@mnemom/mnemom 0.17.0-next.6 → 0.17.0-next.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/commands/agent-config.d.ts +17 -0
- package/dist/commands/agent-config.js +173 -0
- package/dist/commands/{code-doctor.d.ts → agent-doctor.d.ts} +2 -2
- package/dist/commands/{code-doctor.js → agent-doctor.js} +27 -22
- package/dist/commands/{code-invite.d.ts → agent-invite.d.ts} +18 -18
- package/dist/commands/{code-invite.js → agent-invite.js} +30 -30
- package/dist/commands/{code-session.d.ts → agent-session.d.ts} +2 -2
- package/dist/commands/{code-session.js → agent-session.js} +8 -8
- package/dist/commands/{code-setup.d.ts → agent-setup.d.ts} +13 -13
- package/dist/commands/{code-setup.js → agent-setup.js} +46 -42
- package/dist/commands/{code.d.ts → agent.d.ts} +14 -14
- package/dist/commands/{code.js → agent.js} +76 -76
- package/dist/commands/agents.d.ts +2 -2
- package/dist/commands/agents.js +5 -5
- package/dist/commands/onboard.js +1 -1
- package/dist/commands/wrap.js +1 -1
- package/dist/index.js +42 -47
- package/dist/lib/{code.d.ts → agent.d.ts} +9 -9
- package/dist/lib/{code.js → agent.js} +14 -14
- package/dist/lib/api.d.ts +4 -4
- package/dist/lib/api.js +9 -9
- package/dist/lib/{code-config.d.ts → launcher-config.d.ts} +23 -23
- package/dist/lib/{code-config.js → launcher-config.js} +31 -31
- package/dist/lib/version-gate.js +1 -1
- package/dist/rc-proxy.mjs +297 -134
- package/package.json +1 -1
- package/dist/commands/code-config.d.ts +0 -17
- package/dist/commands/code-config.js +0 -147
|
@@ -1,9 +1,9 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* `mnemom
|
|
3
|
-
* `mnemom
|
|
2
|
+
* `mnemom agent setup` + the zero-friction provisioning behind a bare
|
|
3
|
+
* `mnemom agent <scenario>`.
|
|
4
4
|
*
|
|
5
|
-
* If a customer names no agent, `mnemom
|
|
6
|
-
* governed identity `
|
|
5
|
+
* If a customer names no agent, `mnemom agent` launches under a per-customer
|
|
6
|
+
* governed identity `agent-<handle>`. This module makes that identity REAL in
|
|
7
7
|
* their Mnemom org: it births the agent through the gateway, claims it (so the
|
|
8
8
|
* customer owns it), and publishes a sane default coding posture. The CARDS are
|
|
9
9
|
* observe-only (visibility, no active intervention); the goal contract is what
|
|
@@ -24,15 +24,15 @@
|
|
|
24
24
|
* putAlignmentCard/putProtectionCard (lib/api.ts) — rather than reinventing it.
|
|
25
25
|
*/
|
|
26
26
|
/**
|
|
27
|
-
* The default governed-agent slug for the current customer: `
|
|
27
|
+
* The default governed-agent slug for the current customer: `agent-<handle>`,
|
|
28
28
|
* where <handle> is the local-part of their mnemom login email (sanitised), or
|
|
29
29
|
* "user" when no email is available (API-key auth / opaque OAuth token).
|
|
30
30
|
*/
|
|
31
31
|
export declare function defaultAgentSlug(): string;
|
|
32
32
|
/**
|
|
33
|
-
* The default slug resolved from the authenticated IDENTITY: `
|
|
33
|
+
* The default slug resolved from the authenticated IDENTITY: `agent-<handle>` from
|
|
34
34
|
* the login email fetched via `/v1/auth/me`. The CLI's stored OAuth token carries
|
|
35
|
-
* no email, so the sync `defaultAgentSlug()` alone falls back to "
|
|
35
|
+
* no email, so the sync `defaultAgentSlug()` alone falls back to "agent-user";
|
|
36
36
|
* this fetches the real email once a session exists. Falls back to
|
|
37
37
|
* `defaultAgentSlug()` on any failure. Call it AFTER the session is ensured.
