@mnemom/mnemom 0.15.0 → 0.15.1-next.0

package/dist/commands/try-me.js

@@ -40,6 +40,13 @@ export async function tryMeCommand(token, options = {}) {
     const json = !!options.json;
     // JSON output is only coherent non-interactively — no prompts can be shown.
     const nonInteractive = !!options.yes || json || !isInteractive();
+    // The name pick is a deliberate human-handoff checkpoint (the manifest marks
+    // it human_handoff:true). It must fire on EVERY real run — agent-driven,
+    // piped, and inherited-stdin runs all report isTTY=false yet can still answer
+    // a prompt — so it is auto-skipped ONLY on an explicit non-interactive
+    // request: --yes, --json, or --name (the last handled inside pickName). It is
+    // intentionally NOT gated on isInteractive(), unlike the open/login prompts.
+    const skipNamePrompt = !!options.yes || json;
     const autoOpen = options.open !== false; // --no-open → false
     const result = { token, version: "", dry_run: !!options.dryRun, steps: [] };
     // A human-facing log that is silenced in --json mode (the JSON is the output).
@@ -69,7 +76,7 @@ export async function tryMeCommand(token, options = {}) {
     }
     const apiBase = (options.api ?? getApiUrl()).replace(/\/$/, "");
     // ── State: name (human checkpoint) ──────────────────────────────────────────
-    const name = await pickName(manifest, options, nonInteractive, say);
+    const name = await pickName(manifest, options, skipNamePrompt, say);
     result.steps.push({ step: "name", status: "ok", detail: name });
     // ── State: birth ────────────────────────────────────────────────────────────
     let agentId;
@@ -143,12 +150,12 @@ export async function tryMeCommand(token, options = {}) {
         console.log(JSON.stringify(result, null, 2));
 }
 // ── name (human checkpoint) ──────────────────────────────────────────────────
-async function pickName(manifest, options, nonInteractive, say) {
+async function pickName(manifest, options, skipPrompt, say) {
     if (options.name && options.name.trim())
         return options.name.trim();
     const opts = manifest.handoff.name_options ?? [];
-    if (nonInteractive) {
-        const fallback = opts[0] ?? "mnemom-dojo-agent";
+    const fallback = opts[0] ?? "mnemom-dojo-agent";
+    if (skipPrompt) {
         say(fmt.dim(`Non-interactive: naming the agent "${fallback}" (override with --name).`));
         return fallback;
     }
@@ -157,13 +164,19 @@ async function pickName(manifest, options, nonInteractive, say) {
     const choice = await askSelect(manifest.handoff.name_question, [...opts, TYPE_MY_OWN]);
     if (choice && choice !== TYPE_MY_OWN)
         return choice;
-    let typed = "";
-    while (!typed) {
-        typed = (await askInput("Enter a name for your agent:")).trim();
-        if (!typed)
-            say(fmt.warn("A name is required (it's permanent) — please enter one."));
+    // "Type my own" — or no valid selection — falls through to free-form entry.
+    for (;;) {
+        const typed = (await askInput("Enter a name for your agent:")).trim();
+        if (typed)
+            return typed;
+        // A non-responsive stream (EOF on a pipe) returns "" on every read; don't
+        // spin forever — fall back to the default so an unattended run completes.
+        if (!process.stdin.isTTY) {
+            say(fmt.warn(`No name entered on a non-interactive stream — using "${fallback}".`));
+            return fallback;
+        }
+        say(fmt.warn("A name is required (it's permanent) — please enter one."));
     }
-    return typed;
 }
 /** Token mode is the shipped reality; legacy provider-key claims aren't supported by this runner. */
 function missingLegacyProof() {

