synomem 0.9.0 → 0.9.1

package/dist/resolvers.js

@@ -8,7 +8,10 @@
  * each other's attribution. The resolver narrows (pins a context, restricts to a
  * preset); the server alone authorizes.
  */
-import { createHash } from 'node:crypto';
+import { randomBytes } from 'node:crypto';
+import { closeSync, existsSync, openSync, readFileSync, rmSync, statSync, writeSync, } from 'node:fs';
+import { join } from 'node:path';
+import { atomicWriteFile } from './fs-utils.js';
 import { SynomemClient } from './client.js';
 import { describeIdentity, discoverContexts } from './discover.js';
 import { SynomemError } from './errors.js';
@@ -29,15 +32,93 @@ function required() {
     return new SynomemError('CONTEXT_REQUIRED', 'This connection can act as more than one workspace/actor. Pass contextId: call synomem_context_list and choose the context that matches what the user asked for.');
 }
 /**
- * Stable local context id: derived from the store's persistent workspace id and the
- * canonical actor — never from a display name — so it survives renames and moving the
- * store, and an unrelated store with a same-named agent gets a different id.
+ * The stable local context id for one actor in one store, from the store's own
+ * context registry (`<home>/contexts.json`).
+ *
+ * The id is cryptographically random (128 bits) and minted the first time the
+ * actor is addressed, never derived from a name or from the canonical tuple:
+ * an id reveals nothing about its target and cannot be guessed. It survives
+ * renames and moving the store (the registry moves with it), and an unrelated
+ * store with a same-named agent has its own registry and so its own id.
+ * Minting is serialized across processes so two harnesses opening the store
+ * at once agree on one id.
  */
-export function localContextId(storeWorkspaceId, actor) {
-    const digest = createHash('sha256')
-        .update(`${storeWorkspaceId}\0${actor.kind}\0${actor.id}`)
-        .digest('hex');
-    return `lctx_${digest.slice(0, 24)}`;
+export function localContextId(home, actor) {
+    const path = join(home, 'contexts.json');
+    const key = `${actor.kind}:${actor.id}`;
+    const existing = readRegistry(path).contexts[key];
+    if (existing)
+        return existing;
+    return withRegistryLock(home, () => {
+        const registry = readRegistry(path);
+        const current = registry.contexts[key];
+        if (current)
+            return current;
+        const id = `lctx_${randomBytes(16).toString('hex')}`;
+        registry.contexts[key] = id;
+        atomicWriteFile(path, `${JSON.stringify(registry, null, 2)}\n`, 0o600);
+        return id;
+    });
+}
+function readRegistry(path) {
+    if (!existsSync(path))
+        return { version: 1, contexts: {} };
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        if (parsed.version === 1 && parsed.contexts && typeof parsed.contexts === 'object') {
+            return { version: 1, contexts: { ...parsed.contexts } };
+        }
+    }
+    catch {
+        /* fall through */
+    }
+    throw new SynomemError('CONFIG_INVALID', `${path} is not a valid Synomem context registry.`);
+}
+/** A short synchronous O_EXCL lock; a dead or old owner is broken. */
+function withRegistryLock(home, operation) {
+    const lock = join(home, 'contexts.json.lock');
+    const deadline = Date.now() + 10_000;
+    const sleeper = new Int32Array(new SharedArrayBuffer(4));
+    for (;;) {
+        try {
+            const descriptor = openSync(lock, 'wx', 0o600);
+            writeSync(descriptor, `${process.pid}\n`);
+            closeSync(descriptor);
+            break;
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            try {
+                const pid = Number(readFileSync(lock, 'utf8').trim());
+                const old = Date.now() - statSync(lock).mtimeMs > 5_000;
+                let alive = Number.isSafeInteger(pid) && pid > 0;
+                if (alive) {
+                    try {
+                        process.kill(pid, 0);
+                    }
+                    catch (probe) {
+                        alive = probe.code === 'EPERM';
+                    }
+                }
+                if (!alive || old)
+                    rmSync(lock, { force: true });
+            }
+            catch {
+                /* released meanwhile */
+            }
+            if (Date.now() > deadline) {
+                throw new SynomemError('DATABASE_BUSY', 'The local context registry is locked. Try again.');
+            }
+            Atomics.wait(sleeper, 0, 0, 20);
+        }
+    }
+    try {
+        return operation();
+    }
+    finally {
+        rmSync(lock, { force: true });
+    }
 }
 /**
  * A remote (hosted API) resolver over one credential.
@@ -194,7 +275,7 @@ export function createLocalResolver(options) {
             return {
                 service: client,
                 context: {
-                    contextId: localContextId(capabilities.binding.workspaceId, actor),
+                    contextId: localContextId(options.home, actor),
                     organizationId: null,
                     workspaceId: capabilities.binding.workspaceId,
                     actor,

