@lanes-sh/link 0.7.2 → 0.9.0

package/src/cli/commands/identity.ts

@@ -1,4 +1,4 @@
-import type { IdentityEntry, ProfileSelection, Resolution } from '#profile';
+import { CONNECTIONS_FILE, type IdentityEntry, type ProfileSelection, type Resolution } from '#profile';
 import { ConfigDocument } from '../config-edit.ts';
 import { ensureIdentityConnection, repairLines, repaired } from '../config-repair.ts';
 import { announce, announceProfile, emit, ok, print, style, table, warn } from '../output.ts';
@@ -37,9 +37,9 @@ export interface IdentityListing {
   readonly reachable: boolean;
 }
 
-/** Whether a rule list puts `identity.*` in force, in either spelling. */
+/** Whether a rule list puts `lanes_identity.*` in force, in either spelling. */
 function covers(rules: ReadonlyArray<{ capability: string }>): boolean {
-  return rules.some((rule) => rule.capability === '*' || rule.capability === 'identity.*');
+  return rules.some((rule) => rule.capability === '*' || rule.capability === 'lanes_identity.*');
 }
 
 /**
@@ -51,14 +51,20 @@ function covers(rules: ReadonlyArray<{ capability: string }>): boolean {
  * misleading thing this command could print.
  */
 function readable(config: {
-  connections: ReadonlyArray<{ provider: string }>;
-  policy: { allow: ReadonlyArray<{ capability: string }>; deny: ReadonlyArray<{ capability: string }> };
+  grants: ReadonlyArray<{
+    connection: string;
+    allow: ReadonlyArray<{ capability: string }>;
+    deny: ReadonlyArray<{ capability: string }>;
+  }>;
 }): boolean {
-  return (
-    config.connections.some((connection) => connection.provider === 'identity') &&
-    covers(config.policy.allow) &&
-    !covers(config.policy.deny)
-  );
+  // One row now rather than a connection and a rule that had to agree
+  // (ADR-058). The old shape could say "declared but not granted" and
+  // "granted but not declared", and both served nothing while reading like
+  // configuration that worked; neither is expressible here.
+  const grant = config.grants.find((row) => row.connection.startsWith('lanes_identity.'));
+  if (grant === undefined) return false;
+
+  return covers(grant.allow) && !covers(grant.deny);
 }
 
 /**
@@ -96,7 +102,13 @@ export async function addIdentity(
   const entry: IdentityEntry = { kind, value, ...(options.note ? { note: options.note } : {}) };
   document.addTo(['identity'], entry, { inline: true });
 
-  const repair = ensureIdentityConnection(document);
+  // The identity *connection* is the workspace's, like every other (ADR-057),
+  // so provisioning the surface on first use touches two files. Both saves, or
+  // neither: a grant naming a connection that does not exist is refused at load,
+  // so writing the profile alone would leave one that no longer opens.
+  const connections = await ConfigDocument.openKey(resolution.workspaceRoot, CONNECTIONS_FILE);
+  const repair = ensureIdentityConnection(connections, document);
+  await connections.save();
   await document.save();
 
   return {
@@ -232,7 +244,7 @@ export async function identityList(options: { json?: boolean } & GlobalFlags): P
       print(warn('declared, but no agent can read it'));
       print(
         style.dim(
-          '      the identity surface needs a connection row and an identity.* allow rule;',
+          '      the identity surface needs a connection row and a lanes_identity.* allow rule;',
         ),
       );
       print(style.dim('      adding an entry with this command writes both.'));

package/src/cli/commands/knowledge/index.ts

@@ -1,4 +1,5 @@
 import {
+  soleGrantFor,
   ConfigError,
   KNOWLEDGE_LAYOUT,
   knowledgeTargetSchema,
@@ -23,7 +24,6 @@ import {
   removeLocal,
   summarise,
 } from './migrate.ts';
-
 /**
  * `lanes link knowledge` — where this profile's memory and skills are kept.
  *
@@ -65,78 +65,6 @@ export interface KnowledgeFlags extends GlobalFlags {
   readonly fetch?: FetchLike | undefined;
 }
 
