@lanes-sh/link 0.9.2 → 0.9.3

package/src/connectivity/manifest/provider.ts

@@ -109,7 +109,15 @@ export const RESERVED_PROVIDER_IDS: readonly string[] = [
   'lanes_entities',
 ];
 
-/** Old id to new, for the contract-4 migration and for a refusal that names it. */
+/**
+ * Old id to new, for a refusal that can name what a stale client is asking for.
+ *
+ * Nothing consumes it yet. The migration builds its own map from
+ * `C3_OWNER_PROVIDERS` (`src/cli/contract4-rename.ts`), and a `tools/call` on a
+ * pre-0.9.0 name is answered by the SDK's exact-match lookup before anything
+ * here sees it — so the refusal this exists for is still unwritten. ADR-066
+ * records the failure it would address.
+ */
 export const RENAMED_OWNER_PROVIDERS: ReadonlyMap<string, string> = new Map(
   RESERVED_PROVIDER_IDS.map((id) => [id.slice('lanes_'.length), id]),
 );

package/src/deployments/prepare.ts

@@ -4,7 +4,7 @@ import {
   readConnections, listProfiles, loadProfileConfig, vaultRef, type Config, type TargetConfig } from '#profile';
 import { VAULT_DOCUMENT_REF, VAULT_KEY_REF, generateVaultKey, type SecretStore } from '#secrets';
 import { ok, print, style, warn } from '#cli/output.ts';
-import { buildRegistryWithWorkspace, ensureProfileToken } from '#cli/runtime.ts';
+import { buildRegistryWithWorkspace } from '#cli/runtime.ts';
 
 /**
  * Getting the target's credential store to the state a revision can boot from.
@@ -198,7 +198,6 @@ export async function readableRefs(
       continue;
     }
 
-    refs.add(config.auth.token_ref);
     if (declared?.vault?.adapter === 'secret') refs.add(vaultRef(declared, config));
     // The OIDC audience check reads this on every verify (`server/endpoint.ts`).
     if (config.auth.authorization?.mode === 'oidc') {
@@ -209,6 +208,13 @@ export async function readableRefs(
 
   // Once, for the reason `rotatableRefs` gives.
   const connectionsFile = await readConnections(root);
+
+  // The endpoint's own tokens, which are the workspace's rather than any
+  // profile's since ADR-068. Pushed so a deployed revision can authenticate a
+  // headless caller; the *rows* travel with `connections.yaml`, so a ref here
+  // without its value is a row that matches nothing and reads to the client
+  // exactly like a wrong token.
+  for (const issued of connectionsFile.tokens) refs.add(issued.ref);
   const registry = await buildRegistryWithWorkspace(root);
 
   for (const connection of connectionsFile.connections) {
@@ -227,7 +233,6 @@ export async function prepareSecrets(input: PrepareInput): Promise<PrepareResult
   const blocking: string[] = [];
   const warnings: string[] = [];
 
-  await seedProfileToken({ config, credentials, readOnly, blocking });
   await seedVaultKey({ declared: input.declared, credentials, readOnly });
 
   // Connection credentials are written by `connect`, against a real account, in
@@ -280,34 +285,4 @@ async function seedVaultKey(input: {
   print(ok(`minted the vault key at "${VAULT_KEY_REF}" — the revision reads it from there`));
 }
 
-/**
- * The endpoint's own bearer token.
- *
- * Minted rather than demanded, and not even asked about: it is a random string
- * this process generates correctly and the operator cannot usefully choose, so a
- * prompt would be a question with one answer. `ensureProfileToken` is the same
- * call `outputs` makes for a local target, which is what keeps "the token" one
- * thing rather than a per-command notion.
- *
- * The deployed container deliberately will *not* do this — a token invented
- * inside something that scales to zero is a token nobody can read back, and the
- * endpoint would come up healthy while rejecting every agent.
- */
-async function seedProfileToken(input: {
-  config: Config;
-  credentials: SecretStore;
-  readOnly: boolean;
-  blocking: string[];
-}): Promise<void> {
-  const ref = input.config.auth.token_ref;
-  if (await input.credentials.has(ref)) return;
-
-  if (input.readOnly) {
-    input.blocking.push(`the endpoint bearer token — nothing at "${ref}"`);
-    return;
-  }
-
-  const { created } = await ensureProfileToken(input.credentials, ref);
-  if (created) print(ok(`minted an endpoint token at "${ref}" — read it with lanes link token show`));
-}
 

