@mnemom/mnemom 0.15.0 → 0.15.1-next.1

package/dist/commands/try-me.js

@@ -24,7 +24,7 @@
  * host-connector authorization in the MCP flow, not a forged credential.
  */
 import { resolveBriefing, birthAgent, fetchAgentClaimed, buildClaimUrl, buildGrantUrl, buildDojoDeepLink, claimProof, isTokenMode, looksLikeTryMeToken, sleep, } from "../lib/try-me.js";
-import { putAlignmentCard, putProtectionCard, MnemomApiError } from "../lib/api.js";
+import { putAlignmentCard, putProtectionCard, listOrgAgents, MnemomApiError } from "../lib/api.js";
 import { resolveAuth, loginWithBrowser, loginWithDeviceFlow } from "../lib/auth.js";
 import { openBrowser } from "../lib/oauth.js";
 import { askSelect, askInput, askYesNo, isInteractive } from "../lib/prompt.js";
@@ -40,6 +40,13 @@ export async function tryMeCommand(token, options = {}) {
     const json = !!options.json;
     // JSON output is only coherent non-interactively — no prompts can be shown.
     const nonInteractive = !!options.yes || json || !isInteractive();
+    // The name pick is a deliberate human-handoff checkpoint (the manifest marks
+    // it human_handoff:true). It must fire on EVERY real run — agent-driven,
+    // piped, and inherited-stdin runs all report isTTY=false yet can still answer
+    // a prompt — so it is auto-skipped ONLY on an explicit non-interactive
+    // request: --yes, --json, or --name (the last handled inside pickName). It is
+    // intentionally NOT gated on isInteractive(), unlike the open/login prompts.
+    const skipNamePrompt = !!options.yes || json;
     const autoOpen = options.open !== false; // --no-open → false
     const result = { token, version: "", dry_run: !!options.dryRun, steps: [] };
     // A human-facing log that is silenced in --json mode (the JSON is the output).
@@ -69,7 +76,7 @@ export async function tryMeCommand(token, options = {}) {
     }
     const apiBase = (options.api ?? getApiUrl()).replace(/\/$/, "");
     // ── State: name (human checkpoint) ──────────────────────────────────────────
-    const name = await pickName(manifest, options, nonInteractive, say);
+    const name = await pickName(manifest, options, skipNamePrompt, say);
     result.steps.push({ step: "name", status: "ok", detail: name });
     // ── State: birth ────────────────────────────────────────────────────────────
     let agentId;
@@ -107,12 +114,15 @@ export async function tryMeCommand(token, options = {}) {
     result.claimed = true;
     result.steps.push({ step: "claim", status: "ok", detail: agentId });
     say(fmt.success("Claimed — you now own this agent."));
+    // The session context the card writes share: ensureSession + writeCardWithRetry
+    // both need it (the latter re-triggers ensureSession on a persistent auth 403).
+    const sessionCtx = { nonInteractive, autoOpen, agentId, say };
     // ── Ensure a CLI session for the card writes (the human's own login) ────────
-    await ensureSession({ nonInteractive, autoOpen, agentId, say });
+    await ensureSession(sessionCtx);
     // ── State: alignment (set directly with the post-claim session) ─────────────
     say();
     say(`${fmt.badge("alignment", "cyan")} Publishing your alignment card — your signed, public statement of intent…`);
-    await writeCardWithRetry("alignment", agentId, manifest.declare.alignment_card, options.pollTimeout ?? 600, say);
+    await writeCardWithRetry("alignment", manifest.declare.alignment_card, options.pollTimeout ?? 600, sessionCtx);
     result.alignment = "set";
     result.steps.push({ step: "alignment", status: "ok" });
     say(fmt.success("Alignment card set."));
@@ -126,7 +136,7 @@ export async function tryMeCommand(token, options = {}) {
         say,
     });
     say(fmt.dim("Waiting for your approval, then setting the protection card…"));
-    await writeCardWithRetry("protection", agentId, manifest.declare.protection_card, options.pollTimeout ?? 600, say);
+    await writeCardWithRetry("protection", manifest.declare.protection_card, options.pollTimeout ?? 600, sessionCtx);
     result.protection = "set";
     result.steps.push({ step: "protection", status: "ok" });
     say(fmt.success("Protection card set."));
@@ -143,12 +153,12 @@ export async function tryMeCommand(token, options = {}) {
         console.log(JSON.stringify(result, null, 2));
 }
 // ── name (human checkpoint) ──────────────────────────────────────────────────
-async function pickName(manifest, options, nonInteractive, say) {
+async function pickName(manifest, options, skipPrompt, say) {
     if (options.name && options.name.trim())
         return options.name.trim();
     const opts = manifest.handoff.name_options ?? [];
-    if (nonInteractive) {
-        const fallback = opts[0] ?? "mnemom-dojo-agent";
+    const fallback = opts[0] ?? "mnemom-dojo-agent";
+    if (skipPrompt) {
         say(fmt.dim(`Non-interactive: naming the agent "${fallback}" (override with --name).`));
         return fallback;
     }
@@ -157,13 +167,19 @@ async function pickName(manifest, options, nonInteractive, say) {
     const choice = await askSelect(manifest.handoff.name_question, [...opts, TYPE_MY_OWN]);
     if (choice && choice !== TYPE_MY_OWN)
         return choice;
-    let typed = "";
-    while (!typed) {
-        typed = (await askInput("Enter a name for your agent:")).trim();
-        if (!typed)
-            say(fmt.warn("A name is required (it's permanent) — please enter one."));
+    // "Type my own" — or no valid selection — falls through to free-form entry.
