@mnemom/mnemom 0.14.1 → 0.14.3

package/dist/commands/agents.js

@@ -1,14 +1,24 @@
 import { createHash } from "node:crypto";
-import { listOrgAgents, listMyOrgs, getAgentByName, claimAgent, MnemomApiError, } from "../lib/api.js";
+import { listAgents, listOrgAgents, listMyOrgs, getAgentByName, claimAgent, MnemomApiError, } from "../lib/api.js";
 import { requireAuth } from "../lib/auth.js";
 import { fmt } from "../lib/format.js";
 export async function agentsListCommand(options = {}) {
-    await requireAuth();
+    const cred = await requireAuth();
     console.log(fmt.header("Agents"));
     console.log();
+    // API keys are agent-scoped, not user/org-scoped. --org requires a session to
+    // resolve org membership; route the key to the compatible endpoint instead so
+    // a valid key is never reported as unauthenticated.
+    if (cred.type === "api-key" && options.org) {
+        console.log(fmt.warn("API keys can't filter by org — org membership is a session concept.") + "\n");
+        console.log(fmt.dim("  To list org-scoped agents, log in with a session: mnemom login") + "\n");
+        return;
+    }
+    // Show the Org column only when a JWT session aggregates across all orgs.
+    const showOrg = cred.type === "jwt" && !options.org;
     let agents;
     try {
-        agents = await listOrgAgents(options.org);
+        agents = cred.type === "api-key" ? await listAgents() : await listOrgAgents(options.org);
     }
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
@@ -19,10 +29,8 @@ export async function agentsListCommand(options = {}) {
         console.log(options.org ? `  No agents found in org '${options.org}'.\n` : "  No agents found.\n");
         return;
     }
-    // Show the Org column only when aggregating across orgs; with --org it's redundant.
-    const showOrg = !options.org;
     const nameW = 24;
-    const idW = 40;
+    const idW = Math.max("ID".length, ...agents.map((a) => a.id.length)) + 2;
     const seenW = 14;
     const statusW = 14;
     const orgW = 22;

package/dist/commands/integrity.js

@@ -2,14 +2,14 @@ import { resolveAgentId, getIntegrity, MnemomApiError } from "../lib/api.js";
 import { fmt } from "../lib/format.js";
 export async function integrityCommand(agentName) {
     const agentId = await resolveAgentId(agentName);
-    console.log("\nFetching integrity score...\n");
+    console.log("\nFetching agent activity...\n");
     try {
         const integrity = await getIntegrity(agentId);
         // Field names match the docs.mnemom.ai canonical IntegrityScore schema:
         // integrity_score (in [0,1]), total_traces, verified_traces, violation_count.
         const scorePercent = (integrity.integrity_score * 100).toFixed(1);
         const scoreBar = generateScoreBar(integrity.integrity_score);
-        console.log(fmt.header("Integrity Score"));
+        console.log(fmt.header("Agent Activity (AAP)"));
         console.log(`  ${fmt.label("Score:     ", `${scorePercent}% ${scoreBar}`)}`);
         console.log(`  ${fmt.label("Total:     ", `${integrity.total_traces} traces`)}`);
         console.log(`  ${fmt.label("Verified:  ", `${integrity.verified_traces}`)}`);
@@ -30,7 +30,7 @@ export async function integrityCommand(agentName) {
         // undocumented 404 to a synthetic 500 carrying spec_deviation.original_status,
         // and effectiveStatus surfaces the true status (=== status when documented).
         if (error instanceof MnemomApiError && error.effectiveStatus === 404) {
-            console.log(fmt.header("Integrity Score"));
+            console.log(fmt.header("Agent Activity (AAP)"));
             console.log(`  ${fmt.label("Score:     ", "N/A")}`);
             console.log(`  ${fmt.label("Total:     ", "0 traces")}`);
             console.log(`  ${fmt.label("Verified:  ", "0")}`);