package/src/deployments/report.ts

@@ -22,14 +22,14 @@ import { heading, ok, print, style, warn } from '#cli/output.ts';
  * `tools/list` when it connects and keeps it: this endpoint is stateless, so
  * there is no stream on which to send `notifications/tools/list_changed`, and
  * `buildMcpServer` no longer pretends otherwise. A first deploy necessarily
- * publishes a profile whose only connection is `setup.main` — the accounts come
+ * publishes a profile whose only connection is `lanes_setup.lan1` — the accounts come
  * after — so a connector registered in that window captures a two-tool surface
  * and holds it. The endpoint is right, every reload lands, and the client shows
  * two tools until someone removes and re-adds it.
  *
  * Unconditional, and that is the correction that matters. This was gated on
  * `prepared.warnings.length`, which is zero in precisely the case it describes:
- * a fresh profile declares only `setup.main`, `setup` is a local provider with
+ * a fresh profile declares only `lanes_setup.lan1`, and it is a local provider with
  * no credential, so `prepareSecrets` has nothing to warn about. The advice
  * appeared only on a later re-deploy, by which point the connector is usually
  * registered and the ordering is no longer available to get right.
@@ -39,7 +39,10 @@ export function registerLine(profile: string, target: string): string {
     `  Connect your accounts first, then register with:\n` +
       `    lanes link outputs --profile ${profile} --workspace ${target}\n` +
       '  A client keeps the tool list it fetched when it connected, so one registered\n' +
-      '  before the accounts holds a surface without them until it is re-added.',
+      '  before the accounts holds a surface without them until it is re-added.\n' +
+      '  One registered before this deploy holds the list from before it, so a version\n' +
+      '  that renamed a provider or an id leaves it calling names that are gone:\n' +
+      '    lanes link mcp add',
   );
 }
 

package/src/dispatch/context.ts

@@ -131,6 +131,8 @@ export interface BuildContextOptions {
   readonly authorize?: ((request: Request) => Promise<Request>) | undefined;
   /** `oauth_apps` entries this profile declares. See `resolveSecretRefs`. */
   readonly ownClients?: readonly string[] | undefined;
+  /** Every profile the caller may reach. See `ProviderContext.profiles`. */
+  readonly profiles: readonly string[];
 }
 
 export function buildProviderContext(options: BuildContextOptions): ProviderContext {
@@ -146,6 +148,7 @@ export function buildProviderContext(options: BuildContextOptions): ProviderCont
 
   return {
     connection: info,
+    profiles: options.profiles,
     state: createScopedStore(options.state, namespace),
     storage: scopeBlobStore(options.storage, namespace),
     credentials: scopeSecrets(

package/src/dispatch/dispatch.ts

@@ -271,6 +271,11 @@ export class Dispatcher {
         // provider that could be brokered but is not reads its client from the
         // store, so it has to be able to.
         ownClients: this.#deps.oauthApps,
+        // The *caller's* set, not the workspace's. `undefined` means
+        // unrestricted — the stdio pipe — and the profile in play is the only
+        // honest answer a dispatcher can give for it without knowing what the
+        // endpoint is serving.
+        profiles: request.principal.profiles ?? [request.principal.profile],
         ...(entry.manifest.connector.kind === 'local' ? {} : { authorize }),
       });
 

package/src/profile/connections.ts

@@ -20,6 +20,38 @@ export function connectionRefOf(connection: ConnectionConfig): string {
   return `${connection.provider}.${connection.id}`;
 }
 
