synomem 0.4.0 → 0.5.1

package/CHANGELOG.md

@@ -3,7 +3,68 @@
 All notable changes will be documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and releases follow Semantic Versioning.
 
-## [Unreleased]
+## [0.5.1] - 2026-09-07
+
+### Documentation
+
+- The README and CLI reference were rewritten for the two backends. They still
+  described Synomem as running only on one machine, listed four record kinds
+  when there are six, and pointed at `synomem init` rather than `synomem
+config`. The pasteable agent-setup prompt was stale in the same ways.
+
+### Fixed
+
+- CI could not install the project at all. A dependency bump moved TypeScript to
+  7, which is outside `typescript-eslint`'s peer range, so every `npm ci` failed
+  on resolution while local runs kept working against an older `node_modules`.
+  TypeScript is pinned to 6 until `typescript-eslint` supports 7.
+
+### Changed
+
+- Commander 15.
+
+## [0.5.0] - 2026-09-07
+
+### Added
+
+- **`synomem backend status`** — connects to the selected backend and reports
+  what answered. `backend show` still reads the configuration file and connects
+  to nothing; a person debugging a broken setup needs that, and a person
+  confirming a working one needs a connection to have been made.
+- **`synomem projection status`** — whether the generated files match the
+  canonical events, when they were last rebuilt, and which ones drifted. The
+  comparison is against Synomem's own manifest, so a file somebody added to the
+  projection tree by hand is not reported as drift.
+- **`synomem remote workspaces`** — the organizations and workspaces a
+  credential can reach, with the IDs `backend use remote --workspace` takes.
+- `agent runtime list` with no agent named lists every agent that runs
+  anywhere. Requiring the agent meant already knowing the answer to the
+  question being asked.
+
+### Changed
+
+- **Remote setup no longer asks for a workspace ID.** An installation access
+  key is bound to exactly one workspace, so the service is asked which one
+  rather than the person; `config init --backend remote --access-token-stdin`
+  needs no `--workspace`. Typing `ws-04psqx2rkt8ttft7a1t2z69r97` from memory
+  was never something a person could do.
+- The Windows credential-store choice is the restricted file rather than
+  Credential Manager, which the credential layer does not implement. Offering a
+  store that cannot read its own credential back fails on first use, after
+  setup has already claimed the credential was safe.
+
+### Fixed
+
+- `doctor` reported every workspace's projections as stale once any agent had a
+  generated ID: the expected-path list was built from canonical IDs while the
+  files, the manifest and the cleanup all used handles.
+- `doctor`'s agent-directory symbolic-link check inspected a path built from the
+  canonical ID, so it examined a directory that does not exist and passed on a
+  workspace whose agent directory really had been replaced with a link.
+
+## [0.4.0] - 2026-09-07
+
+Published as 0.3.0 and 0.4.0 on the same day; the entries below cover both.
 
 ### Changed
 

package/README.md

@@ -14,20 +14,24 @@
 
 [CLI reference](docs/cli.md) · [MCP guide](docs/mcp.md) · [Storage](docs/storage-format.md) · [Security](SECURITY.md)
 
-The experimental remote client supports explicit backend configuration. `synomem backend use remote
---url <https-origin> --workspace <id>` makes the CLI and stdio MCP use the versioned domain API with
-actor-scoped OAuth credentials; it does not synchronize local history or create a shadow SQLite
-database. Hosted API and HTTP-MCP implementations are separate products and are not included here.
-See the [CLI reference](docs/cli.md#backend-and-authentication).
+Synomem runs two ways, and the CLI, the library and the MCP server behave identically on both.
+**Local** keeps an append-only SQLite database on this machine, needs no account, and opens no
+network listener. **Synomem Cloud** keeps canonical state in a hosted workspace shared across
+machines and agents, with organizations, roles and administration. `synomem config` sets up either
+one. Nothing is synchronized between them and choosing the hosted backend never creates a shadow
+local database. See the [CLI reference](docs/cli.md#backend-and-authentication).
 
