@mnemom/mnemom 0.16.2 → 0.17.0-next.0

package/dist/lib/skills.js

@@ -42,23 +42,36 @@ export const SKILLS = [
     },
     {
         name: "onboard",
-        status: "planned",
-        ref: "MNE-933",
-        summary: "Self-onboard the calling agent end-to-end (scan → claim → declare → badge).",
-        usage: "mnemom onboard",
+        status: "available",
+        summary: "Self-onboard the calling agent end-to-end (scan → claim → declare → rating → badge).",
+        usage: "mnemom onboard [--agent <id>] [--key <key>] [--hash-proof <hex>] [--yes] [--json] [--no-open]",
         description: "Runs the sovereignty path for the calling agent itself: scan its trust posture, " +
-            "claim its identity, declare an alignment card, and earn a verifiable Trust Rating — " +
-            "one command, no manifest. Planned (MNE-933).",
+            "claim its identity (as its own device-grant principal), declare a starter alignment " +
+            "card, and surface a Trust Rating + public badge URL — one command, no manifest. " +
+            "The Trust Rating is provisional until the observer pipeline generates traces (the " +
+            "signed rating + rendered badge are computed server-side, post-hoc). Idempotent: " +
+            "re-running skips an already-claimed identity and replays an unchanged card.",
+        examples: [
+            "npx @mnemom/mnemom@latest onboard",
+            "mnemom onboard --json",
+            "mnemom onboard --agent mnm-... --key <agent-api-key>",
+        ],
     },
     {
         name: "wrap",
-        status: "planned",
-        ref: "MNE-935",
+        status: "available",
         summary: "Instrument an existing production agent through the Mnemom gateway.",
-        usage: "mnemom wrap",
-        description: "Points an existing agent's provider calls at the Mnemom gateway, claims/births its " +
-            "identity, and seeds starter alignment + protection cards — bring-your-own-agent " +
-            "onboarding. Planned (MNE-935).",
+        usage: "mnemom wrap [--provider <anthropic|openai|gemini>] [--framework <python|node>] " +
+            "[--name <name>] [--provider-key <key>] [--yes] [--json]",
+        description: "Points an existing agent's provider calls at the Mnemom gateway " +
+            "(`gateway.mnemom.ai/<provider>` + `x-mnemom-agent` header), births its identity, " +
+            "and seeds starter alignment + protection cards — bring-your-own-agent onboarding. " +
+            "Emits a drop-in code snippet for your provider SDK and next-step claim instructions.",
+        examples: [
+            "npx @mnemom/mnemom@latest wrap",
+            "mnemom wrap --provider anthropic --framework python --name my-agent",
+            "mnemom wrap --json",
+        ],
     },
 ];
 /** All registered skills, in registry order. */

package/dist/lib/version-gate.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Minimum-CLI-version enforcement.
+ *
+ * The Mnemom API advertises the lowest fully-supported CLI version on every
+ * response via the `X-Mnemom-Min-CLI` header (mnemom-api MIN_CLI_VERSION). This
+ * module reads that header off any API response and, if THIS CLI is below the
+ * floor, prints a loud upgrade instruction and hard-exits.
+ *
+ * Why hard-fail: an outdated CLI can silently drop request fields a newer server
+ * expects and produce a wrong-but-successful result with no error. The canonical
+ * case that motivated this: a CLI predating claim-to-org (ADR-062) accepted
+ * `--org` but never sent `org_id`, so `agents claim … --org <slug>` cheerfully
+ * landed the agent in the caller's personal org. Failing loudly beats a silent
+ * wrong outcome.
+ */
+/**
+ * Compare dotted numeric versions. Returns true iff `current` is strictly below
+ * `floor`. Prerelease/build suffixes (after `-` or `+`) are ignored — the floor
+ * is expressed as a plain release, and a prerelease of that release is treated
+ * as the release for gating purposes (we don't block `-rc` builds of a good ver).
+ */
+export declare function isBelowVersion(current: string, floor: string): boolean;
+/**
+ * Enforce the server-advertised minimum CLI version against `response`.
