@lanes-sh/link 0.7.2 → 0.9.0

package/src/server/index.ts

@@ -4,6 +4,7 @@ import { capabilityIdForToolName } from '#server/mcp';
 import { ATTACHMENTS_PATH, handleAttachments } from './attachments.ts';
 import { allowedHostnamesFor, rebindingRefusal } from './rebinding.ts';
 import { ANY_ORIGIN, corsAware, type CorsPolicy } from './cors.ts';
+import { isReadPath, readRoutes, type ReadDeps } from './read/routes.ts';
 import type { Generation } from './generation.ts';
 import type { Generations } from './generations.ts';
 import {
@@ -67,6 +68,16 @@ export interface ServerOptions {
    * — a page the owner happens to be visiting — before this would be reached.
    */
   readonly meterUnauthenticated?: boolean | undefined;
+  /**
+   * The dashboard's read surface, when this bind may serve it (ADR-064).
+   *
+   * Another property of the bind address, decided in the same lines of
+   * `serve()` as `cors` and the meter. Absent on loopback, where the TLS
+   * listener in `./read/open.ts` serves it on its own port instead — a
+   * cross-origin grant on `127.0.0.1` is what `./rebinding.ts` refuses
+   * outright, and ADR-039's rule is not being relaxed to fit this in.
+   */
+  readonly read?: ReadDeps | undefined;
 }
 
 export const MCP_PATH = '/mcp';
@@ -155,6 +166,8 @@ export function createRequestHandler(options: ServerOptions): RequestHandler {
           healthPath: HEALTH_PATH,
           isAuthorizationPath,
           authorizationEnabled: options.authorization !== undefined,
+          isReadPath,
+          readEnabled: options.read !== undefined,
         });
         if (refusal) {
           options.log.warn('rejected request', { reason: 'unauthenticated_rate' });
@@ -188,6 +201,17 @@ export function createRequestHandler(options: ServerOptions): RequestHandler {
         });
       }
 
+      // Above the 404 gate because these are deliberately not in the three-path
+      // set, and never through `options.authenticator`: the pairing token is a
+      // different credential for a different surface, and one shared check
+      // would make each able to do the other's job (ADR-063). Below the meter,
+      // because verifying one costs a credential-store read. Only what
+      // `isReadPath` matched is handed over — `readRoutes` answers everything
+      // it is given, so a wider hand-off would swallow `/mcp`.
+      if (options.read && isReadPath(url.pathname)) {
+        return await readRoutes(request, options.read);
+      }
+
       if (
         url.pathname !== MCP_PATH &&
         url.pathname !== ATTACHMENTS_PATH &&
@@ -344,8 +368,15 @@ export function serve(options: ServeOptions): RunningServer {
   const cors: CorsPolicy | undefined = loopback
     ? undefined
     : { allowedOrigins: primary.config.auth.allowed_origins ?? [ANY_ORIGIN] };
+  // The fourth property of this bind address, decided with the other three.
+  // Never on loopback: `./read/open.ts` serves it there over TLS on its own
+  // port, and a deployment-only grant that leaked onto `127.0.0.1` is exactly
+  // what ADR-039 refuses. Discarded rather than overridable, as `cors` is.
+  const read = loopback ? undefined : options.read;
+
   const handler = createRequestHandler({
     ...options,
+    ...(read ? { read } : { read: undefined }),
     // Off on loopback for the same reason `cors` is undefined there, and decided
     // here so every property of the bind address is decided together. An
     // explicit `true` wins, which is how a test drives the deployed behaviour.

package/src/server/mcp/build.ts

@@ -1,6 +1,7 @@
 import { McpServer } from '@modelcontextprotocol/server';
 import { isPrompt, isResource, isTool } from '#connectivity';
 import { SERVER_ICONS } from './icon.ts';
+import { GUIDE_TITLE, GUIDE_URI, guideDocument } from './guide.ts';
 import { serverInstructions } from './instructions.ts';
 import { SERVER_NAME } from './naming.ts';
 import { registerPrompt } from './prompts.ts';
@@ -77,12 +78,30 @@ export function buildMcpServer(options: BuildServerOptions): McpServer {
       // server — to be told nothing is there.
       capabilities: {
         tools: { listChanged: false },
-        ...(offers(merged, isResource) ? { resources: { listChanged: false } } : {}),
+        // Unconditional now: `lanes://instructions` is registered below
+        // whatever policy said, so this endpoint always has at least one
+        // resource and gating the capability on the merged set would advertise
+        // nothing while serving something.
+        resources: { listChanged: false },
         ...(offers(merged, isPrompt) ? { prompts: { listChanged: false } } : {}),
       },
     },
   );
 