package/dist/resolvers.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolvers.js","sourceRoot":"","sources":["../src/resolvers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AA6B/D,wFAAwF;AACxF,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC;AAEzC,MAAM,YAAY,GAAG,MAAM,CAAC;AAE5B,SAAS,SAAS,CAAC,SAA6B;IAC9C,MAAM,KAAK,GAAG,SAAS,EAAE,IAAI,EAAE,CAAC;IAChC,OAAO,CAAC,KAAK,IAAI,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AACjE,CAAC;AAED,SAAS,SAAS;IAChB,2EAA2E;IAC3E,6EAA6E;IAC7E,OAAO,IAAI,YAAY,CACrB,mBAAmB,EACnB,uGAAuG,CACxG,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,IAAI,YAAY,CACrB,kBAAkB,EAClB,kKAAkK,CACnK,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,gBAAwB,EAAE,KAAoB;IAC3E,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,GAAG,gBAAgB,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,EAAE,CAAC;SACzD,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,QAAQ,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAMpC;IACC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,iBAAiB,EAAE,MAAM;QAC/C,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACpC,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,MAA2D,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyC,CAAC;IAElE,MAAM,WAAW,GAAG,KAAK,IAAqB,EAAE;QAC9C,MAAM,KAAK,GAAG,MAAM,MAAM,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,4CAA4C,CAAC,CAAC;QACxF,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,KAAK,EAAE,KAAK,GAAG,KAAK,EAA2B,EAAE;QACrE,IAAI,CAAC,KAAK,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,YAAY;YAAE,OAAO,MAAM,CAAC,OAAO,CAAC;QACrF,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC;YACrC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,WAAW,EAAE,MAAM,WAAW,EAAE;YAChC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnD,CAAC,CAAC;QACH,MAAM,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACrC,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,OAAuB,EAAkB,EAAE;QAC1D,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,cAAc,EAAE,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC;gBACxE,UAAU,EAAE,IAAI;aACjB,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,cAAc,EAAE,IAAI;gBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC1E,UAAU,EAAE,IAAI;aACjB,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,KAAK,EAAE,SAAiB,EAA2B,EAAE;QACtE,IAAI,KAAK,GAAG,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QAC5F,sFAAsF;QACtF,kDAAkD;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,MAAM,SAAS,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,OAAuB,EAAiC,EAAE;QAC5E,IAAI,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;gBACpB,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC;oBACvC,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACnD,CAAC,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;gBACrB,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC,EAAE,CAAC;YACL,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACzC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO;QACL,IAAI;YACF,IAAI,MAAM;gBAAE,OAAO,OAAO,CAAC;YAC3B,IAAI,OAAO;gBAAE,OAAO,UAAU,CAAC;YAC/B,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAClD,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,SAAS;YACrB,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,MAAc,CAAC;YACnB,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,SAAS,IAAI,SAAS,KAAK,MAAM;oBAAE,MAAM,SAAS,EAAE,CAAC;gBACzD,MAAM,GAAG,MAAM,CAAC;YAClB,CAAC;iBAAM,IAAI,SAAS,EAAE,CAAC;gBACrB,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;oBAAE,MAAM,SAAS,EAAE,CAAC;gBAC1D,MAAM,GAAG,SAAS,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;gBACtC,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,cAAc,IAAI,CAAC,OAAO,EAAE,CAAC;oBACnE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;gBAClC,CAAC;qBAAM,CAAC;oBACN,MAAM,QAAQ,EAAE,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;YAC1C,OAAO;gBACL,OAAO;gBACP,OAAO,EAAE;oBACP,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,KAAK,EAAE,OAAO,CAAC,KAAK;iBACrB;aACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI;YACR,OAAO,OAAO,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,OAAO,MAAM,gBAAgB,CAAC;gBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,WAAW,EAAE,MAAM,WAAW,EAAE;gBAChC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACvC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACpF,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAA8F;IAE9F,IAAI,KAA2C,CAAC;IAChD,MAAM,IAAI,GAAG,GAA6B,EAAE;QAC1C,KAAK,KAAK,CAAC,KAAK,IAAI,EAAE;YACpB,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;YAC3F,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;YACjD,qFAAqF;YACrF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC3B,OAAO;gBACL,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE;oBACP,SAAS,EAAE,cAAc,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC;oBAClE,cAAc,EAAE,IAAI;oBACpB,WAAW,EAAE,YAAY,CAAC,OAAO,CAAC,WAAW;oBAC7C,KAAK;iBACN;aACF,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;QACL,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE;YACf,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO;QACnB,KAAK,CAAC,OAAO,CAAC,SAAS;YACrB,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,SAAS,IAAI,SAAS,KAAK,KAAK,CAAC,OAAO,CAAC,SAAS;gBAAE,MAAM,SAAS,EAAE,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,CAAC,IAAI;YACR,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;YACjC,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,cAAc,EAAE,OAAO,CAAC,SAAS;gBACjC,QAAQ,EAAE;oBACR;wBACE,SAAS,EAAE,OAAO,CAAC,SAAS;wBAC5B,cAAc,EAAE,IAAI;wBACpB,WAAW,EAAE,OAAO,CAAC,WAAW;wBAChC,KAAK,EAAE,OAAO,CAAC,KAAK;wBACpB,OAAO,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;wBAC1C,MAAM,EAAE,OAAO;qBAChB;iBACF;gBACD,UAAU,EAAE,IAAI;aACjB,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;YACjC,OAAO;gBACL,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE;gBACxB,cAAc,EAAE,IAAI;gBACpB,UAAU,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE;gBAC/D,KAAK,EAAE,IAAI;gBACX,cAAc,EAAE,OAAO,CAAC,SAAS;gBACjC,gBAAgB,EAAE,OAAO;aAC1B,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,OAAO,GAAG,KAAK,CAAC;YACtB,KAAK,GAAG,SAAS,CAAC;YAClB,IAAI,OAAO;gBAAE,MAAM,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAC7E,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"resolvers.js","sourceRoot":"","sources":["../src/resolvers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,SAAS,EACT,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,MAAM,EACN,QAAQ,EACR,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AA6B/D,wFAAwF;AACxF,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC;AAEzC,MAAM,YAAY,GAAG,MAAM,CAAC;AAE5B,SAAS,SAAS,CAAC,SAA6B;IAC9C,MAAM,KAAK,GAAG,SAAS,EAAE,IAAI,EAAE,CAAC;IAChC,OAAO,CAAC,KAAK,IAAI,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AACjE,CAAC;AAED,SAAS,SAAS;IAChB,2EAA2E;IAC3E,6EAA6E;IAC7E,OAAO,IAAI,YAAY,CACrB,mBAAmB,EACnB,uGAAuG,CACxG,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,IAAI,YAAY,CACrB,kBAAkB,EAClB,kKAAkK,CACnK,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,KAAoB;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE;QACjC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,MAAM,EAAE,GAAG,QAAQ,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QAC5B,eAAe,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvE,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAOD,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA6B,CAAC;QAClF,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACnF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;IACD,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,GAAG,IAAI,2CAA2C,CAAC,CAAC;AAC/F,CAAC;AAED,sEAAsE;AACtE,SAAS,gBAAgB,CAAI,IAAY,EAAE,SAAkB;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,SAAS,CAAC;QACR,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC/C,SAAS,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YAC1C,SAAS,CAAC,UAAU,CAAC,CAAC;YACtB,MAAM;QACR,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACpE,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC;gBACxD,IAAI,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;gBACjD,IAAI,KAAK,EAAE,CAAC;oBACV,IAAI,CAAC;wBACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;oBACvB,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,KAAK,GAAI,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;oBAC5D,CAAC;gBACH,CAAC;gBACD,IAAI,CAAC,KAAK,IAAI,GAAG;oBAAE,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,kDAAkD,CAAC,CAAC;YAC9F,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,SAAS,EAAE,CAAC;IACrB,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAMpC;IACC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,iBAAiB,EAAE,MAAM;QAC/C,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACpC,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,MAA2D,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyC,CAAC;IAElE,MAAM,WAAW,GAAG,KAAK,IAAqB,EAAE;QAC9C,MAAM,KAAK,GAAG,MAAM,MAAM,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,4CAA4C,CAAC,CAAC;QACxF,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,KAAK,EAAE,KAAK,GAAG,KAAK,EAA2B,EAAE;QACrE,IAAI,CAAC,KAAK,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,YAAY;YAAE,OAAO,MAAM,CAAC,OAAO,CAAC;QACrF,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC;YACrC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,WAAW,EAAE,MAAM,WAAW,EAAE;YAChC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnD,CAAC,CAAC;QACH,MAAM,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACrC,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,OAAuB,EAAkB,EAAE;QAC1D,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,cAAc,EAAE,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC;gBACxE,UAAU,EAAE,IAAI;aACjB,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,cAAc,EAAE,IAAI;gBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC1E,UAAU,EAAE,IAAI;aACjB,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,KAAK,EAAE,SAAiB,EAA2B,EAAE;QACtE,IAAI,KAAK,GAAG,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QAC5F,sFAAsF;QACtF,kDAAkD;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,MAAM,SAAS,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,OAAuB,EAAiC,EAAE;QAC5E,IAAI,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;gBACpB,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC;oBACvC,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACnD,CAAC,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;gBACrB,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC,EAAE,CAAC;YACL,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACzC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO;QACL,IAAI;YACF,IAAI,MAAM;gBAAE,OAAO,OAAO,CAAC;YAC3B,IAAI,OAAO;gBAAE,OAAO,UAAU,CAAC;YAC/B,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAClD,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,SAAS;YACrB,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,MAAc,CAAC;YACnB,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,SAAS,IAAI,SAAS,KAAK,MAAM;oBAAE,MAAM,SAAS,EAAE,CAAC;gBACzD,MAAM,GAAG,MAAM,CAAC;YAClB,CAAC;iBAAM,IAAI,SAAS,EAAE,CAAC;gBACrB,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;oBAAE,MAAM,SAAS,EAAE,CAAC;gBAC1D,MAAM,GAAG,SAAS,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;gBACtC,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,cAAc,IAAI,CAAC,OAAO,EAAE,CAAC;oBACnE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;gBAClC,CAAC;qBAAM,CAAC;oBACN,MAAM,QAAQ,EAAE,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;YAC1C,OAAO;gBACL,OAAO;gBACP,OAAO,EAAE;oBACP,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,KAAK,EAAE,OAAO,CAAC,KAAK;iBACrB;aACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI;YACR,OAAO,OAAO,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,OAAO,MAAM,gBAAgB,CAAC;gBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,WAAW,EAAE,MAAM,WAAW,EAAE;gBAChC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACvC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACpF,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAA8F;IAE9F,IAAI,KAA2C,CAAC;IAChD,MAAM,IAAI,GAAG,GAA6B,EAAE;QAC1C,KAAK,KAAK,CAAC,KAAK,IAAI,EAAE;YACpB,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;YAC3F,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;YACjD,qFAAqF;YACrF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC3B,OAAO;gBACL,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE;oBACP,SAAS,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;oBAC9C,cAAc,EAAE,IAAI;oBACpB,WAAW,EAAE,YAAY,CAAC,OAAO,CAAC,WAAW;oBAC7C,KAAK;iBACN;aACF,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;QACL,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE;YACf,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO;QACnB,KAAK,CAAC,OAAO,CAAC,SAAS;YACrB,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,SAAS,IAAI,SAAS,KAAK,KAAK,CAAC,OAAO,CAAC,SAAS;gBAAE,MAAM,SAAS,EAAE,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,CAAC,IAAI;YACR,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;YACjC,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,cAAc,EAAE,OAAO,CAAC,SAAS;gBACjC,QAAQ,EAAE;oBACR;wBACE,SAAS,EAAE,OAAO,CAAC,SAAS;wBAC5B,cAAc,EAAE,IAAI;wBACpB,WAAW,EAAE,OAAO,CAAC,WAAW;wBAChC,KAAK,EAAE,OAAO,CAAC,KAAK;wBACpB,OAAO,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;wBAC1C,MAAM,EAAE,OAAO;qBAChB;iBACF;gBACD,UAAU,EAAE,IAAI;aACjB,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;YACjC,OAAO;gBACL,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE;gBACxB,cAAc,EAAE,IAAI;gBACpB,UAAU,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE;gBAC/D,KAAK,EAAE,IAAI;gBACX,cAAc,EAAE,OAAO,CAAC,SAAS;gBACjC,gBAAgB,EAAE,OAAO;aAC1B,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,OAAO,GAAG,KAAK,CAAC;YACtB,KAAK,GAAG,SAAS,CAAC;YAClB,IAAI,OAAO;gBAAE,MAAM,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAC7E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "synomem",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "Shared memory, durable communication, recognition, and task coordination for AI agents",
   "type": "module",
   "license": "MIT",