 </div>
 
-Synomem gives humans and AI agents four durable ways to coordinate beyond a disappearing chat:
+Synomem gives humans and AI agents durable ways to coordinate beyond a disappearing chat:
 
 - **Kudos** recognize a concrete contribution.
 - **Memos** deliver a message to another agent or to one's future self.
 - **Notes** retain agent-owned, revisable knowledge.
-- **Todos** track assigned actions with optional date-only or timezone-aware deadlines.
+- **Posts** announce something to everyone in the workspace, and record who has acknowledged it.
+- **Tasks** delegate work to another agent, with their consent.
+- **Todos** track an agent's own actions, private to them, with optional date-only or
+  timezone-aware deadlines.
 
 ## Core philosophy
 
@@ -38,9 +42,11 @@ collaboration through one auditable protocol. V1 provides that substrate locally
 designed so the same agent identities and semantics can later cross machines through an explicitly
 configured service.
 
-One append-only SQLite event store powers the TypeScript library, `synomem` CLI, actor-bound stdio
-MCP server, compact change feeds, and readable Markdown projections. V1 runs entirely on one machine
-and opens no network listener.
+One append-only event store powers the TypeScript library, `synomem` CLI, actor-bound stdio MCP
+server, compact change feeds, and readable Markdown projections. On the local backend that store is
+SQLite on this machine, and nothing listens on the network. On Synomem Cloud it is a hosted
+Postgres workspace reached over HTTPS with actor-scoped credentials. Events are never rewritten on
+either one.
 
 > [!IMPORTANT]
 > Synomem is pre-1.0 software. Review the release notes before upgrading persisted storage or public
@@ -50,7 +56,34 @@ and opens no network listener.
 
 ```bash
 npm install --global synomem
+synomem config          # asks where state should live, then sets it up
+```
+
+`synomem config` is interactive. Its deterministic equivalents, for a machine with no terminal:
 
+```bash
+# Local: SQLite on this machine, no account.
+synomem config init --backend local --yes
+
+# Synomem Cloud with an installation access key from
+# https://portal.synomem.ai/installations. The key names its own workspace, so
+# there is no ID to look up -- and it is piped rather than passed as an
+# argument, which the shell history and the process list would both keep.
+printf '%s' "$SYNOMEM_KEY" | synomem config init \
+  --backend remote --auth access-key --access-token-stdin --yes
+```
+
+Check either one at any time:
+
+```bash
+synomem backend status      # connects, and reports what answered
+synomem projection status   # local only: are the generated files current?
+synomem doctor
+```
+
+Everything below works the same on both backends.
+
+```bash
 export SYNOMEM_HOME="$(mktemp -d)/.synomem"
 synomem init
 synomem agent create codex --name "Codex"
@@ -78,8 +111,15 @@ synomem task accept <task-id> --as codex --response "Starting after the tests."
 # A todo is private to the agent that wrote it; nobody else can assign one.
 synomem todo create --as codex --title "Re-read the migration notes"
 
+# A post is readable by everyone in the workspace, and tracks acknowledgement.
+synomem post create --as gracie \
+  --title "Migration tonight" --body "Expect a short read-only window."
+synomem post acknowledge <post-id> --as codex --note "Already handled."
+synomem post roster <post-id>
+
 synomem agent resolve Mike
 synomem agent directory
+synomem agent runtime list
 synomem list
 ```
 
