@lanes-sh/link 0.8.0 → 0.9.0

package/instructions/skills/lanes-link/SKILL.md

@@ -107,7 +107,7 @@ when Y", that is a skill they should write, not a memory entry describing it.
 
 ## Reach for memory before answering from nothing
 
-`memory.search` before concluding you do not know something about this person or
+`lanes_memory.search` before concluding you do not know something about this person or
 their work. It is a substring search over their own notes, not a ranked index —
 try more than one wording before deciding it is not there.
 
@@ -118,7 +118,7 @@ entries with `lanes link memory list --profile <name> --workspace <name>` and a
 
 ## Tasks have a status, so finish them rather than deleting them
 
-`tasks.list` answers what is outstanding. It shows `in_progress`, `open` and
+`lanes_tasks.list` answers what is outstanding. It shows `in_progress`, `open` and
 `blocked` and hides the rest, so a listing is what is left to do rather than
 everything that ever was — name a status to see more.
 
@@ -133,7 +133,7 @@ Six of them, and the two that are easy to confuse are worth learning:
 | `done` | finished |
 | `dropped` | decided against, which is not the same as finished |
 
-**Closing a task is `tasks.update` with a status, never `tasks.remove`.** The
+**Closing a task is `lanes_tasks.update` with a status, never `lanes_tasks.remove`.** The
 record of having done it is the useful half, and it is what stops the same thing
 being suggested again next week. Remove is for something recorded by mistake.
 
@@ -180,7 +180,7 @@ value has been printed by accident, say so.
 ## Who you are writing as is declared, not inferred
 
 A profile may declare the names, addresses and handles its owner wants used when
-something is written as them. Call `identity_list` for the profile in play
+something is written as them. Call `lanes_identity_list` for the profile in play
 before signing a message, choosing an address to send from, or attributing work
 to a handle — **do not** read a name off the conversation, off a previous
 message's signature, or off the account label on a connection. That label is the
@@ -200,7 +200,7 @@ Nothing you can call writes here, deliberately.
 
 ## Who you are writing *to* is declared as well
 
-`entities_find` holds the people, companies and projects this owner deals with,
+`lanes_entities_find` holds the people, companies and projects this owner deals with,
 with the addresses and handles to reach each of them. Call it before using
 anyone's address — do not recall one from earlier in the conversation, and do
 not lift one off a message you happen to have read.
@@ -218,9 +218,9 @@ Where an entity holds two of a kind — a work address and a personal one — th
 first is the default and the notes say when to prefer the other, exactly as
 identity works.
 
-Writing is a separate grant. Where you have it, `entities_write` declares one
-and `entities_link` relates two; a field you do not send is left as it is.
-`entities_forget` does not clean up edges pointing at what it removed, and says
+Writing is a separate grant. Where you have it, `lanes_entities_write` declares one
+and `lanes_entities_link` relates two; a field you do not send is left as it is.
+`lanes_entities_forget` does not clean up edges pointing at what it removed, and says
 which ones will dangle.
 
 ## Attachments are named, not carried
@@ -279,9 +279,9 @@ shows what was attempted, refusals included.
 
 ## Setting something up
 
-Call `setup_overview` before answering any question about what you can reach, and
+Call `lanes_setup_overview` before answering any question about what you can reach, and
 before suggesting that anything be connected. It names the accounts reachable in a
-profile and the providers that are not connected yet. `setup_provider` then gives
+profile and the providers that are not connected yet. `lanes_setup_provider` then gives
 one provider's console steps, the values it will ask for, and the exact command.
 
 **Memory, tasks, assets, skills and the vault need no setup at all.** They hold
@@ -306,7 +306,7 @@ lanes link policy allow gmail.users.messages.list --connection gmail.<id> --prof
 profiles that grant it, which is the answer when an owner says an account they
 connected is not showing up somewhere.
 
-**Take the command from `setup_provider`; never compose one yourself.** It carries
+**Take the command from `lanes_setup_provider`; never compose one yourself.** It carries
 the right profile and, where the provider stores a credential per account, the
 `--id` it needs. A command you assembled is one the owner pastes and watches fail.
 