+ * No-op when the header is absent (older server, or a non-API response) or when
+ * this CLI is at/above the floor. Otherwise writes a clear message to stderr and
+ * exits with code 1.
+ *
+ * @param exit  injectable for tests; defaults to process.exit
+ * @param write injectable for tests; defaults to process.stderr.write
+ */
+export declare function enforceMinCliVersion(response: Pick<Response, "headers">, exit?: (code: number) => never, write?: (chunk: string) => void): void;
+/**
+ * Drop-in wrapper around global fetch for Mnemom API calls: issues the request,
+ * enforces the advertised minimum CLI version on the response, then returns it.
+ */
+export declare function mnemomFetch(input: string | URL, init?: RequestInit): Promise<Response>;

package/dist/lib/version-gate.js

@@ -0,0 +1,84 @@
+/**
+ * Minimum-CLI-version enforcement.
+ *
+ * The Mnemom API advertises the lowest fully-supported CLI version on every
+ * response via the `X-Mnemom-Min-CLI` header (mnemom-api MIN_CLI_VERSION). This
+ * module reads that header off any API response and, if THIS CLI is below the
+ * floor, prints a loud upgrade instruction and hard-exits.
+ *
+ * Why hard-fail: an outdated CLI can silently drop request fields a newer server
+ * expects and produce a wrong-but-successful result with no error. The canonical
+ * case that motivated this: a CLI predating claim-to-org (ADR-062) accepted
+ * `--org` but never sent `org_id`, so `agents claim … --org <slug>` cheerfully
+ * landed the agent in the caller's personal org. Failing loudly beats a silent
+ * wrong outcome.
+ */
+import { CLI_VERSION } from "../version.js";
+const MIN_CLI_HEADER = "x-mnemom-min-cli";
+/**
+ * Compare dotted numeric versions. Returns true iff `current` is strictly below
+ * `floor`. Prerelease/build suffixes (after `-` or `+`) are ignored — the floor
+ * is expressed as a plain release, and a prerelease of that release is treated
+ * as the release for gating purposes (we don't block `-rc` builds of a good ver).
+ */
+export function isBelowVersion(current, floor) {
+    const parse = (v) => v
+        .trim()
+        .split(/[-+]/)[0]
+        .split(".")
+        .map((n) => {
+        const parsed = Number.parseInt(n, 10);
+        return Number.isNaN(parsed) ? 0 : parsed;
+    });
+    const c = parse(current);
+    const f = parse(floor);
+    const len = Math.max(c.length, f.length);
+    for (let i = 0; i < len; i++) {
+        const cv = c[i] ?? 0;
+        const fv = f[i] ?? 0;
+        if (cv < fv)
+            return true;
+        if (cv > fv)
+            return false;
+    }
+    return false; // equal → supported
+}
+// Guard so a command issuing several requests exits exactly once.
+let exited = false;
+/**
+ * Enforce the server-advertised minimum CLI version against `response`.
+ * No-op when the header is absent (older server, or a non-API response) or when
+ * this CLI is at/above the floor. Otherwise writes a clear message to stderr and
+ * exits with code 1.
+ *
+ * @param exit  injectable for tests; defaults to process.exit
+ * @param write injectable for tests; defaults to process.stderr.write
+ */
+export function enforceMinCliVersion(response, exit = process.exit, write = (chunk) => void process.stderr.write(chunk)) {
+    // Defensive: some callers/tests provide a Response-like object without a real
+    // Headers instance. Treat a missing/incompatible headers bag as "no floor".
+    const headers = response?.headers;
+    const floor = typeof headers?.get === "function" ? headers.get(MIN_CLI_HEADER) : null;
+    if (!floor)
+        return;
+    if (!isBelowVersion(CLI_VERSION, floor))
+        return;
+    if (exited)
+        return;
+    exited = true;
+    write(`\n✖ Your Mnemom CLI (v${CLI_VERSION}) is too old for this server (minimum v${floor}).\n` +
+        `  Old CLIs can silently drop newer request fields — e.g. \`--org\` on \`mnemom agents claim\`.\n\n` +
+        `  Upgrade:  npm i -g @mnemom/mnemom@latest\n\n`);
+    exit(1);
+}
+/**
+ * Drop-in wrapper around global fetch for Mnemom API calls: issues the request,
+ * enforces the advertised minimum CLI version on the response, then returns it.
