synomem 0.6.1 → 0.6.3

package/README.md

@@ -65,10 +65,11 @@ synomem config          # asks where state should live, then sets it up
 # Local: SQLite on this machine, no account.
 synomem config init --backend local --yes
 
-# Synomem Cloud with an installation access key from
-# https://portal.synomem.ai/installations. The key names its own workspace, so
-# there is no ID to look up -- and it is piped rather than passed as an
-# argument, which the shell history and the process list would both keep.
+# Synomem Cloud with an access key from https://portal.synomem.ai/access-keys/new.
+# It reaches every workspace your membership already lets you reach, so setup
+# picks the workspace for you when there is only one, and otherwise asks for
+# --workspace <id>. The key is piped rather than passed as an argument, which
+# the shell history and the process list would both keep.
 printf '%s' "$SYNOMEM_KEY" | synomem config init \
   --backend remote --auth access-key --access-token-stdin --yes
 ```
@@ -140,8 +141,8 @@ Each agent has an opaque canonical ID, generated at creation and never reused, a
 Work autonomously through the safe, reversible steps below. Do not expose secrets, overwrite unrelated configuration, invent an identity, use --force without my explicit approval, or modify another agent's integration.
 
 1. Verify Node.js 22.13+ and npm are available. Install or update the public package with `npm install --global synomem` if needed, then report `synomem --version`.
-2. Preserve an existing `SYNOMEM_HOME`; otherwise use the default ~/.synomem. Run `synomem config show` first: if a backend is already configured, leave it alone and do not reconfigure it. Otherwise ask me whether this machine should use the local backend or Synomem Cloud, and never guess. For local, run `synomem config init --backend local --yes`. For Synomem Cloud, ask me for an installation access key from https://portal.synomem.ai/installations and pipe it in — `printf '%s' "$KEY" | synomem config init --backend remote --auth access-key --access-token-stdin --yes` — because an argument is kept by both the shell history and the process list. The key names its own workspace, so do not ask me for a workspace ID. Then run `synomem backend status` and `synomem doctor`. Never point tests or experiments at another Synomem home.
-3. Run `synomem agent list`. Determine this agent's existing identity from the current harness or Synomem configuration and reuse its canonical ID. If no identity is clearly established, ask me for the handle and display name before running `synomem agent create <handle> --name <name>`, then record the canonical ID it reports. Never silently merge or rename identities.
+2. Preserve an existing `SYNOMEM_HOME`; otherwise use the default ~/.synomem. Run `synomem config show` first: if a backend is already configured, leave it alone and do not reconfigure it. Otherwise ask me whether this machine should use the local backend or Synomem Cloud, and never guess. For local, run `synomem config init --backend local --yes`. For Synomem Cloud, ask me for an access key from https://portal.synomem.ai/access-keys/new and pipe it in — `printf '%s' "$KEY" | synomem config init --backend remote --auth access-key --access-token-stdin --yes` — because an argument is kept by both the shell history and the process list. The key reaches every workspace my membership already allows; setup picks one automatically when there is only one, and asks for `--workspace <workspace-id>` if there are several — ask me which, and re-run with it, if so. Then run `synomem backend status` and `synomem doctor`. Never point tests or experiments at another Synomem home.
+3. Run `synomem agent list`. Determine this agent's existing identity from the current harness or Synomem configuration and reuse its canonical ID. If no identity is clearly established: for a local backend, ask me for the handle and display name and run `synomem agent create <handle> --name <name>` directly, then record the canonical ID it reports. For Synomem Cloud configured with an access key, do not attempt `synomem agent create` — it always fails there (agent creation requires an administrator, which an access key never asserts on its own, regardless of my own role in the organization); ask me to create the agent in the Synomem portal instead (a workspace's Actors page → New agent) and give you its canonical ID. Never silently merge or rename identities.
 4. Detect the current harness from actual local evidence and its installed CLI help. Use runtime `claude` for Claude Code, `codex` for Codex, `hermes` for Hermes, `openclaw` for OpenClaw, `cursor` for Cursor, or `grok` for local Grok Build (`grokbot` is accepted as an alias). Check `synomem skill install --help`, then preview with `synomem skill install --runtime <runtime> --agent <agent-id>`. Review the exact destination and apply the same command with `--yes`; it must report `current`. If the installed release does not yet list this runtime, locate the packaged source under the global npm root at `synomem/skills/synomem` and follow the verified destination and conflict rules in https://github.com/Coaden/synomem/blob/main/docs/skill.md instead. Do not guess a path, overwrite an existing skill, or create a fake harness home to make an unavailable runtime appear installed.