@@ -326,7 +326,7 @@ it needs, print the scopes and let the owner add the flag. Deciding that is thei
 
 **A new connection is served at once; the tools you were handed are not.**
 Connecting publishes the config to wherever that workspace's endpoint reads it and
-asks the endpoint to re-read it, so a `setup_overview` straight after connecting
+asks the endpoint to re-read it, so a `lanes_setup_overview` straight after connecting
 *does* show the account. What has not changed is the set of tools this session
 was given when it connected — the endpoint does not announce that its tools
 changed, so a capability for a freshly connected account is not callable until

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanes-sh/link",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "A self-hostable MCP gateway for all your connections, memory, tasks, files, and secrets",
   "license": "Apache-2.0",
   "homepage": "https://lanes.sh/link",

package/src/auth/oauth/store.ts

@@ -1,4 +1,4 @@
-import type { KeyValueStore } from '#stores/state';
+import { OAUTH_NAMESPACE, type KeyValueStore } from '#stores/state';
 
 /**
  * What an authorization server has to remember.
@@ -20,10 +20,26 @@ import type { KeyValueStore } from '#stores/state';
  * living about a minute.
  */
 
-const CLIENTS = 'oauth/clients';
-const CODES = 'oauth/codes';
-const TOKENS = 'oauth/tokens';
-const PENDING = 'oauth/pending';
+// Derived from `OAUTH_NAMESPACE`, not spelled. These were `oauth/clients` and
+// the rest while the namespace constant said `oauth.v1`, so the contract-4
+// migration moved every record to a key nothing read — every signed-in client
+// logged out, which is the outcome the migration exists to prevent. Worse, an
+// undotted namespace is not a workspace one, so `isWorkspaceNamespace` sent
+// live records into one profile's store: `profile remove <primary>` would take
+// the endpoint's registrations with it.
+const CLIENTS = `${OAUTH_NAMESPACE}/clients`;
+const CODES = `${OAUTH_NAMESPACE}/codes`;
+const TOKENS = `${OAUTH_NAMESPACE}/tokens`;
+const PENDING = `${OAUTH_NAMESPACE}/pending`;
+
+/**
+ * The four, for the test that holds them to `isWorkspaceNamespace`.
+ *
+ * Exported rather than retyped there: the pairing between what this module
+ * writes and where state routing sends it is the thing that broke, so the test
+ * reads the names off the module that owns them.
+ */
+export const OAUTH_SUBSPACES: readonly string[] = [CLIENTS, CODES, TOKENS, PENDING];
 
 /** Far above any real number of connectors, and far below a problem. */
 const MAX_CLIENTS = 200;

package/src/cli/accepts.ts

@@ -39,11 +39,12 @@ export const ACCEPTS: Record<string, readonly string[]> = {
   ],
   setup: ['id'],
   'profile add': ['workspace', 'non-interactive'],
-  // `--target` decommissions one target's stores and leaves the profile file in
-  // place (`removal.ts`). It is documented in `usage.ts` and read by
-  // `removalPlan`, and was refused here — the flag existed everywhere except in
-  // the list that decides whether it may be typed.
-  'profile remove': ['dry-run', 'yes', 'workspace'],
+  // `--delete-data` and `--migrate-to` say what becomes of the bytes the
+  // profile owns (ADR-066). Neither is optional in effect: `--yes` skips
+  // confirmations of things the command was told to do, and this is a question
+  // it has not been asked, so a run with no terminal is refused rather than
+  // guessing.
+  'profile remove': ['dry-run', 'yes', 'workspace', 'delete-data', 'migrate-to'],
   'profile members': ['me', 'role'],
   disconnect: ['yes', 'keep-credential'],
   // The one repair `doctor` can apply rather than only name. Narrow on purpose:

package/src/cli/commands/connect/index.ts

@@ -35,6 +35,7 @@ import { settleIdentity } from './settle.ts';
 import { runStrategySetup } from './strategy.ts';
 import { announceConnectTarget } from './target-note.ts';
 import { unknownProvider } from './unknown.ts';
+import { DISCOVERY_NAMESPACE } from '#stores/state';
 
 const PROVISIONAL_ID = 'pending';
 