@@ -93,13 +133,15 @@ terminal-capable agent. The Synomem package contains the portable
 installer for the six named local harnesses.
 
 ```text
-Set up Synomem for this agent and runtime. Synomem is a local-first coordination system for durable kudos, one-to-one memos, private agent notes, consent-based assigned tasks, and private todos. It uses an append-only SQLite database under ~/.synomem by default, an actor-bound stdio MCP server, and a portable Agent Skill. Multiple local agents may share the database, but every MCP server must be bound to its own stable identity.
+Set up Synomem for this agent and runtime. Synomem is a coordination system for durable kudos, one-to-one memos, private agent notes, workspace-wide posts with acknowledgement, consent-based assigned tasks, and private todos. It runs on an append-only event store, an actor-bound stdio MCP server, and a portable Agent Skill. The store is either local SQLite under ~/.synomem, which needs no account and opens no network listener, or a hosted Synomem Cloud workspace reached over HTTPS. Nothing is synchronized between the two. Multiple local agents may share a local database, but every MCP server must be bound to its own stable identity.
+
+Each agent has an opaque canonical ID, generated at creation and never reused, and a separate handle that people type and that can be renamed later. `agent create` takes the handle. Never assert an ID yourself.
 
 Work autonomously through the safe, reversible steps below. Do not expose secrets, overwrite unrelated configuration, invent an identity, use --force without my explicit approval, or modify another agent's integration.
 
 1. Verify Node.js 22.13+ and npm are available. Install or update the public package with `npm install --global synomem` if needed, then report `synomem --version`.
-2. Preserve an existing `SYNOMEM_HOME`; otherwise use the default ~/.synomem. Run `synomem init`, then `synomem doctor`. Never point tests or experiments at another Synomem home.
-3. Run `synomem agent list`. Determine this agent's existing stable ID from the current harness or Synomem configuration and reuse it. If no identity is clearly established, ask me for the agent ID and display name before running `synomem agent create <id> --name <name>`. Never silently merge or rename identities.
+2. Preserve an existing `SYNOMEM_HOME`; otherwise use the default ~/.synomem. Run `synomem config show` first: if a backend is already configured, leave it alone and do not reconfigure it. Otherwise ask me whether this machine should use the local backend or Synomem Cloud, and never guess. For local, run `synomem config init --backend local --yes`. For Synomem Cloud, ask me for an installation access key from https://portal.synomem.ai/installations and pipe it in — `printf '%s' "$KEY" | synomem config init --backend remote --auth access-key --access-token-stdin --yes` — because an argument is kept by both the shell history and the process list. The key names its own workspace, so do not ask me for a workspace ID. Then run `synomem backend status` and `synomem doctor`. Never point tests or experiments at another Synomem home.
+3. Run `synomem agent list`. Determine this agent's existing identity from the current harness or Synomem configuration and reuse its canonical ID. If no identity is clearly established, ask me for the handle and display name before running `synomem agent create <handle> --name <name>`, then record the canonical ID it reports. Never silently merge or rename identities.
 4. Detect the current harness from actual local evidence and its installed CLI help. Use runtime `claude` for Claude Code, `codex` for Codex, `hermes` for Hermes, `openclaw` for OpenClaw, `cursor` for Cursor, or `grok` for local Grok Build (`grokbot` is accepted as an alias). Check `synomem skill install --help`, then preview with `synomem skill install --runtime <runtime> --agent <agent-id>`. Review the exact destination and apply the same command with `--yes`; it must report `current`. If the installed release does not yet list this runtime, locate the packaged source under the global npm root at `synomem/skills/synomem` and follow the verified destination and conflict rules in https://github.com/Coaden/synomem/blob/main/docs/skill.md instead. Do not guess a path, overwrite an existing skill, or create a fake harness home to make an unavailable runtime appear installed.