+    for (;;) {
+        const typed = (await askInput("Enter a name for your agent:")).trim();
+        if (typed)
+            return typed;
+        // A non-responsive stream (EOF on a pipe) returns "" on every read; don't
+        // spin forever — fall back to the default so an unattended run completes.
+        if (!process.stdin.isTTY) {
+            say(fmt.warn(`No name entered on a non-interactive stream — using "${fallback}".`));
+            return fallback;
+        }
+        say(fmt.warn("A name is required (it's permanent) — please enter one."));
     }
-    return typed;
 }
 /** Token mode is the shipped reality; legacy provider-key claims aren't supported by this runner. */
 function missingLegacyProof() {
@@ -210,28 +226,99 @@ async function pollUntilClaimed(apiBase, agentId, timeoutSeconds, say) {
             say(fmt.dim(`  …still waiting for the claim (${waited / 1000}s).`));
     }
 }
-// ── CLI session for the card writes ──────────────────────────────────────────
 /**
- * Ensure the CLI holds the human's session before the card writes. The card-write
- * PUTs authorize on org membership and need the human's JWT/API-key — the
- * headless twin of the MCP host-connector authorization. If unauthenticated, offer
- * a one-click `mnemom login` (one-click since the human just signed in to claim).
+ * Validate that a JWT session can actually act for the just-claimed agent —
+ * NOT merely that some credential exists on disk.
+ *
+ * The card-write PUTs authorize on ORG MEMBERSHIP (ADR-062): the caller may set
+ * the cards only if they belong to the org the agent was claimed into. Listing
+ * the caller's org fleets is the cheapest authoritative probe of exactly that —
+ * it both proves the token is live (a stale/revoked token throws "Not
+ * authenticated" / 401) AND that this session governs the agent (it appears in
+ * the fleet). A locally-unexpired token signed in as a DIFFERENT account passes
+ * the old `type !== "none"` check yet fails here (the agent isn't in its fleet),
+ * which is the silent-403 hang this guards against.
+ *
+ * A brief read lag right after the claim is absorbed with a couple of bounded
+ * retries so the happy path doesn't bounce a valid owner into a needless
+ * re-login. A non-auth error (network blip / 5xx) is inconclusive → we return
+ * `true` and let the card-write path's grace+escalation be the authority, so a
+ * transient hiccup can't strand the run.
  */
-async function ensureSession(ctx) {
-    const cred = await resolveAuth();
-    if (cred.type !== "none")
-        return;
-    ctx.say();
-    ctx.say(fmt.dim("To set your cards as you, the CLI needs your Mnemom session — this is the headless twin of " +
-        "the host-connector authorization (your own login, not a forged credential)."));
+async function sessionCanActForAgent(agentId) {
+    const ATTEMPTS = 3;
+    for (let i = 0; i < ATTEMPTS; i++) {
+        try {
+            const fleet = await listOrgAgents();
+            if (fleet.some((a) => a.id === agentId))
+                return true;
+            // Authenticated, but the agent isn't (yet) in any of the caller's orgs.
+            // Retry a couple of times to ride out post-claim propagation before
+            // concluding the session is for the wrong account.