+/**
+ * What to call a connection nobody has named.
+ *
+ * `label` is the operator's own word for a row and is usually unset: `connect`
+ * offers a default and does not write one that only repeats a line above it, so
+ * most rows are an id, a provider and an account and nothing else. Every reader
+ * then has to decide what to show, and each of them picked the id — which is the
+ * one field that says nothing. It is opaque on purpose (`nextConnectionId`), so
+ * `con8` tells a reader strictly less about a row than any other line of it.
+ *
+ * The provider is what somebody is asking about, and the account is what tells
+ * two rows of the same provider apart, so the name is both: `Gmail (ada)`. The
+ * local part only — every address a person holds at one domain repeats it, and
+ * the account itself is on the line beside this everywhere this is shown.
+ *
+ * A connection with no account behind it is its provider and nothing else. That
+ * is the owner layer, whose rows carry the proper noun in `account` already, so
+ * composing the two would read `Memory (Memory)`.
+ */
+export function defaultConnectionLabel(
+  providerName: string,
+  account: string | null | undefined,
+): string {
+  if (!account || account === providerName) return providerName;
+
+  // Split on `@` and nothing else. A handle, an IBAN or a workspace name has no
+  // "first part" that is safe to guess at: `Lanes HQ` cut at the space is
+  // `Lanes`, which is a different workspace's name as often as not.
+  const local = account.split('@')[0];
+  return `${providerName} (${local || account})`;
+}
+
 /**
  * One account this profile reaches, with the rules that govern it.
  *

package/src/profile/index.ts

@@ -46,6 +46,7 @@ export {
   assertGrantsResolve,
   assertNoRenamedProviders,
   connectionRefOf,
+  defaultConnectionLabel,
   selectConnections,
   soleGrantFor,
   vaultRef,
@@ -121,6 +122,14 @@ export {
   type ResolvedTarget,
 } from './registry.ts';
 export { recordTarget, removeTarget } from './deployments.ts';
+export {
+  anyIssuedToken,
+  membersResolver,
+  nextTokenId,
+  readEndpointTokens,
+  tokenRef,
+  type EndpointToken,
+} from './tokens.ts';
 export {
   isRemoteWorkspace,
   readWorkspaceFile,

package/src/profile/schema.ts

@@ -59,11 +59,22 @@ import { knowledgeTargetSchema } from './knowledge.ts';
  * declaration moved inside it. No file's *shape* changed: `grants:`,
  * `members:` and `connections.yaml` are untouched, and only the paths moved.
  *
+ * **5 made the endpoint token a person's rather than a profile's** (ADR-068).
+ * `auth.token_ref` defaulted to the constant `profile/token` for every profile
+ * out of a credential store that is one per workspace, so the "profile's token"
+ * was the workspace's wearing a per-profile name — which is why removing one
+ * profile once deleted the token its siblings were served by. It moves to
+ * `tokens:` in `connections.yaml`, one row per issued token, each naming the
+ * Lanes subject it was issued to. What that buys is the thing a bearer token
+ * could not do: it resolves through `members:` like an OAuth token does, so a
+ * credential says who you are and the profiles follow from that rather than
+ * from which profile happened to mint it.
+ *
  * A hard cut each time, and only the newest is read here. `./legacy.ts`
  * understands the older shapes and only the migration uses it — a runtime that
  * loaded either would be the two-sources-of-truth problem again, one level up.
  */
-export const SUPPORTED_CONTRACT = 4;
+export const SUPPORTED_CONTRACT = 5;
 
 /**
  * There is no `database:` block any more.
@@ -447,6 +458,29 @@ export const oauthAppSchema = z.object({
   client_secret_ref: credentialRef,
 });
 