+ */
+export async function mnemomFetch(input, init) {
+    // Preserve the exact call shape: fetch(input) when no init, so callers and
+    // tests that assert a single-arg fetch stay valid.
+    const response = init === undefined ? await fetch(input) : await fetch(input, init);
+    enforceMinCliVersion(response);
+    return response;
+}

package/dist/rc-proxy.mjs

@@ -0,0 +1,341 @@
+#!/usr/bin/env node
+// mnemom-code-rc-proxy — the local proxy behind ``mnemom code … --remote-control``.
+//
+// WHY THIS EXISTS
+// Claude Code's `remote-control` subcommand (drive a local session from claude.ai / the
+// mobile app) is gated: it refuses to start unless the CLI believes it talks to
+// api.anthropic.com with a claude.ai (OAuth) login — no ANTHROPIC_BASE_URL, no
+// ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN, no ANTHROPIC_UNIX_SOCKET. Every knob the
+// normal `mnemom code` launch uses to reach the Mnemom gateway trips that gate.
+// HTTPS_PROXY + NODE_EXTRA_CA_CERTS are honoured and NOT gated (measured 2026-09-13,
+// Claude Code 2.1.269). So `--remote-control` runs Claude Code untouched — OAuth login,
+// first-party base URL — and puts this proxy in front of it.
+//
+// WHAT IT DOES
+//   * Listens on 127.0.0.1 (ephemeral port) as an HTTP CONNECT proxy.
+//   * Terminates TLS for api.anthropic.com ONLY, with an ephemeral CA + leaf minted at
+//     startup into a private 0700 tmpdir (CA key deleted right after signing, dir removed on
+//     exit). Every other host is tunnelled byte-for-byte (telemetry, Datadog, MCP servers…).
+//   * Inside api.anthropic.com, only `POST /v1/messages[?…]` is rewritten to the Mnemom
+//     gateway door: the real Anthropic key rides as `x-api-key` (API-key billing), plus
+//     `x-mnemom-agent`, `x-mnemom-conversation-id`, and optionally `x-mnemom-api-key`,
+//     `x-mnemom-provider`, `x-mnemom-egress-key`, `x-mnemom-contract` — the exact header set
+//     the non-RC launch sends via ANTHROPIC_CUSTOM_HEADERS. The OAuth `authorization` bearer
+//     is STRIPPED on that leg (it never leaves the machine) and `oauth-*` tokens are removed
+//     from `anthropic-beta`. Everything else under api.anthropic.com (OAuth refresh, the
+//     Remote Control bridge `/v1/code/sessions/*`, `/v1/environments/*/work/poll`, event
+//     logging) passes through to the real host untouched.
+//   * Serves BOTH request forms: CONNECT tunnels and absolute-form plaintext requests to the
+//     proxy port. Remote Control registration and the environment work-poll loop use the
+//     latter for https URLs; a CONNECT-only proxy answers 405 and registration fails.
+//   * Body handling on the gateway leg (see the mnemom code docs (Remote Control)):
+//       - deletes every `cache_control.ttl` — Claude Code on claude.ai auth marks blocks
+//         `ttl:"1h"`; the gateway prepends its own 5m-cached system block and Anthropic
+//         rejects a 1h block that follows a 5m one (400). Forwarded bodies only.