 5. Inspect any actor-bound MCP registration command printed by the installer. Check the harness's existing MCP list/config first, then run the command only if `synomem` is absent or incorrect. Do not create duplicates. Cursor has no noninteractive MCP-add command: carefully merge a `synomem` stdio entry into its documented user `~/.cursor/mcp.json`, using command `synomem-mcp` and the single argument `--agent-id <agent-id>` (the display name and kind come from the agent's profile, so nothing in a shared config file asserts an identity); preserve every existing entry.
 6. Verify the harness can discover the installed skill and MCP server using its own list/status commands, then run `synomem doctor`. Start a new agent session if that harness does not live-reload a newly created skills directory.

package/dist/cli.d.ts

@@ -23,6 +23,12 @@ export interface CliDependencies {
         reference: string;
         credentialStore: CredentialStore;
     }) => Promise<void>;
+    discoverBoundWorkspace?: (options: {
+        baseUrl: string;
+        accessToken: string;
+    }) => Promise<{
+        workspaceId: string;
+    }>;
     createImportBundle?: (home: string) => Promise<ImportBundle>;
     remoteImport?: (options: {
         baseUrl: string;

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAKA,OAAO,EAAE,OAAO,EAA0B,MAAM,WAAW,CAAC;AAkB5D,OAAO,EAAmB,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAA0C,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAIhG,OAAO,EAA4C,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE9F,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EAClB,MAAM,aAAa,CAAC;AASrB,OAAO,KAAK,EACV,aAAa,EAQd,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAkB,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE1E,MAAM,WAAW,KAAK;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE;QACjC,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,aAAa,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,eAAe,CAAC;KAClC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpB,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7D,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,aAAa,CAAC;QACrB,MAAM,EAAE,YAAY,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,KAAK,OAAO,CAAC,aAAa,GAAG,YAAY,CAAC,CAAC;CAC7C;AAkND,wBAAgB,SAAS,CACvB,EAAE,GAAE,KAAiB,EACrB,cAAc,GAAE,qBAAgD,EAChE,YAAY,GAAE,eAAoB,GACjC,OAAO,CAuqET;AAED,wBAAsB,MAAM,CAC1B,IAAI,WAAe,EACnB,EAAE,GAAE,KAAiB,EACrB,cAAc,GAAE,qBAAgD,EAChE,YAAY,GAAE,eAAoB,GACjC,OAAO,CAAC,MAAM,CAAC,CAqBjB"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAKA,OAAO,EAAE,OAAO,EAA0B,MAAM,WAAW,CAAC;AAmB5D,OAAO,EAAmB,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAA0C,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAIhG,OAAO,EAA4C,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE9F,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EAClB,MAAM,aAAa,CAAC;AASrB,OAAO,KAAK,EACV,aAAa,EASd,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAkB,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE1E,MAAM,WAAW,KAAK;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE;QACjC,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,aAAa,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,eAAe,CAAC;KAClC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAKpB,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE;QACjC,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB,KAAK,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvC,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7D,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,aAAa,CAAC;QACrB,MAAM,EAAE,YAAY,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,KAAK,OAAO,CAAC,aAAa,GAAG,YAAY,CAAC,CAAC;CAC7C;AAkND,wBAAgB,SAAS,CACvB,EAAE,GAAE,KAAiB,EACrB,cAAc,GAAE,qBAAgD,EAChE,YAAY,GAAE,eAAoB,GACjC,OAAO,CA62ET;AAED,wBAAsB,MAAM,CAC1B,IAAI,WAAe,EACnB,EAAE,GAAE,KAAiB,EACrB,cAAc,GAAE,qBAAgD,EAChE,YAAY,GAAE,eAAoB,GACjC,OAAO,CAAC,MAAM,CAAC,CAqBjB"}

package/dist/cli.js

@@ -8,6 +8,7 @@ import { configuredServiceFactory, readSynomemConfig, writeSynomemBackend } from
 import { cloudApiUrl } from './cloud.js';
 import { resolveHome } from './config.js';
 import { assertInteractive, confirmPlan, credentialFingerprint, credentialStoreChoices, environmentInstructions, readAccessToken, runConfigWizard, writeCredentialFile, } from './configure.js';
+import { discoverBoundWorkspace, discoverOrganizations, workspaceChoices } from './discover.js';
 import { defaultPromptIo } from './prompt.js';
 import { credentialReference, OsCredentialStore } from './credentials.js';
 import { asSynomemError, SynomemError } from './errors.js';