-export async function knowledgeShow(flags: KnowledgeFlags): Promise<void> {
-  const runtime = await openRuntime(flags, { fetch: flags.fetch });
-  try {
-    if (!flags.json) announce(runtime.resolution);
-
-    const profile = runtime.config.instance.profile;
-    const selection = ` --profile ${runtime.resolution.profile} --target ${runtime.target}`;
-    const skills = (await runtime.skills.list()).length;
-    const memory = (await runtime.storage.list(`${KNOWLEDGE_LAYOUT.memory}/`)).length;
-    const entities = (await runtime.storage.list(`${KNOWLEDGE_LAYOUT.entities}/`)).length;
-    const where = runtime.knowledge?.describe;
-
-    if (flags.json) {
-      print(
-        JSON.stringify(
-          { target: runtime.target, where: where ?? 'local', memory, skills, entities },
-          null,
-          2,
-        ),
-      );
-      return;
-    }
-
-    heading('Knowledge');
-    table([
-      // The memory *directory*, not the blob root it sits in. `layout.blobs`
-      // is `data/<profile>`, which is where every provider's namespace lives —
-      // printing it here would name a directory that is mostly not memory.
-      [
-        '  memory',
-        where ? `${where}/${KNOWLEDGE_LAYOUT.memory}` : `${layout.blobs(profile)}/${KNOWLEDGE_LAYOUT.memory}`,
-        style.dim(`${memory} file${memory === 1 ? '' : 's'}`),
-      ],
-      [
-        '  skills',
-        where ? `${where}/${KNOWLEDGE_LAYOUT.skills}` : layout.skills(profile),
-        style.dim(`${skills} file${skills === 1 ? '' : 's'}`),
-      ],
-      // The count includes the derived `_index.json`, deliberately: it is a
-      // file in that directory and it is committed with the rest, so a number
-      // that quietly excluded it would not match what a person sees there.
-      [
-        '  entities',
-        where
-          ? `${where}/${KNOWLEDGE_LAYOUT.entities}`
-          : `${layout.blobs(profile)}/${KNOWLEDGE_LAYOUT.entities}`,
-        style.dim(`${entities} file${entities === 1 ? '' : 's'}`),
-      ],
-    ]);
-
-    print('');
-    print(
-      style.dim(
-        `  The vault, the credential store, runtime state and the audit log stay in target "${runtime.target}".`,
-      ),
-    );
-    // Complete commands, not shapes. Every one of these is pasted, and with
-    // nothing left to fall back on (ADR-037) a line missing either flag is a
-    // line that refuses — `emitted.test.ts` states the rule for the templates
-    // reachable without a runtime, and this is the same rule where there is one.
-    print(
-      style.dim(
-        where
-          ? `  Bring them back with: lanes link knowledge use local --migrate${selection}`
-          : `  Keep them in a repository with: lanes link knowledge use github --repo <owner/name>${selection}`,
-      ),
-    );
-  } finally {
-    await runtime.close();
-  }
-}
-
 export async function knowledgeUse(where: string | undefined, flags: KnowledgeFlags): Promise<void> {
   if (where === 'local') return useLocal(flags);
   if (where === 'github') return useGithub(flags);
@@ -172,7 +100,7 @@ async function useGithub(flags: KnowledgeFlags): Promise<void> {
   const runtime = await openRuntime(flags, { fetch: flags.fetch });
   try {
     announce(runtime.resolution);
-    const selection = ` --profile ${runtime.resolution.profile} --target ${runtime.target}`;
+    const selection = ` --profile ${runtime.resolution.profile} --workspace ${runtime.target}`;
 
     if (runtime.knowledge) {
       print(style.dim(`  This profile already reads ${runtime.knowledge.describe}.`));
@@ -187,11 +115,7 @@ async function useGithub(flags: KnowledgeFlags): Promise<void> {
 
     // Nothing is written until this returns: the token is asked for, the
     // repository is probed, and either can refuse while the profile is intact.
-    const secrets = await openSecretStoreFor(
-      runtime.config,
-      runtime.resolution.workspaceRoot,
-      runtime.target,
-    );
+    const secrets = await openSecretStoreFor(runtime.resolution.workspaceRoot, runtime.target);
     const token = await resolveToken(secrets, knowledge.token_ref, knowledge.repo, selection, {
       replace: flags.replace,
     });
@@ -206,7 +130,16 @@ async function useGithub(flags: KnowledgeFlags): Promise<void> {
       ['  token', viewer, style.dim('can write')],
     ]);
 