+//       - a body carrying a top-level `thread` (Claude Code's message-threads / "tether"
+//         feature, beta `message-threads-2026-08-12`) is ANSWERED LOCALLY with a 400 whose
+//         `details.error_code` is `thread_unsupported_request`, and never reaches the
+//         gateway. `thread:{type:"create"}` carries the full transcript, but
+//         `thread:{type:"continue",previous_message_id}` carries only the messages after
+//         the anchor — a delta the API rejects as a whole conversation (400 "unexpected
+//         tool_use_id found in tool_result blocks"), one wasted gateway + judge call per
+//         tool-using turn. Thread state would have to live at the gateway, cross-org
+//         (mnemom-platform#1770). On this 400 Claude Code resends the same turn stateless
+//         (full transcript, no `thread`) and stops threading on that model for the rest of
+//         the session. The latch is per agent+model, so a subagent or a /model switch takes
+//         one more local 400: typically one or two `-> local 400` lines early in the
+//         session, each an instant local round trip, and zero gateway 400s. A `thread: null`
+//         is not a thread — the key is deleted and the body forwarded.
+//         MNEMOM_CODE_RC_THREAD_MODE=strip restores the legacy delete-and-forward behaviour
+//         (diagnostic only: it forwards continue-deltas the API rejects).
+//
+// SECRETS
+// Arrive on stdin as three newline-terminated lines: Anthropic key, Mnemom key (may be
+// empty), OpenAI egress key (may be empty). Never argv, never env, never disk, never logged.
+// The log (MNEMOM_CODE_RC_PROXY_LOG, else stderr) carries method/path/status/latency and the
+// gateway's `x-mnemom-agent` / `x-mnemom-goal-verdict` response headers only. Gateway error
+// bodies (status ≥ 400) are logged truncated so a 4xx is diagnosable (compressed ones as
+// `body=<encoding> <N> bytes`). Locally answered thread 400s log the thread type only.
+//
+// CONFIG (env, none secret)
+//   MNEMOM_CODE_RC_DOOR              gateway door URL (required), e.g. https://gateway.mnemom.ai/anthropic
+//   MNEMOM_CODE_RC_AGENT             x-mnemom-agent value (required)
+//   MNEMOM_CODE_RC_CONVERSATION_ID   x-mnemom-conversation-id value (required)
+//   MNEMOM_CODE_RC_CONTRACT_B64      base64 contract for x-mnemom-contract (optional)
+//   MNEMOM_CODE_RC_PROVIDER          x-mnemom-provider directive JSON (optional; router door)
+//   MNEMOM_CODE_RC_THREAD_MODE       `reject` (default: answer thread-bearing requests locally,
+//                                  see above) | `strip` (legacy: delete `thread`, forward)
+//   MNEMOM_CODE_RC_PROXY_LOG         append log lines to this file instead of stderr (optional)
+//   MNEMOM_CODE_RC_PARENT_PID        exit when this pid is gone, so no orphan holds the keys
+//   MNEMOM_CODE_RC_PORT              listen port (default 0 = ephemeral)
+//
+// stdout: exactly one line, `READY <port> <ca.pem path>`, once listening. Node ≥ 18, no deps.
+import http from 'node:http';
+import https from 'node:https';
+import net from 'node:net';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+
+const MITM_HOST = 'api.anthropic.com';
+const env = process.env;
+
+function die(msg) { process.stderr.write(`mnemom-code-rc-proxy: ${msg}\n`); process.exit(2); }
+
+if (!env.MNEMOM_CODE_RC_DOOR) die('MNEMOM_CODE_RC_DOOR is required');
+let GATEWAY;
+try { GATEWAY = new URL(env.MNEMOM_CODE_RC_DOOR); } catch { die(`MNEMOM_CODE_RC_DOOR is not a URL: ${env.MNEMOM_CODE_RC_DOOR}`); }
+if (GATEWAY.protocol !== 'https:') die('MNEMOM_CODE_RC_DOOR must be https');
+const AGENT = env.MNEMOM_CODE_RC_AGENT || die('MNEMOM_CODE_RC_AGENT is required');
+const CONV = env.MNEMOM_CODE_RC_CONVERSATION_ID || die('MNEMOM_CODE_RC_CONVERSATION_ID is required');
+const CONTRACT_B64 = env.MNEMOM_CODE_RC_CONTRACT_B64 || '';
+const PROVIDER = env.MNEMOM_CODE_RC_PROVIDER || '';
+const THREAD_MODE = env.MNEMOM_CODE_RC_THREAD_MODE || 'reject';