package/dist/commands/logs.js

@@ -1,5 +1,5 @@
-import { resolveAgentId, getTraces, MnemomApiError } from "../lib/api.js";
-import { getGatewayUrl } from "../lib/config.js";
+import { resolveAgentId, getTraces, MnemomApiError, } from "../lib/api.js";
+import { getGatewayUrl, getWebsiteUrl } from "../lib/config.js";
 import { fmt } from "../lib/format.js";
 export async function logsCommand(options = {}) {
     const agentId = await resolveAgentId(options.agentName);
@@ -20,7 +20,7 @@ export async function logsCommand(options = {}) {
             displayTrace(trace);
         }
         console.log(`\nView more: mnemom logs --limit ${limit + 10}`);
-        console.log(`Dashboard: https://mnemon.ai/dashboard/${agentId}\n`);
+        console.log(`Dashboard: ${getWebsiteUrl()}/agents/${agentId}\n`);
     }
     catch (error) {
         // A 404 means the agent isn't registered yet — treat as the empty state.
@@ -60,9 +60,36 @@ function displayTrace(trace) {
         console.log(`  ${fmt.label("Reason:", ` ${preview}`)}`);
     }
     if (trace.verification && trace.verification.violations.length > 0) {
-        console.log(`  ${fmt.label("Issues:", ` ${trace.verification.violations.join(", ")}`)}`);
+        const issues = trace.verification.violations.map(formatViolation).join("; ");
+        console.log(`  ${fmt.label("Issues:", ` ${issues}`)}`);
     }
 }
+/**
+ * Render a single policy violation as a readable one-line string.
+ *
+ * The wire shape is an object ({type,tool,severity,reason} — canonical
+ * `PolicyViolation`); a naive `.join(", ")` string-coerces each to
+ * "[object Object]". We compose only the fields that are present, e.g.
+ * "[high] forbidden — write_file: tool not in capability set", and tolerate a
+ * bare-string element (legacy/forward compatibility) by returning it verbatim.
+ */
+function formatViolation(v) {
+    if (typeof v === "string")
+        return v;
+    let line = "";
+    if (v.severity)
+        line += `[${v.severity}] `;
+    if (v.type)
+        line += v.type;
+    if (v.tool)
+        line += `${v.type ? " — " : ""}${v.tool}`;
+    if (v.reason)
+        line += `${v.type || v.tool ? ": " : ""}${v.reason}`;
+    const out = line.trim();
+    // Fall back to a structured dump only if no known field was present, so we
+    // never silently emit an empty Issues entry or "[object Object]".
+    return out || JSON.stringify(v);
+}
 function formatTimestamp(iso) {
     try {
         const date = new Date(iso);

package/dist/commands/status.js

@@ -1,8 +1,7 @@
-import { getGatewayUrl } from "../lib/config.js";
+import { getGatewayUrl, getWebsiteUrl } from "../lib/config.js";
 import { resolveAgentId, getAgent, getIntegrity, getTraces, MnemomApiError } from "../lib/api.js";
 import { isLoggedIn, getAuthInfo } from "../lib/auth.js";
 import { fmt } from "../lib/format.js";
-const DASHBOARD_URL = "https://mnemom.ai";
 export async function statusCommand(agentName) {
     console.log(fmt.header("mnemom status"));
     console.log();
@@ -31,7 +30,7 @@ export async function statusCommand(agentName) {
     console.log();
     console.log(fmt.label("Agent ID: ", agentId));
     console.log(fmt.label("Gateway:  ", gatewayUrl));
-    console.log(fmt.label("Dashboard:", ` ${DASHBOARD_URL}/agents/${agentId}`));
+    console.log(fmt.label("Dashboard:", ` ${getWebsiteUrl()}/agents/${agentId}`));
     // Trace summary if API connectivity is healthy
     if (apiCheck.status === "ok") {
         await showTraceSummary(agentId);

package/dist/index.js

@@ -109,10 +109,11 @@ const cardCmd = program.command("card").description("Manage alignment card");
 cardCmd
     .command("show")
     .description("Display alignment card (YAML)")
-    .action(async () => {
+    .option("--agent <name>", "Agent name or ID (or set MNEMOM_AGENT)")
+    .action(async (subOpts) => {
     try {
         const opts = program.opts();
-        await cardShowCommand(opts.agent);
+        await cardShowCommand(subOpts.agent ?? opts.agent);
     }
     catch (error) {
         console.error("Error:", error instanceof Error ? error.message : error);
@@ -122,11 +123,14 @@ cardCmd
 cardCmd
     .command("edit")
     .description("Edit alignment card in $EDITOR")
+    .option("--agent <name>", "Agent name or ID (or set MNEMOM_AGENT)")
     .option("--idempotency-key <uuid>", "Reuse a specific Idempotency-Key (for retries; default: auto)")
     .action(async (subOpts) => {
     try {
         const opts = program.opts();
-        await cardEditCommand(opts.agent, { idempotencyKey: subOpts.idempotencyKey });
+        await cardEditCommand(subOpts.agent ?? opts.agent, {
+            idempotencyKey: subOpts.idempotencyKey,
+        });
     }
     catch (error) {
         console.error("Error:", error instanceof Error ? error.message : error);
@@ -137,11 +141,14 @@ cardCmd
     .command("publish")
     .argument("<file>", "Path to alignment card file (YAML or JSON)")
     .description("Publish alignment card")
+    .option("--agent <name>", "Agent name or ID (or set MNEMOM_AGENT)")
     .option("--idempotency-key <uuid>", "Reuse a specific Idempotency-Key (for retries; default: auto)")
     .action(async (file, subOpts) => {
     try {
         const opts = program.opts();
-        await cardPublishCommand(file, opts.agent, { idempotencyKey: subOpts.idempotencyKey });
+        await cardPublishCommand(file, subOpts.agent ?? opts.agent, {
+            idempotencyKey: subOpts.idempotencyKey,
+        });
     }
     catch (error) {
         console.error("Error:", error instanceof Error ? error.message : error);
@@ -531,6 +538,17 @@ advisoriesCmd
     .option("--json", "Output JSON")
     .action(async (options) => {
     try {
+        // The program-level `--agent` shadows this subcommand's own `--agent`
+        // (Commander binds the shared long flag to the parent program, not the
+        // subcommand — verified against commander@12), so resolve the agent
+        // scope here from the explicit sources: the subcommand flag and the
+        // global `--agent`. Fall back to MNEMOM_AGENT only when `--team` is NOT
+        // set — a stray env var alongside an explicit `--team` must not inject
+        // an agent and spuriously trip the handler's mutual-exclusion guard,
+        // whereas an explicit `--agent` alongside `--team` should still trip
+        // it. (MNE-238)
+        const explicitAgent = options.agent ?? program.opts().agent;
+        options.agent = options.team ? explicitAgent : (explicitAgent ?? process.env.MNEMOM_AGENT);
         await advisoriesListCommand(options);
     }
     catch (error) {
@@ -546,6 +564,11 @@ advisoriesCmd
     .option("--json", "Output JSON")
     .action(async (advisoryId, options) => {
     try {
+        // Same global `--agent` shadow fix as `advisories list` (MNE-238):
+        // resolve the explicit agent (local ?? global), and fall back to
+        // MNEMOM_AGENT only when `--team` is not set.
+        const explicitAgent = options.agent ?? program.opts().agent;
+        options.agent = options.team ? explicitAgent : (explicitAgent ?? process.env.MNEMOM_AGENT);
         await advisoriesShowCommand(advisoryId, options);
     }
     catch (error) {