+  // Always, and ahead of everything policy decided. This describes the surface
+  // rather than exposing any of it, so there is nothing here to grant — and a
+  // client whose owner has connected nothing at all still gets an account of
+  // what the thing is. It also means `resources` is advertised unconditionally,
+  // which `offers` below no longer decides on its own.
+  server.registerResource(
+    'instructions',
+    GUIDE_URI,
+    { title: GUIDE_TITLE, description: 'What this endpoint is and how to behave against it', mimeType: 'text/markdown' },
+    async (uri: URL) => ({
+      contents: [{ uri: uri.href, mimeType: 'text/markdown', text: guideDocument() }],
+    }),
+  );
+
   for (const [id, entry] of merged) {
     // Discovered first: an upstream MCP server or an OpenAPI document supplies
     // the schema, and there is no local capability object to inspect.

package/src/server/mcp/client-info.ts

@@ -0,0 +1,54 @@
+/**
+ * Which agent is calling, read off the request rather than off a header.
+ *
+ * The audit log's `clientLabel` field has always said it holds "the MCP
+ * `clientInfo` name". It did not. Over HTTP it read an `x-mcp-client` header,
+ * which is not part of MCP and which no client sends; over a pipe nothing set
+ * it at all. So the one field that exists to say *who made this call* was empty
+ * on every event this endpoint has ever written.
+ *
+ * The protocol does carry it. A client announces itself at `initialize` and the
+ * SDK repeats that announcement in every later request, in `_meta` under
+ * `io.modelcontextprotocol/clientInfo`, which the server surfaces on the
+ * request envelope. Reading it there rather than from the handshake is what
+ * makes it work at all here: streamable HTTP is stateless on this endpoint, a
+ * fresh `McpServer` is built and discarded per request (`build.ts`), and a
+ * handshake captured on one instance is gone before the next arrives.
+ *
+ * **A client that announces itself only at `initialize` and never repeats it is
+ * still anonymous**, and that is the honest outcome rather than a gap worth
+ * papering over. The SDK does not backfill the envelope from the session, so
+ * inferring one would mean this endpoint keeping its own session table to hold
+ * a field it is not allowed to trust anyway.
+ *
+ * **Self-reported, and labelled as such wherever it surfaces.** A client may
+ * call itself anything. It is recorded so a reader can see which agent made a
+ * call and is never consulted to decide what that agent may do — the same rule
+ * the field carried when it was a header, and the reason widening it is safe.
+ */
+
+/** Where the SDK puts the client's own `Implementation` on each request. */
+const CLIENT_INFO_META_KEY = 'io.modelcontextprotocol/clientInfo';
+
+/**
+ * The name the client gave for itself, or undefined.
+ *
+ * Deliberately tolerant. This is untrusted input on a path whose failure mode
+ * would otherwise be an exception inside a tool call that was going to succeed,
+ * and the worst honest outcome is the empty field that already exists.
+ */
+export function clientLabelFrom(extra: unknown): string | undefined {
+  if (typeof extra !== 'object' || extra === null) return undefined;
+
+  const request = (extra as { mcpReq?: unknown }).mcpReq;
+  if (typeof request !== 'object' || request === null) return undefined;
+
+  const envelope = (request as { envelope?: unknown }).envelope;
+  if (typeof envelope !== 'object' || envelope === null) return undefined;
+
+  const info = (envelope as Record<string, unknown>)[CLIENT_INFO_META_KEY];
+  if (typeof info !== 'object' || info === null) return undefined;
+
+  const name = (info as { name?: unknown }).name;
+  return typeof name === 'string' && name.length > 0 ? name : undefined;
+}