-    const movable = await localContents(runtime.storage, runtime.skills, knowledge);
+    // Which instances this profile grants, so `memory/` and `entities/` reach
+    // only its own and not every profile's (ADR-059).
+    const instances = grantedInstances(runtime.config);
+
+    const movable = await localContents(
+      runtime.storage,
+      runtime.skills ?? null,
+      knowledge,
+      instances,
+    );
     const moving = await decideMigration(movable.length > 0, flags);
 
     if (moving) {
@@ -225,7 +158,7 @@ async function useGithub(flags: KnowledgeFlags): Promise<void> {
       if (flags.keep) {
         print(style.dim('  --keep: the local copies are still there, and are no longer read.'));
       } else {
-        await removeLocal(runtime.storage, runtime.skills, movable);
+        await removeLocal(runtime.storage, runtime.skills ?? null, movable, instances);
         print(ok('removed the local copies'));
       }
     } else if (movable.length > 0) {
@@ -268,11 +201,7 @@ async function useLocal(flags: KnowledgeFlags): Promise<void> {
 
     // Built here rather than taken from `runtime.knowledge`, so both directions
     // of this command reach the repository through one constructor.
-    const secrets = await openSecretStoreFor(
-      runtime.config,
-      runtime.resolution.workspaceRoot,
-      runtime.target,
-    );
+    const secrets = await openSecretStoreFor(runtime.resolution.workspaceRoot, runtime.target);
     const token = await resolveToken(secrets, knowledge.token_ref, knowledge.repo, selection);
     const repository = repositoryFor(knowledge, token, flags.fetch);
 
@@ -280,7 +209,13 @@ async function useLocal(flags: KnowledgeFlags): Promise<void> {
       flags.migrate ??
       (await agreedTo(flags, `Copy everything in ${knowledge.repo} back onto this target's storage?`))
     ) {
-      const moved = await moveOut(repository, knowledge, local.storage, local.skills);
+      const moved = await moveOut(
+        repository,
+        knowledge,
+        local.storage,
+        local.skills,
+        grantedInstances(runtime.config),
+      );
       print(
         ok(
           `wrote back ${moved.memory} memory entr${moved.memory === 1 ? 'y' : 'ies'}, ` +
@@ -314,7 +249,7 @@ async function useLocal(flags: KnowledgeFlags): Promise<void> {
  */
 async function openLocalStores(
   runtime: Runtime,
-): Promise<{ storage: BlobStore; skills: BlobStore }> {
+): Promise<{ storage: BlobStore; skills: BlobStore | null }> {
   const { openStorage } = await import('#deployments/target.ts');
   const declared = runtime.declared;
 
@@ -327,7 +262,14 @@ async function openLocalStores(
     },
     runtime.credentials,
   );
-  return { storage: factory(), skills: factory(layout.skills(runtime.config.instance.profile)) };
+  // The *granted* connection, beside the profile. `layout.skills` changed
+  // meaning without changing arity at ADR-059, so the compiler was silent;
+  // ADR-066 put the profile back in front of it, and it is an argument now.
+  const skillsConnection = soleGrantFor(runtime.config, 'lanes_skills');
+  return {
+    storage: factory(),
+    skills: skillsConnection === undefined ? null : factory(layout.skills(runtime.config.instance.profile, skillsConnection)),
+  };
 }
 
 /**
@@ -386,3 +328,21 @@ async function agreedTo(flags: KnowledgeFlags, question: string): Promise<boolea
   if (!yes) print(style.dim('  cancelled'));
   return yes;
 }
+
+/**
+ * The memory and entities instances one profile grants.
+ *
+ * `main` where a profile grants none, which is what a profile that predates the
+ * owner layer looks like and is also where a fresh one puts them. The point is
+ * that this is never the *surface* — `memory/` alone matches every profile's
+ * notes now that the blob root is the workspace's.
+ */
+function grantedInstances(config: Parameters<typeof soleGrantFor>[0]): {
+  memory: string;
+  entities: string;
+} {
+  return {
+    memory: soleGrantFor(config, 'lanes_memory') ?? 'main',
+    entities: soleGrantFor(config, 'lanes_entities') ?? 'main',
+  };
+}

package/src/cli/commands/knowledge/migrate.ts

@@ -1,6 +1,7 @@
 import {
   ConfigError,
   KNOWLEDGE_LAYOUT,
+  KNOWLEDGE_PREFIX,
   knowledgeRoot,
   type KnowledgeArea,
   type KnowledgeConfig,
@@ -43,16 +44,75 @@ export interface Movable {
  * it once means `localContents`, `removeLocal` and `moveOut` each became a loop
  * over this rather than a branch on a literal.
  */
-type LocalArea = { readonly store: BlobStore; readonly prefix: string };
+/**
+ * One area's local home: where to look, and what of that key is the repository's.
+ *
+ * Two prefixes rather than one, and the difference is the whole fix. `scope` is
+ * what is listed — `memory/<instance>/`, so a profile sees only the instance it
+ * grants. `prefix` is what is stripped to get the repository path, which stays
+ * `memory/<instance>/<file>` because that is the layout ADR-041 documents and
+ * what makes two profiles' notes distinguishable in one repository.
+ *
+ * Collapsing them listed every profile's memory and then wrote it flat.
+ */
+type LocalArea = {
+  readonly store: BlobStore;
+  readonly scope: string;
+  readonly prefix: string;
+};
 
