synomem 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -3,7 +3,48 @@
 All notable changes will be documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and releases follow Semantic Versioning.
 
-## [Unreleased]
+## [0.5.0] - 2026-09-07
+
+### Added
+
+- **`synomem backend status`** — connects to the selected backend and reports
+  what answered. `backend show` still reads the configuration file and connects
+  to nothing; a person debugging a broken setup needs that, and a person
+  confirming a working one needs a connection to have been made.
+- **`synomem projection status`** — whether the generated files match the
+  canonical events, when they were last rebuilt, and which ones drifted. The
+  comparison is against Synomem's own manifest, so a file somebody added to the
+  projection tree by hand is not reported as drift.
+- **`synomem remote workspaces`** — the organizations and workspaces a
+  credential can reach, with the IDs `backend use remote --workspace` takes.
+- `agent runtime list` with no agent named lists every agent that runs
+  anywhere. Requiring the agent meant already knowing the answer to the
+  question being asked.
+
+### Changed
+
+- **Remote setup no longer asks for a workspace ID.** An installation access
+  key is bound to exactly one workspace, so the service is asked which one
+  rather than the person; `config init --backend remote --access-token-stdin`
+  needs no `--workspace`. Typing `ws-04psqx2rkt8ttft7a1t2z69r97` from memory
+  was never something a person could do.
+- The Windows credential-store choice is the restricted file rather than
+  Credential Manager, which the credential layer does not implement. Offering a
+  store that cannot read its own credential back fails on first use, after
+  setup has already claimed the credential was safe.
+
+### Fixed
+
+- `doctor` reported every workspace's projections as stale once any agent had a
+  generated ID: the expected-path list was built from canonical IDs while the
+  files, the manifest and the cleanup all used handles.
+- `doctor`'s agent-directory symbolic-link check inspected a path built from the
+  canonical ID, so it examined a directory that does not exist and passed on a
+  workspace whose agent directory really had been replaced with a link.
+
+## [0.4.0] - 2026-09-07
+
+Published as 0.3.0 and 0.4.0 on the same day; the entries below cover both.
 
 ### Changed
 

package/README.md

@@ -14,20 +14,24 @@
 
 [CLI reference](docs/cli.md) · [MCP guide](docs/mcp.md) · [Storage](docs/storage-format.md) · [Security](SECURITY.md)
 
-The experimental remote client supports explicit backend configuration. `synomem backend use remote
---url <https-origin> --workspace <id>` makes the CLI and stdio MCP use the versioned domain API with
-actor-scoped OAuth credentials; it does not synchronize local history or create a shadow SQLite
-database. Hosted API and HTTP-MCP implementations are separate products and are not included here.
-See the [CLI reference](docs/cli.md#backend-and-authentication).
+Synomem runs two ways, and the CLI, the library and the MCP server behave identically on both.
+**Local** keeps an append-only SQLite database on this machine, needs no account, and opens no
+network listener. **Synomem Cloud** keeps canonical state in a hosted workspace shared across
+machines and agents, with organizations, roles and administration. `synomem config` sets up either
+one. Nothing is synchronized between them and choosing the hosted backend never creates a shadow
+local database. See the [CLI reference](docs/cli.md#backend-and-authentication).
 
 </div>
 
-Synomem gives humans and AI agents four durable ways to coordinate beyond a disappearing chat:
+Synomem gives humans and AI agents durable ways to coordinate beyond a disappearing chat:
 
 - **Kudos** recognize a concrete contribution.
 - **Memos** deliver a message to another agent or to one's future self.
 - **Notes** retain agent-owned, revisable knowledge.
-- **Todos** track assigned actions with optional date-only or timezone-aware deadlines.
+- **Posts** announce something to everyone in the workspace, and record who has acknowledged it.
+- **Tasks** delegate work to another agent, with their consent.
+- **Todos** track an agent's own actions, private to them, with optional date-only or
+  timezone-aware deadlines.
 
 ## Core philosophy
 
@@ -38,9 +42,11 @@ collaboration through one auditable protocol. V1 provides that substrate locally
 designed so the same agent identities and semantics can later cross machines through an explicitly
 configured service.
 
-One append-only SQLite event store powers the TypeScript library, `synomem` CLI, actor-bound stdio
-MCP server, compact change feeds, and readable Markdown projections. V1 runs entirely on one machine
-and opens no network listener.
+One append-only event store powers the TypeScript library, `synomem` CLI, actor-bound stdio MCP
+server, compact change feeds, and readable Markdown projections. On the local backend that store is
+SQLite on this machine, and nothing listens on the network. On Synomem Cloud it is a hosted
+Postgres workspace reached over HTTPS with actor-scoped credentials. Events are never rewritten on
+either one.
 