package/src/cli.ts

@@ -4,12 +4,7 @@ import { spawn } from 'node:child_process';
 import { join, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { Command, CommanderError, Option } from 'commander';
-import {
-  ensureLocalStore,
-  LOCAL_OPERATOR,
-  localStoreWorkspaceId,
-  openLocalService,
-} from './backend.js';
+import { ensureLocalStore, LOCAL_OPERATOR, openLocalService } from './backend.js';
 import { cloudApiUrl } from './cloud.js';
 import { resolveHome } from './config.js';
 import {
@@ -509,7 +504,7 @@ export function createCli(io: CliIo = defaultIo, dependencies: CliDependencies =
         if (!handle) throw new SynomemError('INVALID_INPUT', 'An agent handle is required.');
         const profileName = assertName(options.profileName ?? handle, 'profile');
         const store = profileStoreFor(global.home);
-        const storeConfig = ensureLocalStore(global.home);
+        ensureLocalStore(global.home);
         const config = store.read();
 
         const existing = config.profiles[profileName];
@@ -568,7 +563,7 @@ export function createCli(io: CliIo = defaultIo, dependencies: CliDependencies =
           ...(global.explicitHome ? { home: global.home } : {}),
           actorId: agent.id,
           actorName: agent.displayName,
-          contextId: localContextId(storeConfig.workspaceId, actor),
+          contextId: localContextId(global.home, actor),
         };
         const next: ProfilesConfig = {
           ...config,
@@ -1017,7 +1012,7 @@ export function createCli(io: CliIo = defaultIo, dependencies: CliDependencies =
             ...(storeHome !== global.home ? { home: storeHome } : {}),
             actorId: agent.id,
             actorName: agent.displayName,
-            contextId: localContextId(localStoreWorkspaceId(storeHome), {
+            contextId: localContextId(storeHome, {
               kind: 'agent',
               id: agent.id,
             }),
@@ -1629,7 +1624,7 @@ export function createCli(io: CliIo = defaultIo, dependencies: CliDependencies =
             ...(created.storeHome !== global.home ? { home: created.storeHome } : {}),
             actorId: agent.id,
             actorName: agent.displayName,
-            contextId: localContextId(localStoreWorkspaceId(created.storeHome), {
+            contextId: localContextId(created.storeHome, {
               kind: 'agent',
               id: agent.id,
             }),

package/src/credentials.ts

@@ -21,19 +21,21 @@
  * that names the explicit alternative.
  */
 import { spawn } from 'node:child_process';
-import { randomUUID } from 'node:crypto';
+import { randomBytes, randomUUID } from 'node:crypto';
 import {
   chmodSync,
   closeSync,
   existsSync,
+  linkSync,
   mkdirSync,
   openSync,
   readFileSync,
+  renameSync,
   rmSync,
   statSync,
-  unlinkSync,
   writeSync,
 } from 'node:fs';
+import { hostname } from 'node:os';
 import { join } from 'node:path';
 import { z } from 'zod';
 import { SynomemError } from './errors.js';
@@ -154,7 +156,18 @@ export class OsCredentialStore implements CredentialStore {
 
   constructor(options: { platform?: NodeJS.Platform; run?: CredentialCommandRunner } = {}) {
     this.platform = options.platform ?? process.platform;
-    this.run = options.run ?? command;
+    const run = options.run ?? command;
+    // A missing helper (a headless Linux box with no Secret Service) is a
+    // configuration answer, not a crash: name the explicit alternatives. There
+    // is still no fallback — the caller chooses --store file deliberately.
+    this.run = async (executable, arguments_, input) => {
+      try {
+        return await run(executable, arguments_, input);
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code === 'ENOENT') this.unsupported();
+        throw error;
+      }
+    };
   }
 
   async get(reference: string): Promise<StoredCredential | undefined> {
@@ -235,7 +248,7 @@ export class OsCredentialStore implements CredentialStore {
       'CONFIG_INVALID',
       this.platform === 'win32'
         ? 'Windows Credential Manager storage is not supported yet. Use --store file, or --store environment with SYNOMEM_ACCESS_TOKEN.'
-        : 'Operating-system credential storage needs the macOS Keychain, or secret-tool on Linux. Use --store file, or --store environment with SYNOMEM_ACCESS_TOKEN.',
+        : 'No operating-system credential store is available here (it needs the macOS Keychain, or secret-tool with a Secret Service on Linux). Choose one explicitly: --store file keeps it in a 0600 file under your Synomem home; --store environment reads SYNOMEM_ACCESS_TOKEN.',
     );
   }
 }
@@ -261,6 +274,8 @@ export class FileCredentialStore implements CredentialStore {
   async get(reference: string): Promise<StoredCredential | undefined> {
     const path = this.path(reference);
     if (!existsSync(path)) return undefined;
+    assertPrivate(this.directory, 0o700);
+    assertPrivate(path, 0o600);
     return parseStoredCredential(readFileSync(path, 'utf8'));
   }
 
@@ -282,6 +297,31 @@ export class FileCredentialStore implements CredentialStore {
   }
 }
 
