@mnemom/mnemom 0.16.1 → 0.16.3

package/dist/lib/agent-config.js

@@ -0,0 +1,86 @@
+/**
+ * Agent identity config store — ~/.mnemom/agent.json.
+ *
+ * Persists the calling agent's resolved identity so skill verbs (try-me,
+ * onboard, wrap) write on first success and read thereafter — no re-prompt for
+ * identity on subsequent invocations (MNE-937).
+ *
+ * Co-located with auth.ts → auth.json. Separate by design: auth.json holds
+ * bearer credentials (wiped on logout); agent.json holds identity metadata
+ * that survives re-login and provider key rotation.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { MNEMOM_DIR } from "./config.js";
+function agentFile() {
+    return path.join(MNEMOM_DIR, "agent.json");
+}
+/** Load the agent config; a missing or corrupt file returns `{}`. */
+export function loadAgentConfig() {
+    try {
+        if (!fs.existsSync(agentFile()))
+            return {};
+        const parsed = JSON.parse(fs.readFileSync(agentFile(), "utf-8"));
+        return parsed && typeof parsed === "object" ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+function writeAgentConfig(config) {
+    if (!fs.existsSync(MNEMOM_DIR)) {
+        // 0700 to match the auth store — the directory holds credentials.
+        fs.mkdirSync(MNEMOM_DIR, { recursive: true, mode: 0o700 });
+    }
+    const resolvedPath = path.resolve(agentFile());
+    const tmpFile = `${resolvedPath}.${process.pid}.tmp`;
+    // Write-then-rename for atomicity; 0600 owner-only to match the auth store posture.
+    try {
+        fs.writeFileSync(tmpFile, JSON.stringify(config, null, 2), { mode: 0o600 });
+        try {
+            fs.chmodSync(tmpFile, 0o600);
+        }
+        catch {
+            /* best effort on platforms without POSIX perms */
+        }
+        fs.renameSync(tmpFile, resolvedPath);
+    }
+    catch (err) {
+        // Don't leave a partially-written `${pid}.tmp` sibling behind on a failed
+        // write/rename — best-effort unlink, then re-throw the original error.
+        try {
+            fs.unlinkSync(tmpFile);
+        }
+        catch {
+            /* the tmp file may not have been created — nothing to clean up */
+        }
+        throw err;
+    }
+}
+/** Persist the full agent config (replaces the file). */
+export function saveAgentConfig(config) {
+    writeAgentConfig(config);
+}
+/** Shallow-merge `partial` into the existing config and persist. */
+export function mergeAgentConfig(partial) {
+    const current = loadAgentConfig();
+    const next = { ...current };
+    for (const key of Object.keys(partial)) {
+        if (partial[key] !== undefined) {
+            next[key] = partial[key];
+        }
+    }
+    writeAgentConfig(next);
+}
+export function getAgentId() {
+    return loadAgentConfig().agent_id;
+}
+export function getAgentName() {
+    return loadAgentConfig().agent_name;
+}
+export function getOrgId() {
+    return loadAgentConfig().org_id;
+}
+export function getGatewayUrl() {
+    return loadAgentConfig().gateway_url;
+}