@@ -198,6 +199,7 @@ export function createCli(io = defaultIo, serviceFactory = configuredServiceFact
     const env = dependencies.env ?? process.env;
     const credentialStore = dependencies.credentialStore ?? new OsCredentialStore();
     const oauthLogin = dependencies.oauthLogin ?? loginWithOAuth;
+    const discoverWorkspace = dependencies.discoverBoundWorkspace ?? discoverBoundWorkspace;
     const promptIo = dependencies.promptIo ?? defaultPromptIo();
     const verifyRemoteCredential = dependencies.verifyRemoteCredential ??
         (async (options) => {
@@ -226,6 +228,41 @@ export function createCli(io = defaultIo, serviceFactory = configuredServiceFact
         .showSuggestionAfterError()
         .configureOutput({ writeOut: io.stdout, writeErr: io.stderr });
     const remoteCommand = program.command('remote').description('Administer a remote workspace');
+    /*
+     * The browser counterpart to an access key naming its own workspace.
+     *
+     * A signed-in account may reach several organizations, each with several
+     * workspaces, so there is a genuine choice to make -- and no way to make it
+     * without seeing the list. Printing the IDs alongside the names is the point:
+     * the ID is what `backend use remote --workspace` takes.
+     */
+    remoteCommand
+        .command('workspaces')
+        .description('List the organizations and workspaces this credential can reach')
+        .option('--url <url>', 'internal: alternate HTTPS origin')
+        .action(async (options, command) => {
+        const global = globals(command);
+        const config = readSynomemConfig(global.home, env);
+        const baseUrl = options.url ??
+            (config?.backend.kind === 'remote' ? config.backend.baseUrl : cloudApiUrl(env));
+        const accessToken = env.SYNOMEM_ACCESS_TOKEN;
+        if (!accessToken) {
+            throw new SynomemError('AUTH_REQUIRED', 'Set SYNOMEM_ACCESS_TOKEN, or run `synomem auth login` first.');
+        }
+        const organizations = await discoverOrganizations({ baseUrl, accessToken });
+        const choices = workspaceChoices(organizations);
+        const human = organizations.length
+            ? organizations
+                .map((organization) => [
+                `${organization.displayName} (${organization.slug}) — ${organization.role}`,
+                ...(organization.workspaces.length
+                    ? organization.workspaces.map((workspace) => `  ${workspace.id}  ${workspace.displayName}`)
+                    : ['  (no workspaces yet)']),
+            ].join('\n'))
+                .join('\n')
+            : 'This account belongs to no organizations yet.';
+        output(io, global.json, { organizations, choices }, human);
+    });
     remoteCommand
         .command('import')
         .description('Preview or confirm a one-way import from a local Synomem home')
@@ -308,13 +345,45 @@ export function createCli(io = defaultIo, serviceFactory = configuredServiceFact
         .description('Set up Synomem, interactively or deterministically');
     const applyPlan = async (plan, token, global) => {
         const home = plan.home;
+        const serviceUrl = plan.serviceUrl ?? cloudApiUrl(env);
+        /*
+         * The workspace is discovered, not typed.
+         *
+         * An installation access key is bound to exactly one workspace, so the
+         * service can be asked which one rather than the person. An explicit
+         * --workspace still wins, because automation should not depend on a
+         * network round trip to configure a machine.
+         */
+        let workspaceId = plan.workspaceId;
+        if (plan.backend === 'remote' && !workspaceId && token) {
+            const bound = await discoverWorkspace({ baseUrl: serviceUrl, accessToken: token });
+            workspaceId = bound.workspaceId;
+            io.stdout(`Access key is bound to workspace ${workspaceId}.\n`);
+        }
+        if (plan.backend === 'remote' && !workspaceId) {
+            /*
+             * Signing in through a browser needs an actor identity and a client ID,
+             * which is `synomem auth login`'s job. Rather than write a remote
+             * backend with no workspace -- a configuration that fails on its first
+             * real use -- say exactly what remains.
+             */
+            output(io, global.json, { applied: false, pending: 'sign-in', home, serviceUrl }, [
+                '',
+                'Nothing was configured yet: signing in through a browser is a separate step.',
+                '',