+/*
+ * Like ssh with a private key: a credential file (or its directory) that other
+ * users can read, or that another user owns, is refused rather than used. The
+ * fix is the owner's to make; silently tightening it would hide that the
+ * secret may already have been exposed.
+ */
+function assertPrivate(path: string, expected: number): void {
+  if (process.platform === 'win32') return;
+  const stat = statSync(path);
+  if (typeof process.getuid === 'function' && stat.uid !== process.getuid()) {
+    throw new SynomemError(
+      'CONFIG_INVALID',
+      `${path} is owned by another user; refusing to use it.`,
+    );
+  }
+  if ((stat.mode & 0o077) !== 0) {
+    throw new SynomemError(
+      'CONFIG_INVALID',
+      `${path} is accessible to other users (mode ${(stat.mode & 0o777).toString(8)}). ` +
+        `Run \`chmod ${expected.toString(8)} ${path}\` if you are sure it was not exposed, ` +
+        'otherwise remove it and sign in again.',
+    );
+  }
+}
+
 export interface CredentialStores {
   keychain: CredentialStore;
   file: CredentialStore;
@@ -294,10 +334,19 @@ export function defaultCredentialStores(home: string): CredentialStores {
 /**
  * A cross-process lock around one credential's refresh.
  *
- * `O_EXCL` creation is the mutual exclusion; a lock older than `staleMs` is
- * from a crashed process and is broken. The lock only serializes refreshes —
- * correctness against a concurrent writer is the generation compare-and-swap
- * in `refreshCredential`.
+ * `O_EXCL` creation is the mutual exclusion. The lock file records its owner
+ * (pid, host) and a random token. A lock is broken only when its owner is
+ * provably gone — a dead pid on this host — or, for an owner on another host
+ * or an unreadable file, once it is older than `staleMs`. A live owner is never
+ * preempted however long its refresh takes (the refresh request itself times
+ * out well inside `staleMs`).
+ *
+ * Breaking renames the file aside first and checks the token: if another
+ * process already broke and re-acquired it in between, the fresh lock is put
+ * back rather than deleted. Correctness against a concurrent writer is still
+ * the generation compare-and-swap in the refresh path; the lock exists so that
+ * only one process ever spends a given refresh token. Locks assume one host's
+ * filesystem; a home shared over a network filesystem is not supported.
  */
 export async function withCredentialLock<T>(
   home: string,
@@ -314,22 +363,16 @@ export async function withCredentialLock<T>(
   const staleMs = options.staleMs ?? 60_000;
   const deadline = Date.now() + (options.timeoutMs ?? 30_000);
   const pollMs = options.pollMs ?? 50;
+  const token = randomBytes(16).toString('hex');
+  const host = hostname();
   let descriptor: number | undefined;
   while (descriptor === undefined) {
     try {
       descriptor = openSync(path, 'wx', 0o600);
-      writeSync(descriptor, `${process.pid}\n`);
+      writeSync(descriptor, `${process.pid}\n${host}\n${token}\n`);
     } catch (error) {
       if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;
-      try {
-        if (Date.now() - statSync(path).mtimeMs > staleMs) {
-          unlinkSync(path);
-          continue;
-        }
-      } catch {
-        // Removed between the failed open and the stat: try again at once.
-        continue;
-      }
+      if (breakIfAbandoned(path, host, staleMs)) continue;
       if (Date.now() > deadline) {
         throw new SynomemError(
           'DATABASE_BUSY',
@@ -343,6 +386,70 @@ export async function withCredentialLock<T>(
     return await operation();
   } finally {
     closeSync(descriptor);
-    rmSync(path, { force: true });
+    // Release only our own lock.
+    if (readLock(path)?.token === token) rmSync(path, { force: true });
+  }
+}
+
+interface LockOwner {
+  pid: number;
+  host: string;
+  token: string;
+}
+
+function readLock(path: string): LockOwner | undefined {
+  try {
+    const [pid, host, token] = readFileSync(path, 'utf8').split('\n');
+    const parsed = Number(pid);
+    if (!Number.isSafeInteger(parsed) || !host || !token) return undefined;
+    return { pid: parsed, host, token };
+  } catch {
+    return undefined;
+  }
+}
+
+function processAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    // EPERM: it exists but belongs to someone else — alive.
+    return (error as NodeJS.ErrnoException).code === 'EPERM';
+  }
+}
+
+/** Returns true when the caller should immediately retry acquiring. */
+function breakIfAbandoned(path: string, host: string, staleMs: number): boolean {
+  let age: number;
+  try {
+    age = Date.now() - statSync(path).mtimeMs;
+  } catch {
+    return true; // Released between the failed open and now.
+  }
+  const owner = readLock(path);
+  // A lock whose contents are still being written is fresh, not abandoned.
+  if (!owner && age < 1_000) return false;
+  const abandoned = owner
+    ? owner.host === host
+      ? !processAlive(owner.pid)
+      : age > staleMs
+    : age > staleMs;
+  if (!abandoned) return false;
+  const aside = `${path}.broken-${randomBytes(6).toString('hex')}`;
+  try {
+    renameSync(path, aside);
+  } catch {
+    return true; // Someone else broke or released it first.
+  }
+  const taken = readLock(aside);
+  if (owner && taken?.token !== owner.token) {
+    // We grabbed a lock re-acquired after our inspection: restore it.
+    try {
+      linkSync(aside, path);
+    } catch {
+      /* a third process holds the path now; ours is the one to discard */
+    }
   }
+  rmSync(aside, { force: true });
+  return true;
 }