package/src/server/mcp/guide.ts

@@ -0,0 +1,120 @@
+import { RESERVED_PROVIDER_IDS } from '#connectivity';
+
+/**
+ * The long form of what this endpoint is, served as a resource.
+ *
+ * `initialize.instructions` has a budget it pays on every request forever, so it
+ * carries only the habits that must arrive everywhere. This is the document a
+ * client reads once when it wants the whole account, and it is served always,
+ * without a tool grant, because it describes the surface rather than exposing
+ * any of it.
+ *
+ * **Why a resource rather than a longer `instructions`.** A client caches
+ * `initialize` for the life of its registration, so guidance improved after
+ * somebody connected never reaches them. A resource is fetched when it is read,
+ * so this can be corrected without anybody reconnecting.
+ *
+ * **No vendor may be named here.** `src/architecture.test.ts` forbids it
+ * anywhere under `server/`, and rightly: what an owner has connected is theirs,
+ * and prose naming one provider would be wrong for everybody else.
+ */
+
+export const GUIDE_URI = 'lanes://instructions';
+
+export const GUIDE_TITLE = 'How this endpoint works';
+
+/**
+ * The document.
+ *
+ * Fixed prose, deliberately: it describes the model rather than this workspace,
+ * and the per-principal facts are in `initialize.instructions`, which is
+ * computed. Two documents with different lifetimes, and mixing them would make
+ * this one wrong the moment a connection was added.
+ */
+export function guideDocument(): string {
+  return `# Lanes Link
+
+One endpoint in front of everything its owner has chosen to expose. It
+authenticates, applies permissions per call, and records what happened.
+
+## The three words
+
+**Connection.** One authorised account or store, named \`<provider>.<id>\`. It
+belongs to the workspace, so the same account can be reached from more than one
+profile without being authorised twice.
+
+**Profile.** A selection of connections, with the capabilities allowed on each,
+and the people who may consume it. This is how someone keeps work and personal
+apart, and how they hand you one mailbox read-only while another is writable.
+
+**Workspace.** Where connections and profiles live, and which credential store
+opens them. You never name one; the endpoint you are talking to is already in it.
+
+## Routing
+
+Every tool takes \`profile\` and \`connection\`. Both are enums, and both are
+already narrowed to what you may reach, so anything offered is something you are
+allowed to use.
+
+**When it is ambiguous which profile is meant, ask.** Do not default to whichever
+is listed first. A profile is a boundary somebody drew on purpose, and crossing
+it is the failure this design exists to prevent.
+
+A connection belongs to a profile. Naming one from a different profile is
+refused, and the refusal lists what is available where you asked.
+
+## The owner's own material
+
+${RESERVED_PROVIDER_IDS.join(', ')} are not third-party services. They are the
+owner's own stores, and each is a connection like any other, so a profile decides
+which instances it can reach and what it may do with them.
+
+**Memory and tasks are different stores.** Search memory before concluding you do
+not know something about this person or their work. A thing to *do* is a task,
+and it has a status; "remember to..." is a task, not a memory. Both are served
+back to every later session, so write when asked rather than by habit.
+
+**Skills are the owner's procedures**, surfaced as prompts rather than tools.
+That is deliberate: a procedure is selected by the person, not chosen by the
+model, and you cannot read one's body. If a task has a skill for it, say so and
+let them invoke it rather than improvising your own version.
+
+**Vault values are credentials.** Use one to do the thing that needs it. Do not
+quote it back, summarise it, or write it anywhere.
+
+**Entities are the people, companies and projects this owner deals with.** Before
+using anyone's address or handle, look them up. A lookup returns every match and
+never chooses: more than one means ask which is meant, not take the first.
+
+## What is set up is answerable
+
+Before saying something cannot be reached, or that an account must be added, ask
+the setup surface. It reports what exists and what is missing, and it gives the
+exact command for the missing thing.
+
+**Running that command is the owner's to do, and inventing one is not.** Every
+change to what exists here is a command a person runs; nothing on this surface
+adds a connection, edits a profile, or changes who may consume it. That is not an
+omission to work around.
+
+## When a call is refused
+
+A refusal is information, not an obstacle. Three kinds, and they mean different
+things:
+
+- **The profile is not available.** You are not a member of it. Nothing you can
+  do; its owner adds you.
+- **The connection is not part of this profile.** Look at what is, in the enum.
+- **The capability is denied.** The profile allows a narrower set than the tool
+  suggests. Say what was refused and let the owner decide whether to widen it.
+
+Retrying a refusal unchanged produces the same refusal and one more line in the
+owner's audit log.
+
+## Files are named, not carried
+
+Where a tool takes attachments, give a path, an HTTPS URL, or an attachment
+already on another message. Do not base64 a file into an argument: it is recorded
+in the audit log, and the log is something the owner reads.
+`;
+}

package/src/server/mcp/instructions.ts

@@ -53,7 +53,7 @@ import type { MergedCapability } from './visibility.ts';
  */
 const OPENING = `This endpoint is one place to reach what its owner has chosen to expose. It
 authenticates, applies permissions, and records what happened, so you do not
-have to.`;
+have to. Read \`lanes://instructions\` for the whole account of how it works.`;
 