+/**
+ * One static endpoint token, and the person it was issued to.
+ *
+ * **`subject` is the whole point** (ADR-068). A bearer token used to resolve to
+ * the primary profile's owner and reach every profile in the workspace, which
+ * made it the one credential here that answered "what may I open" without ever
+ * answering "who are you". It names a Lanes subject now, and the profiles it
+ * reaches are the ones whose `members:` list that subject — the same resolution
+ * an OAuth token has gone through since ADR-060.
+ *
+ * The value is never here. `ref` points into the workspace's credential store,
+ * which is what keeps `findSecrets` from having anything to find in this file.
+ */
+export const endpointTokenSchema = z.object({
+  id: identifier,
+  subject: subjectRef,
+  ref: credentialRef,
+  /** What it is for, in a word — `ci`, `runner`. Free text, shown in listings. */
+  label: z.string().min(1).optional(),
+  /** ISO 8601, written when the row is created. Reported, never compared. */
+  issued_at: z.string().min(1).optional(),
+});
+
 
 /**
  * One profile: who it is, what it reaches, and what it may do.
@@ -473,7 +507,6 @@ export const configSchema = z.object({
   auth: z
     .object({
       mode: z.literal('bearer').default('bearer'),
-      token_ref: credentialRef.default('profile/token'),
       /**
        * Additive. `mode` above still describes what the endpoint accepts on the
        * wire — a bearer token — and this describes where a *remote* client can
@@ -490,7 +523,7 @@ export const configSchema = z.object({
        */
       allowed_origins: z.array(browserOrigin).optional(),
     })
-    .default({ mode: 'bearer', token_ref: 'profile/token' }),
+    .default({ mode: 'bearer' }),
 
   limits: z
     .object({
@@ -575,12 +608,23 @@ export const connectionsFileSchema = z.object({
   contract: z.number().int().positive(),
   connections: z.array(connectionSchema).default([]),
   oauth_apps: z.record(identifier, oauthAppSchema).default({}),
+  /**
+   * The static tokens this workspace has issued (ADR-068).
+   *
+   * Here rather than in a file of their own because this is already where the
+   * workspace keeps what is not a profile's and not an account's — `oauth_apps`
+   * is the precedent, and it is credential-referencing in the same way. A
+   * workspace that has issued none has no key, which is what lets an untouched
+   * file parse.
+   */
+  tokens: z.array(endpointTokenSchema).default([]),
 });
 
 export type ConnectionsFile = z.infer<typeof connectionsFileSchema>;
 
 export type Config = z.infer<typeof configSchema>;
 export type ConnectionConfig = z.infer<typeof connectionSchema>;
+export type EndpointToken = z.infer<typeof endpointTokenSchema>;
 export type GrantConfig = z.infer<typeof grantSchema>;
 export type MemberConfig = z.infer<typeof memberSchema>;
 export type PolicyRuleConfig = z.infer<typeof policyRuleSchema>;