-function localAreas(storage: BlobStore, skills: BlobStore): Record<KnowledgeArea, LocalArea> {
+/** The connection ids this profile's memory and entities live under. */
+export interface Instances {
+  readonly memory: string;
+  readonly entities: string;
+}
+
+function localAreas(
+  storage: BlobStore,
+  skills: BlobStore | null,
+  /** Which instance of each surface this profile grants (ADR-059). */
+  instances: Instances,
+): Record<KnowledgeArea, LocalArea> {
   return {
-    memory: { store: storage, prefix: `${KNOWLEDGE_LAYOUT.memory}/` },
-    skills: { store: skills, prefix: '' },
-    entities: { store: storage, prefix: `${KNOWLEDGE_LAYOUT.entities}/` },
+    // Scoped to the instance this profile grants, not to the surface.
+    //
+    // `layout.blobs()` is the whole workspace since contract 3, so a prefix of
+    // `memory/` matched every profile's memory — and `knowledge use github
+    // --migrate --profile personal` therefore committed `work`'s notes to
+    // personal's repository and then deleted them locally, leaving `work`
+    // reading an empty store with no knowledge block of its own. `skills` was
+    // already connection-scoped, which is why it alone was correct.
+    // `scope` reads the *local* store and `prefix` names the repository
+    // directory, and since contract 4 those are different strings:
+    // `lanes_memory/lan1/` on disk becomes `memory/lan1/` in the repository.
+    // Reading one where the other belongs finds nothing and reports success.
+    memory: {
+      store: storage,
+      scope: `${KNOWLEDGE_PREFIX.memory}/${instances.memory}/`,
+      prefix: `${KNOWLEDGE_PREFIX.memory}/`,
+    },
+    // Null becomes an empty area rather than a refusal: a profile granting no
+    // skills connection has none to move, and `knowledge use` should still move
+    // its memory and entities rather than failing on the one area that is empty
+    // by construction (ADR-059).
+    skills: { store: skills ?? EMPTY_AREA, scope: '', prefix: '' },
+    entities: {
+      store: storage,
+      scope: `${KNOWLEDGE_PREFIX.entities}/${instances.entities}/`,
+      prefix: `${KNOWLEDGE_PREFIX.entities}/`,
+    },
   };
 }
 
+/** Nothing to list, nothing to delete. See `localAreas`. */
+const EMPTY_AREA: BlobStore = {
+  get: async () => null,
+  put: async () => {},
+  has: async () => false,
+  delete: async () => {},
+  list: async () => [],
+};
+
 const AREAS = ['memory', 'skills', 'entities'] as const;
 
 /**
@@ -66,16 +126,18 @@ const AREAS = ['memory', 'skills', 'entities'] as const;
  */
 export async function localContents(
   storage: BlobStore,
-  skills: BlobStore,
+  /** Null when the profile grants no skills connection (ADR-059). */
+  skills: BlobStore | null,
   knowledge: KnowledgeConfig,
+  instances: Instances,
 ): Promise<Movable[]> {
-  const areas = localAreas(storage, skills);
+  const areas = localAreas(storage, skills, instances);
   const found: Movable[] = [];
 
   for (const area of AREAS) {
-    const { store, prefix } = areas[area];
+    const { store, scope, prefix } = areas[area];
 
-    for (const entry of await store.list(prefix)) {
+    for (const entry of await store.list(scope)) {
       const data = await store.get(entry.key);
       if (data === null) continue; // Listed then deleted; not worth failing over.
 