|
|
38
38
|
*/
|
|
@@ -60,12 +60,12 @@ export interface EnsureAgentResult {
|
|
|
60
60
|
* allowed here (non-interactive without --setup, or not logged in), or when the
|
|
61
61
|
* customer declines the confirm — in all those cases the launch continues under
|
|
62
62
|
* the given slug. THROWS only on an actual provisioning failure (birth/claim/
|
|
63
|
-
* card write) so the caller can decide whether that is fatal (`mnemom
|
|
63
|
+
* card write) so the caller can decide whether that is fatal (`mnemom agent
|
|
64
64
|
* setup`) or a warn-and-continue (a bare launch).
|
|
65
65
|
*/
|
|
66
66
|
export declare function ensureGovernedAgent(opts: EnsureAgentOptions): Promise<EnsureAgentResult>;
|
|
67
|
-
/** `mnemom
|
|
68
|
-
export declare function
|
|
67
|
+
/** `mnemom agent setup [--agent <slug>]` — the explicit provisioning entry point. */
|
|
68
|
+
export declare function agentSetupCommand(opts?: {
|
|
69
69
|
agent?: string;
|
|
70
70
|
}): Promise<void>;
|
|
71
71
|
/** Thrown when the agent's org has no spendable MU balance. The user-facing
|
|
@@ -77,7 +77,7 @@ export declare class MuInsufficientError extends Error {
|
|
|
77
77
|
/**
|
|
78
78
|
* The preamble errors whose guidance is ALREADY printed when thrown — callers
|
|
79
79
|
* exit 1 quietly instead of re-printing them as "Error: …". One predicate so the
|
|
80
|
-
* two catch sites (`mnemom
|
|
80
|
+
* two catch sites (`mnemom agent` and `mnemom agent setup`) cannot drift.
|
|
81
81
|
*/
|
|
82
82
|
export declare function isQuietPreambleExit(err: unknown): boolean;
|
|
83
83
|
/**
|
|
@@ -93,7 +93,7 @@ export declare function ensureMnemomSession(opts?: {
|
|
|
93
93
|
}): Promise<boolean>;
|
|
94
94
|
/**
|
|
95
95
|
* Enforce a positive Mnemom Units balance on the org the agent lives in.
|
|
96
|
-
* `mnemom
|
|
96
|
+
* `mnemom agent` has NO free tier — a determined zero/negative balance (or an org
|
|
97
97
|
* with no billing account) is BLOCKED with a portal-style top-up message.
|
|
98
98
|
* Fails OPEN on an inconclusive error (transient 5xx / network / 403), since the
|
|
99
99
|
* gateway is the real enforcement and this is a friendly pre-check; hard-blocks
|
|
@@ -101,7 +101,7 @@ export declare function ensureMnemomSession(opts?: {
|
|
|
101
101
|
*/
|
|
102
102
|
export declare function assertMuBalance(orgId: string, orgLabel: string): Promise<void>;
|
|
103
103
|
/**
|
|
104
|
-
* The shared pre-launch preamble for `mnemom
|
|
104
|
+
* The shared pre-launch preamble for `mnemom agent` (and `mnemom agent setup`):
|
|
105
105
|
* ensure a Mnemom session (login/sign-up), then enforce the MU balance on the
|
|
106
106
|
* org the agent lives in (default: the user's personal org). Returns the
|
|
107
107
|
* resolved org so the caller can reuse it. Throws with clear guidance when there
|
|
@@ -1,9 +1,9 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* `mnemom
|
|
3
|
-
* `mnemom
|
|
2
|
+
* `mnemom agent setup` + the zero-friction provisioning behind a bare
|
|
3
|
+
* `mnemom agent <scenario>`.