package/src/profile/tokens.ts

@@ -0,0 +1,137 @@
+import { loadWorkspaceProfiles, readConnections } from './workspace.ts';
+import type { EndpointToken } from './schema.ts';
+
+/**
+ * The endpoint's static tokens, which belong to the workspace (ADR-068).
+ *
+ * **Why this is not a field on a profile any more.** `auth.token_ref` defaulted
+ * to the constant `profile/token` for every profile, out of a credential store
+ * that has been one per workspace since ADR-057 — so naming a profile to find
+ * the endpoint's token asked a question with one answer, and every command whose
+ * subject is the endpoint had to ask it. `profile/removal.ts` records the
+ * sharper consequence: removing one profile deleted the token its siblings were
+ * being served by, and the deployed revision then refused every request.
+ *
+ * **A row names a person.** That is the part that changes behaviour rather than
+ * merely moving a file. A bearer token used to resolve to `ownerPrincipal` of
+ * whichever profile was primary, with `profiles: undefined` — "all of them" —
+ * so it was the one credential on this endpoint that answered *what may I open*
+ * without ever answering *who are you*. A row carries a Lanes subject, so the
+ * token resolves through the profile's `members:` exactly as an OAuth token has
+ * since ADR-060, and `mayReach` needs no special case for it.
+ *
+ * The value is never in the file. A row holds a `ref` into the workspace's
+ * credential store, which is what keeps `findSecrets` with nothing to find.
+ */
+
+/** Where a row's value lives in the workspace credential store. */
+export function tokenRef(id: string): string {
+  return `tokens/${id}`;
+}
+
+/**
+ * The next free row id, `tok1` upward.
+ *
+ * Same shape as `nextConnectionId` and opaque for the same reason: the id ends
+ * up in a listing and in a credential path, and an id derived from the label or
+ * the subject would either collide or leak. `label` is the field for saying what
+ * a token is for.
+ */
+export function nextTokenId(taken: readonly string[]): string {
+  let highest = 0;
+  for (const id of taken) {
+    const match = /^tok([0-9]+)$/.exec(id);
+    if (match) highest = Math.max(highest, Number(match[1]));
+  }
+  return `tok${highest + 1}`;
+}
+
+/**
+ * Every token this workspace has issued.
+ *
+ * Read through `readConnections` rather than the filesystem, so a deployed
+ * revision whose root is a bucket URL loads them (ADR-049). A workspace that has
+ * issued none returns empty, which is not an error: it is what a fresh install
+ * looks like, and what a workspace looks like after `token revoke` removes the
+ * last row.
+ */
+export async function readEndpointTokens(
+  workspaceRoot: string,
+): Promise<readonly EndpointToken[]> {
+  return (await readConnections(workspaceRoot)).tokens;
+}
+
+export type { EndpointToken };
+
+/**
+ * Which profiles in this workspace list a subject as a member.
+ *
+ * The rule is ADR-060's and is stated once: a caller reaches a profile if that
+ * profile's `members:` names them. `server/endpoint.ts` answers the same
+ * question from its live runtime map when an OAuth code is minted; this answers
+ * it from disk, which is what a static token needs because it has no mint to be
+ * resolved at. Both are bounded by what the endpoint is actually serving —
+ * `visibility.ts` iterates the served profiles, so a name returned here that is
+ * not being served is filtered out rather than reachable.
+ *
+ * **Cached for the same window the token values are.** Without it a deployed
+ * revision read every profile's YAML out of a bucket on every request. The
+ * window is why `profile members remove` takes effect in seconds rather than on
+ * the next rotation, which is the property worth keeping.
+ */
+export function membersResolver(
+  workspaceRoot: string,
+  options: { readonly ttlMs?: number; readonly now?: () => number } = {},
+): (subject: string) => Promise<readonly string[]> {
+  const ttl = options.ttlMs ?? 5_000;
+  const now = options.now ?? Date.now;
+
+  let cached: ReadonlyMap<string, readonly string[]> | null = null;
+  let readAt = 0;
+
+  return async (subject) => {
+    if (cached === null || now() - readAt >= ttl) {
+      const { loaded } = await loadWorkspaceProfiles(workspaceRoot);
+      const bySubject = new Map<string, string[]>();
+      for (const entry of loaded) {
+        for (const member of entry.config.members) {
+          const known = bySubject.get(member.subject) ?? [];
+          known.push(entry.profile);
+          bySubject.set(member.subject, known);
+        }
+      }
+      cached = bySubject;
+      readAt = now();
+    }
+
+    return cached.get(subject) ?? [];
+  };
+}
+
+/**
+ * Any token this workspace holds, for talking to its own endpoint.
+ *
+ * `outputs`, `tools`, `doctor` and the reload notification all need *a* valid
+ * credential to ask the endpoint something, and none of them cares whose: they
+ * are the operator's own commands run against the operator's own workspace.
+ * Which row answers is therefore not a choice worth making visible — unlike
+ * `token show`, where it is the whole subject of the command and `--id` is
+ * required once there is more than one.
+ *
+ * **Null is an ordinary answer, not a failure.** A workspace that has issued
+ * none is the common case after ADR-062: a person's client registers against
+ * the bare URL and signs in, so nothing needs a static token until something
+ * headless does. Every caller degrades — reporting what it could not ask rather
+ * than minting a credential nobody asked for, which is what the old
+ * `ensureProfileToken` did on six different commands.
+ */
+export async function anyIssuedToken(
+  workspaceRoot: string,
+  credentials: { get(ref: string): Promise<string | null> },
+): Promise<{ readonly id: string; readonly value: string } | null> {
+  for (const row of await readEndpointTokens(workspaceRoot)) {
+    const value = await credentials.get(row.ref);
+    if (value) return { id: row.id, value };
+  }
+  return null;
+}