 > [!IMPORTANT]
 > Synomem is pre-1.0 software. Review the release notes before upgrading persisted storage or public
@@ -50,7 +56,34 @@ and opens no network listener.
 
 ```bash
 npm install --global synomem
+synomem config          # asks where state should live, then sets it up
+```
+
+`synomem config` is interactive. Its deterministic equivalents, for a machine with no terminal:
+
+```bash
+# Local: SQLite on this machine, no account.
+synomem config init --backend local --yes
+
+# Synomem Cloud with an installation access key from
+# https://portal.synomem.ai/installations. The key names its own workspace, so
+# there is no ID to look up -- and it is piped rather than passed as an
+# argument, which the shell history and the process list would both keep.
+printf '%s' "$SYNOMEM_KEY" | synomem config init \
+  --backend remote --auth access-key --access-token-stdin --yes
+```
+
+Check either one at any time:
 
+```bash
+synomem backend status      # connects, and reports what answered
+synomem projection status   # local only: are the generated files current?
+synomem doctor
+```
+
+Everything below works the same on both backends.
+
+```bash
 export SYNOMEM_HOME="$(mktemp -d)/.synomem"
 synomem init
 synomem agent create codex --name "Codex"
@@ -78,8 +111,15 @@ synomem task accept <task-id> --as codex --response "Starting after the tests."
 # A todo is private to the agent that wrote it; nobody else can assign one.
 synomem todo create --as codex --title "Re-read the migration notes"
 
+# A post is readable by everyone in the workspace, and tracks acknowledgement.
+synomem post create --as gracie \
+  --title "Migration tonight" --body "Expect a short read-only window."
+synomem post acknowledge <post-id> --as codex --note "Already handled."
+synomem post roster <post-id>
+
 synomem agent resolve Mike
 synomem agent directory
+synomem agent runtime list
 synomem list
 ```
 

package/dist/cli.d.ts

@@ -23,6 +23,12 @@ export interface CliDependencies {
         reference: string;
         credentialStore: CredentialStore;
     }) => Promise<void>;
+    discoverBoundWorkspace?: (options: {
+        baseUrl: string;
+        accessToken: string;
+    }) => Promise<{
+        workspaceId: string;
+    }>;
     createImportBundle?: (home: string) => Promise<ImportBundle>;
     remoteImport?: (options: {
         baseUrl: string;

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAKA,OAAO,EAAE,OAAO,EAA0B,MAAM,WAAW,CAAC;AAkB5D,OAAO,EAAmB,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAA0C,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAIhG,OAAO,EAA4C,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE9F,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EAClB,MAAM,aAAa,CAAC;AASrB,OAAO,KAAK,EACV,aAAa,EAQd,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAkB,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE1E,MAAM,WAAW,KAAK;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE;QACjC,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,aAAa,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,eAAe,CAAC;KAClC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpB,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7D,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,aAAa,CAAC;QACrB,MAAM,EAAE,YAAY,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,KAAK,OAAO,CAAC,aAAa,GAAG,YAAY,CAAC,CAAC;CAC7C;AAkND,wBAAgB,SAAS,CACvB,EAAE,GAAE,KAAiB,EACrB,cAAc,GAAE,qBAAgD,EAChE,YAAY,GAAE,eAAoB,GACjC,OAAO,CAuqET;AAED,wBAAsB,MAAM,CAC1B,IAAI,WAAe,EACnB,EAAE,GAAE,KAAiB,EACrB,cAAc,GAAE,qBAAgD,EAChE,YAAY,GAAE,eAAoB,GACjC,OAAO,CAAC,MAAM,CAAC,CAqBjB"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAKA,OAAO,EAAE,OAAO,EAA0B,MAAM,WAAW,CAAC;AAmB5D,OAAO,EAAmB,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAA0C,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAIhG,OAAO,EAA4C,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE9F,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EAClB,MAAM,aAAa,CAAC;AASrB,OAAO,KAAK,EACV,aAAa,EASd,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAkB,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE1E,MAAM,WAAW,KAAK;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE;QACjC,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,aAAa,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,eAAe,CAAC;KAClC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAKpB,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE;QACjC,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB,KAAK,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvC,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7D,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,aAAa,CAAC;QACrB,MAAM,EAAE,YAAY,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,KAAK,OAAO,CAAC,aAAa,GAAG,YAAY,CAAC,CAAC;CAC7C;AAkND,wBAAgB,SAAS,CACvB,EAAE,GAAE,KAAiB,EACrB,cAAc,GAAE,qBAAgD,EAChE,YAAY,GAAE,eAAoB,GACjC,OAAO,CA62ET;AAED,wBAAsB,MAAM,CAC1B,IAAI,WAAe,EACnB,EAAE,GAAE,KAAiB,EACrB,cAAc,GAAE,qBAAgD,EAChE,YAAY,GAAE,eAAoB,GACjC,OAAO,CAAC,MAAM,CAAC,CAqBjB"}