package/dist/lib/oauth.d.ts

@@ -119,3 +119,14 @@ export declare function refreshTokens(refreshToken: string, clientId: string): P
  * fallback, so a missing browser must not crash login.
  */
 export declare function openBrowser(url: string): void;
+/**
+ * Await `promise` while emitting a heartbeat tick every `intervalMs`, so a long
+ * silent wait (a browser sign-in round-trip) doesn't look hung. `onTick` is
+ * called with the elapsed whole-seconds count. The timer is always cleared when
+ * the promise settles, and is unref'd so it never keeps the event loop alive on
+ * its own. `timers` is injectable so tests drive the ticks without real clocks.
+ */
+export declare function withHeartbeat<T>(promise: Promise<T>, intervalMs: number, onTick: (elapsedSeconds: number) => void, timers?: {
+    set?: (cb: () => void, ms: number) => unknown;
+    clear?: (handle: unknown) => void;
+}): Promise<T>;

package/dist/lib/oauth.js

@@ -35,6 +35,10 @@ const DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 // Loopback login waits at most this long for the browser round-trip before
 // giving up and freeing the port.
 const LOOPBACK_TIMEOUT_MS = 5 * 60 * 1000;
+// Cadence for the "…still waiting for you to finish signing in" heartbeat that
+// both interactive login poll loops emit, so a multi-minute browser sign-in
+// doesn't read as a hung CLI (matches the card-write retry tick in try-me).
+const LOGIN_HEARTBEAT_MS = 15 * 1000;
 let cachedMetadata = null;
 /**
  * Fetch (and process-cache) the AS metadata document. We resolve it relative to
@@ -157,7 +161,9 @@ export async function loginWithLoopback(openUrl = openBrowser) {
     openUrl(authUrl.toString());
     console.log("Waiting for authentication...");
     try {
-        const code = await codePromise;
+        // Heartbeat while we await the loopback redirect — otherwise the sign-in
+        // round-trip is dead silent and reads as a hung CLI.
+        const code = await withHeartbeat(codePromise, LOGIN_HEARTBEAT_MS, (s) => console.log(`…still waiting for you to finish signing in (${s}s)`));
         const tokens = await exchangeCode(meta, clientId, code, pkce.verifier, redirectUri);
         return { tokens, clientId };
     }
@@ -293,19 +299,24 @@ export async function loginWithDevice(opts) {
     }
     display("");
     display("Waiting for authorization...");
-    const tokens = await pollDeviceToken(meta, clientId, authz, sleep);
+    const tokens = await pollDeviceToken(meta, clientId, authz, sleep, display);
     return { tokens, clientId };
 }
-async function pollDeviceToken(meta, clientId, authz, sleep) {
+async function pollDeviceToken(meta, clientId, authz, sleep, display) {
     // RFC 8628 §3.5: default interval is 5s if the server omits it; on slow_down
     // we increase the interval by 5s and keep that as the new minimum.
     let intervalMs = (authz.interval ?? 5) * 1000;
     const deadline = Date.now() + authz.expires_in * 1000;
+    // Heartbeat off accumulated poll time (not wall-clock) so it stays correct
+    // even when sleep is stubbed in tests; ticks every LOGIN_HEARTBEAT_MS.
+    let waitedMs = 0;
+    let nextHeartbeatMs = LOGIN_HEARTBEAT_MS;
     for (;;) {
         if (Date.now() >= deadline) {
             throw new Error("Device authorization expired before approval. Please try again.");
         }
         await sleep(intervalMs);
+        waitedMs += intervalMs;
         const res = await fetch(meta.token_endpoint, {
             method: "POST",
             headers: {
@@ -324,10 +335,10 @@ async function pollDeviceToken(meta, clientId, authz, sleep) {
         const body = (await res.json().catch(() => ({})));
         switch (body.error) {
             case "authorization_pending":
-                continue; // keep polling at the current interval
+                break; // keep polling at the current interval
             case "slow_down":
                 intervalMs += 5000; // RFC 8628 §3.5
-                continue;
+                break;
             case "expired_token":
                 throw new Error("Device authorization expired before approval. Please try again.");
             case "access_denied":
@@ -336,6 +347,12 @@ async function pollDeviceToken(meta, clientId, authz, sleep) {
                 throw new Error(`Device authorization failed: ${body.error ?? `HTTP ${res.status}`}` +
                     (body.error_description ? ` — ${body.error_description}` : ""));
         }
+        // Still pending (authorization_pending / slow_down) — emit a heartbeat
+        // every ~15s so a multi-minute approval doesn't look hung.
+        if (waitedMs >= nextHeartbeatMs) {
+            display(`…still waiting for you to finish signing in (${Math.round(waitedMs / 1000)}s)`);
+            nextHeartbeatMs += LOGIN_HEARTBEAT_MS;
+        }
     }
 }
 // ============================================================================
@@ -411,6 +428,29 @@ export function openBrowser(url) {
 function defaultSleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
+/**
+ * Await `promise` while emitting a heartbeat tick every `intervalMs`, so a long
+ * silent wait (a browser sign-in round-trip) doesn't look hung. `onTick` is
+ * called with the elapsed whole-seconds count. The timer is always cleared when
+ * the promise settles, and is unref'd so it never keeps the event loop alive on
+ * its own. `timers` is injectable so tests drive the ticks without real clocks.
+ */
+export async function withHeartbeat(promise, intervalMs, onTick, timers = {}) {
+    const set = timers.set ?? ((cb, ms) => setInterval(cb, ms));
+    const clear = timers.clear ?? ((h) => clearInterval(h));
+    let elapsedMs = 0;
+    const handle = set(() => {
+        elapsedMs += intervalMs;
+        onTick(Math.round(elapsedMs / 1000));
+    }, intervalMs);
+    handle?.unref?.();
+    try {
+        return await promise;
+    }
+    finally {
+        clear(handle);
+    }
+}
 /** Constant-time string compare that tolerates length differences. */
 function timingSafeEqual(a, b) {
     const ab = Buffer.from(a);