@@ -265,7 +266,7 @@ export async function runConnect(
       credentials: runtime.credentials,
       connectorFor: address.connectorFor,
       remember: async (found) => {
-        await runtime.state.kv.set('discovery', providerId, JSON.stringify(found));
+        await runtime.state.kv.set(DISCOVERY_NAMESPACE, providerId, JSON.stringify(found));
         registry.setDiscovered(providerId, found);
       },
     });

package/src/cli/commands/connect/settle.ts

@@ -3,7 +3,7 @@ import { bearerTokenAsStored } from '#connectivity/auth/index.ts';
 import type { SecretStore } from '#secrets';
 import type { ConnectionConfig, Config } from '#profile';
 import type { AnyConnector, ProviderManifest } from '#connectivity';
-import { idFromAccount, resolveAccount } from '../../identity.ts';
+import { nextConnectionId, resolveAccount } from '../../identity.ts';
 import { style } from '../../output.ts';
 import { PromptCancelled, terminalPrompter, type Prompter } from '../../prompt.ts';
 import { accountSiblings } from './accounts.ts';
@@ -151,15 +151,23 @@ export async function settleIdentity(input: {
     typed = true;
   }
 
-  const taken = siblings.map((candidate) => candidate.id);
+  // Every id in the workspace, not this provider's alone. An id is opaque now,
+  // so a reader has nothing but the number to go on and two rows sharing one
+  // across providers would be a needless second thing to hold in mind — and
+  // `con3` naming exactly one row is what makes it usable in a refusal.
+  const taken = runtime.workspaceConnections.map((candidate) => candidate.id);
 
+  // The reconnect match is on the *account*, which is what tells a repair from
+  // a second row. That is the whole reason `resolveAccount` runs before this:
+  // without it a failed attempt appends rather than repairs, which is how
+  // `Gmail main3` came to exist.
   const connectionId =
     explicitId ??
     (unaccounted
-      ? idFromAccount('main', taken)
+      ? nextConnectionId(taken, true)
       : (siblings.find(
           (candidate) => candidate.account.toLowerCase() === account!.toLowerCase(),
-        )?.id ?? idFromAccount(account, taken)));
+        )?.id ?? nextConnectionId(taken, false)));
 
   return {
     connectionId,

package/src/cli/commands/connection.ts

@@ -7,6 +7,7 @@ import {
   readConnections,
   type ConnectionConfig,
   type Resolution,
+  layout,
 } from '#profile';
 import { ConfigDocument } from '../config-edit.ts';
 import { announce, announceWorkspace, emit, ok, print, style, warn } from '../output.ts';
@@ -230,7 +231,7 @@ export async function removeConnection(
     // refused at load, while a connection nothing grants is merely unused. So if
     // the process dies between the two writes, the workspace still opens.
     for (const profile of affected) {
-      const document = await ConfigDocument.openKey(root, `profiles/${profile}.yaml`);
+      const document = await ConfigDocument.openKey(root, layout.profileConfig(profile));
       if (dropGrantRow(document, key)) await document.save();
     }
 

package/src/cli/commands/identity.ts

@@ -37,9 +37,9 @@ export interface IdentityListing {
   readonly reachable: boolean;
 }
 
-/** Whether a rule list puts `identity.*` in force, in either spelling. */
+/** Whether a rule list puts `lanes_identity.*` in force, in either spelling. */
 function covers(rules: ReadonlyArray<{ capability: string }>): boolean {
-  return rules.some((rule) => rule.capability === '*' || rule.capability === 'identity.*');
+  return rules.some((rule) => rule.capability === '*' || rule.capability === 'lanes_identity.*');
 }
 