|
|
4
4
|
*
|
|
5
|
-
* If a customer names no agent, `mnemom
|
|
6
|
-
* governed identity `
|
|
5
|
+
* If a customer names no agent, `mnemom agent` launches under a per-customer
|
|
6
|
+
* governed identity `agent-<handle>`. This module makes that identity REAL in
|
|
7
7
|
* their Mnemom org: it births the agent through the gateway, claims it (so the
|
|
8
8
|
* customer owns it), and publishes a sane default coding posture. The CARDS are
|
|
9
9
|
* observe-only (visibility, no active intervention); the goal contract is what
|
|
@@ -29,15 +29,15 @@ import { getActiveOrg } from "../lib/cli-config.js";
|
|
|
29
29
|
import { getWebsiteUrl } from "../lib/config.js";
|
|
30
30
|
import { fmt } from "../lib/format.js";
|
|
31
31
|
import { askYesNo, isInteractive } from "../lib/prompt.js";
|
|
32
|
-
import { resolveGatewayHost, sanitizeAgentName } from "../lib/
|
|
33
|
-
import { configKeySpec,
|
|
32
|
+
import { resolveGatewayHost, sanitizeAgentName } from "../lib/agent.js";
|
|
33
|
+
import { configKeySpec, loadLauncherConfig, writeLauncherConfig } from "../lib/launcher-config.js";
|
|
34
34
|
import { deriveHashProof } from "./agents.js";
|
|
35
35
|
import { birthThroughGateway } from "./wrap.js";
|
|
36
|
-
import { resolveAnthropicKey } from "./
|
|
37
|
-
import { assertCodeEnabled, CodeNotEnabledError } from "./
|
|
36
|
+
import { resolveAnthropicKey } from "./agent.js";
|
|
37
|
+
import { assertCodeEnabled, CodeNotEnabledError } from "./agent-invite.js";
|
|
38
38
|
const say = (line = "") => console.error(line);
|
|
39
39
|
/**
|
|
40
|
-
* The default governed-agent slug for the current customer: `
|
|
40
|
+
* The default governed-agent slug for the current customer: `agent-<handle>`,
|
|
41
41
|
* where <handle> is the local-part of their mnemom login email (sanitised), or
|
|
42
42
|
* "user" when no email is available (API-key auth / opaque OAuth token).
|
|
43
43
|
*/
|
|
@@ -45,12 +45,12 @@ export function defaultAgentSlug() {
|
|
|
45
45
|
const email = getAuthInfo()?.email ?? "";
|
|
46
46
|
const local = email.split("@")[0] ?? "";
|
|
47
47
|
const handle = sanitizeAgentName(local) || "user";
|
|
48
|
-
return `
|
|
48
|
+
return `agent-${handle}`;
|
|
49
49
|
}
|
|
50
50
|
/**
|
|
51
|
-
* The default slug resolved from the authenticated IDENTITY: `
|
|
51
|
+
* The default slug resolved from the authenticated IDENTITY: `agent-<handle>` from
|
|
52
52
|
* the login email fetched via `/v1/auth/me`. The CLI's stored OAuth token carries
|
|
53
|
-
* no email, so the sync `defaultAgentSlug()` alone falls back to "
|
|
53
|
+
* no email, so the sync `defaultAgentSlug()` alone falls back to "agent-user";
|
|
54
54
|
* this fetches the real email once a session exists. Falls back to
|
|
55
55
|
* `defaultAgentSlug()` on any failure. Call it AFTER the session is ensured.
|
|
56
56
|
*/
|
|
@@ -59,7 +59,7 @@ export async function resolveDefaultSlug() {
|
|
|
59
59
|
const email = (await getMe()).email ?? "";
|
|
60
60
|
const handle = sanitizeAgentName(email.split("@")[0] ?? "");
|
|
61
61
|
if (handle)
|
|
62
|
-
return `
|
|
62
|
+
return `agent-${handle}`;
|
|
63
63
|
}
|
|
64
64
|
catch {
|
|
65
65
|
// fall through to the token-based best-effort
|
|
@@ -72,7 +72,7 @@ export async function resolveDefaultSlug() {
|
|
|
72
72
|
* allowed here (non-interactive without --setup, or not logged in), or when the
|
|
73
73
|
* customer declines the confirm — in all those cases the launch continues under
|
|
74
74
|
* the given slug. THROWS only on an actual provisioning failure (birth/claim/
|
|
75
|
-
* card write) so the caller can decide whether that is fatal (`mnemom
|
|
75
|
+
* card write) so the caller can decide whether that is fatal (`mnemom agent
|
|
76
76
|
* setup`) or a warn-and-continue (a bare launch).