package/src/profile/workspace.ts

@@ -178,7 +178,7 @@ export const CONNECTIONS_FILE = 'connections.yaml';
 export async function readConnections(workspaceRoot: string): Promise<ConnectionsFile> {
   const path = join(workspaceRoot, CONNECTIONS_FILE);
   const text = await readWorkspaceFile(workspaceFiles(workspaceRoot), CONNECTIONS_FILE);
-  if (text === null) return { contract: SUPPORTED_CONTRACT, connections: [], oauth_apps: {} };
+  if (text === null) return { contract: SUPPORTED_CONTRACT, connections: [], oauth_apps: {}, tokens: [] };
 
   const raw = parseYaml(text);
 

package/src/providers/harness.ts

@@ -36,6 +36,7 @@ export function harnessFor(
     manifest: definition.manifest,
     definition,
     connection: { id: connectionId, provider: definition.manifest.id, account: 'Owner' },
+    profiles: ['personal'],
     state: createMemoryState(),
     // Seeded deliberately: an owner provider must not be able to read any of
     // this, and the credential-boundary test says so by name.

package/src/providers/setup/plan.ts

@@ -188,3 +188,19 @@ export function planAll(
     .sort((a, b) => a.id.localeCompare(b.id))
     .map((manifest) => planFor(manifest, context));
 }
+
+/**
+ * One connection this profile can reach, as the overview renders it.
+ *
+ * Declared once rather than spelled structurally at both ends: the two literals
+ * had to agree about `providerName`, and the display name went missing on one
+ * side — which is how an owner row came to read "Memory (lanes_memory (Memory))".
+ */
+export interface ReachableConnection {
+  readonly key: string;
+  readonly provider?: string;
+  /** The manifest's display name, which is what a label composes with. */
+  readonly providerName?: string;
+  readonly account: string;
+  readonly label?: string | undefined;
+}

package/src/providers/setup/provider.ts

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import { defineLocalProvider, keepKeys, type ProviderDefinition, type ProviderManifest } from '#connectivity';
-import { planAll, planFor, type ProviderPlan } from './plan.ts';
+import { defaultConnectionLabel } from '#profile';
+import { planAll, planFor, type ProviderPlan, type ReachableConnection } from './plan.ts';
 
 /**
  * `setup` — what is connected, and what connecting something else would take.
@@ -54,7 +55,11 @@ export interface SetupProviderOptions {
    * further than the commands this provider emits — nothing here opens a store.
    */
   readonly target: string;
-  /** Sibling profile names on this endpoint. Names only; already at `/health`. */
+  /**
+   * Every profile on disk. **Not what gets rendered:** the caller's own set
+   * arrives at handler time in `ProviderContext.profiles`; this only says how
+   * many are withheld — "one profile" versus "one of four".
+   */
   readonly profiles?: readonly string[];
   /**
    * `oauth_apps` entries this profile declares.
@@ -77,7 +82,7 @@ export interface SetupProviderOptions {
    * enum from. Computing it separately here is how discovery and enforcement
    * drift, and a leak in discovery is still a leak.
    */
-  readonly reachable?: () => ReadonlyArray<{ key: string; provider: string; account: string }>;
+  readonly reachable?: () => ReadonlyArray<ReachableConnection>;
 }
 