 5. Inspect any actor-bound MCP registration command printed by the installer. Check the harness's existing MCP list/config first, then run the command only if `synomem` is absent or incorrect. Do not create duplicates. Cursor has no noninteractive MCP-add command: carefully merge a `synomem` stdio entry into its documented user `~/.cursor/mcp.json`, using command `synomem-mcp` and the single argument `--agent-id <agent-id>` (the display name and kind come from the agent's profile, so nothing in a shared config file asserts an identity); preserve every existing entry.
 6. Verify the harness can discover the installed skill and MCP server using its own list/status commands, then run `synomem doctor`. Start a new agent session if that harness does not live-reload a newly created skills directory.

package/dist/backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../src/backend.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAS5C,OAAO,EAAiC,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGlF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,KAAK,EAEV,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACd,MAAM,YAAY,CAAC;AAkBpB,wBAAgB,iBAAiB,CAC/B,YAAY,CAAC,EAAE,MAAM,EACrB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,aAAa,GAAG,SAAS,CAQ3B;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,oBAAoB,EAC7B,YAAY,CAAC,EAAE,MAAM,GACpB,aAAa,CAef;AAED,wBAAgB,uBAAuB,CACrC,OAAO,GAAE,oBAAyB,EAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,wCAmBrC;AAED,eAAO,MAAM,wBAAwB,EAAE,qBACL,CAAC"}
+{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../src/backend.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAS5C,OAAO,EAAiC,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGlF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,KAAK,EAEV,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACd,MAAM,YAAY,CAAC;AAkBpB,wBAAgB,iBAAiB,CAC/B,YAAY,CAAC,EAAE,MAAM,EACrB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,aAAa,GAAG,SAAS,CAQ3B;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,oBAAoB,EAC7B,YAAY,CAAC,EAAE,MAAM,GACpB,aAAa,CAef;AAED,wBAAgB,uBAAuB,CACrC,OAAO,GAAE,oBAAyB,EAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,wCAqBrC;AAED,eAAO,MAAM,wBAAwB,EAAE,qBACL,CAAC"}

package/dist/backend.js

@@ -58,7 +58,7 @@ export function createConfiguredService(options = {}, env = process.env) {
         expectedActor,
         credentialProvider: env.SYNOMEM_ACCESS_TOKEN
             ? environmentCredentialProvider(env)
-            : new StoredCredentialProvider(credentialReference(backend.baseUrl, backend.workspaceId, expectedActor), new OsCredentialStore(), env),
+            : new StoredCredentialProvider(credentialReference(backend.baseUrl, backend.workspaceId, expectedActor), new OsCredentialStore(), env, fetch, resolveHome(options.home)),
         ...(options.signal ? { signal: options.signal } : {}),
     });
 }

package/dist/backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"backend.js","sourceRoot":"","sources":["../src/backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,6BAA6B,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAStD,SAAS,cAAc,CAAC,YAAqB;IAK3C;;;;;;OAMG;IACH,MAAM,IAAI,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IACvC,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,YAAqB,EACrB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IAC5E,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;QAC1D,MAAM,IAAI,YAAY,CAAC,aAAa,EAAE,wCAAwC,CAAC,CAAC;IAClF,CAAC;IACD,qBAAqB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC9C,OAAO,WAAW,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAA6B,EAC7B,YAAqB;IAErB,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IAC5E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,YAAY,CAAC,aAAa,EAAE,wDAAwD,CAAC,CAAC;IAClG,CAAC;IACD,eAAe,CAAC,gBAAgB,CAAC,CAAC;IAClC,qBAAqB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC9C,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC;QACrC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC;QACtD,CAAC,CAAC,EAAE,GAAG,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IACpE,eAAe,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,UAAgC,EAAE,EAClC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,SAAS,EAAE,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC;IACvF,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,aAAa,GAAkB,OAAO,CAAC,KAAK,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;IAC1F,OAAO,IAAI,oBAAoB,CAAC;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,aAAa;QACb,kBAAkB,EAAE,GAAG,CAAC,oBAAoB;YAC1C,CAAC,CAAC,6BAA6B,CAAC,GAAG,CAAC;YACpC,CAAC,CAAC,IAAI,wBAAwB,CAC1B,mBAAmB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,EACxE,IAAI,iBAAiB,EAAE,EACvB,GAAG,CACJ;QACL,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAA0B,CAAC,OAAO,EAAE,EAAE,CACzE,uBAAuB,CAAC,OAAO,CAAC,CAAC"}