+            if (i < ATTEMPTS - 1)
+                await sleep(POLL_INTERVAL_MS);
+        }
+        catch (err) {
+            const status = err instanceof MnemomApiError ? err.effectiveStatus : undefined;
+            const authFailure = status === 401 || (err instanceof Error && /not authenticated/i.test(err.message));
+            // A definitive auth failure ⇒ the session is unusable ⇒ force re-login.
+            if (authFailure)
+                return false;
+            // Anything else is inconclusive — don't force a re-login on it.
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Ensure the CLI holds a session that can set THIS agent's cards before writing
+ * them. The card-write PUTs authorize on org membership and need the human's
+ * JWT/API-key — the headless twin of the MCP host-connector authorization.
+ *
+ * This does NOT trust a bare existence check: a stale/expired/wrong-account
+ * session passes `type !== "none"` but can't write the cards, which previously
+ * turned into a silent multi-minute 403 retry hang. So for a JWT we VALIDATE it
+ * can act for the agent's owner and, if not, fall through to a fresh login
+ * instead of returning early.
+ *
+ * `force` (set by the card-write escalation) skips the existence/validation
+ * check and re-authenticates unconditionally — the session on disk has already
+ * proven it can't write this agent's cards.
+ */
+async function ensureSession(ctx, opts = {}) {
+    if (!opts.force) {
+        const cred = await resolveAuth();
+        // An API key is a long-lived credential with no expiry/identity to validate
+        // (and the org-scoped probe rejects API keys) — trust it as before.
+        if (cred.type === "api-key")
+            return;
+        if (cred.type === "jwt") {
+            if (await sessionCanActForAgent(ctx.agentId))
+                return;
+            ctx.say();
+            ctx.say(fmt.warn("Your CLI session looks stale — it's expired or signed in as a different account, so " +
+                "it can't set this agent's cards. Re-authenticating as the agent's owner…"));
+            // fall through to the fresh-login path
+        }
+    }
+    if (!opts.force) {
+        ctx.say();
+        ctx.say(fmt.dim("To set your cards as you, the CLI needs your Mnemom session — this is the headless twin of " +
+            "the host-connector authorization (your own login, not a forged credential)."));
+    }
     if (ctx.nonInteractive) {
-        throw new Error("Not authenticated. Run `mnemom login` (or set MNEMOM_TOKEN / MNEMOM_API_KEY) first, then " +
-            `re-run with --resume ${ctx.agentId} to resume after the claim.`);
+        throw new Error("No usable Mnemom session for this agent. Run `mnemom login` (or set MNEMOM_TOKEN / " +
+            `MNEMOM_API_KEY) as the account that owns ${ctx.agentId}, then re-run with ` +
+            `--resume ${ctx.agentId} to resume after the claim.`);
     }
-    const ok = await askYesNo("Sign in now? (one-click — you just signed in to claim)", true);
-    if (!ok) {
-        throw new Error("A Mnemom session is required to set the cards. Run `mnemom login`, then re-run with " +
-            `--resume ${ctx.agentId} to resume.`);
+    // On a forced re-auth the user is mid-flow and we've already explained why; go
+    // straight to the login rather than prompting again.
+    if (!opts.force) {
+        const ok = await askYesNo("Sign in now? (one-click — you just signed in to claim)", true);
+        if (!ok) {
+            throw new Error("A Mnemom session is required to set the cards. Run `mnemom login`, then re-run with " +
+                `--resume ${ctx.agentId} to resume.`);
+        }
     }
     // No local browser (e.g. SSH) → device flow; otherwise the loopback OAuth flow.
     if (ctx.autoOpen) {
@@ -242,18 +329,52 @@ async function ensureSession(ctx) {
     }
     ctx.say(fmt.success("Signed in."));
 }
-// ── card writes (retry on first-auth / grant propagation) ───────────────────
+// ── card writes (retry on grant propagation; escalate on stale auth) ─────────
 /**
- * Write a card, retrying while the server reports the caller isn't yet authorized
- * (401 / 403). For alignment this absorbs the brief org-membership propagation
- * right after the claim; for protection it ALSO absorbs the one-time grant landing
- * (the manifest's 403 insufficient_scope → keep polling; first 200 → done). Any
- * other status is a real error and is surfaced immediately.