 /**
@@ -61,7 +61,7 @@ function readable(config: {
   // (ADR-058). The old shape could say "declared but not granted" and
   // "granted but not declared", and both served nothing while reading like
   // configuration that worked; neither is expressible here.
-  const grant = config.grants.find((row) => row.connection.startsWith('identity.'));
+  const grant = config.grants.find((row) => row.connection.startsWith('lanes_identity.'));
   if (grant === undefined) return false;
 
   return covers(grant.allow) && !covers(grant.deny);
@@ -244,7 +244,7 @@ export async function identityList(options: { json?: boolean } & GlobalFlags): P
       print(warn('declared, but no agent can read it'));
       print(
         style.dim(
-          '      the identity surface needs a connection row and an identity.* allow rule;',
+          '      the identity surface needs a connection row and a lanes_identity.* allow rule;',
         ),
       );
       print(style.dim('      adding an entry with this command writes both.'));

package/src/cli/commands/knowledge/index.ts

@@ -115,11 +115,7 @@ async function useGithub(flags: KnowledgeFlags): Promise<void> {
 
     // Nothing is written until this returns: the token is asked for, the
     // repository is probed, and either can refuse while the profile is intact.
-    const secrets = await openSecretStoreFor(
-      runtime.config,
-      runtime.resolution.workspaceRoot,
-      runtime.target,
-    );
+    const secrets = await openSecretStoreFor(runtime.resolution.workspaceRoot, runtime.target);
     const token = await resolveToken(secrets, knowledge.token_ref, knowledge.repo, selection, {
       replace: flags.replace,
     });
@@ -205,11 +201,7 @@ async function useLocal(flags: KnowledgeFlags): Promise<void> {
 
     // Built here rather than taken from `runtime.knowledge`, so both directions
     // of this command reach the repository through one constructor.
-    const secrets = await openSecretStoreFor(
-      runtime.config,
-      runtime.resolution.workspaceRoot,
-      runtime.target,
-    );
+    const secrets = await openSecretStoreFor(runtime.resolution.workspaceRoot, runtime.target);
     const token = await resolveToken(secrets, knowledge.token_ref, knowledge.repo, selection);
     const repository = repositoryFor(knowledge, token, flags.fetch);
 
@@ -270,12 +262,13 @@ async function openLocalStores(
     },
     runtime.credentials,
   );
-  // The *granted* connection, not the profile name. `layout.skills` changed
-  // meaning without changing arity at ADR-059, so the compiler was silent.
-  const skillsConnection = soleGrantFor(runtime.config, 'skills');
+  // The *granted* connection, beside the profile. `layout.skills` changed
+  // meaning without changing arity at ADR-059, so the compiler was silent;
+  // ADR-066 put the profile back in front of it, and it is an argument now.
+  const skillsConnection = soleGrantFor(runtime.config, 'lanes_skills');
   return {
     storage: factory(),
-    skills: skillsConnection === undefined ? null : factory(layout.skills(skillsConnection)),
+    skills: skillsConnection === undefined ? null : factory(layout.skills(runtime.config.instance.profile, skillsConnection)),
   };
 }
 
@@ -349,7 +342,7 @@ function grantedInstances(config: Parameters<typeof soleGrantFor>[0]): {
   entities: string;
 } {
   return {
-    memory: soleGrantFor(config, 'memory') ?? 'main',
-    entities: soleGrantFor(config, 'entities') ?? 'main',
+    memory: soleGrantFor(config, 'lanes_memory') ?? 'main',
+    entities: soleGrantFor(config, 'lanes_entities') ?? 'main',
   };
 }

