@mnemom/mnemom 0.14.0 → 0.14.2

package/dist/commands/agents.js

@@ -1,14 +1,24 @@
 import { createHash } from "node:crypto";
-import { listOrgAgents, listMyOrgs, getAgentByName, claimAgent, MnemomApiError, } from "../lib/api.js";
+import { listAgents, listOrgAgents, listMyOrgs, getAgentByName, claimAgent, MnemomApiError, } from "../lib/api.js";
 import { requireAuth } from "../lib/auth.js";
 import { fmt } from "../lib/format.js";
 export async function agentsListCommand(options = {}) {
-    await requireAuth();
+    const cred = await requireAuth();
     console.log(fmt.header("Agents"));
     console.log();
+    // API keys are agent-scoped, not user/org-scoped. --org requires a session to
+    // resolve org membership; route the key to the compatible endpoint instead so
+    // a valid key is never reported as unauthenticated.
+    if (cred.type === "api-key" && options.org) {
+        console.log(fmt.warn("API keys can't filter by org — org membership is a session concept.") + "\n");
+        console.log(fmt.dim("  To list org-scoped agents, log in with a session: mnemom login") + "\n");
+        return;
+    }
+    // Show the Org column only when a JWT session aggregates across all orgs.
+    const showOrg = cred.type === "jwt" && !options.org;
     let agents;
     try {
-        agents = await listOrgAgents(options.org);
+        agents = cred.type === "api-key" ? await listAgents() : await listOrgAgents(options.org);
     }
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
@@ -19,8 +29,6 @@ export async function agentsListCommand(options = {}) {
         console.log(options.org ? `  No agents found in org '${options.org}'.\n` : "  No agents found.\n");
         return;
     }
-    // Show the Org column only when aggregating across orgs; with --org it's redundant.
-    const showOrg = !options.org;
     const nameW = 24;
     const idW = 40;
     const seenW = 14;

package/dist/commands/logs.js

@@ -1,5 +1,5 @@
-import { resolveAgentId, getTraces, MnemomApiError } from "../lib/api.js";
-import { getGatewayUrl } from "../lib/config.js";
+import { resolveAgentId, getTraces, MnemomApiError, } from "../lib/api.js";
+import { getGatewayUrl, getWebsiteUrl } from "../lib/config.js";
 import { fmt } from "../lib/format.js";
 export async function logsCommand(options = {}) {
     const agentId = await resolveAgentId(options.agentName);
@@ -20,7 +20,7 @@ export async function logsCommand(options = {}) {
             displayTrace(trace);
         }
         console.log(`\nView more: mnemom logs --limit ${limit + 10}`);
-        console.log(`Dashboard: https://mnemon.ai/dashboard/${agentId}\n`);
+        console.log(`Dashboard: ${getWebsiteUrl()}/agents/${agentId}\n`);
     }
     catch (error) {
         // A 404 means the agent isn't registered yet — treat as the empty state.
@@ -60,9 +60,36 @@ function displayTrace(trace) {
         console.log(`  ${fmt.label("Reason:", ` ${preview}`)}`);
     }
     if (trace.verification && trace.verification.violations.length > 0) {
-        console.log(`  ${fmt.label("Issues:", ` ${trace.verification.violations.join(", ")}`)}`);
+        const issues = trace.verification.violations.map(formatViolation).join("; ");
+        console.log(`  ${fmt.label("Issues:", ` ${issues}`)}`);
     }
 }
+/**
+ * Render a single policy violation as a readable one-line string.
+ *
+ * The wire shape is an object ({type,tool,severity,reason} — canonical
+ * `PolicyViolation`); a naive `.join(", ")` string-coerces each to
+ * "[object Object]". We compose only the fields that are present, e.g.
+ * "[high] forbidden — write_file: tool not in capability set", and tolerate a
+ * bare-string element (legacy/forward compatibility) by returning it verbatim.
+ */
+function formatViolation(v) {
+    if (typeof v === "string")
+        return v;
+    let line = "";
+    if (v.severity)
+        line += `[${v.severity}] `;
+    if (v.type)
+        line += v.type;
+    if (v.tool)
+        line += `${v.type ? " — " : ""}${v.tool}`;
+    if (v.reason)
+        line += `${v.type || v.tool ? ": " : ""}${v.reason}`;
+    const out = line.trim();
+    // Fall back to a structured dump only if no known field was present, so we
+    // never silently emit an empty Issues entry or "[object Object]".
+    return out || JSON.stringify(v);
+}
 function formatTimestamp(iso) {
     try {
         const date = new Date(iso);