+ * Short window to absorb the legit org-membership propagation that can briefly
+ * 401/403 the alignment write right after a claim, before we treat a persistent
+ * unauthorized response as a stale-session auth problem worth re-authenticating.
  */
-async function writeCardWithRetry(kind, agentId, card, timeoutSeconds, say) {
+const AUTH_PROPAGATION_GRACE_MS = 20_000;
+/**
+ * Classify a retriable (401/403) card-write failure.
+ *
+ * - `grant-pending`: a PROTECTION 403 — the one-time CISO grant hasn't landed in
+ *   the browser yet (the manifest's `insufficient_scope`). This is expected and
+ *   is polled for the full window; it must NOT trigger a re-login. (Alignment is
+ *   written first and has no grant, so a stale/wrong-account session is caught
+ *   there before protection runs — making a protection 403 reliably the grant.)
+ * - `auth`: a 401 anywhere, or an alignment 403 — the caller isn't authorized.
+ *   After a short propagation grace this means the session is stale/mismatched.
+ */
+function classifyAuthError(kind, status) {
+    if (status === 403 && kind === "protection")
+        return "grant-pending";
+    return "auth";
+}
+/**
+ * Write a card, tolerating the two legitimate transient unauthorized states and
+ * escalating a persistent one instead of hanging:
+ *
+ *  - PROTECTION grant landing (403): poll the full window for the human to
+ *    approve the one-time grant in the browser.
+ *  - post-claim org-membership propagation (alignment 401/403): a SHORT grace.
+ *
+ * Beyond the grace a persistent 401/403 is a stale/wrong-account session, NOT a
+ * propagation delay — so we re-authenticate as the agent's owner (forced
+ * `ensureSession`) and retry the write ONCE. If it still 401/403s after that the
+ * account genuinely can't act for this agent → a clear error, never a 10-minute
+ * silent retry. Any non-401/403 status is a real error surfaced immediately.
+ */
+async function writeCardWithRetry(kind, card, timeoutSeconds, ctx) {
+    const { agentId, say } = ctx;
     const body = JSON.stringify(card);
     const put = kind === "alignment" ? putAlignmentCard : putProtectionCard;
     const deadline = Date.now() + timeoutSeconds * 1000;
+    // The auth-escalation grace is capped by the overall timeout so a 0-timeout
+    // (tests / explicit --poll-timeout 0) escalates immediately rather than never.
+    const authGraceDeadline = Date.now() + Math.min(AUTH_PROPAGATION_GRACE_MS, timeoutSeconds * 1000);
+    let reauthed = false;
     let waited = 0;
     for (;;) {
         try {
@@ -262,23 +383,35 @@ async function writeCardWithRetry(kind, agentId, card, timeoutSeconds, say) {
         }
         catch (err) {
             const status = err instanceof MnemomApiError ? err.effectiveStatus : undefined;
-            const retriable = status === 401 || status === 403;
-            if (!retriable || Date.now() >= deadline) {
-                if (retriable) {
-                    throw new Error(`Timed out waiting to set the ${kind} card (last status ${status}). ` +
-                        (kind === "protection"
-                            ? "Make sure you approved the one-time grant, then re-run with --resume " +
-                                agentId +
-                                "."
-                            : "Re-run with --resume " + agentId + " to resume."), { cause: err });
+            if (status !== 401 && status !== 403)
+                throw err; // a real error — surface it
+            const kindOfFailure = classifyAuthError(kind, status);
+            // A stale/mismatched session: once the short propagation grace is spent,
+            // re-authenticate as the agent's owner and retry the write exactly once.
+            if (kindOfFailure === "auth" && Date.now() >= authGraceDeadline) {
+                if (!reauthed) {
+                    reauthed = true;
+                    await ensureSession(ctx, { force: true });
+                    continue; // retry immediately with the fresh session
                 }
-                throw err;
+                throw new Error(`Couldn't set the ${kind} card — this account isn't authorized for ${agentId} ` +
+                    `(last status ${status}) even after re-authenticating. Sign in as the account that ` +
+                    `owns ${agentId}, then re-run with --resume ${agentId}.`, { cause: err });
+            }
+            // Overall timeout (covers the long human wait for the protection grant).
+            if (Date.now() >= deadline) {
+                throw new Error(`Timed out waiting to set the ${kind} card (last status ${status}). ` +
+                    (kindOfFailure === "grant-pending"
+                        ? "Make sure you approved the one-time grant, then re-run with --resume " +
+                            agentId +
+                            "."