|
|
77
77
|
*/
|
|
78
78
|
export async function ensureGovernedAgent(opts) {
|
|
@@ -83,11 +83,11 @@ export async function ensureGovernedAgent(opts) {
|
|
|
83
83
|
if (loggedIn) {
|
|
84
84
|
const existing = await getAgentByName(slug).catch(() => null);
|
|
85
85
|
if (existing) {
|
|
86
|
-
// On an EXPLICIT `mnemom
|
|
86
|
+
// On an EXPLICIT `mnemom agent setup`, repair/complete the cards on the
|
|
87
87
|
// already-claimed agent (e.g. a protection card that failed on a prior run
|
|
88
88
|
// before we minted its one-time grant). A bare launch leaves it alone.
|
|
89
89
|
if (opts.setup === true) {
|
|
90
|
-
say(fmt.dim(`mnemom
|
|
90
|
+
say(fmt.dim(`mnemom agent: '${slug}' is already claimed — refreshing its cards.`));
|
|
91
91
|
await publishDefaultCards(existing.id);
|
|
92
92
|
persistAgentSlug(slug);
|
|
93
93
|
return { slug, provisioned: true };
|
|
@@ -106,8 +106,8 @@ export async function ensureGovernedAgent(opts) {
|
|
|
106
106
|
if (opts.setup === true && !interactive) {
|
|
107
107
|
throw new Error("not authenticated — run `mnemom login` (or set MNEMOM_API_KEY) first.");
|
|
108
108
|
}
|
|
109
|
-
say(fmt.warn(`mnemom
|
|
110
|
-
say(fmt.dim(" Run `mnemom login`, then `mnemom
|
|
109
|
+
say(fmt.warn(`mnemom agent: not logged in — can't provision '${slug}'.`));
|
|
110
|
+
say(fmt.dim(" Run `mnemom login`, then `mnemom agent setup`. Launching with the unclaimed identity for now."));
|
|
111
111
|
return { slug, provisioned: false };
|
|
112
112
|
}
|
|
113
113
|
// 4. Confirm the plan (interactive runs; --setup non-interactive proceeds).
|
|
@@ -120,7 +120,7 @@ export async function ensureGovernedAgent(opts) {
|
|
|
120
120
|
say(fmt.label(" Posture:", "observe (alignment + protection observe-only, all surfaces screened); goal contracts nudge"));
|
|
121
121
|
say(fmt.dim(" Births the agent through the gateway, claims it to your org, and publishes its cards."));
|
|
122
122
|
if (!(await askYesNo("Provision and claim this agent now?", true))) {
|
|
123
|
-
say(fmt.dim(" Skipped — launching under the unclaimed identity. Run `mnemom
|
|
123
|
+
say(fmt.dim(" Skipped — launching under the unclaimed identity. Run `mnemom agent setup` anytime."));
|
|
124
124
|
return { slug, provisioned: false };
|
|
125
125
|
}
|
|
126
126
|
}
|
|
@@ -129,7 +129,7 @@ export async function ensureGovernedAgent(opts) {
|
|
|
129
129
|
const agentId = await birthThroughGateway(gatewayUrl, "anthropic", slug, opts.anthropicKey);
|
|
130
130
|
const hashProof = deriveHashProof(opts.anthropicKey, slug);
|
|
131
131
|
await claimAgent(agentId, { hashProof, orgId: org?.org_id });
|
|
132
|
-
say(fmt.success(`mnemom
|
|
132
|
+
say(fmt.success(`mnemom agent: claimed '${slug}' (${agentId}) in ${orgLabel}.`));
|
|
133
133
|
// Publish the observe-only cards. A card write that can't complete (propagation
|
|
134
134
|
// right after the claim, or a missing cards:write scope) does NOT abort the
|
|
135
135
|
// provision — the agent is claimed and governed on whatever landed; we warn how
|
|
@@ -181,23 +181,23 @@ async function publishDefaultCards(agentId) {
|
|
|
181
181
|
}
|
|
182
182
|
const prot = await tryPublishCard("protection", () => putProtectionCard(agentId, JSON.stringify(buildCodeProtectionCard(agentId)), "application/json"));
|
|
183
183
|
if (align.ok && prot.ok) {
|
|
184
|
-
say(fmt.success("mnemom
|
|
184
|
+
say(fmt.success("mnemom agent: observe posture published (alignment + protection observe; goal contracts nudge)."));
|
|
185
185
|
return;
|
|
186
186
|
}
|
|
187
187
|
if (align.ok)
|
|
188
|
-
say(fmt.success("mnemom
|
|
188
|
+
say(fmt.success("mnemom agent: alignment card published (observe)."));
|
|
189
189
|
for (const c of [align, prot]) {
|
|
190
190
|
if (c.ok)
|
|
191
191
|
continue;
|
|
192
192
|
// Alignment rides a standing cap, so `mnemom card publish` finishes it; the
|
|
193
193
|
// protection grant is one-time, so re-running setup (which re-mints) is the fix.