package/dist/commands/status.js

@@ -1,8 +1,7 @@
-import { getGatewayUrl } from "../lib/config.js";
+import { getGatewayUrl, getWebsiteUrl } from "../lib/config.js";
 import { resolveAgentId, getAgent, getIntegrity, getTraces, MnemomApiError } from "../lib/api.js";
 import { isLoggedIn, getAuthInfo } from "../lib/auth.js";
 import { fmt } from "../lib/format.js";
-const DASHBOARD_URL = "https://mnemom.ai";
 export async function statusCommand(agentName) {
     console.log(fmt.header("mnemom status"));
     console.log();
@@ -31,7 +30,7 @@ export async function statusCommand(agentName) {
     console.log();
     console.log(fmt.label("Agent ID: ", agentId));
     console.log(fmt.label("Gateway:  ", gatewayUrl));
-    console.log(fmt.label("Dashboard:", ` ${DASHBOARD_URL}/agents/${agentId}`));
+    console.log(fmt.label("Dashboard:", ` ${getWebsiteUrl()}/agents/${agentId}`));
     // Trace summary if API connectivity is healthy
     if (apiCheck.status === "ok") {
         await showTraceSummary(agentId);

package/dist/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { pathToFileURL } from "node:url";
 import { program } from "commander";
+import { isEntrypoint } from "./lib/entrypoint.js";
 import { CLI_VERSION } from "./version.js";
 import { statusCommand } from "./commands/status.js";
 import { integrityCommand } from "./commands/integrity.js";
@@ -1326,8 +1326,8 @@ program
 // statically introspect the command surface WITHOUT executing the CLI.
 export { program };
 // Parse argv only when invoked as the CLI entrypoint — not when imported.
-// (ESM has no `require.main`; compare this module's URL to argv[1].)
-const invokedDirectly = process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.argv[1]).href;
-if (invokedDirectly) {
+// The symlink-safe guard lives in ./lib/entrypoint so it can be unit-tested
+// without executing this module's top-level parse().
+if (isEntrypoint(import.meta.url, process.argv[1])) {
     program.parse();
 }

package/dist/lib/api.d.ts

@@ -72,7 +72,19 @@ export interface IntegrityScore {
  * reasoning, tool_name } — none of which the wire emits. `mnemom logs` rendered
  * every action as "[object Object]" and flagged EVERY trace as [VIOLATION]
  * (undefined `verified` is falsy). Field names + nesting now match the wire.
+ *
+ * `verification.violations` elements are OBJECTS ({type,tool,severity,reason}),
+ * not strings — produced by the observer/gateway mappers (canonical
+ * `PolicyViolation` in shared/policy-engine). A prior pass corrected `action`'s
+ * nesting but left `violations` mistyped, which re-introduced "[object Object]"
+ * on the Issues line. All fields are optional here for forward/backward tolerance.
  */
+export interface TraceViolation {
+    type?: string;
+    tool?: string;
+    severity?: string;
+    reason?: string;
+}
 export interface Trace {
     trace_id: string;
     agent_id: string;
@@ -90,7 +102,7 @@ export interface Trace {
     };
     verification: {
         verified: boolean;
-        violations: string[];
+        violations: TraceViolation[];
     } | null;
     created_at?: string;
 }
@@ -208,11 +220,11 @@ export interface AgentListItem {
     key_prefix?: string | null;
 }
 /**
- * @deprecated Legacy per-user listing — `GET /v1/agents` is scoped by the
- * caller's `claimed_by` rows, which ADR-062 retired as an authorization /
- * listing boundary (org_id is now the sole boundary). New code must list via
- * {@link listOrgAgents} (org-scoped). Retained only for back-compat callers;
- * the `mnemom agents` command and name resolution no longer use it.
+ * Key-compatible agent listing — `GET /v1/agents` is scoped by the caller's
+ * `claimed_by` rows (the pre-ADR-062 boundary). JWT callers should prefer
+ * {@link listOrgAgents} (org-scoped, the ADR-062 canonical boundary).
+ * API-key callers use this path because the org-scoped route rejects API keys;
+ * routing here avoids the false "Not authenticated" error (MNE-194 F10).
  */
 export declare function listAgents(): Promise<AgentListItem[]>;
 export interface OrgListItem {