package/src/cli/commands/knowledge/migrate.ts

@@ -1,6 +1,7 @@
 import {
   ConfigError,
   KNOWLEDGE_LAYOUT,
+  KNOWLEDGE_PREFIX,
   knowledgeRoot,
   type KnowledgeArea,
   type KnowledgeConfig,
@@ -81,10 +82,14 @@ function localAreas(
     // personal's repository and then deleted them locally, leaving `work`
     // reading an empty store with no knowledge block of its own. `skills` was
     // already connection-scoped, which is why it alone was correct.
+    // `scope` reads the *local* store and `prefix` names the repository
+    // directory, and since contract 4 those are different strings:
+    // `lanes_memory/lan1/` on disk becomes `memory/lan1/` in the repository.
+    // Reading one where the other belongs finds nothing and reports success.
     memory: {
       store: storage,
-      scope: `${KNOWLEDGE_LAYOUT.memory}/${instances.memory}/`,
-      prefix: `${KNOWLEDGE_LAYOUT.memory}/`,
+      scope: `${KNOWLEDGE_PREFIX.memory}/${instances.memory}/`,
+      prefix: `${KNOWLEDGE_PREFIX.memory}/`,
     },
     // Null becomes an empty area rather than a refusal: a profile granting no
     // skills connection has none to move, and `knowledge use` should still move
@@ -93,8 +98,8 @@ function localAreas(
     skills: { store: skills ?? EMPTY_AREA, scope: '', prefix: '' },
     entities: {
       store: storage,
-      scope: `${KNOWLEDGE_LAYOUT.entities}/${instances.entities}/`,
-      prefix: `${KNOWLEDGE_LAYOUT.entities}/`,
+      scope: `${KNOWLEDGE_PREFIX.entities}/${instances.entities}/`,
+      prefix: `${KNOWLEDGE_PREFIX.entities}/`,
     },
   };
 }

package/src/cli/commands/knowledge/show.ts

@@ -1,4 +1,4 @@
-import { KNOWLEDGE_LAYOUT, layout, soleGrantFor } from '#profile';
+import { KNOWLEDGE_LAYOUT, KNOWLEDGE_PREFIX, layout, soleGrantFor } from '#profile';
 import { announce, emit, heading, print, style, table } from '../../output.ts';
 import { openRuntime } from '../../runtime.ts';
 import type { KnowledgeFlags } from './index.ts';
@@ -20,12 +20,16 @@ export async function knowledgeShow(flags: KnowledgeFlags): Promise<void> {
     const profile = runtime.config.instance.profile;
     const selection = ` --profile ${runtime.resolution.profile} --target ${runtime.target}`;
     const skills = runtime.skills ? (await runtime.skills.list()).length : 0;
-    const memory = (await runtime.storage.list(`${KNOWLEDGE_LAYOUT.memory}/`)).length;
-    const entities = (await runtime.storage.list(`${KNOWLEDGE_LAYOUT.entities}/`)).length;
+    // Counted through the *provider's* prefix, which is what the local store is
+    // scoped into; `KNOWLEDGE_LAYOUT` is the repository's directory name and
+    // since contract 4 the two are different strings. Counting by the wrong one
+    // reports zero for a profile whose memory is perfectly well populated.
+    const memory = (await runtime.storage.list(`${KNOWLEDGE_PREFIX.memory}/`)).length;
+    const entities = (await runtime.storage.list(`${KNOWLEDGE_PREFIX.entities}/`)).length;
     const where = runtime.knowledge?.describe;
     // Null when no skills connection is granted (ADR-059). The row still prints,
     // saying so: a missing row reads as "there are none", not "not granted".
-    const skillsConnection = soleGrantFor(runtime.config, 'skills');
+    const skillsConnection = soleGrantFor(runtime.config, 'lanes_skills');
 