+if (THREAD_MODE !== 'reject' && THREAD_MODE !== 'strip') die(`MNEMOM_CODE_RC_THREAD_MODE must be 'reject' or 'strip', got '${THREAD_MODE}'`);
+const LOGFILE = env.MNEMOM_CODE_RC_PROXY_LOG || '';
+const PARENT = Number(env.MNEMOM_CODE_RC_PARENT_PID || 0);
+const PORT = Number(env.MNEMOM_CODE_RC_PORT || 0);
+
+const log = (line) => {
+  const s = `${new Date().toISOString()} ${line}\n`;
+  if (LOGFILE) { try { fs.appendFileSync(LOGFILE, s); return; } catch { /* fall through */ } }
+  process.stderr.write(s);
+};
+
+// --- secrets: three lines on stdin ------------------------------------------------------
+let secrets;
+try {
+  const lines = fs.readFileSync(0, 'utf8').split('\n');
+  secrets = { anthropic: (lines[0] || '').trim(), mnemom: (lines[1] || '').trim(), openai: (lines[2] || '').trim() };
+} catch {
+  die('expected three lines of secrets on stdin (anthropic, mnemom, openai)');
+}
+if (!secrets.anthropic) die('the Anthropic key (stdin line 1) is empty');
+
+// --- ephemeral CA + leaf for api.anthropic.com ------------------------------------------
+// Private 0700 dir under the OS tmpdir; the CA key is deleted as soon as the leaf is signed
+// (only the leaf key is needed to serve sessions) and the whole dir goes on exit. Works with
+// macOS's system LibreSSL (3.3+) and OpenSSL 1.1.1+ (`-addext`).
+const caDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mnemom-code-rc-ca-'));
+fs.chmodSync(caDir, 0o700);
+const p = (f) => path.join(caDir, f);
+const cleanup = () => { try { fs.rmSync(caDir, { recursive: true, force: true }); } catch { /* best effort */ } };
+process.on('exit', cleanup);
+for (const sig of ['SIGINT', 'SIGTERM', 'SIGHUP']) process.on(sig, () => process.exit(0));
+try {
+  const ossl = (...a) => execFileSync('openssl', a, { stdio: ['ignore', 'ignore', 'pipe'] });
+  ossl('req', '-x509', '-newkey', 'ec', '-pkeyopt', 'ec_paramgen_curve:prime256v1', '-nodes',
+    '-keyout', p('ca.key'), '-out', p('ca.pem'), '-days', '2', '-subj', '/CN=mnemom code local CA (ephemeral)',
+    '-addext', 'basicConstraints=critical,CA:TRUE', '-addext', 'keyUsage=critical,keyCertSign,cRLSign');
+  ossl('req', '-newkey', 'ec', '-pkeyopt', 'ec_paramgen_curve:prime256v1', '-nodes',
+    '-keyout', p('leaf.key'), '-out', p('leaf.csr'), '-subj', `/CN=${MITM_HOST}`);
+  fs.writeFileSync(p('leaf.ext'),
+    `subjectAltName=DNS:${MITM_HOST}\nbasicConstraints=CA:FALSE\nkeyUsage=digitalSignature,keyEncipherment\nextendedKeyUsage=serverAuth\n`);
+  ossl('x509', '-req', '-in', p('leaf.csr'), '-CA', p('ca.pem'), '-CAkey', p('ca.key'), '-CAcreateserial',
+    '-out', p('leaf.pem'), '-days', '2', '-extfile', p('leaf.ext'));
+  fs.rmSync(p('ca.key'));
+} catch (e) {
+  die(`could not mint the ephemeral CA with openssl: ${e.stderr ? e.stderr.toString() : e.message}`);
+}
+
+// --- request handling ---------------------------------------------------------------------
+const gatewayAgent = new https.Agent({ keepAlive: false }); // a reused socket to the gateway gave ECONNRESET on retry
+const upstreamAgent = new https.Agent({ keepAlive: true, maxSockets: 32 });
+const HOP = new Set(['connection', 'proxy-connection', 'keep-alive', 'upgrade', 'host', 'te', 'trailer']);
+
+const isMessagesPath = (u) => u === '/v1/messages' || u.startsWith('/v1/messages?');
+
+// Inspect + normalise a /v1/messages body for the gateway leg. Returns
+//   { body: <possibly rewritten Buffer>, thread: null | 'create' | 'continue' | 'other' }
+// `thread` reports whether the body carried a non-null top-level `thread` field (the type
+// is reduced to one of three words so nothing from the body can reach the log). A
+// `thread: null` is semantically thread-less (JSON.stringify keeps null, unlike undefined):
+// the key is deleted and the body forwarded, because Claude Code's own 400 handler would
+// read `.type` off it and throw instead of retrying stateless. Under THREAD_MODE=strip a
+// real thread is deleted from the returned body; under `reject` the body is returned
+// unchanged apart from `cache_control.ttl`, because the caller will not forward it.