package/dist/lib/api.js

@@ -206,11 +206,11 @@ export async function getAgent(id) {
     return fetchApi(`/v1/agents/${id}`);
 }
 /**
- * @deprecated Legacy per-user listing — `GET /v1/agents` is scoped by the
- * caller's `claimed_by` rows, which ADR-062 retired as an authorization /
- * listing boundary (org_id is now the sole boundary). New code must list via
- * {@link listOrgAgents} (org-scoped). Retained only for back-compat callers;
- * the `mnemom agents` command and name resolution no longer use it.
+ * Key-compatible agent listing — `GET /v1/agents` is scoped by the caller's
+ * `claimed_by` rows (the pre-ADR-062 boundary). JWT callers should prefer
+ * {@link listOrgAgents} (org-scoped, the ADR-062 canonical boundary).
+ * API-key callers use this path because the org-scoped route rejects API keys;
+ * routing here avoids the false "Not authenticated" error (MNE-194 F10).
  */
 export async function listAgents() {
     const url = validateUrl(`${API_BASE}/v1/agents?limit=100`);

package/dist/lib/entrypoint.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Decide whether the current module is being run as the CLI entrypoint
+ * (so it should `program.parse()`) rather than merely imported.
+ *
+ * ESM has no `require.main`, so we compare this module's URL to argv[1].
+ * The catch: npm installs the global bin as a SYMLINK
+ * (…/bin/mnemom → …/dist/index.js). When invoked through that symlink Node
+ * sets `process.argv[1]` to the symlink path while `import.meta.url` is the
+ * real resolved file — so a naive comparison never matches and the CLI
+ * silently no-ops. Canonicalize argv[1] with `realpathSync` before comparing
+ * so the symlinked global bin and the real path both resolve to the same URL.
+ *
+ * `realpathSync` is wrapped in try/catch because argv[1] may be missing or
+ * point at a path that no longer exists (ENOENT); in that case we return
+ * `false` to preserve the safe default of not auto-running.
+ */
+export declare function isEntrypoint(moduleUrl: string, argv1: string | undefined): boolean;

package/dist/lib/entrypoint.js

@@ -0,0 +1,28 @@
+import { realpathSync } from "node:fs";
+import { pathToFileURL } from "node:url";
+/**
+ * Decide whether the current module is being run as the CLI entrypoint
+ * (so it should `program.parse()`) rather than merely imported.
+ *
+ * ESM has no `require.main`, so we compare this module's URL to argv[1].
+ * The catch: npm installs the global bin as a SYMLINK
+ * (…/bin/mnemom → …/dist/index.js). When invoked through that symlink Node
+ * sets `process.argv[1]` to the symlink path while `import.meta.url` is the
+ * real resolved file — so a naive comparison never matches and the CLI
+ * silently no-ops. Canonicalize argv[1] with `realpathSync` before comparing
+ * so the symlinked global bin and the real path both resolve to the same URL.
+ *
+ * `realpathSync` is wrapped in try/catch because argv[1] may be missing or
+ * point at a path that no longer exists (ENOENT); in that case we return
+ * `false` to preserve the safe default of not auto-running.
+ */
+export function isEntrypoint(moduleUrl, argv1) {
+    if (argv1 === undefined)
+        return false;
+    try {
+        return pathToFileURL(realpathSync(argv1)).href === moduleUrl;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/smoltbot-shim.js

@@ -2,6 +2,9 @@
 // smoltbot is deprecated — this shim prints a warning then hands off to mnemom
 process.stderr.write("\n⚠️  The smoltbot command is deprecated. Use mnemom instead.\n" +
     "   Install: npm install -g @mnemom/mnemom\n\n");
-// Dynamic import runs index.ts which calls program.parse(process.argv) automatically
-await import("./index.js");
+// argv[1] here is the smoltbot bin path, so index.js's entrypoint guard never
+// fires (it resolves to dist/index.js, not this shim). Import the assembled
+// program and call parse() explicitly instead of relying on its auto-parse.
+const { program } = await import("./index.js");
+program.parse(process.argv);
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemom/mnemom",
-  "version": "0.14.0",
+  "version": "0.14.2",
   "description": "Transparent AI agent tracing",
   "type": "module",
   "bin": {