package/src/oauth.ts

@@ -156,6 +156,20 @@ export async function discoverApiAuthorization(
   };
 }
 
+export const TOKEN_REQUEST_TIMEOUT_MS = 20_000;
+
+/*
+ * Failures that prove the request never reached the server. Anything else — a
+ * timeout, a reset mid-response — may have followed a committed rotation, so
+ * the refresh token it carried must be treated as spent (plan §6: never retry
+ * a possibly consumed token; reauthorize instead).
+ */
+const NOT_SENT = new Set(['ECONNREFUSED', 'ENOTFOUND', 'EAI_AGAIN', 'ENETUNREACH', 'EHOSTUNREACH']);
+function neverDelivered(error: unknown): boolean {
+  const cause = (error as { cause?: { code?: unknown } } | undefined)?.cause;
+  return typeof cause?.code === 'string' && NOT_SENT.has(cause.code);
+}
+
 async function tokenRequest(
   endpoint: string,
   parameters: URLSearchParams,
@@ -168,10 +182,15 @@ async function tokenRequest(
       redirect: 'error',
       headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
       body: parameters,
+      // Well inside the credential lock's stale window, so a refresh can never
+      // outlive the lock that serializes it.
+      signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS),
     });
   } catch (error) {
     if (error instanceof SynomemError) throw error;
-    throw new SynomemError('REMOTE_UNAVAILABLE', 'The OAuth token endpoint is unavailable.');
+    throw new SynomemError('REMOTE_UNAVAILABLE', 'The OAuth token endpoint is unavailable.', {
+      delivery: neverDelivered(error) ? 'not_sent' : 'indeterminate',
+    });
   }
   const text = await response.text();
   if (Buffer.byteLength(text) > maximumDocumentBytes) {

package/src/profiles.ts

@@ -27,7 +27,7 @@
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { z } from 'zod';
-import { localStoreWorkspaceId, readSynomemConfig } from './backend.js';
+import { readSynomemConfig } from './backend.js';
 import { resolveHome } from './config.js';
 import {
   withCredentialLock,
@@ -96,7 +96,7 @@ const localProfileSchema = z
     home: z.string().optional(),
     actorId: z.string().min(1),
     actorName: z.string().optional(),
-    contextId: z.string().regex(/^lctx_[0-9a-f]{24}$/),
+    contextId: z.string().regex(/^lctx_[0-9a-f]{32}$/),
   })
   .strict();
 
@@ -374,7 +374,24 @@ export class ConnectionCredentialSource implements RemoteCredentialSource {
       try {
         refreshed = await refreshOAuthCredential(current, this.options.fetch ?? fetch);
       } catch (error) {
-        if (error instanceof SynomemError && error.code === 'REMOTE_UNAVAILABLE') throw error;
+        if (
+          error instanceof SynomemError &&
+          error.code === 'REMOTE_UNAVAILABLE' &&
+          error.details?.delivery === 'not_sent'
+        ) {
+          // The refresh token provably never left this machine: safe to retry later.
+          throw error;
+        }
+        // Refused, or delivery unknown (the server may have rotated it): the
+        // stored refresh token is treated as spent and removed, so no process
+        // can replay it and trip reuse detection for the whole family.
+        const withoutRefresh: StoredOAuthCredential = { ...current };
+        delete withoutRefresh.refreshToken;
+        await store.set(entry.secretRef!, {
+          ...withoutRefresh,
+          expiresAt: 0,
+          generation: current.generation + 1,
+        });
         throw this.reauthorize(`Connection ${name} could not be refreshed.`);
       }
       // Compare-and-swap: only this process may have spent the refresh token
@@ -440,7 +457,7 @@ export function localProfileTarget(
     id: profile.actorId,
     ...(profile.actorName ? { displayName: profile.actorName } : {}),
   };
-  const expected = localContextId(localStoreWorkspaceId(home), actor);
+  const expected = localContextId(home, actor);
   if (expected !== profile.contextId) {
     throw new SynomemError(
       'CONTEXT_FORBIDDEN',

package/src/resolvers.ts

@@ -8,7 +8,18 @@
  * each other's attribution. The resolver narrows (pins a context, restricts to a
  * preset); the server alone authorizes.
  */
-import { createHash } from 'node:crypto';
+import { randomBytes } from 'node:crypto';
+import {
+  closeSync,
+  existsSync,
+  openSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeSync,
+} from 'node:fs';
+import { join } from 'node:path';
+import { atomicWriteFile } from './fs-utils.js';
 import { SynomemClient } from './client.js';
 import { describeIdentity, discoverContexts } from './discover.js';
 import { SynomemError } from './errors.js';
@@ -68,15 +79,90 @@ function required(): SynomemError {
 }
 