+function normalizeBody(body) {
+  try {
+    const j = JSON.parse(body.toString('utf8'));
+    let n = 0;
+    const walk = (o) => {
+      if (Array.isArray(o)) { for (const x of o) walk(x); return; }
+      if (o && typeof o === 'object') {
+        if (o.cache_control && typeof o.cache_control === 'object' && 'ttl' in o.cache_control) { delete o.cache_control.ttl; n++; }
+        for (const v of Object.values(o)) walk(v);
+      }
+    };
+    walk(j);
+    let thread = null;
+    if (j && typeof j === 'object' && !Array.isArray(j) && 'thread' in j) {
+      if (j.thread === null || j.thread === undefined) {
+        delete j.thread; n++;                             // not a thread: forward the rest
+      } else {
+        const t = typeof j.thread === 'object' ? j.thread.type : undefined;
+        thread = t === 'create' || t === 'continue' ? t : 'other';
+        if (THREAD_MODE === 'strip') { delete j.thread; n++; }
+      }
+    }
+    return { body: n ? Buffer.from(JSON.stringify(j)) : body, thread };
+  } catch {
+    return { body, thread: null }; // not JSON: forward untouched
+  }
+}
+
+// The local answer for a thread-bearing request. Every branch of Claude Code's thread-400
+// classifier must land on "unsupported_request": `details.error_code` is the primary
+// signal, and the message names the beta, the `thread` param and `previous_message_id`
+// so the fallback regexes agree even if the details path were ever ignored.
+const THREAD_400 = Buffer.from(JSON.stringify({
+  type: 'error',
+  error: {
+    type: 'invalid_request_error',
+    message: 'message threads (beta message-threads-2026-08-12: top-level thread param / previous_message_id) are not supported on the mnemom gateway leg; resend the full transcript without a thread',
+    details: { error_code: 'thread_unsupported_request' },
+  },
+}));
+let localSeq = 0;
+function rejectThread(res, tag, thread) {
+  res.writeHead(400, {
+    'content-type': 'application/json',
+    'content-length': String(THREAD_400.length),
+    'request-id': `mnemom-code-rc-proxy-${++localSeq}`,
+  });
+  res.end(THREAD_400);
+  log(`${tag} -> local 400 thread=${thread} (thread_unsupported_request; Claude Code resends this turn stateless and stops threading for this agent+model for the rest of the session — a subagent or model switch takes one more local 400)`);
+}
+
+// One handler serves both the MITM'd TLS stream (origin-form URLs, host = api.anthropic.com)
+// and absolute-form plaintext requests sent straight to the proxy port.