     if (flags.json) {
       print(
@@ -41,11 +45,12 @@ export async function knowledgeShow(flags: KnowledgeFlags): Promise<void> {
     heading('Knowledge');
     table([
       // The memory *directory*, not the blob root it sits in. `layout.blobs`
-      // is `data/`, which is where every provider's namespace lives —
-      // printing it here would name a directory that is mostly not memory.
+      // is the profile's own directory, which is where every provider's
+      // namespace lives — printing it here would name a directory that is
+      // mostly not memory.
       [
         '  memory',
-        where ? `${where}/${KNOWLEDGE_LAYOUT.memory}` : `${layout.blobs()}/${KNOWLEDGE_LAYOUT.memory}`,
+        where ? `${where}/${KNOWLEDGE_LAYOUT.memory}` : `${layout.blobs(profile)}/${KNOWLEDGE_PREFIX.memory}`,
         style.dim(`${memory} file${memory === 1 ? '' : 's'}`),
       ],
       [
@@ -53,7 +58,7 @@ export async function knowledgeShow(flags: KnowledgeFlags): Promise<void> {
         where
           ? `${where}/${KNOWLEDGE_LAYOUT.skills}`
           : skillsConnection
-            ? layout.skills(skillsConnection)
+            ? layout.skills(profile, skillsConnection)
             : style.dim('not granted'),
         style.dim(`${skills} file${skills === 1 ? '' : 's'}`),
       ],
@@ -64,7 +69,7 @@ export async function knowledgeShow(flags: KnowledgeFlags): Promise<void> {
         '  entities',
         where
           ? `${where}/${KNOWLEDGE_LAYOUT.entities}`
-          : `${layout.blobs()}/${KNOWLEDGE_LAYOUT.entities}`,
+          : `${layout.blobs(profile)}/${KNOWLEDGE_PREFIX.entities}`,
         style.dim(`${entities} file${entities === 1 ? '' : 's'}`),
       ],
     ]);

package/src/cli/commands/operate/migrate.ts

@@ -71,7 +71,7 @@ export async function migratedRenamedProviders(
   // Throws when it is malformed beyond a rename, which is a better sentence
   // than the referential one it would otherwise be reported under.
   const config = shapeOf(await ConfigDocument.open(root, selection.profile));
-  const credentials = await openSecretStoreFor(config, root, target);
+  const credentials = await openSecretStoreFor(root, target);
 
   const migration = await migrateRenamedProviders(document, profiles, credentials, {
     apply: flags.fix === true,
@@ -158,7 +158,10 @@ export async function migratedContract(flags: RenameFlags, refusal: unknown): Pr
   // only about contract 1 — so a contract-2 bucket, the exact thing this
   // function exists to rescue, returned false here and fell through to the
   // refusal it was supposed to fix. With `--fix` absent this writes nothing.
-  const migration = await migrateToCurrentContract(where, { apply: flags.fix === true });
+  const migration = await migrateToCurrentContract(where, {
+    apply: flags.fix === true,
+    target,
+  });
   if (migration.alreadyCurrent) return false;
 
   const applied = flags.fix === true;

package/src/cli/commands/operate/pair.ts

@@ -121,7 +121,7 @@ export async function pair(flags: PairFlags, deps: PairDeps = {}): Promise<void>
 
   const chosen = named ?? profiles[0]!;
   const host = chosen.config.instance.host;
-  const credentials = await openSecretStoreFor(chosen.config, root, target);
+  const credentials = await openSecretStoreFor(root, target);
 
   // A workspace that declares a deployment is paired over the address the
   // platform gave it, not over loopback — which is what `declared.deploy`

package/src/cli/commands/operate/serve.ts

@@ -2,7 +2,7 @@ import { readSession } from '#auth/lanes/session.ts';
 import { ConfigError } from '#profile';
 import { startEndpoint } from '#server/endpoint.ts';
 import { streamLogger } from '#server/logging.ts';
-import { repairOwnerLayer } from '../../config-repair.ts';
+import { repairOwnerLayer } from '../../config-repair-sweep.ts';
 import { announce, ok, print, style, warn } from '../../output.ts';
 import { staleNudge } from '../../release.ts';
 import { primaryProfile, resolveProfile, type GlobalFlags } from '../../runtime.ts';