 const ROUTING = `**Routing.** Every tool takes \`profile\` and \`connection\`. A profile is how
 someone separates work from personal — when it is ambiguous which one is meant,
@@ -102,12 +102,12 @@ quote it back, summarise it, or write it anywhere.`;
  * Asked to connect a second mailbox, a client with no setup surface and no
  * skill answered that it could not and then invented the procedure — edit the
  * profile YAML, run "the auth command" — neither of which is a thing. It had
- * no way to know `setup_overview` answers exactly that, so the instruction has
+ * no way to know `lanes_setup_overview` answers exactly that, so the instruction has
  * to arrive here: this is the only channel that reaches a client which has
  * merely been pointed at the URL.
  */
 const SETUP = `**What is set up is answerable.** Before saying something cannot be reached, or
-that an account must be added, call \`setup_overview\` — then \`setup_provider\`
+that an account must be added, call \`lanes_setup_overview\` — then \`lanes_setup_provider\`
 for the exact command. Running it is the owner's to do; inventing it is not.`;
 
 /**
@@ -117,14 +117,14 @@ for the exact command. Running it is the owner's to do; inventing it is not.`;
  * declaration would put a per-profile list into a string with a fixed ceiling —
  * so the workspace with the most identities to keep straight is exactly the one
  * whose list would be summarised away first. A pointer costs the same for one
- * profile as for twenty, and `identity_list` has room to say when each applies,
+ * profile as for twenty, and `lanes_identity_list` has room to say when each applies,
  * which is the half that actually prevents the mistake.
  *
  * Conditional like the rest: a profile that declares nothing has no `identity`
  * connection, so the capability is unreachable and this paragraph is unspent.
  */
 const IDENTITY = `**Identity is declared, not inferred.** Where a name, address or handle of the
-owner's is needed, call \`identity_list\`: a profile may hold several, each with a
+owner's is needed, call \`lanes_identity_list\`: a profile may hold several, each with a
 note on when it applies.`;
 
 /**
@@ -136,7 +136,7 @@ note on when it applies.`;
  * message sent to the wrong Jan has left.
  *
  * It carries two rules rather than one, because dropping the refusal made the
- * second necessary. `entities_find` returns every match and sets no error, so a
+ * second necessary. `lanes_entities_find` returns every match and sets no error, so a
  * client is not stopped by anything: nothing but this sentence stands between
  * "two candidates" and an agent using the first. The count and the wording of
  * the tool result say it too, and this says it before the first call rather
@@ -166,7 +166,7 @@ which is meant, not take the first.`;
  * form and this one arrives only once the owner has declared themselves.
  */
 const IDENTITY_AND_ENTITIES = `**Who someone is, is declared rather than inferred.** For the owner's own name,
-address or handle, call \`identity_list\`. For anyone else — a person, a company,
+address or handle, call \`lanes_identity_list\`. For anyone else — a person, a company,
 a project — call \`entities_find\`, which returns every match and never chooses:
 more than one means ask which is meant, not take the first.`;
 
@@ -201,14 +201,14 @@ not land, do not redo what already succeeded, and offer to retry.`;
 
 /** Which paragraph each owner-layer provider brings, when it is reachable alone. */
 const OWNER_HABITS: Record<string, string> = {
-  memory: MEMORY,
-  tasks: TASKS,
-  assets: ASSETS,
-  skills: SKILLS,
-  vault: VAULT,
-  setup: SETUP,
-  identity: IDENTITY,
-  entities: ENTITIES,
+  lanes_memory: MEMORY,
+  lanes_tasks: TASKS,
+  lanes_assets: ASSETS,
+  lanes_skills: SKILLS,
+  lanes_vault: VAULT,
+  lanes_setup: SETUP,
+  lanes_identity: IDENTITY,
+  lanes_entities: ENTITIES,
 };
 