+function handle(req, res, viaPlain) {
+  let host = MITM_HOST, port = 443, urlPath = req.url, proto = https;
+  if (viaPlain) {
+    let u;
+    try { u = new URL(req.url); } catch { res.writeHead(400); res.end('mnemom-code-rc-proxy: absolute-form URL required\n'); return; }
+    host = u.hostname;
+    port = Number(u.port || (u.protocol === 'http:' ? 80 : 443));
+    urlPath = u.pathname + u.search;
+    proto = u.protocol === 'http:' ? http : https;
+  }
+  const headers = {};
+  for (const [k, v] of Object.entries(req.headers)) if (!HOP.has(k)) headers[k] = v;
+
+  const toGateway = host === MITM_HOST && isMessagesPath(urlPath);
+  let target;
+  if (toGateway) {
+    target = { hostname: GATEWAY.hostname, port: GATEWAY.port || 443,
+      path: GATEWAY.pathname.replace(/\/$/, '') + urlPath, agent: gatewayAgent };
+    delete headers.authorization;                       // the OAuth bearer stays local
+    headers['x-api-key'] = secrets.anthropic;
+    headers['x-mnemom-agent'] = AGENT;
+    headers['x-mnemom-conversation-id'] = CONV;
+    if (secrets.mnemom) headers['x-mnemom-api-key'] = secrets.mnemom;
+    if (PROVIDER) headers['x-mnemom-provider'] = PROVIDER;
+    if (secrets.openai) headers['x-mnemom-egress-key'] = secrets.openai;
+    if (CONTRACT_B64) headers['x-mnemom-contract'] = CONTRACT_B64;
+    if (headers['anthropic-beta']) {                    // drop the OAuth-only beta tokens
+      const b = String(headers['anthropic-beta']).split(',').map((s) => s.trim()).filter((s) => s && !s.startsWith('oauth-'));
+      if (b.length) headers['anthropic-beta'] = b.join(','); else delete headers['anthropic-beta'];
+    }
+  } else {
+    target = { hostname: host, port, path: urlPath, agent: proto === https ? upstreamAgent : undefined };
+  }
+
+  const started = Date.now();
+  const tag = `${req.method} ${viaPlain ? host : ''}${urlPath}`;
+  const leg = toGateway ? 'gateway' : 'upstream';
+
+  // Open the upstream request only once we know we are forwarding. `body` is the fully
+  // buffered (normalised) gateway body; undefined means stream the client request through.
+  const forward = (body) => {
+    const opts = { ...target, method: req.method, headers };
+    if (!net.isIP(target.hostname)) opts.servername = target.hostname; // SNI is for names, not IPs
+    const up = (toGateway ? https : proto).request(opts, (ur) => {
+      res.writeHead(ur.statusCode, ur.headers);
+      // Gateway error bodies are logged (truncated) so a 4xx is diagnosable — unless the
+      // body is compressed, in which case only its encoding + size is useful
+      // (`identity` is not a compression).
+      let errBody = '', errBytes = 0;
+      const enc = ur.headers['content-encoding'];
+      const errEnc = enc && enc !== 'identity' ? enc : '';
+      if (toGateway && ur.statusCode >= 400) {
+        ur.on('data', (c) => { errBytes += c.length; if (!errEnc && errBody.length < 1500) errBody += c.toString('utf8'); });
+      }
+      ur.pipe(res);
+      const ident = toGateway ? ` agent=${ur.headers['x-mnemom-agent'] || '-'} verdict=${ur.headers['x-mnemom-goal-verdict'] || '-'}` : '';
+      ur.on('end', () => {
+        let bodyNote = '';
+        if (toGateway && ur.statusCode >= 400) {
+          bodyNote = errEnc ? ` body=${errEnc} ${errBytes} bytes` : (errBody ? ' body=' + errBody.slice(0, 1500).replace(/\s+/g, ' ') : '');
+        }
+        log(`${tag} -> ${leg} ${ur.statusCode} ${Date.now() - started}ms${ident}${bodyNote}`);
+      });
+    });
+    up.on('error', (e) => {
+      log(`${tag} -> ${leg} ERROR ${e.code || e.message}`);
+      if (!res.headersSent) res.writeHead(502, { 'content-type': 'application/json' });
+      res.end(JSON.stringify({ type: 'error', error: { type: 'proxy_error', message: `mnemom-code-rc-proxy upstream: ${e.code || e.message}` } }));
+    });
+    res.on('close', () => { if (!up.destroyed) up.destroy(); });
+    if (body !== undefined) {
+      up.removeHeader('transfer-encoding');
+      up.setHeader('content-length', String(body.length));
+      up.end(body);
+    } else {
+      req.pipe(up);
+    }
+  };
+
+  if (toGateway && req.method === 'POST') {
+    // Buffer the body first: a thread-bearing request is answered here and nothing may be
+    // sent to (or left half-open toward) the gateway for it.