+                'Run, with the actor this machine acts as:',
+                '',
+                '  synomem auth login --actor-id <agent> --client-id <client>',
+                '',
+                'Then select the workspace it reports:',
+                '',
+                '  synomem backend use remote --workspace <workspace-id>',
+            ].join('\n'));
+            return;
+        }
         const config = writeSynomemBackend(plan.backend === 'local'
             ? { kind: 'local' }
-            : {
-                kind: 'remote',
-                baseUrl: plan.serviceUrl ?? cloudApiUrl(env),
-                workspaceId: plan.workspaceId,
-            }, home);
+            : { kind: 'remote', baseUrl: serviceUrl, workspaceId: workspaceId }, home);
         let credentialLocation;
         if (token) {
             if (plan.credentialStore === 'environment') {
@@ -328,7 +397,7 @@ export function createCli(io = defaultIo, serviceFactory = configuredServiceFact
                 // The platform store is the default, and a failure falls back to the
                 // restricted file rather than leaving the credential nowhere.
                 try {
-                    await credentialStore.set(`synomem:${plan.workspaceId}`, {
+                    await credentialStore.set(`synomem:${workspaceId}`, {
                         kind: 'installation-key',
                         accessToken: token,
                     });
@@ -392,8 +461,10 @@ export function createCli(io = defaultIo, serviceFactory = configuredServiceFact
             throw new SynomemError('INVALID_INPUT', 'Pass --backend local or --backend remote.');
         }
         const backend = options.backend;
-        if (backend === 'remote' && !options.workspace) {
-            throw new SynomemError('INVALID_INPUT', 'Remote setup requires --workspace.');
+        // An access key names its own workspace, so --workspace is only
+        // required when there is no key to ask.
+        if (backend === 'remote' && !options.workspace && !options.accessTokenStdin) {
+            throw new SynomemError('INVALID_INPUT', 'Remote setup requires --workspace, or --access-token-stdin so the key can name its own.');
         }
         const token = options.accessTokenStdin ? await readAccessToken(promptIo) : undefined;
         if (backend === 'remote' && options.auth === 'access-key' && !token) {
@@ -541,6 +612,80 @@ export function createCli(io = defaultIo, serviceFactory = configuredServiceFact
             }, global.home);
         output(io, global.json, { backend: config.backend }, `Selected ${config.backend.kind} Synomem backend.`);
     });
+    /*
+     * `show` reads the config file; `status` proves the selection actually works.
+     *
+     * The two are deliberately separate. A person debugging a broken setup needs
+     * to know what is configured even when nothing can be reached, and a person
+     * checking that a setup is live needs a connection to have been made. One
+     * command doing both would make a printed workspace ID look like a reachable
+     * workspace.
+     */
+    backendCommand
+        .command('status')
+        .description('Connect to the selected backend and report what answered')
+        .action(async (_options, command) => {
+        const global = globals(command);
+        const config = readSynomemConfig(global.home);
+        if (!config) {
+            throw new SynomemError('CONFIG_INVALID', 'No Synomem home here yet. Run `synomem config init` first.');
+        }
+        const result = await withClient(global.home, defaultActor(env, 'system', 'cli'), async (client) => ({
+            info: await client.info(),
+            capabilities: await client.capabilities(),
+            diagnostics: (await client.doctor()).diagnostics.filter((item) => item.level === 'error' || item.level === 'warning'),
+        }));
+        const { info, capabilities, diagnostics } = result;
+        const where = info.backend === 'local'
+            ? `Home: ${info.home}\nDatabase: ${info.databasePath}`
+            : `URL: ${info.baseUrl}`;
+        const problems = diagnostics.length
+            ? diagnostics
+                .map((item) => `${item.level.toUpperCase()} ${item.code}: ${item.message}`)
+                .join('\n')
+            : 'No warnings or errors.';
+        const human = [
+            `Backend: ${info.backend} (reachable)`,
+            where,
+            `Workspace: ${capabilities.binding.workspaceId}`,