 /**
- * Stable local context id: derived from the store's persistent workspace id and the
- * canonical actor — never from a display name — so it survives renames and moving the
- * store, and an unrelated store with a same-named agent gets a different id.
+ * The stable local context id for one actor in one store, from the store's own
+ * context registry (`<home>/contexts.json`).
+ *
+ * The id is cryptographically random (128 bits) and minted the first time the
+ * actor is addressed, never derived from a name or from the canonical tuple:
+ * an id reveals nothing about its target and cannot be guessed. It survives
+ * renames and moving the store (the registry moves with it), and an unrelated
+ * store with a same-named agent has its own registry and so its own id.
+ * Minting is serialized across processes so two harnesses opening the store
+ * at once agree on one id.
  */
-export function localContextId(storeWorkspaceId: string, actor: ActorIdentity): string {
-  const digest = createHash('sha256')
-    .update(`${storeWorkspaceId}\0${actor.kind}\0${actor.id}`)
-    .digest('hex');
-  return `lctx_${digest.slice(0, 24)}`;
+export function localContextId(home: string, actor: ActorIdentity): string {
+  const path = join(home, 'contexts.json');
+  const key = `${actor.kind}:${actor.id}`;
+  const existing = readRegistry(path).contexts[key];
+  if (existing) return existing;
+  return withRegistryLock(home, () => {
+    const registry = readRegistry(path);
+    const current = registry.contexts[key];
+    if (current) return current;
+    const id = `lctx_${randomBytes(16).toString('hex')}`;
+    registry.contexts[key] = id;
+    atomicWriteFile(path, `${JSON.stringify(registry, null, 2)}\n`, 0o600);
+    return id;
+  });
+}
+
+interface ContextRegistry {
+  version: 1;
+  contexts: Record<string, string>;
+}
+
+function readRegistry(path: string): ContextRegistry {
+  if (!existsSync(path)) return { version: 1, contexts: {} };
+  try {
+    const parsed = JSON.parse(readFileSync(path, 'utf8')) as Partial<ContextRegistry>;
+    if (parsed.version === 1 && parsed.contexts && typeof parsed.contexts === 'object') {
+      return { version: 1, contexts: { ...parsed.contexts } };
+    }
+  } catch {
+    /* fall through */
+  }
+  throw new SynomemError('CONFIG_INVALID', `${path} is not a valid Synomem context registry.`);
+}
+
+/** A short synchronous O_EXCL lock; a dead or old owner is broken. */
+function withRegistryLock<T>(home: string, operation: () => T): T {
+  const lock = join(home, 'contexts.json.lock');
+  const deadline = Date.now() + 10_000;
+  const sleeper = new Int32Array(new SharedArrayBuffer(4));
+  for (;;) {
+    try {
+      const descriptor = openSync(lock, 'wx', 0o600);
+      writeSync(descriptor, `${process.pid}\n`);
+      closeSync(descriptor);
+      break;
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;
+      try {
+        const pid = Number(readFileSync(lock, 'utf8').trim());
+        const old = Date.now() - statSync(lock).mtimeMs > 5_000;
+        let alive = Number.isSafeInteger(pid) && pid > 0;
+        if (alive) {
+          try {
+            process.kill(pid, 0);
+          } catch (probe) {
+            alive = (probe as NodeJS.ErrnoException).code === 'EPERM';
+          }
+        }
+        if (!alive || old) rmSync(lock, { force: true });
+      } catch {
+        /* released meanwhile */
+      }
+      if (Date.now() > deadline) {
+        throw new SynomemError('DATABASE_BUSY', 'The local context registry is locked. Try again.');
+      }
+      Atomics.wait(sleeper, 0, 0, 20);
+    }
+  }
+  try {
+    return operation();
+  } finally {
+    rmSync(lock, { force: true });
+  }
 }
 
 /**
@@ -240,7 +326,7 @@ export function createLocalResolver(
       return {
         service: client,
         context: {
-          contextId: localContextId(capabilities.binding.workspaceId, actor),
+          contextId: localContextId(options.home, actor),
           organizationId: null,
           workspaceId: capabilities.binding.workspaceId,
           actor,