+                        : "Re-run with --resume " + agentId + " to resume."), { cause: err });
             }
             await sleep(POLL_INTERVAL_MS);
             waited += POLL_INTERVAL_MS;
             if (waited % 15000 === 0) {
                 say(fmt.dim(`  …waiting to set the ${kind} card (${waited / 1000}s)` +
-                    (kind === "protection"
+                    (kindOfFailure === "grant-pending"
                         ? " — approve the grant in your browser if you haven't."
                         : ".")));
             }

package/dist/lib/oauth.d.ts

@@ -119,3 +119,14 @@ export declare function refreshTokens(refreshToken: string, clientId: string): P
  * fallback, so a missing browser must not crash login.
  */
 export declare function openBrowser(url: string): void;
+/**
+ * Await `promise` while emitting a heartbeat tick every `intervalMs`, so a long
+ * silent wait (a browser sign-in round-trip) doesn't look hung. `onTick` is
+ * called with the elapsed whole-seconds count. The timer is always cleared when
+ * the promise settles, and is unref'd so it never keeps the event loop alive on
+ * its own. `timers` is injectable so tests drive the ticks without real clocks.
+ */
+export declare function withHeartbeat<T>(promise: Promise<T>, intervalMs: number, onTick: (elapsedSeconds: number) => void, timers?: {
+    set?: (cb: () => void, ms: number) => unknown;
+    clear?: (handle: unknown) => void;
+}): Promise<T>;

package/dist/lib/oauth.js

@@ -35,6 +35,10 @@ const DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 // Loopback login waits at most this long for the browser round-trip before
 // giving up and freeing the port.
 const LOOPBACK_TIMEOUT_MS = 5 * 60 * 1000;
+// Cadence for the "…still waiting for you to finish signing in" heartbeat that
+// both interactive login poll loops emit, so a multi-minute browser sign-in
+// doesn't read as a hung CLI (matches the card-write retry tick in try-me).
+const LOGIN_HEARTBEAT_MS = 15 * 1000;
 let cachedMetadata = null;
 /**
  * Fetch (and process-cache) the AS metadata document. We resolve it relative to
@@ -157,7 +161,9 @@ export async function loginWithLoopback(openUrl = openBrowser) {
     openUrl(authUrl.toString());
     console.log("Waiting for authentication...");
     try {
-        const code = await codePromise;
+        // Heartbeat while we await the loopback redirect — otherwise the sign-in
+        // round-trip is dead silent and reads as a hung CLI.
+        const code = await withHeartbeat(codePromise, LOGIN_HEARTBEAT_MS, (s) => console.log(`…still waiting for you to finish signing in (${s}s)`));
         const tokens = await exchangeCode(meta, clientId, code, pkce.verifier, redirectUri);
         return { tokens, clientId };
     }
@@ -293,19 +299,24 @@ export async function loginWithDevice(opts) {
     }
     display("");
     display("Waiting for authorization...");
-    const tokens = await pollDeviceToken(meta, clientId, authz, sleep);
+    const tokens = await pollDeviceToken(meta, clientId, authz, sleep, display);
     return { tokens, clientId };
 }
-async function pollDeviceToken(meta, clientId, authz, sleep) {
+async function pollDeviceToken(meta, clientId, authz, sleep, display) {
     // RFC 8628 §3.5: default interval is 5s if the server omits it; on slow_down
     // we increase the interval by 5s and keep that as the new minimum.
     let intervalMs = (authz.interval ?? 5) * 1000;
     const deadline = Date.now() + authz.expires_in * 1000;
+    // Heartbeat off accumulated poll time (not wall-clock) so it stays correct
+    // even when sleep is stubbed in tests; ticks every LOGIN_HEARTBEAT_MS.