|
|
194
|
-
const publishCmd = c.name === "alignment" ? "mnemom card publish" : "mnemom
|
|
195
|
-
say(fmt.warn(`mnemom
|
|
194
|
+
const publishCmd = c.name === "alignment" ? "mnemom card publish" : "mnemom agent setup";
|
|
195
|
+
say(fmt.warn(`mnemom agent: couldn't publish the ${c.name} card — ${c.error}`));
|
|
196
196
|
say(fmt.dim(` The agent is claimed and running; finish it later with \`${publishCmd}\`.`));
|
|
197
197
|
}
|
|
198
198
|
}
|
|
199
|
-
/** `mnemom
|
|
200
|
-
export async function
|
|
199
|
+
/** `mnemom agent setup [--agent <slug>]` — the explicit provisioning entry point. */
|
|
200
|
+
export async function agentSetupCommand(opts = {}) {
|
|
201
201
|
const gatewayHost = resolveGatewayHost(process.env);
|
|
202
202
|
// Sign in (offer sign-up) and enforce the MU balance before any account write.
|
|
203
203
|
try {
|
|
@@ -209,25 +209,27 @@ export async function codeSetupCommand(opts = {}) {
|
|
|
209
209
|
throw err;
|
|
210
210
|
}
|
|
211
211
|
const anthropicKey = await resolveAnthropicKey(process.env, { allowPrompt: true });
|
|
212
|
-
// Session exists now, so derive the real handle from /v1/auth/me (not "
|
|
213
|
-
const slug = opts.agent?.trim()
|
|
212
|
+
// Session exists now, so derive the real handle from /v1/auth/me (not "agent-user").
|
|
213
|
+
const slug = opts.agent?.trim()
|
|
214
|
+
? sanitizeAgentName(opts.agent.trim())
|
|
215
|
+
: await resolveDefaultSlug();
|
|
214
216
|
if (!slug)
|
|
215
|
-
throw new Error("mnemom
|
|
217
|
+
throw new Error("mnemom agent setup: agent slug sanitised to empty — pass --agent <slug>.");
|
|
216
218
|
const result = await ensureGovernedAgent({ slug, anthropicKey, setup: true, gatewayHost });
|
|
217
219
|
if (!result.provisioned) {
|
|
218
220
|
say(fmt.dim(` '${slug}' is ready (already claimed) or setup was skipped.`));
|
|
219
221
|
}
|
|
220
222
|
}
|
|
221
223
|
function warnUnclaimed(slug) {
|
|
222
|
-
say(fmt.warn(`mnemom
|
|
223
|
-
say(fmt.dim(" Provision it (creates + claims the agent, publishes observe cards): mnemom
|
|
224
|
+
say(fmt.warn(`mnemom agent: agent '${slug}' is not set up in your org — launching with an UNCLAIMED identity (governance is advisory/fail-open).`));
|
|
225
|
+
say(fmt.dim(" Provision it (creates + claims the agent, publishes observe cards): mnemom agent setup"));
|
|
224
226
|
}
|
|
225
227
|
function persistAgentSlug(slug) {
|
|
226
228
|
try {
|
|
227
|
-
const cfg =
|
|
229
|
+
const cfg = loadLauncherConfig();
|
|
228
230
|
if (!cfg.agent) {
|
|
229
231
|
configKeySpec("agent").set(cfg, slug);
|
|
230
|
-
|
|
232
|
+
writeLauncherConfig(cfg);
|
|
231
233
|
}
|
|
232
234
|
}
|
|
233
235
|
catch {
|
|
@@ -248,7 +250,7 @@ export class MuInsufficientError extends Error {
|
|
|
248
250
|
/**
|
|
249
251
|
* The preamble errors whose guidance is ALREADY printed when thrown — callers
|
|
250
252
|
* exit 1 quietly instead of re-printing them as "Error: …". One predicate so the
|
|
251
|
-
* two catch sites (`mnemom
|
|
253
|
+
* two catch sites (`mnemom agent` and `mnemom agent setup`) cannot drift.