package/dist/cli.js

@@ -8,6 +8,7 @@ import { configuredServiceFactory, readSynomemConfig, writeSynomemBackend } from
 import { cloudApiUrl } from './cloud.js';
 import { resolveHome } from './config.js';
 import { assertInteractive, confirmPlan, credentialFingerprint, credentialStoreChoices, environmentInstructions, readAccessToken, runConfigWizard, writeCredentialFile, } from './configure.js';
+import { discoverBoundWorkspace, discoverOrganizations, workspaceChoices } from './discover.js';
 import { defaultPromptIo } from './prompt.js';
 import { credentialReference, OsCredentialStore } from './credentials.js';
 import { asSynomemError, SynomemError } from './errors.js';
@@ -198,6 +199,7 @@ export function createCli(io = defaultIo, serviceFactory = configuredServiceFact
     const env = dependencies.env ?? process.env;
     const credentialStore = dependencies.credentialStore ?? new OsCredentialStore();
     const oauthLogin = dependencies.oauthLogin ?? loginWithOAuth;
+    const discoverWorkspace = dependencies.discoverBoundWorkspace ?? discoverBoundWorkspace;
     const promptIo = dependencies.promptIo ?? defaultPromptIo();
     const verifyRemoteCredential = dependencies.verifyRemoteCredential ??
         (async (options) => {
@@ -226,6 +228,41 @@ export function createCli(io = defaultIo, serviceFactory = configuredServiceFact
         .showSuggestionAfterError()
         .configureOutput({ writeOut: io.stdout, writeErr: io.stderr });
     const remoteCommand = program.command('remote').description('Administer a remote workspace');
+    /*
+     * The browser counterpart to an access key naming its own workspace.
+     *
+     * A signed-in account may reach several organizations, each with several
+     * workspaces, so there is a genuine choice to make -- and no way to make it
+     * without seeing the list. Printing the IDs alongside the names is the point:
+     * the ID is what `backend use remote --workspace` takes.
+     */
+    remoteCommand
+        .command('workspaces')
+        .description('List the organizations and workspaces this credential can reach')
+        .option('--url <url>', 'internal: alternate HTTPS origin')
+        .action(async (options, command) => {
+        const global = globals(command);
+        const config = readSynomemConfig(global.home, env);
+        const baseUrl = options.url ??
+            (config?.backend.kind === 'remote' ? config.backend.baseUrl : cloudApiUrl(env));
+        const accessToken = env.SYNOMEM_ACCESS_TOKEN;
+        if (!accessToken) {
+            throw new SynomemError('AUTH_REQUIRED', 'Set SYNOMEM_ACCESS_TOKEN, or run `synomem auth login` first.');
+        }
+        const organizations = await discoverOrganizations({ baseUrl, accessToken });
+        const choices = workspaceChoices(organizations);
+        const human = organizations.length
+            ? organizations
+                .map((organization) => [
+                `${organization.displayName} (${organization.slug}) — ${organization.role}`,
+                ...(organization.workspaces.length
+                    ? organization.workspaces.map((workspace) => `  ${workspace.id}  ${workspace.displayName}`)
+                    : ['  (no workspaces yet)']),
+            ].join('\n'))
+                .join('\n')
+            : 'This account belongs to no organizations yet.';
+        output(io, global.json, { organizations, choices }, human);
+    });
     remoteCommand
         .command('import')
         .description('Preview or confirm a one-way import from a local Synomem home')
@@ -308,13 +345,45 @@ export function createCli(io = defaultIo, serviceFactory = configuredServiceFact
         .description('Set up Synomem, interactively or deterministically');
     const applyPlan = async (plan, token, global) => {
         const home = plan.home;
+        const serviceUrl = plan.serviceUrl ?? cloudApiUrl(env);
+        /*
+         * The workspace is discovered, not typed.
+         *
+         * An installation access key is bound to exactly one workspace, so the
+         * service can be asked which one rather than the person. An explicit
+         * --workspace still wins, because automation should not depend on a
+         * network round trip to configure a machine.
+         */
+        let workspaceId = plan.workspaceId;
+        if (plan.backend === 'remote' && !workspaceId && token) {
+            const bound = await discoverWorkspace({ baseUrl: serviceUrl, accessToken: token });
+            workspaceId = bound.workspaceId;
+            io.stdout(`Access key is bound to workspace ${workspaceId}.\n`);
+        }
+        if (plan.backend === 'remote' && !workspaceId) {
+            /*
+             * Signing in through a browser needs an actor identity and a client ID,
