking whether anything else
+    // still needs them. That check is the whole reason this cannot happen here.
 
     // A deployed revision reads its config from the bucket rather than the
     // image (ADR-023), so that copy is the profile too — and it is outside the

package/src/cli/commands/profile/remove.ts

@@ -13,6 +13,7 @@ import {
 import { parseDocument } from 'yaml';
 import { rm } from 'node:fs/promises';
 import { terminalPrompter, type Prompter } from '../../prompt.ts';
+import { recordConfigChange } from '../../audit-change.ts';
 import { announceProfile, emit, fail, ok, print, style } from '../../output.ts';
 import {
   buildRegistryWithWorkspace,
@@ -21,6 +22,7 @@ import {
   resolveProfileOnly,
   type GlobalFlags,
 } from '../../runtime.ts';
+import { loadWorkspaceProfiles } from '#profile';
 import { removalPlan, renderPlan, type RemovalItem, type RemovalPlan } from './removal.ts';
 
 /**
@@ -255,7 +257,7 @@ export async function removeProfile(name: string, flags: RemoveFlags): Promise<v
   announceProfile(selection);
 
   const root = selection.workspaceRoot;
-  const registry = await buildRegistryWithWorkspace(root, name);
+  const registry = await buildRegistryWithWorkspace(root);
   const files = workspaceFiles(root);
   const { declared } = await openTarget(root, target);
 
@@ -265,6 +267,11 @@ export async function removeProfile(name: string, flags: RemoveFlags): Promise<v
     openSecrets: (target) => openSecretStoreFor(config, root, target),
     openBlobs: (target, area) => openBlobStoreFor(config, root, target, area),
     readDefaultProfile: async () => (await readWorkspace(root))?.default_profile,
+    // What the workspace keeps. The credential store is one file for all of
+    // them now, so anything a survivor declares is not this removal's to delete.
+    survivors: (await loadWorkspaceProfiles(root)).loaded
+      .filter((one) => one.profile !== name)
+      .map((one) => one.config),
   });
 
   renderPlan(plan);
@@ -286,6 +293,14 @@ export async function removeProfile(name: string, flags: RemoveFlags): Promise<v
     retry: retryCommand,
   });
 
+  // Before the render, and against the config loaded above — the profile's file
+  // is gone by now, so a helper that re-read it would find nothing.
+  await recordConfigChange(config, root, target, {
+    capability: 'config.profile.remove',
+    scope: name,
+    arguments: { connections: config.grants.map((grant) => grant.connection) },
+  });
+
   return emit(flags.json, outcome, () => renderOutcome(outcome));
 }