|
|
252
254
|
*/
|
|
253
255
|
export function isQuietPreambleExit(err) {
|
|
254
256
|
return err instanceof MuInsufficientError || err instanceof CodeNotEnabledError;
|
|
@@ -278,7 +280,7 @@ export async function ensureMnemomSession(opts = {}) {
|
|
|
278
280
|
if (!interactive)
|
|
279
281
|
return false;
|
|
280
282
|
say(fmt.section("Sign in to Mnemom"));
|
|
281
|
-
say(fmt.dim(" mnemom
|
|
283
|
+
say(fmt.dim(" mnemom agent runs your coding session governed and under your Mnemom account,"));
|
|
282
284
|
say(fmt.dim(" so it shows up in your traces and draws on your org's µ balance."));
|
|
283
285
|
say(fmt.dim(` New to Mnemom? You can create a free account in the same flow (or at ${getWebsiteUrl()}/signup).`));
|
|
284
286
|
if (!(await askYesNo("Sign in or create your account now?", true)))
|
|
@@ -304,7 +306,7 @@ export async function ensureMnemomSession(opts = {}) {
|
|
|
304
306
|
}
|
|
305
307
|
/**
|
|
306
308
|
* Enforce a positive Mnemom Units balance on the org the agent lives in.
|
|
307
|
-
* `mnemom
|
|
309
|
+
* `mnemom agent` has NO free tier — a determined zero/negative balance (or an org
|
|
308
310
|
* with no billing account) is BLOCKED with a portal-style top-up message.
|
|
309
311
|
* Fails OPEN on an inconclusive error (transient 5xx / network / 403), since the
|
|
310
312
|
* gateway is the real enforcement and this is a friendly pre-check; hard-blocks
|
|
@@ -333,7 +335,9 @@ export async function assertMuBalance(orgId, orgLabel) {
|
|
|
333
335
|
}
|
|
334
336
|
function safeBigInt(v) {
|
|
335
337
|
try {
|
|
336
|
-
return BigInt(String(v ?? "0")
|
|
338
|
+
return BigInt(String(v ?? "0")
|
|
339
|
+
.trim()
|
|
340
|
+
.split(".")[0] || "0");
|
|
337
341
|
}
|
|
338
342
|
catch {
|
|
339
343
|
return 0n;
|
|
@@ -347,16 +351,16 @@ function safeBigInt(v) {
|
|
|
347
351
|
function printTopUp(orgLabel, balanceMu) {
|
|
348
352
|
say();
|
|
349
353
|
say(fmt.warn(`No µ balance — ${orgLabel} is at ${balanceMu} µ.`));
|
|
350
|
-
say(fmt.dim(" mnemom
|
|
354
|
+
say(fmt.dim(" mnemom agent runs on µ, and there's no free tier. Without µ, Mnemom's safety"));
|
|
351
355
|
say(fmt.dim(" features can't run, so the launch is blocked. Top up to launch a governed session:"));
|
|
352
356
|
say();
|
|
353
357
|
say(` Top up µ: ${getWebsiteUrl()}/settings/billing`);
|
|
354
358
|
say(fmt.dim(" If you don't manage billing for this org, ask an admin to top up."));
|
|
355
359
|
say();
|
|
356
|
-
say(fmt.dim(" Your µ balance updates the moment a top-up completes — then re-run `mnemom
|
|
360
|
+
say(fmt.dim(" Your µ balance updates the moment a top-up completes — then re-run `mnemom agent`."));
|
|
357
361
|
}
|
|
358
362
|
/**
|
|
359
|
-
* The shared pre-launch preamble for `mnemom
|
|
363
|
+
* The shared pre-launch preamble for `mnemom agent` (and `mnemom agent setup`):
|
|
360
364
|
* ensure a Mnemom session (login/sign-up), then enforce the MU balance on the
|
|
361
365
|
* org the agent lives in (default: the user's personal org). Returns the
|
|
362
366
|
* resolved org so the caller can reuse it. Throws with clear guidance when there
|
|
@@ -366,14 +370,14 @@ export async function ensureSessionAndBalance(opts) {
|
|
|
366
370
|
const interactive = opts.interactive ?? isInteractive();
|
|
367
371
|
const haveSession = await ensureMnemomSession({ interactive });
|
|
368
372
|
if (!haveSession) {
|
|
369
|
-
throw new Error("mnemom
|
|
373
|
+
throw new Error("mnemom agent needs a Mnemom account — it runs your coding session governed and on your org's µ balance.\n" +
|
|
370
374
|
" Sign in: mnemom login (or set MNEMOM_API_KEY)\n" +
|
|
371
375
|
` New here? create a free account, then top up µ: ${getWebsiteUrl()}/settings/billing`);
|
|
372
376
|
}
|
|
373
377
|
const active = getActiveOrg();
|
|
374
378
|
const orgId = active?.org_id ?? (await getMyPersonalOrg()).org_id;
|
|
375
379
|
const orgLabel = active ? `${active.name} (${active.slug})` : "your personal org";
|
|
376
|
-
// Invited-cohort gate FIRST: an org that is not enabled for Mnemom
|
|
380
|
+
// Invited-cohort gate FIRST: an org that is not enabled for Mnemom Agent gets
|
|
377
381
|
// the invite guidance, not a top-up message (the µ check would be moot).