+    const chunks = [];
+    req.on('data', (c) => chunks.push(c));
+    req.on('end', () => {
+      const { body, thread } = normalizeBody(Buffer.concat(chunks));
+      if (thread !== null && THREAD_MODE === 'reject') { rejectThread(res, tag, thread); return; }
+      forward(body);
+    });
+  } else {
+    forward();
+  }
+}
+
+const tlsServer = https.createServer(
+  { key: fs.readFileSync(p('leaf.key')), cert: fs.readFileSync(p('leaf.pem')) },
+  (req, res) => handle(req, res, false),
+);
+tlsServer.on('tlsClientError', (e) => log(`tls client error: ${e.code || e.message}`));
+
+const proxy = http.createServer((req, res) => handle(req, res, true));
+proxy.on('connect', (req, sock, head) => {
+  const [host, portStr] = req.url.split(':');
+  const port = Number(portStr || 443);
+  sock.on('error', () => {});
+  if (host === MITM_HOST && port === 443) {
+    sock.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+    if (head && head.length) sock.unshift(head);
+    tlsServer.emit('connection', sock);
+    return;
+  }
+  const up = net.connect(port, host, () => {
+    sock.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+    if (head && head.length) up.write(head);
+    up.pipe(sock); sock.pipe(up);
+  });
+  up.on('error', (e) => { log(`CONNECT ${req.url} tunnel ERROR ${e.code || e.message}`); sock.destroy(); });
+  sock.on('close', () => up.destroy());
+  up.on('close', () => sock.destroy());
+  log(`CONNECT ${req.url} tunnel`);
+});
+proxy.on('clientError', (e, sock) => { try { sock.destroy(); } catch { /* already gone */ } });
+
+proxy.listen(PORT, '127.0.0.1', () => {
+  const { port } = proxy.address();
+  log(`listening 127.0.0.1:${port} agent=${AGENT} conv=${CONV} door=${GATEWAY.href} contract=${CONTRACT_B64 ? 'yes' : 'no'} provider=${PROVIDER || '-'} thread=${THREAD_MODE}`);
+  process.stdout.write(`READY ${port} ${p('ca.pem')}\n`);
+});
+
+// Die with the launcher so no orphan keeps the secrets in memory.
+if (PARENT) setInterval(() => { try { process.kill(PARENT, 0); } catch { process.exit(0); } }, 2000).unref();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemom/mnemom",
-  "version": "0.16.2",
+  "version": "0.17.0-next.0",
   "description": "Transparent AI agent tracing",
   "type": "module",
   "bin": {
@@ -8,7 +8,8 @@
     "smoltbot": "./dist/smoltbot-shim.js"
   },
   "scripts": {
-    "build": "npm install && npm install --prefix ../shared/policy-engine && npm run build --prefix ../shared/policy-engine && tsc",
+    "build": "tsc && node scripts/copy-assets.mjs",
+    "prepublishOnly": "npm run build",
     "dev": "tsx src/index.ts",
     "gen:command-tree": "tsx scripts/gen-command-tree.mjs",
     "check:command-tree": "tsx scripts/gen-command-tree.mjs --check",
@@ -19,15 +20,16 @@
     "@mnemom/policy-engine": "^0.3.0",
     "chalk": "^5.3.0",
     "commander": "^12.0.0",
-    "js-yaml": "^4.1.1"
+    "js-yaml": "^4.3.2",
+    "smol-toml": "^1.8.0"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^20.10.0",
-    "@vitest/coverage-v8": "^1.6.1",
-    "tsx": "^4.7.0",
-    "typescript": "^5.3.3",
-    "vitest": "^1.2.0"
+    "@vitest/coverage-v8": "^4.1.10",
+    "tsx": "^4.23.1",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.10"
   },
   "files": [
     "dist",