+             * which is `synomem auth login`'s job. Rather than write a remote
+             * backend with no workspace -- a configuration that fails on its first
+             * real use -- say exactly what remains.
+             */
+            output(io, global.json, { applied: false, pending: 'sign-in', home, serviceUrl }, [
+                '',
+                'Nothing was configured yet: signing in through a browser is a separate step.',
+                '',
+                'Run, with the actor this machine acts as:',
+                '',
+                '  synomem auth login --actor-id <agent> --client-id <client>',
+                '',
+                'Then select the workspace it reports:',
+                '',
+                '  synomem backend use remote --workspace <workspace-id>',
+            ].join('\n'));
+            return;
+        }
         const config = writeSynomemBackend(plan.backend === 'local'
             ? { kind: 'local' }
-            : {
-                kind: 'remote',
-                baseUrl: plan.serviceUrl ?? cloudApiUrl(env),
-                workspaceId: plan.workspaceId,
-            }, home);
+            : { kind: 'remote', baseUrl: serviceUrl, workspaceId: workspaceId }, home);
         let credentialLocation;
         if (token) {
             if (plan.credentialStore === 'environment') {
@@ -328,7 +397,7 @@ export function createCli(io = defaultIo, serviceFactory = configuredServiceFact
                 // The platform store is the default, and a failure falls back to the
                 // restricted file rather than leaving the credential nowhere.
                 try {
-                    await credentialStore.set(`synomem:${plan.workspaceId}`, {
+                    await credentialStore.set(`synomem:${workspaceId}`, {
                         kind: 'installation-key',
                         accessToken: token,
                     });
@@ -392,8 +461,10 @@ export function createCli(io = defaultIo, serviceFactory = configuredServiceFact
             throw new SynomemError('INVALID_INPUT', 'Pass --backend local or --backend remote.');
         }
         const backend = options.backend;
-        if (backend === 'remote' && !options.workspace) {
-            throw new SynomemError('INVALID_INPUT', 'Remote setup requires --workspace.');
+        // An access key names its own workspace, so --workspace is only
+        // required when there is no key to ask.
+        if (backend === 'remote' && !options.workspace && !options.accessTokenStdin) {
+            throw new SynomemError('INVALID_INPUT', 'Remote setup requires --workspace, or --access-token-stdin so the key can name its own.');
         }
         const token = options.accessTokenStdin ? await readAccessToken(promptIo) : undefined;
         if (backend === 'remote' && options.auth === 'access-key' && !token) {
@@ -541,6 +612,80 @@ export function createCli(io = defaultIo, serviceFactory = configuredServiceFact
             }, global.home);
         output(io, global.json, { backend: config.backend }, `Selected ${config.backend.kind} Synomem backend.`);
     });
+    /*
+     * `show` reads the config file; `status` proves the selection actually works.
+     *
+     * The two are deliberately separate. A person debugging a broken setup needs
+     * to know what is configured even when nothing can be reached, and a person
+     * checking that a setup is live needs a connection to have been made. One
+     * command doing both would make a printed workspace ID look like a reachable
+     * workspace.
+     */
+    backendCommand
+        .command('status')
+        .description('Connect to the selected backend and report what answered')
+        .action(async (_options, command) => {
+        const global = globals(command);
+        const config = readSynomemConfig(global.home);
+        if (!config) {
+            throw new SynomemError('CONFIG_INVALID', 'No Synomem home here yet. Run `synomem config init` first.');
+        }
+        const result = await withClient(global.home, defaultActor(env, 'system', 'cli'), async (client) => ({
+            info: await client.info(),
+            capabilities: await client.capabilities(),
+            diagnostics: (await client.doctor()).diagnostics.filter((item) => item.level === 'error' || item.level === 'warning'),
+        }));
+        const { info, capabilities, diagnostics } = result;
+        const where = info.backend === 'local'
+            ? `Home: ${info.home}\nDatabase: ${info.databasePath}`
+            : `URL: ${info.baseUrl}`;
+        const problems = diagnostics.length
+            ? diagnostics
+                .map((item) => `${item.level.toUpperCase()} ${item.code}: ${item.message}`)
+                .join('\n')