package/dist/lib/api.d.ts

@@ -57,6 +57,15 @@ export interface IntegrityScore {
     verified_traces: number;
     violation_count: number;
     integrity_score: number;
+    /**
+     * MNE-596 — count of traces AAP structurally flagged but were reclassified
+     * as a correctly policy-refused attack (agreeing with AIP's `clear`
+     * verdict). Logged/visible here for transparency; NOT subtracted from
+     * `verified_traces` (they already count as verified) and NOT included in
+     * `violation_count`. Optional for backward compatibility with older API
+     * deployments that don't yet emit this field.
+     */
+    bounded_refusal_count?: number;
 }
 /**
  * GET /v1/traces row — components/schemas/APTrace.
@@ -103,6 +112,17 @@ export interface Trace {
     verification: {
         verified: boolean;
         violations: TraceViolation[];
+        /**
+         * MNE-596 — when set to "bounded_refusal", AAP structurally flagged a
+         * violation (`verified: false`) but the observer's DDR cross-check found
+         * AIP independently confirmed `clear` AND no bounded action was ever
+         * executed (a pure refusal, no tool call) — i.e. the agent was attacked
+         * and correctly declined. This is NOT a real violation: it must not
+         * render as `[VIOLATION]` and must not count against integrity_score
+         * (see GET /v1/integrity/:id's `bounded_refusal_count`). `violations`
+         * stays populated for audit/debugging — only the classification changes.
+         */
+        classification?: "bounded_refusal" | string;
     } | null;
     created_at?: string;
 }
@@ -262,7 +282,11 @@ export interface OrgFleetAgent {
     owner_email: string | null;
     last_seen: string | null;
     created_at: string;
-    integrity_score: number;
+    /** MNE-460: renamed from `integrity_score` to disambiguate from reputation's
+     *  `integrity_ratio` (a different metric). Trace-verification ratio:
+     *  verified/total traces, lifetime, 0-1. Type-only in this CLI — never
+     *  displayed by `fleetToRow`, so this rename carries zero behavioral risk. */
+    trace_verification_ratio: number;
     coverage_ratio: number;
     latest_verdict: string | null;
     active_drift_alerts: number;
@@ -329,6 +353,24 @@ export declare function claimAgent(agentId: string, body: {
 }, opts?: {
     idempotencyKey?: string;
 }): Promise<ClaimAgentResult>;
+export interface MoveAgentResult {
+    moved: boolean;
+    agent_id: string;
+    from_org_id: string | null;
+    to_org_id: string | null;
+}
+/**
+ * POST /v1/agents/:id/move — role-based relocation between orgs.
+ *
+ * The role-based counterpart to claimAgent's re-claim: the server requires
+ * the caller to be an owner/admin of BOTH the agent's current org and
+ * `destOrgId` — no hash proof / agent key involved. Moving to the current
+ * org is an idempotent no-op (`moved: false`). An Idempotency-Key is minted
+ * (held across the 401-refresh retry) like every mutation.
+ */
+export declare function moveAgent(agentId: string, destOrgId: string, opts?: {
+    idempotencyKey?: string;
+}): Promise<MoveAgentResult>;
 /**
  * GET /v1/auth/me/personal-org — accessor for the user's personal org.
  * Idempotent: lazily provisions for legacy accounts that pre-date the
@@ -1044,4 +1086,83 @@ export interface RecipeReportResult {
     related_recipe_id: string;
 }
 export declare function reportRecipeFnFp(recipeId: string, input: RecipeReportInput): Promise<RecipeReportResult>;
+/**
+ * One row from GET /v1/orgs/:org_id/usage/by-person — consumption grouped by
+ * (person, provider, model).
+ *
+ * Field names mirror the wire contract in the API's `openapi.json` exactly.
+ * They are NOT invented here: the first version of this client was written
+ * against a guessed shape (`rows`/`tokens_consumed`/`requests` on a
+ * `/v1/orgs/:id/usage` path) and every one of its tests passed because they
+ * all mocked the response. `/v1/orgs/:id/usage` is a DIFFERENT, pre-existing
+ * endpoint that returns per-DAY operational metrics
+ * (`{ period: 'daily', days, data }`), so the command rendered `undefined`
+ * against the real server. Any change here must be checked against
+ * `openapi.json`, not against these types.
+ *
+ * Token and request totals are 64-bit integers serialized as strings.
+ * Never coerce to Number — values from large orgs can exceed Number.MAX_SAFE_INTEGER.
+ */
+export interface OrgUsageRow {
+    /** Null for unattributed consumption — a real row, never dropped. */
+    user_id: string | null;
+    display_name: string;
+    email: string | null;
+    membership_state: string;
+    /** "Unknown" when the event carried no provider. */
+    provider: string;
+    /** "Unknown" when the event carried no model. */
+    model: string;
+    /** 64-bit integer as string. */
+    tokens_in: string;
+    /** 64-bit integer as string. */
+    tokens_out: string;
+    /** 64-bit integer as string. */
+    request_count: string;
+}
+/** Totals over the COMPLETE filtered result, computed before pagination. */
+export interface OrgUsageTotals {
+    tokens_in: string;
+    tokens_out: string;
+    request_count: string;
+    attributed_request_count: string;
+    unattributed_request_count: string;
+    /** Fraction 0–1, already rounded by the server. */
+    attribution_rate: number;
+}
+export interface OrgUsageResponse {
+    /** Window start, inclusive (ISO-8601, UTC midnight). */
+    from: string;
+    /** Window end, exclusive (ISO-8601, UTC midnight). */
+    to: string;
+    /** Earliest attributed event for the org, or null before the first one. */
+    collection_started_at: string | null;
+    data: OrgUsageRow[];
+    totals: OrgUsageTotals;
+    /** Opaque keyset cursor, or null on the last page. */
+    next_cursor: string | null;
+}
+/** The only windows the endpoint accepts (`days` enum in `openapi.json`). */
+export declare const USAGE_ALLOWED_DAYS: readonly [7, 30, 90];
+export type UsageDays = (typeof USAGE_ALLOWED_DAYS)[number];
+export interface OrgUsageQuery {
+    days?: UsageDays;
+    personId?: string;
+    provider?: string;
+    model?: string;
+    limit?: number;
+    cursor?: string;
+}
+/**
+ * GET /v1/orgs/:org_id/usage/by-person — consumption by person/provider/model.
+ *
+ * Role-gated to owner/admin/auditor; member and viewer get a real 403.
+ *
+ * Gated by USAGE_ATTRIBUTION_API_ENABLED, which returns **404, not 403**, when
+ * off — deliberately, so a disabled endpoint is indistinguishable from one that
+ * does not exist. That makes 404 ambiguous by design (flag off OR unknown org
+ * OR no access), so no `notFoundLabel` is passed here: a caller must not tell
+ * the user "org not found" on what is most often just the flag being off.
+ */
+export declare function getOrgUsage(orgId: string, opts?: OrgUsageQuery): Promise<OrgUsageResponse>;
 export {};