|
|
378
382
|
await assertCodeEnabled(orgId, orgLabel);
|
|
379
383
|
await assertMuBalance(orgId, orgLabel);
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* `mnemom
|
|
2
|
+
* `mnemom agent <scenario>` — the CLI's first-class governed-coding-agent launcher.
|
|
3
3
|
*
|
|
4
4
|
* Launches your coding-agent CLI (Claude Code in v1) with its dev-time model
|
|
5
5
|
* traffic routed through the Mnemom gateway's /anthropic door for observability +
|
|
@@ -11,7 +11,7 @@
|
|
|
11
11
|
* no router door / Mnemom key). `--cli` selects the executable to run (name or
|
|
12
12
|
* full path) so codex/cursor/github adapters can be added later.
|
|
13
13
|
* - The us-2/PROD gateway is the DEFAULT door (https://gateway.mnemom.ai); an
|
|
14
|
-
* explicit
|
|
14
|
+
* explicit MNEMOM_AGENT_GATEWAY / --gateway still wins, never silently prod.
|
|
15
15
|
* - Three launch shapes: `terminal` (DEFAULT), `remote-control` (interactive RC
|
|
16
16
|
* in this terminal), `server` (headless RC dispatcher). RC runs the CLI
|
|
17
17
|
* UNTOUCHED behind a bundled local TLS proxy (rc-proxy.mjs) — Claude Code
|
|
@@ -20,12 +20,12 @@
|
|
|
20
20
|
* - yolo (`--dangerously-skip-permissions`) is ON by default; `--no-yolo` opts out.
|
|
21
21
|
*
|
|
22
22
|
* The Anthropic key is resolved from a credential source with ZERO 1Password
|
|
23
|
-
* dependency (env → the CLI's own ~/.mnemom/
|
|
23
|
+
* dependency (env → the CLI's own ~/.mnemom/launcher.json store → interactive
|
|
24
24
|
* prompt) and placed ONLY in the launched process (an `ANTHROPIC_CUSTOM_HEADERS`
|
|
25
25
|
* line, or the proxy's stdin under RC). It is never logged, printed, or passed as
|
|
26
26
|
* an argv value.
|
|
27
27
|
*/
|
|
28
|
-
export interface
|
|
28
|
+
export interface AgentOptions {
|
|
29
29
|
goal?: string;
|
|
30
30
|
requirement?: string[];
|
|
31
31
|
allow?: string[];
|
|
@@ -54,7 +54,7 @@ export interface CodeOptions {
|
|
|
54
54
|
*/
|
|
55
55
|
setup?: boolean;
|
|
56
56
|
/**
|
|
57
|
-
* Where to source the Anthropic key (from ~/.mnemom/
|
|
57
|
+
* Where to source the Anthropic key (from ~/.mnemom/launcher.toml `key_source`).
|
|
58
58
|
* Restricts the default env → store → prompt search: "env" uses env only,
|
|
59
59
|
* "store" uses env → store (no prompt), "prompt" forces the interactive prompt.
|
|
60
60
|
* Undefined = the full default order.