 export function createSetupProvider(options: SetupProviderOptions): ProviderDefinition {
@@ -132,7 +137,13 @@ export function createSetupProvider(options: SetupProviderOptions): ProviderDefi
             content: [
               {
                 type: 'text',
-                text: renderOverview(options, connections, plans, handlerContext.connection.key),
+                // The caller's set, not the workspace's (ADR-068): rendering
+                // `options.profiles` named profiles `mayReach` hides from the
+                // same caller's `profile` enum.
+                text: renderOverview(options, connections, plans, handlerContext.connection.key, {
+                  reachable: handlerContext.profiles,
+                  total: options.profiles?.length ?? handlerContext.profiles.length,
+                }),
               },
             ],
           };
@@ -185,9 +196,10 @@ export function createSetupProvider(options: SetupProviderOptions): ProviderDefi
 
 function renderOverview(
   options: SetupProviderOptions,
-  connections: ReadonlyArray<{ key: string; account: string; label?: string | undefined }>,
+  connections: ReadonlyArray<ReachableConnection>,
   plans: readonly ProviderPlan[],
   self: string,
+  caller: { reachable: readonly string[]; total: number },
 ): string {
   const lines: string[] = [`Profile "${options.profile}".`, ''];
 
@@ -199,11 +211,16 @@ function renderOverview(
       // Account first, label in brackets. The other way round for a person
       // reading `status`, and deliberately not here: an agent choosing which
       // connection to call needs the identity, and "Work mail" is not one.
+      //
+      // `defaultConnectionLabel` when the row carries none, so an unnamed row is
+      // called what `connection list` and `/state` call it. The provider's
+      // *name*, never its id: `lanes_memory` with account `Memory` would read
+      // "lanes_memory (Memory)".
+      const provider = connection.providerName ?? connection.key.split('.')[0] ?? connection.key;
+      const named = connection.label ?? defaultConnectionLabel(provider, connection.account);
       lines.push(
         `  ${connection.key}  — ${connection.account}` +
-          (connection.label && connection.label !== connection.account
-            ? ` (${connection.label})`
-            : ''),
+          (named && named !== connection.account ? ` (${named})` : ''),
       );
     }
   }
@@ -241,11 +258,21 @@ function renderOverview(
     );
   }
 
-  const siblings = (options.profiles ?? []).filter((name) => name !== options.profile);
-  if (siblings.length > 0) {
+  // **Which profiles *this caller* can reach** — the question an agent asks
+  // first. `initialize.instructions` names them until its budget is tight, then
+  // collapses to a count; this is the surface it already points at.
+  const others = caller.reachable.filter((name) => name !== options.profile);
+  lines.push('', `You can reach ${caller.reachable.length} profile(s) on this endpoint.`);
+  if (others.length > 0) {
+    lines.push(`  Also: ${others.join(', ')}. Pass one as \`profile\` to see what it reaches.`);
+  }
+
+  // A count, never names: naming them is the leak this used to be. That some
+  // exist is not a secret, and an agent told "one of four" asks the owner.
+  const hidden = caller.total - caller.reachable.length;
+  if (hidden > 0) {
     lines.push(
-      '',
-      `This endpoint also serves: ${siblings.join(', ')}. Pass that profile to see what it reaches.`,
+      `  ${hidden} other profile(s) exist here that you are not a member of. Only the owner can change that.`,
     );
   }
 

package/src/server/container.ts

@@ -72,8 +72,9 @@ try {
     },
     port,
     host,
-    // A deployed instance never mints its own token: see `endpoint.ts`.
-    mintToken: false,
+    // Nothing about tokens here any more (ADR-068): a deployed instance neither
+    // mints one nor needs one to boot. A client discovers the
+    // protected-resource document from the 401 and signs its owner in.
     // Stdout is where Cloud Run collects logs, and a rejected credential on a
     // public URL is the event this exists for.
     log: streamLogger((line) => process.stdout.write(`${line}\n`)),
@@ -84,7 +85,6 @@ try {
         // into an image that will be replaced.
         log(`reconciled ${profile}\n${plan}`);
       },
-      tokenMinted() {},
     },
   });