@@ -128,10 +190,12 @@ export async function moveIn(
 /** Remove what has been verified elsewhere. Never called before `moveIn`. */
 export async function removeLocal(
   storage: BlobStore,
-  skills: BlobStore,
+  /** Null when the profile grants no skills connection (ADR-059). */
+  skills: BlobStore | null,
   movable: readonly Movable[],
+  instances: Instances,
 ): Promise<void> {
-  const areas = localAreas(storage, skills);
+  const areas = localAreas(storage, skills, instances);
 
   for (const item of movable) {
     const { store, prefix } = areas[item.area];
@@ -152,10 +216,12 @@ export async function moveOut(
   repository: GithubRepository,
   knowledge: KnowledgeConfig,
   storage: BlobStore,
-  skills: BlobStore,
+  /** Null when the profile grants no skills connection (ADR-059). */
+  skills: BlobStore | null,
+  instances: Instances,
 ): Promise<Record<KnowledgeArea, number>> {
   const { entries } = await repository.entries();
-  const areas = localAreas(storage, skills);
+  const areas = localAreas(storage, skills, instances);
   const counts: Record<KnowledgeArea, number> = { memory: 0, skills: 0, entities: 0 };
 
   for (const entry of entries.values()) {

package/src/cli/commands/knowledge/show.ts

@@ -0,0 +1,97 @@
+import { KNOWLEDGE_LAYOUT, KNOWLEDGE_PREFIX, layout, soleGrantFor } from '#profile';
+import { announce, emit, heading, print, style, table } from '../../output.ts';
+import { openRuntime } from '../../runtime.ts';
+import type { KnowledgeFlags } from './index.ts';
+
+/**
+ * `lanes link knowledge show` — where memory, skills and entities actually are.
+ *
+ * Split from `knowledge use` so `index.ts` stays inside the size budget, on the
+ * seam the two commands already have: this one opens stores and counts, and
+ * never writes. That difference is why `show` can answer for a repository `use`
+ * would refuse to touch.
+ */
+
+export async function knowledgeShow(flags: KnowledgeFlags): Promise<void> {
+  const runtime = await openRuntime(flags, { fetch: flags.fetch });
+  try {
+    if (!flags.json) announce(runtime.resolution);
+
+    const profile = runtime.config.instance.profile;
+    const selection = ` --profile ${runtime.resolution.profile} --target ${runtime.target}`;
+    const skills = runtime.skills ? (await runtime.skills.list()).length : 0;
+    // Counted through the *provider's* prefix, which is what the local store is
+    // scoped into; `KNOWLEDGE_LAYOUT` is the repository's directory name and
+    // since contract 4 the two are different strings. Counting by the wrong one
+    // reports zero for a profile whose memory is perfectly well populated.
+    const memory = (await runtime.storage.list(`${KNOWLEDGE_PREFIX.memory}/`)).length;
+    const entities = (await runtime.storage.list(`${KNOWLEDGE_PREFIX.entities}/`)).length;
+    const where = runtime.knowledge?.describe;
+    // Null when no skills connection is granted (ADR-059). The row still prints,
+    // saying so: a missing row reads as "there are none", not "not granted".
+    const skillsConnection = soleGrantFor(runtime.config, 'lanes_skills');
+
+    if (flags.json) {
+      print(
+        JSON.stringify(
+          { target: runtime.target, where: where ?? 'local', memory, skills, entities },
+          null,
+          2,
+        ),
+      );
+      return;
+    }
+
+    heading('Knowledge');
+    table([
+      // The memory *directory*, not the blob root it sits in. `layout.blobs`
+      // is the profile's own directory, which is where every provider's
+      // namespace lives — printing it here would name a directory that is
+      // mostly not memory.
+      [
+        '  memory',
+        where ? `${where}/${KNOWLEDGE_LAYOUT.memory}` : `${layout.blobs(profile)}/${KNOWLEDGE_PREFIX.memory}`,
+        style.dim(`${memory} file${memory === 1 ? '' : 's'}`),
+      ],
+      [
+        '  skills',
+        where
+          ? `${where}/${KNOWLEDGE_LAYOUT.skills}`
+          : skillsConnection
+            ? layout.skills(profile, skillsConnection)
+            : style.dim('not granted'),
+        style.dim(`${skills} file${skills === 1 ? '' : 's'}`),
+      ],
+      // The count includes the derived `_index.json`, deliberately: it is a
+      // file in that directory and it is committed with the rest, so a number
+      // that quietly excluded it would not match what a person sees there.
+      [
+        '  entities',
+        where
+          ? `${where}/${KNOWLEDGE_LAYOUT.entities}`
+          : `${layout.blobs(profile)}/${KNOWLEDGE_PREFIX.entities}`,
+        style.dim(`${entities} file${entities === 1 ? '' : 's'}`),
+      ],
+    ]);
+
+    print('');
+    print(
+      style.dim(
+        `  The vault, the credential store, runtime state and the audit log stay in workspace "${runtime.target}".`,
+      ),
+    );
+    // Complete commands, not shapes. Every one of these is pasted, and with
+    // nothing left to fall back on (ADR-037) a line missing either flag is a
+    // line that refuses — `emitted.test.ts` states the rule for the templates
+    // reachable without a runtime, and this is the same rule where there is one.
+    print(
+      style.dim(
+        where
+          ? `  Bring them back with: lanes link knowledge use local --migrate${selection}`
+          : `  Keep them in a repository with: lanes link knowledge use github --repo <owner/name>${selection}`,
+      ),
+    );
+  } finally {
+    await runtime.close();
+  }
+}