+    let waitedMs = 0;
+    let nextHeartbeatMs = LOGIN_HEARTBEAT_MS;
     for (;;) {
         if (Date.now() >= deadline) {
             throw new Error("Device authorization expired before approval. Please try again.");
         }
         await sleep(intervalMs);
+        waitedMs += intervalMs;
         const res = await fetch(meta.token_endpoint, {
             method: "POST",
             headers: {
@@ -324,10 +335,10 @@ async function pollDeviceToken(meta, clientId, authz, sleep) {
         const body = (await res.json().catch(() => ({})));
         switch (body.error) {
             case "authorization_pending":
-                continue; // keep polling at the current interval
+                break; // keep polling at the current interval
             case "slow_down":
                 intervalMs += 5000; // RFC 8628 §3.5
-                continue;
+                break;
             case "expired_token":
                 throw new Error("Device authorization expired before approval. Please try again.");
             case "access_denied":
@@ -336,6 +347,12 @@ async function pollDeviceToken(meta, clientId, authz, sleep) {
                 throw new Error(`Device authorization failed: ${body.error ?? `HTTP ${res.status}`}` +
                     (body.error_description ? ` — ${body.error_description}` : ""));
         }
+        // Still pending (authorization_pending / slow_down) — emit a heartbeat
+        // every ~15s so a multi-minute approval doesn't look hung.
+        if (waitedMs >= nextHeartbeatMs) {
+            display(`…still waiting for you to finish signing in (${Math.round(waitedMs / 1000)}s)`);
+            nextHeartbeatMs += LOGIN_HEARTBEAT_MS;
+        }
     }
 }
 // ============================================================================
@@ -411,6 +428,29 @@ export function openBrowser(url) {
 function defaultSleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
+/**
+ * Await `promise` while emitting a heartbeat tick every `intervalMs`, so a long
+ * silent wait (a browser sign-in round-trip) doesn't look hung. `onTick` is
+ * called with the elapsed whole-seconds count. The timer is always cleared when
+ * the promise settles, and is unref'd so it never keeps the event loop alive on
+ * its own. `timers` is injectable so tests drive the ticks without real clocks.
+ */
+export async function withHeartbeat(promise, intervalMs, onTick, timers = {}) {
+    const set = timers.set ?? ((cb, ms) => setInterval(cb, ms));
+    const clear = timers.clear ?? ((h) => clearInterval(h));
+    let elapsedMs = 0;
+    const handle = set(() => {
+        elapsedMs += intervalMs;
+        onTick(Math.round(elapsedMs / 1000));
+    }, intervalMs);
+    handle?.unref?.();
+    try {
+        return await promise;
+    }
+    finally {
+        clear(handle);
+    }
+}
 /** Constant-time string compare that tolerates length differences. */
 function timingSafeEqual(a, b) {
     const ab = Buffer.from(a);

package/dist/lib/prompt.js

@@ -162,6 +162,11 @@ export async function askMultiSelect(question, options) {
         });
     });
 }
+/** Map a typed answer ("1".."n") to its option label, or null if out of range. */
+function resolveSelection(answer, options) {
+    const idx = parseInt(answer.trim(), 10) - 1;
+    return idx >= 0 && idx < options.length ? options[idx] : null;
+}
 /**
  * Single-select prompt. Displays numbered options, user enters a number.
  * Returns selected label or null if invalid.
@@ -171,6 +176,19 @@ export async function askSelect(question, options) {
     for (let i = 0; i < options.length; i++) {
         console.log(`  ${i + 1}) ${options[i]}`);
     }
+    // Non-interactive stdin (pipe / CI / agent-driven): serve the next buffered
+    // line from the SAME shared reader askInput uses. A fresh per-prompt readline
+    // interface drops buffered lines on a pipe (MNE-269), and `rl.question` never
+    // resolves on EOF — so a non-TTY run would silently hang here. Read the
+    // shared buffer instead; on EOF there's nothing to pick, so return null and
+    // let the caller fall back.
+    if (!process.stdin.isTTY) {
+        process.stdout.write("Select: ");
+        const lines = await readPipedStdinLines();
+        const next = lines.shift();
+        process.stdout.write("\n");
+        return resolveSelection(next ?? "", options);
+    }
     const rl = readline.createInterface({
         input: process.stdin,
         output: process.stdout,
@@ -178,13 +196,7 @@ export async function askSelect(question, options) {
     return new Promise((resolve) => {
         rl.question("Select: ", (answer) => {
             rl.close();
-            const idx = parseInt(answer.trim(), 10) - 1;
-            if (idx >= 0 && idx < options.length) {
-                resolve(options[idx]);
-            }
-            else {
-                resolve(null);
-            }
+            resolve(resolveSelection(answer, options));
         });
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemom/mnemom",
-  "version": "0.15.0",
+  "version": "0.15.1-next.1",
   "description": "Transparent AI agent tracing",
   "type": "module",
   "bin": {