Module context 

Local connection context: which bus, as whom, for which project.

Every client-side entry point — the console client, the stdio proxy, the lifecycle hooks — answers the same question before it can talk to the bus: which endpoint, with which token, expected to be which agent of which team, working on which project? This module answers it once, from three local sources and one explicit override, in a fixed order:

1. Explicit credentials — --token / BUS_TOKEN (with --url / BUS_URL). The operator said exactly what to use; nothing below may override it. A project file still contributes metadata (project name, channel), never credentials.
2. Explicit profile — --profile / BUS_PROFILE. Must exist in the local profile store; a missing profile is an error, never a fallback.
3. Project defaults — .acs.toml at the project root names an approved profile and a logical project. The repository is untrusted: it may only name a profile that the operator defined locally, and it may never carry an endpoint or a credential. A name that does not resolve locally is an error, not a different team.
4. User default — default = "…" in the profile store.

Profiles live in <config dir>/profiles.toml and carry the endpoint, the expected team and agent, and a reference to a credential: the name of a tokens-<team> file (the same name=token files admin token issue --save writes) and, optionally, which entry. The secret itself is read at resolve time and never stored twice.

Nothing here logs; Resolved::redacted is what context show prints.

Re-exports

pub use crate::admin_cli::config_dir;

pub use crate::admin_cli::write_private;

Structs

Binding

What the proxy of this conversation recorded: which profile, project and role it settled on. Advisory — a hook works without it, just with less.

Inputs

Profile

An operator-approved way to reach a bus: endpoint, expected identity and where the credential lives. Never contains the secret.

Profiles

ProjectConfig

What a repository may say about itself. Names only: it references an approved profile, it never defines one. deny_unknown_fields on purpose: this file comes from a repository, so an unrecognised key is a claim we do not understand, not a comment. A tolerated token_file = that silently did nothing would be indistinguishable from one that worked.

Resolved

The answer. token is the secret and the only field Self::redacted hides.

Verified

What the server says the credential is.

Enums

LocalOutcome

What keep_project_file_local did.

Origin

Everything a caller can say. Each field is None when not given; the binary fills them from flags and environment, tests fill them directly. Where an explicit value physically came from. Provenance for humans debugging an upgrade, never an authorization signal: precedence is decided by resolve exactly as before, whatever the origin.

Source

Which rule produced the credentials.

Constants

BASE_KEY

Entry used when a project has no entry of its own in a tokens file.

BINDINGS_DIR

Directory holding one record per live conversation. Mode 0700: it is the only place a session credential is written, and context hook is the only thing that reads one.

CODEX_THREAD_BINDING

The binding source that proves a record’s key is a Codex thread id.

DEFAULT_MCP_URL

Default MCP endpoint, kept from the console client’s original default.

PROFILES_FILE

PROJECT_FILE

Functions

binding_key

Key of the binding record a proxy writes for its conversation.

binding_path

find_project

The project a directory belongs to: the nearest ancestor holding .acs.toml. A linked git worktree that has no file of its own inherits the main worktree’s, so one checked-in file covers every worktree of the repository.

keep_project_file_local

Keep the project file out of git: list it in the repository’s info/exclude (shared by linked worktrees). It names profiles from each person’s own profiles.toml, so a committed copy only works for a team whose members all use the same profile names; local is the default. Idempotent when callers serialise it (set-project holds the configuration lock across the check and the append). An exclude never hides a file git already tracks; see project_file_is_tracked.

load_profiles

parse_project_file

project_file_is_tracked

Whether git already tracks the project file at root, which an exclude cannot undo. None when git is not available to ask.

read_binding

resolve

Resolve the connection context. See the module docs for the order.

save_profiles

session_for_host

The bus session a conversation id maps to. Pure and deterministic, so every process of that conversation agrees without coordinating: this is the handshake, not a file.

update_profiles

Read-modify-write a profile store under the lock.

validate_name

A profile name is one safe word: it is a file key people type and a value a repository may reference.

validate_tokens_ref

A tokens file reference stays inside the configuration directory: a bare name, no separators, no traversal.

verify

Present the resolved credential to the bus and require it to be the agent and team the profile expects. Explicit credentials, which promise nothing, are simply reported.

with_config_lock

Serialise every write to the configuration directory through one lock, so two context profile add or two --save running at once cannot interleave a read-modify-write. The lock file itself is empty.

write_binding_file

Write a binding record: 0700 directory, 0600 file, atomic replace.

write_project_file