|
|
@@ -64,13 +64,13 @@ export interface CodeOptions {
|
|
|
64
64
|
/** Print the resolved launch plan and exit — no key read, no spawn. */
|
|
65
65
|
dryRun?: boolean;
|
|
66
66
|
}
|
|
67
|
-
/** Entry point for `mnemom
|
|
68
|
-
export declare function
|
|
67
|
+
/** Entry point for `mnemom agent [scenario]`. Throws on fatal misconfig. */
|
|
68
|
+
export declare function agentCommand(scenarioArg: string | undefined, options?: AgentOptions): Promise<void>;
|
|
69
69
|
/**
|
|
70
70
|
* Resolve the Anthropic key with NO 1Password dependency (built for external
|
|
71
71
|
* customer adoption), in order:
|
|
72
|
-
* 1. env:
|
|
73
|
-
* 2. the CLI's own store: ~/.mnemom/
|
|
72
|
+
* 1. env: MNEMOM_AGENT_ANTHROPIC_KEY, else ANTHROPIC_API_KEY
|
|
73
|
+
* 2. the CLI's own store: ~/.mnemom/launcher.json (`anthropic_key`)
|
|
74
74
|
* 3. interactive prompt (masked), offering to save it to the store
|
|
75
75
|
* Never logged / printed. Throws with guidance when nothing resolves — we refuse
|
|
76
76
|
* to launch un-routed.
|
|
@@ -81,8 +81,8 @@ export declare function resolveAnthropicKey(env: NodeJS.ProcessEnv, opts: {
|
|
|
81
81
|
}): Promise<string>;
|
|
82
82
|
/**
|
|
83
83
|
* Where an Anthropic key would resolve from RIGHT NOW, without reading its value:
|
|
84
|
-
* "env" (
|
|
85
|
-
* or null (would fall to the interactive prompt). For `mnemom
|
|
84
|
+
* "env" (MNEMOM_AGENT_ANTHROPIC_KEY / ANTHROPIC_API_KEY), "store" (~/.mnemom/launcher.json),
|
|
85
|
+
* or null (would fall to the interactive prompt). For `mnemom agent doctor`.
|
|
86
86
|
*/
|
|
87
87
|
export declare function anthropicKeySource(env?: NodeJS.ProcessEnv): "env" | "store" | null;
|
|
88
88
|
export interface ResolvedCli {
|
|
@@ -92,7 +92,7 @@ export interface ResolvedCli {
|
|
|
92
92
|
name: string;
|
|
93
93
|
}
|
|
94
94
|
/**
|
|
95
|
-
* Resolve which coding-agent CLI to launch. `--cli` (or
|
|
95
|
+
* Resolve which coding-agent CLI to launch. `--cli` (or MNEMOM_AGENT_CLI) is a
|
|
96
96
|
* name or a full path; default "claude". A value with a path separator is used
|
|
97
97
|
* verbatim (must exist); a bare name is resolved on PATH, then — for claude — the
|
|
98
98
|
* fnm/nvm/asdf install dirs (a version-manager shim / shell function is absent in
|
|
@@ -116,7 +116,7 @@ export interface RcCapability {
|
|
|
116
116
|
/**
|
|
117
117
|
* Can we launch the DEFAULT Remote-Control-in-terminal shape on this machine?
|
|
118
118
|
* Needs node + openssl (the local proxy mints an ephemeral CA) and a claude
|
|
119
|
-
* adapter that advertises `--remote-control`. Used both by `mnemom
|
|
119
|
+
* adapter that advertises `--remote-control`. Used both by `mnemom agent doctor`
|
|
120
120
|
* and by the auto-default selection (a bare launch prefers RC when capable).
|
|
121
121
|
*/
|
|
122
122
|
export declare function checkRcCapability(cli: ResolvedCli): RcCapability;
|
|
@@ -127,7 +127,7 @@ export declare function checkRcCapability(cli: ResolvedCli): RcCapability;
|
|
|
127
127
|
* appends `--strict-mcp-config --mcp-config {}` LAST so it wins over any
|
|
128
128
|
* caller-supplied --mcp-config.
|
|
129
129
|
*/
|
|
130
|
-
export declare function buildCliArgs(options:
|
|
130
|
+
export declare function buildCliArgs(options: AgentOptions, ctx: {
|
|
131
131
|
yolo: boolean;
|
|
132
132
|
allowCliFlags: boolean;
|
|
133
133
|
}): string[];
|