package/src/cli/commands/owner/assets.ts

@@ -127,6 +127,6 @@ export async function assetsRemove(name: string | undefined, flags: OwnerFlags):
  * it is built from the same two functions rather than spelled as a path.
  */
 export function assetsStore(runtime: Runtime, flags: OwnerFlags): BlobStore {
-  const connection = ownerConnection(runtime.config, 'assets', flags);
-  return scopeBlobStore(runtime.storage, scopeNamespace('assets', connection));
+  const connection = ownerConnection(runtime.config, 'lanes_assets', flags);
+  return scopeBlobStore(runtime.storage, scopeNamespace('lanes_assets', connection));
 }

package/src/cli/commands/owner/entities.ts

@@ -239,6 +239,6 @@ export async function entitiesReindex(flags: OwnerFlags): Promise<void> {
  * `memoryStore` gives: a path spelled out again is a path that can differ.
  */
 export function entitiesStore(runtime: Runtime, flags: OwnerFlags): BlobStore {
-  const connection = ownerConnection(runtime.config, 'entities', flags);
-  return scopeBlobStore(runtime.storage, scopeNamespace('entities', connection));
+  const connection = ownerConnection(runtime.config, 'lanes_entities', flags);
+  return scopeBlobStore(runtime.storage, scopeNamespace('lanes_entities', connection));
 }

package/src/cli/commands/owner/memory.ts

@@ -105,6 +105,6 @@ export async function memoryForget(id: string | undefined, flags: OwnerFlags): P
  * again, so the CLI cannot address a different directory from the provider.
  */
 export function memoryStore(runtime: Runtime, flags: OwnerFlags): BlobStore {
-  const connection = ownerConnection(runtime.config, 'memory', flags);
-  return scopeBlobStore(runtime.storage, scopeNamespace('memory', connection));
+  const connection = ownerConnection(runtime.config, 'lanes_memory', flags);
+  return scopeBlobStore(runtime.storage, scopeNamespace('lanes_memory', connection));
 }

package/src/cli/commands/owner/tasks.ts

@@ -189,6 +189,6 @@ function assertStatus(raw: string | undefined): TaskStatus | undefined {
  * CLI cannot address a different directory from the provider.
  */
 export function tasksStore(runtime: Runtime, flags: OwnerFlags): BlobStore {
-  const connection = ownerConnection(runtime.config, 'tasks', flags);
-  return scopeBlobStore(runtime.storage, scopeNamespace('tasks', connection));
+  const connection = ownerConnection(runtime.config, 'lanes_tasks', flags);
+  return scopeBlobStore(runtime.storage, scopeNamespace('lanes_tasks', connection));
 }

package/src/cli/commands/owner/vault.ts

@@ -50,7 +50,7 @@ export async function vaultGet(id: string | undefined, flags: OwnerFlags): Promi
   const itemId = required(id, 'lanes link vault get <id> [--show]');
 
   await withRuntime(flags, async (runtime) => {
-    const connection = ownerConnection(runtime.config, 'vault', flags);
+    const connection = ownerConnection(runtime.config, 'lanes_vault', flags);
     const item = await runtime.vault.get(connection, itemId);
     if (!item) throw new ConfigError(`No vault item "${itemId}" in this profile.`);
 
@@ -77,7 +77,7 @@ export async function vaultSet(id: string | undefined, flags: OwnerFlags): Promi
   const value = await readStdin(`lanes link vault set ${itemId}`, 'the secret');
 
   await withRuntime(flags, async (runtime) => {
-    const connection = ownerConnection(runtime.config, 'vault', flags);
+    const connection = ownerConnection(runtime.config, 'lanes_vault', flags);
     const replacing = (await runtime.vault.get(connection, itemId)) !== null;
 
     await runtime.vault.put(connection, {
@@ -104,7 +104,7 @@ export async function vaultRemove(id: string | undefined, flags: OwnerFlags): Pr
   const itemId = required(id, 'lanes link vault remove <id>');
 
   await withRuntime(flags, async (runtime) => {
-    const connection = ownerConnection(runtime.config, 'vault', flags);
+    const connection = ownerConnection(runtime.config, 'lanes_vault', flags);
     const item = await runtime.vault.get(connection, itemId);
     if (!item) throw new ConfigError(`No vault item "${itemId}" in this profile.`);