+{"version":3,"file":"backend.js","sourceRoot":"","sources":["../src/backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,6BAA6B,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAStD,SAAS,cAAc,CAAC,YAAqB;IAK3C;;;;;;OAMG;IACH,MAAM,IAAI,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IACvC,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,YAAqB,EACrB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IAC5E,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;QAC1D,MAAM,IAAI,YAAY,CAAC,aAAa,EAAE,wCAAwC,CAAC,CAAC;IAClF,CAAC;IACD,qBAAqB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC9C,OAAO,WAAW,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAA6B,EAC7B,YAAqB;IAErB,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IAC5E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,YAAY,CAAC,aAAa,EAAE,wDAAwD,CAAC,CAAC;IAClG,CAAC;IACD,eAAe,CAAC,gBAAgB,CAAC,CAAC;IAClC,qBAAqB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC9C,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC;QACrC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC;QACtD,CAAC,CAAC,EAAE,GAAG,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IACpE,eAAe,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,UAAgC,EAAE,EAClC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,SAAS,EAAE,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC;IACvF,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,aAAa,GAAkB,OAAO,CAAC,KAAK,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;IAC1F,OAAO,IAAI,oBAAoB,CAAC;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,aAAa;QACb,kBAAkB,EAAE,GAAG,CAAC,oBAAoB;YAC1C,CAAC,CAAC,6BAA6B,CAAC,GAAG,CAAC;YACpC,CAAC,CAAC,IAAI,wBAAwB,CAC1B,mBAAmB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,EACxE,IAAI,iBAAiB,EAAE,EACvB,GAAG,EACH,KAAK,EACL,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAC1B;QACL,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAA0B,CAAC,OAAO,EAAE,EAAE,CACzE,uBAAuB,CAAC,OAAO,CAAC,CAAC"}

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAKA,OAAO,EAAE,OAAO,EAA0B,MAAM,WAAW,CAAC;AAkB5D,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,eAAe,CAAC;AAOvB,OAAO,EAA2B,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAA0C,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAIhG,OAAO,EAA4C,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE9F,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EAClB,MAAM,aAAa,CAAC;AASrB,OAAO,KAAK,EACV,aAAa,EASd,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAkB,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE1E,MAAM,WAAW,KAAK;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE;QACjC,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,aAAa,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,eAAe,CAAC;KAClC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAKpB,2BAA2B,CAAC,EAAE,CAAC,OAAO,EAAE;QACtC,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB,KAAK,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,mBAAmB,EAAE,CAAA;KAAE,CAAC,CAAC;IAC7E,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7D,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,aAAa,CAAC;QACrB,MAAM,EAAE,YAAY,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,KAAK,OAAO,CAAC,aAAa,GAAG,YAAY,CAAC,CAAC;CAC7C;AA+QD,wBAAgB,SAAS,CACvB,EAAE,GAAE,KAAiB,EACrB,cAAc,GAAE,qBAAgD,EAChE,YAAY,GAAE,eAAoB,EAClC,IAAI,GAAE,MAAM,EAAiB,GAC5B,OAAO,CAmiFT;AAED,wBAAsB,MAAM,CAC1B,IAAI,WAAe,EACnB,EAAE,GAAE,KAAiB,EACrB,cAAc,GAAE,qBAAgD,EAChE,YAAY,GAAE,eAAoB,GACjC,OAAO,CAAC,MAAM,CAAC,CAqBjB"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAKA,OAAO,EAAE,OAAO,EAA0B,MAAM,WAAW,CAAC;AAkB5D,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,eAAe,CAAC;AAOvB,OAAO,EAA2B,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAA0C,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAIhG,OAAO,EAA4C,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE9F,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EAClB,MAAM,aAAa,CAAC;AASrB,OAAO,KAAK,EACV,aAAa,EASd,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAkB,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE1E,MAAM,WAAW,KAAK;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE;QACjC,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,aAAa,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,eAAe,CAAC;KAClC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAKpB,2BAA2B,CAAC,EAAE,CAAC,OAAO,EAAE;QACtC,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB,KAAK,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,mBAAmB,EAAE,CAAA;KAAE,CAAC,CAAC;IAC7E,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7D,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,aAAa,CAAC;QACrB,MAAM,EAAE,YAAY,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,KAAK,OAAO,CAAC,aAAa,GAAG,YAAY,CAAC,CAAC;CAC7C;AA+QD,wBAAgB,SAAS,CACvB,EAAE,GAAE,KAAiB,EACrB,cAAc,GAAE,qBAAgD,EAChE,YAAY,GAAE,eAAoB,EAClC,IAAI,GAAE,MAAM,EAAiB,GAC5B,OAAO,CA4kFT;AAED,wBAAsB,MAAM,CAC1B,IAAI,WAAe,EACnB,EAAE,GAAE,KAAiB,EACrB,cAAc,GAAE,qBAAgD,EAChE,YAAY,GAAE,eAAoB,GACjC,OAAO,CAAC,MAAM,CAAC,CAqBjB"}

package/dist/cli.js

@@ -404,12 +404,12 @@ export function createCli(io = defaultIo, serviceFactory = configuredServiceFact
     });
     const remoteCommand = program.command('remote').description('Administer a remote workspace');
     /*
-     * The browser counterpart to an access key naming its own workspace.
-     *
-     * A signed-in account may reach several organizations, each with several
-     * workspaces, so there is a genuine choice to make -- and no way to make it
-     * without seeing the list. Printing the IDs alongside the names is the point:
-     * the ID is what `backend use remote --workspace` takes.
+     * The browser counterpart to `discoverAccessKeyWorkspaces` — same purpose,
+     * different credential: a signed-in account may reach several
+     * organizations, each with several workspaces, so there is a genuine choice
+     * to make, and no way to make it without seeing the list. Printing the IDs
+     * alongside the names is the point: the ID is what `backend use remote
+     * --workspace` takes.
      */
     remoteCommand
         .command('workspaces')
@@ -469,7 +469,7 @@ export function createCli(io = defaultIo, serviceFactory = configuredServiceFact
             : await (async () => {
                 const credentialProvider = env.SYNOMEM_ACCESS_TOKEN
                     ? { getAccessToken: async () => env.SYNOMEM_ACCESS_TOKEN }
-                    : new StoredCredentialProvider(credentialReference(backend.baseUrl, backend.workspaceId, administrator), credentialStore, env);
+                    : new StoredCredentialProvider(credentialReference(backend.baseUrl, backend.workspaceId, administrator), credentialStore, env, fetch, resolveHome(global.home));
                 const importer = new RemoteImportClient({
                     baseUrl: backend.baseUrl,
                     workspaceId: backend.workspaceId,
@@ -529,6 +529,10 @@ export function createCli(io = defaultIo, serviceFactory = configuredServiceFact
          * person who already knows which one they want should not be asked again.
          */
         let workspaceId = plan.workspaceId;
+        // Only known once discovered below — printed in the final summary rather
+        // than the bare ID, so "what did config just do" reads like an answer
+        // instead of a lookup key.
+        let workspaceName;
         if (plan.backend === 'remote' && !workspaceId && token) {
             const discovered = await discoverWorkspaces({ baseUrl: serviceUrl, accessToken: token });
             if (discovered.workspaces.length === 0) {
@@ -540,7 +544,7 @@ export function createCli(io = defaultIo, serviceFactory = configuredServiceFact
             }
             else if (discovered.workspaces.length === 1) {
                 workspaceId = discovered.workspaces[0].id;
-                io.stdout(`Using this key's only workspace: ${discovered.workspaces[0].displayName} (${workspaceId}).\n`);
+                workspaceName = discovered.workspaces[0].displayName;
             }
             else if (promptIo.interactive) {
                 workspaceId = await select(promptIo, 'Which workspace should this machine use?', discovered.workspaces.map((workspace) => ({
@@ -548,6 +552,7 @@ export function createCli(io = defaultIo, serviceFactory = configuredServiceFact
                     label: workspace.displayName,
                     detail: workspace.id,
                 })));
+                workspaceName = discovered.workspaces.find((w) => w.id === workspaceId)?.displayName;
             }
             else {
                 throw new SynomemError('INVALID_INPUT', [
@@ -611,23 +616,58 @@ export function createCli(io = defaultIo, serviceFactory = configuredServiceFact
         // Diagnostics run before success is claimed: a configuration that cannot
         // open its own database is not a finished setup.