+            : 'No warnings or errors.';
+        const human = [
+            `Backend: ${info.backend} (reachable)`,
+            where,
+            `Workspace: ${capabilities.binding.workspaceId}`,
+            `Acting as: ${capabilities.binding.actor.kind} ${capabilities.binding.actor.id}`,
+            problems,
+        ].join('\n');
+        output(io, global.json, { reachable: true, info, capabilities, diagnostics }, human);
+        if (diagnostics.some((item) => item.level === 'error'))
+            cliExitCodes.set(program, 5);
+    });
+    const projectionCommand = program
+        .command('projection')
+        .description('Inspect the generated files Synomem derives from events');
+    projectionCommand
+        .command('status')
+        .description('Report whether the generated files match the canonical events')
+        .action(async (_options, command) => {
+        const global = globals(command);
+        const status = await withClient(global.home, defaultActor(env, 'system', 'cli'), (client) => {
+            if (!client.projectionStatus) {
+                throw new SynomemError('INVALID_INPUT', 'The remote backend keeps no filesystem projections, so there is nothing to report.');
+            }
+            return client.projectionStatus();
+        });
+        const enabled = Object.entries(status.settings)
+            .filter(([, on]) => on)
+            .map(([name]) => name);
+        const lines = [
+            `Directory: ${status.directory ?? '(none)'}`,
+            `Enabled: ${enabled.length ? enabled.join(', ') : 'none'}`,
+            `Last rebuilt: ${status.lastRebuiltAt ?? 'never'}`,
+            status.current
+                ? `Current: ${status.counts.manifest} generated file(s) match the events.`
+                : `Stale: ${status.counts.missing} missing, ${status.counts.unexpected} no longer expected. Run \`synomem rebuild\`.`,
+        ];
+        for (const path of status.missing)
+            lines.push(`  missing     ${path}`);
+        for (const path of status.unexpected)
+            lines.push(`  unexpected  ${path}`);
+        output(io, global.json, status, lines.join('\n'));
+    });
     const authCommand = program.command('auth').description('Inspect remote authentication');
     authCommand
         .command('status')
@@ -878,18 +1023,36 @@ export function createCli(io = defaultIo, serviceFactory = configuredServiceFact
         }));
         output(io, global.json, binding, `Bound ${binding.agentId} to ${binding.runtime}${binding.profile ? `/${binding.profile}` : ''} (${binding.id})`);
     });
+    /*
+     * With no agent named this answers the question people actually arrive with:
+     * "where is any of my stuff running?". Naming an agent narrows it. Requiring
+     * the agent, as this once did, means you must already know the answer to the
+     * question you came to ask.
+     */
     runtimeCommand
-        .command('list <agent>')
-        .description('List an agent runtime bindings')
+        .command('list [agent]')
+        .description('List runtime bindings for one agent, or for every agent')
         .action(async (agent, _options, command) => {
         const global = globals(command);
-        const bindings = await withClient(global.home, defaultActor(env, 'system', 'cli'), (client) => client.agents.bindings(agent));
-        const human = bindings.length
-            ? bindings
-                .map((binding) => `${binding.id}  ${binding.runtime}${binding.profile ? `/${binding.profile}` : ''}  bound ${binding.boundAt}`)
+        const result = await withClient(global.home, defaultActor(env, 'system', 'cli'), async (client) => {
+            if (agent) {
+                const profile = await client.agents.get(agent);
+                return [{ profile, runtimeBindings: await client.agents.bindings(agent) }];
+            }
+            return (await client.agents.directory()).filter((entry) => entry.runtimeBindings.length > 0);
+        });
+        const describe = (binding) => `  ${binding.id}  ${binding.runtime}${binding.profile ? `/${binding.profile}` : ''}  bound ${binding.boundAt}`;
+        const human = result.length
+            ? result
+                .map((entry) => [
+                `${entry.profile.handle} (${entry.profile.id})`,
+                ...entry.runtimeBindings.map(describe),
+            ].join('\n'))
                 .join('\n')
-            : 'No runtime bindings.';
-        output(io, global.json, { bindings }, human);
+            : agent
+                ? 'No runtime bindings.'
+                : 'No agent in this workspace has a runtime binding.';
+        output(io, global.json, { agents: result }, human);
     });
     runtimeCommand
         .command('unbind <binding-id>')