+            `Acting as: ${capabilities.binding.actor.kind} ${capabilities.binding.actor.id}`,
+            problems,
+        ].join('\n');
+        output(io, global.json, { reachable: true, info, capabilities, diagnostics }, human);
+        if (diagnostics.some((item) => item.level === 'error'))
+            cliExitCodes.set(program, 5);
+    });
+    const projectionCommand = program
+        .command('projection')
+        .description('Inspect the generated files Synomem derives from events');
+    projectionCommand
+        .command('status')
+        .description('Report whether the generated files match the canonical events')
+        .action(async (_options, command) => {
+        const global = globals(command);
+        const status = await withClient(global.home, defaultActor(env, 'system', 'cli'), (client) => {
+            if (!client.projectionStatus) {
+                throw new SynomemError('INVALID_INPUT', 'The remote backend keeps no filesystem projections, so there is nothing to report.');
+            }
+            return client.projectionStatus();
+        });
+        const enabled = Object.entries(status.settings)
+            .filter(([, on]) => on)
+            .map(([name]) => name);
+        const lines = [
+            `Directory: ${status.directory ?? '(none)'}`,
+            `Enabled: ${enabled.length ? enabled.join(', ') : 'none'}`,
+            `Last rebuilt: ${status.lastRebuiltAt ?? 'never'}`,
+            status.current
+                ? `Current: ${status.counts.manifest} generated file(s) match the events.`
+                : `Stale: ${status.counts.missing} missing, ${status.counts.unexpected} no longer expected. Run \`synomem rebuild\`.`,
+        ];
+        for (const path of status.missing)
+            lines.push(`  missing     ${path}`);
+        for (const path of status.unexpected)
+            lines.push(`  unexpected  ${path}`);
+        output(io, global.json, status, lines.join('\n'));
+    });
     const authCommand = program.command('auth').description('Inspect remote authentication');
     authCommand
         .command('status')
@@ -878,18 +1023,36 @@ export function createCli(io = defaultIo, serviceFactory = configuredServiceFact
         }));
         output(io, global.json, binding, `Bound ${binding.agentId} to ${binding.runtime}${binding.profile ? `/${binding.profile}` : ''} (${binding.id})`);
     });
+    /*
+     * With no agent named this answers the question people actually arrive with:
+     * "where is any of my stuff running?". Naming an agent narrows it. Requiring
+     * the agent, as this once did, means you must already know the answer to the
+     * question you came to ask.
+     */
     runtimeCommand
-        .command('list <agent>')
-        .description('List an agent runtime bindings')
+        .command('list [agent]')
+        .description('List runtime bindings for one agent, or for every agent')
         .action(async (agent, _options, command) => {
         const global = globals(command);
-        const bindings = await withClient(global.home, defaultActor(env, 'system', 'cli'), (client) => client.agents.bindings(agent));
-        const human = bindings.length
-            ? bindings
-                .map((binding) => `${binding.id}  ${binding.runtime}${binding.profile ? `/${binding.profile}` : ''}  bound ${binding.boundAt}`)
+        const result = await withClient(global.home, defaultActor(env, 'system', 'cli'), async (client) => {
+            if (agent) {
+                const profile = await client.agents.get(agent);
+                return [{ profile, runtimeBindings: await client.agents.bindings(agent) }];
+            }
+            return (await client.agents.directory()).filter((entry) => entry.runtimeBindings.length > 0);
+        });
+        const describe = (binding) => `  ${binding.id}  ${binding.runtime}${binding.profile ? `/${binding.profile}` : ''}  bound ${binding.boundAt}`;
+        const human = result.length
+            ? result
+                .map((entry) => [
+                `${entry.profile.handle} (${entry.profile.id})`,
+                ...entry.runtimeBindings.map(describe),
+            ].join('\n'))
                 .join('\n')
-            : 'No runtime bindings.';
-        output(io, global.json, { bindings }, human);
+            : agent
+                ? 'No runtime bindings.'
+                : 'No agent in this workspace has a runtime binding.';
+        output(io, global.json, { agents: result }, human);
     });
     runtimeCommand
         .command('unbind <binding-id>')