package/dist/lib/prompt.js

@@ -162,6 +162,11 @@ export async function askMultiSelect(question, options) {
         });
     });
 }
+/** Map a typed answer ("1".."n") to its option label, or null if out of range. */
+function resolveSelection(answer, options) {
+    const idx = parseInt(answer.trim(), 10) - 1;
+    return idx >= 0 && idx < options.length ? options[idx] : null;
+}
 /**
  * Single-select prompt. Displays numbered options, user enters a number.
  * Returns selected label or null if invalid.
@@ -171,6 +176,19 @@ export async function askSelect(question, options) {
     for (let i = 0; i < options.length; i++) {
         console.log(`  ${i + 1}) ${options[i]}`);
     }
+    // Non-interactive stdin (pipe / CI / agent-driven): serve the next buffered
+    // line from the SAME shared reader askInput uses. A fresh per-prompt readline
+    // interface drops buffered lines on a pipe (MNE-269), and `rl.question` never
+    // resolves on EOF — so a non-TTY run would silently hang here. Read the
+    // shared buffer instead; on EOF there's nothing to pick, so return null and
+    // let the caller fall back.
+    if (!process.stdin.isTTY) {
+        process.stdout.write("Select: ");
+        const lines = await readPipedStdinLines();
+        const next = lines.shift();
+        process.stdout.write("\n");
+        return resolveSelection(next ?? "", options);
+    }
     const rl = readline.createInterface({
         input: process.stdin,
         output: process.stdout,
@@ -178,13 +196,7 @@ export async function askSelect(question, options) {
     return new Promise((resolve) => {
         rl.question("Select: ", (answer) => {
             rl.close();
-            const idx = parseInt(answer.trim(), 10) - 1;
-            if (idx >= 0 && idx < options.length) {
-                resolve(options[idx]);
-            }
-            else {
-                resolve(null);
-            }
+            resolve(resolveSelection(answer, options));
         });
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemom/mnemom",
-  "version": "0.15.0",
+  "version": "0.15.1-next.0",
   "description": "Transparent AI agent tracing",
   "type": "module",
   "bin": {