         const diagnostics = await withClient(home, defaultActor(env, 'system', 'cli'), (client) => client.doctor());
+        /*
+         * What to do next differs by exactly one thing: whether an agent can be
+         * created from here at all. An access key never carries the
+         * administrator authority agent creation requires (§ deliberate,
+         * independent of the key owner's own role) — local storage and a human
+         * browser sign-in both can. Telling everyone to just run `agent create`
+         * regardless was the CLI recommending a command guaranteed to fail for
+         * the single most common setup path.
+         */
+        const canCreateAgentHere = config.backend.kind === 'local' || plan.auth !== 'access-key';
+        const nextSteps = canCreateAgentHere
+            ? [
+                '  synomem agent create <handle> --name "<display name>"',
+                '  synomem skill install --runtime <claude|codex|cursor|...> --agent <agent-id>',
+            ]
+            : [
+                "  An access key can't create an agent — that needs an administrator,",
+                "  which a key never asserts on its own, regardless of the member's own",
+                "  role. Create one in the Synomem portal (a workspace's Actors page →",
+                '  New agent), then use its ID:',
+                '',
+                '  synomem skill install --runtime <claude|codex|cursor|...> --agent <agent-id>',
+            ];
         output(io, global.json, {
             backend: config.backend,
             home,
             ...(credentialLocation ? { credentialSource: credentialLocation } : {}),
             ...(token ? { credential: credentialFingerprint(token) } : {}),
             healthy: diagnostics.healthy,
+            canCreateAgentHere,
         }, [
             '',
             'Synomem is ready.',
             '',
-            `  Backend:  ${config.backend.kind === 'local' ? 'Local SQLite' : 'Synomem Cloud'}`,
-            `  Home:     ${home}`,
+            `  Backend:    ${config.backend.kind === 'local' ? 'Local SQLite' : 'Synomem Cloud'}`,
+            `  Home:       ${home}`,
             ...(config.backend.kind === 'remote'
-                ? [`  Service:  ${config.backend.baseUrl}`, `  Workspace: ${config.backend.workspaceId}`]
+                ? [
+                    `  Service:    ${config.backend.baseUrl}`,
+                    `  Workspace:  ${workspaceName ? `${workspaceName} (${config.backend.workspaceId})` : config.backend.workspaceId}`,
+                ]
                 : []),
             ...(credentialLocation ? [`  Credential: ${credentialLocation}`] : []),
-            `  Database: ${diagnostics.healthy ? 'Healthy' : 'Needs attention — run synomem doctor'}`,
+            `  Database:   ${diagnostics.healthy ? 'Healthy' : 'Needs attention — run synomem doctor'}`,
+            '',
+            'Next: set up an agent for this machine.',
+            '',
+            ...nextSteps,
+            '',
+            'Full walkthrough, including the MCP connector for each platform, and a',
+            'prompt that does all of this for you:',
+            '  https://github.com/Coaden/synomem#let-your-agent-set-it-up',
         ].join('\n'));
     };
     configCommand.action(async (_options, command) => {
@@ -652,7 +692,7 @@ export function createCli(io = defaultIo, serviceFactory = configuredServiceFact
         .option('--credential-store <where>', 'auto, keychain, file, or environment', 'auto')
         // The token is read from stdin, never taken as an argument: an argument is
         // kept by the shell history and visible in the process list.
-        .option('--access-token-stdin', 'read the installation access key from stdin', false)
+        .option('--access-token-stdin', 'read the access key from stdin', false)
         .option('--yes', 'apply without confirming', false)
         .action(async (options, command) => {
         const global = globals(command);