 /**
@@ -228,14 +228,14 @@ const OWNER_HABITS: Record<string, string> = {
  */
 function habitsFor(reachable: readonly string[]): string[] {
   const present = new Set(reachable);
-  const stores = present.has('memory') && present.has('tasks');
-  const people = present.has('identity') && present.has('entities');
+  const stores = present.has('lanes_memory') && present.has('lanes_tasks');
+  const people = present.has('lanes_identity') && present.has('lanes_entities');
 
   return reachable.flatMap((id) => {
-    if (stores && id === 'memory') return [MEMORY_AND_TASKS];
-    if (stores && id === 'tasks') return [];
-    if (people && id === 'identity') return [IDENTITY_AND_ENTITIES];
-    if (people && id === 'entities') return [];
+    if (stores && id === 'lanes_memory') return [MEMORY_AND_TASKS];
+    if (stores && id === 'lanes_tasks') return [];
+    if (people && id === 'lanes_identity') return [IDENTITY_AND_ENTITIES];
+    if (people && id === 'lanes_entities') return [];
     return OWNER_HABITS[id] ? [OWNER_HABITS[id]!] : [];
   });
 }
@@ -270,7 +270,7 @@ function habitsFor(reachable: readonly string[]): string[] {
  * the wrong address has already sent the message; the mistake happens at the
  * instant of the send, before a skill would have been loaded, and the client
  * most in need of the rule is again the one holding no skills directory. The
- * paragraph also carries a rule nothing else can enforce: `entities_find` sets
+ * paragraph also carries a rule nothing else can enforce: `lanes_entities_find` sets
  * no error on an ambiguous result, so between "two candidates" and an agent
  * using the first there is only prose.
  *

package/src/server/mcp/prompts.ts

@@ -1,3 +1,5 @@
+import { forProfile } from '#auth';
+import { clientLabelFrom } from './client-info.ts';
 import type { McpServer } from '@modelcontextprotocol/server';
 import { z } from 'zod';
 import { isPromptResult } from '#connectivity';
@@ -48,17 +50,19 @@ export function registerPrompt(
       description: describeWithConnections(capability.description, entry.reachable),
       argsSchema: z.object(shape),
     },
-    async (args: Record<string, unknown>) => {
+    async (args: Record<string, unknown>, extra?: unknown) => {
       const { profile, connection, ...rest } = args;
       const scope = resolveScope(entry, profile, connection);
       if ('error' in scope) throw new Error(scope.error);
 
+      const label = clientLabelFrom(extra) ?? options.clientLabel;
+
       const outcome = await options.profiles.get(scope.profile)!.dispatcher.invoke({
-        principal: options.principal,
+        principal: forProfile(options.principal, scope.profile),
         capabilityId: id,
         connectionKey: scope.connectionKey,
         arguments: rest,
-        clientLabel: options.clientLabel,
+        ...(label ? { clientLabel: label } : {}),
       });
 
       // A prompt has no `isError` to carry a refusal in, so a denial is a

package/src/server/mcp/resources.ts

@@ -1,3 +1,5 @@
+import { forProfile } from '#auth';
+import { clientLabelFrom } from './client-info.ts';
 import { ResourceTemplate, type McpServer } from '@modelcontextprotocol/server';
 import { isResourceListResult, isResourceResult } from '#connectivity';
 import type { DispatchOutcome } from '#dispatch';
@@ -28,14 +30,20 @@ export function registerResource(
       const scope = { profile, connectionId };
       const scoped = scopeResourceUri(capability.uriTemplate, scope);
 
-      const dispatch = (args: Record<string, unknown>): Promise<DispatchOutcome> =>
-        runtime.dispatcher.invoke({
-          principal: options.principal,
+      const dispatch = (
+        args: Record<string, unknown>,
+        extra?: unknown,
+      ): Promise<DispatchOutcome> => {
+        const label = clientLabelFrom(extra) ?? options.clientLabel;
+
+        return runtime.dispatcher.invoke({
+          principal: forProfile(options.principal, profile),
           capabilityId: id,
           connectionKey,
           arguments: args,
-          clientLabel: options.clientLabel,
+          ...(label ? { clientLabel: label } : {}),
         });
+      };
 
       const metadata = {
         description: `${capability.description} (${profile}: ${connectionKey})`,
@@ -44,8 +52,8 @@ export function registerResource(
 
       // `uri` is the whole argument — the provider recovers its own template
       // variables from it and never sees the routing segments core prepended.
-      const read = async (uri: URL) => {
-        const outcome = await dispatch({ uri: uri.href });
+      const read = async (uri: URL, _variables?: unknown, extra?: unknown) => {
+        const outcome = await dispatch({ uri: uri.href }, extra);
         if (!outcome.ok) throw new Error(outcome.message);
         if (!isResourceResult(outcome.result)) {
           throw new Error(`${id} did not return resource contents`);
@@ -83,8 +91,8 @@ export function registerResource(
           // rather than an oversight. A provider omits `list` when its resource
           // space is unbounded.
           list: capability.list
-            ? async () => {
-                const outcome = await dispatch({});
+            ? async (extra?: unknown) => {
+                const outcome = await dispatch({}, extra);
                 if (!outcome.ok) throw new Error(outcome.message);
                 if (!isResourceListResult(outcome.result)) return { resources: [] };
 