package/dist/lib/api.d.ts

@@ -72,7 +72,19 @@ export interface IntegrityScore {
  * reasoning, tool_name } — none of which the wire emits. `mnemom logs` rendered
  * every action as "[object Object]" and flagged EVERY trace as [VIOLATION]
  * (undefined `verified` is falsy). Field names + nesting now match the wire.
+ *
+ * `verification.violations` elements are OBJECTS ({type,tool,severity,reason}),
+ * not strings — produced by the observer/gateway mappers (canonical
+ * `PolicyViolation` in shared/policy-engine). A prior pass corrected `action`'s
+ * nesting but left `violations` mistyped, which re-introduced "[object Object]"
+ * on the Issues line. All fields are optional here for forward/backward tolerance.
  */
+export interface TraceViolation {
+    type?: string;
+    tool?: string;
+    severity?: string;
+    reason?: string;
+}
 export interface Trace {
     trace_id: string;
     agent_id: string;
@@ -90,7 +102,7 @@ export interface Trace {
     };
     verification: {
         verified: boolean;
-        violations: string[];
+        violations: TraceViolation[];
     } | null;
     created_at?: string;
 }
@@ -208,11 +220,11 @@ export interface AgentListItem {
     key_prefix?: string | null;
 }
 /**
- * @deprecated Legacy per-user listing — `GET /v1/agents` is scoped by the
- * caller's `claimed_by` rows, which ADR-062 retired as an authorization /
- * listing boundary (org_id is now the sole boundary). New code must list via
- * {@link listOrgAgents} (org-scoped). Retained only for back-compat callers;
- * the `mnemom agents` command and name resolution no longer use it.
+ * Key-compatible agent listing — `GET /v1/agents` is scoped by the caller's
+ * `claimed_by` rows (the pre-ADR-062 boundary). JWT callers should prefer
+ * {@link listOrgAgents} (org-scoped, the ADR-062 canonical boundary).
+ * API-key callers use this path because the org-scoped route rejects API keys;
+ * routing here avoids the false "Not authenticated" error (MNE-194 F10).
  */
 export declare function listAgents(): Promise<AgentListItem[]>;
 export interface OrgListItem {

package/dist/lib/api.js

@@ -206,11 +206,11 @@ export async function getAgent(id) {
     return fetchApi(`/v1/agents/${id}`);
 }
 /**
- * @deprecated Legacy per-user listing — `GET /v1/agents` is scoped by the
- * caller's `claimed_by` rows, which ADR-062 retired as an authorization /
- * listing boundary (org_id is now the sole boundary). New code must list via
- * {@link listOrgAgents} (org-scoped). Retained only for back-compat callers;
- * the `mnemom agents` command and name resolution no longer use it.
+ * Key-compatible agent listing — `GET /v1/agents` is scoped by the caller's
+ * `claimed_by` rows (the pre-ADR-062 boundary). JWT callers should prefer
+ * {@link listOrgAgents} (org-scoped, the ADR-062 canonical boundary).
+ * API-key callers use this path because the org-scoped route rejects API keys;
+ * routing here avoids the false "Not authenticated" error (MNE-194 F10).
  */
 export async function listAgents() {
     const url = validateUrl(`${API_BASE}/v1/agents?limit=100`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemom/mnemom",
-  "version": "0.14.1",
+  "version": "0.14.3",
   "description": "Transparent AI agent tracing",
   "type": "module",
   "bin": {