package/src/cli/commands/knowledge.ts

@@ -7,4 +7,5 @@
  * the grammar that puts them in order.
  */
 
-export { knowledgeShow, knowledgeUse, type KnowledgeFlags } from './knowledge/index.ts';
+export { knowledgeUse, type KnowledgeFlags } from './knowledge/index.ts';
+export { knowledgeShow } from './knowledge/show.ts';

package/src/cli/commands/mcp/harnesses.ts

@@ -17,12 +17,31 @@ import { join } from 'node:path';
  * command, write the file where it does not. A skill is content in a documented
  * location, not a config format we would be guessing at, and the directory
  * written is named after this project.
+ *
+ * **No registration carries a token any more** (ADR-062). Every endpoint runs
+ * the authorization flow, discovery is served ahead of the auth gate on
+ * loopback as well as deployed, and a client pointed at a bare URL finds
+ * `/.well-known/oauth-protected-resource`, signs its owner in at lanes.sh, and
+ * comes back with a token of its own. What that removes is worth stating: the
+ * registration no longer contains a credential, so a config file synced to a
+ * dotfiles repository is no longer a leak, and a rotation does not invalidate
+ * every harness at once.
+ *
+ * The exception is `tokenEnv`, which survives for the one caller that has no
+ * browser — see `token show`, which is now documented as a CI command.
  */
 
 export interface AddInput {
   readonly name: string;
   readonly url: string;
-  readonly token: string;
+  /**
+   * The endpoint's static token, for a harness that cannot run a browser.
+   *
+   * Nothing passes this in the ordinary path. It is here because
+   * `--headless` exists for CI, where there is no browser to complete an
+   * authorization in and a pasted credential is the only thing that works.
+   */
+  readonly token?: string | undefined;
   readonly tokenEnv: string;
   readonly scope: string;
   /**
@@ -44,11 +63,12 @@ export interface Harness {
   /** Whether `--scope` means anything here. Codex config is global. */
   readonly scoped: boolean;
   /**
-   * Whether the token is handed to the harness at all.
+   * Whether a credential reaches the harness's config at all.
    *
-   * Codex stores the *name* of an environment variable and reads it when it
-   * launches, so the secret never reaches its config file and a rotation is
-   * picked up without re-registering. Claude Code stores the header value.
+   * Both are `false` in the ordinary path now — the client authorises itself.
+   * This still distinguishes what a `--headless` registration would write:
+   * Claude Code would hold the header value, and Codex stores only the *name*
+   * of an environment variable it reads at launch.
    */
   readonly storesToken: boolean;
   /**
@@ -99,8 +119,10 @@ export const HARNESSES: readonly Harness[] = [
       'http',
       name,
       url,
-      '--header',
-      `Authorization: Bearer ${token}`,
+      // Only when there is no browser to sign in with. Registering the bare URL
+      // is the ordinary path: Claude Code discovers the protected-resource
+      // document and runs the authorization itself.
+      ...(token ? ['--header', `Authorization: Bearer ${token}`] : []),
       '--scope',
       scope,
     ],
@@ -142,7 +164,7 @@ export const HARNESSES: readonly Harness[] = [
       // anywhere else: an unresolvable substitution yields the empty string, the
       // header becomes "Bearer ", and the only symptom is a 401 that reads as a
       // bad token rather than a command that refused.
-      `    export ${tokenEnv}="$(lanes link token show --raw --profile ${profile} --target ${target})"`,
+      `    export ${tokenEnv}="$(lanes link token show --raw --profile ${profile} --workspace ${target})"`,
       '',
       'Add that to your shell profile. This is the better half of the bargain: the token never',
       'reaches ~/.codex/config.toml, and a "lanes link token rotate" is picked up on next launch',