package/src/server/mcp/routing.ts

@@ -16,8 +16,8 @@ import type { MergedCapability, ProfileRuntime } from './visibility.ts';
  * They have to go somewhere that works for *any* template, not just one that
  * happens to spell `{key}`, so they are inserted as the first two path segments
  * directly after the authority: `example://note/{key}` becomes
- * `example://note/personal/a/{key}`, and `memory://entry/{id}` becomes
- * `memory://entry/personal/owner/{id}`.
+ * `example://note/personal/a/{key}`, and `lanes-memory://entry/{id}` becomes
+ * `lanes-memory://entry/personal/owner/{id}`.
  *
  * The previous form substituted the literal token `{key}`, which meant any
  * provider naming its variable anything else — every provider except `example` —
@@ -53,7 +53,7 @@ function originOf(uri: string): string {
 /**
  * Route the `resource_link`s a tool hands back.
  *
- * A provider names its own resources — `memory://entry/deploy_window` — because
+ * A provider names its own resources — `lanes-memory://entry/deploy_window` — because
  * it does not know, and must not learn, which profile or connection it is
  * serving. Core does. Without this, `memory.search` returns addresses that look
  * like resources and cannot be read, which is worse than returning none.

package/src/server/mcp/tools.ts

@@ -1,10 +1,17 @@
+import { forProfile } from '#auth';
 import { fromJsonSchema, type McpServer } from '@modelcontextprotocol/server';
 import { z } from 'zod';
 import { isToolResult } from '#connectivity';
+import { clientLabelFrom } from './client-info.ts';
 import { toolNameFor } from './naming.ts';
 import { resourceLinkRouter } from './routing.ts';
 import { sanitizeSchema } from './schema.ts';
-import { describeWithConnections, type BuildServerOptions, type MergedCapability } from './visibility.ts';
+import {
+  accountsByProfile,
+  describeWithConnections,
+  type BuildServerOptions,
+  type MergedCapability,
+} from './visibility.ts';
 
 /**
  * Tools — the capability kind everything else is measured against.
@@ -49,7 +56,11 @@ export function registerDiscoveredTool(
     toolNameFor(id),
     {
       ...(discovered.title ? { title: discovered.title } : {}),
-      description: describeWithConnections(discovered.description, entry.reachable),
+      description: describeWithConnections(
+        discovered.description,
+        entry.reachable,
+        accountsByProfile(options),
+      ),
       // Spread the upstream schema rather than rebuilding it from properties
       // and required alone. Vendors put `$defs` beside those and `$ref` into
       // them — Linear's attachment tools do — and a rebuild drops the
@@ -85,7 +96,11 @@ export function registerLocalTool(
     toolNameFor(id),
     {
       ...(capability.title ? { title: capability.title } : {}),
-      description: describeWithConnections(capability.description, entry.reachable),
+      description: describeWithConnections(
+        capability.description,
+        entry.reachable,
+        accountsByProfile(options),
+      ),
       inputSchema: {
         ...shape,
         // Injected by core, never declared by a provider — ADR-001. Both enums
@@ -111,9 +126,13 @@ export function registerLocalTool(
 function makeHandler(capabilityId: string, entry: MergedCapability, options: BuildServerOptions) {
   // `unknown` because the JSON-Schema overload types it that way; the schema
   // has already validated the shape by the time this runs.
-  return async (args: unknown) => {
+  return async (args: unknown, extra?: unknown) => {
     const { profile, connection, ...rest } = (args ?? {}) as Record<string, unknown>;
 
+    // The request first, then whatever the transport knew before the call —
+    // which on a stateless POST is nothing, and is why the request is asked.
+    const label = clientLabelFrom(extra) ?? options.clientLabel;
+
     const name = String(profile);
     const runtime = options.profiles.get(name);
     const reachable = entry.reachable.get(name);
@@ -147,11 +166,11 @@ function makeHandler(capabilityId: string, entry: MergedCapability, options: Bui
     }
 
     const outcome = await runtime.dispatcher.invoke({
-      principal: options.principal,
+      principal: forProfile(options.principal, name),
       capabilityId,
       connectionKey: String(connection),
       arguments: rest,
-      clientLabel: options.clientLabel,
+      ...(label ? { clientLabel: label } : {}),
     });
 
     if (!outcome.ok) {