@mnemom/mnemom 0.17.0-next.6 → 0.17.0-next.8

package/dist/commands/agent-session.d.ts

@@ -0,0 +1,68 @@
+/**
+ * `mnemom agent` with no session name — the interactive first-run setup.
+ *
+ * The daily command is just `mnemom agent` (the Claude Code pattern: install
+ * once, then the bare command). When the positional session name is omitted in
+ * a terminal we ask two things, explaining each in a sentence:
+ *
+ *   1. a SESSION NAME — labels the session in traces and the claude.ai session
+ *      list (defaults to the current folder's name);
+ *   2. GOAL ALIGNMENT — one of three:
+ *      - INFER it from your messages (implicit mode): nothing to type; the
+ *        gateway reads your own messages, revises the goal as you steer, and the
+ *        judge nudges the agent back when it drifts (a little µ per new message
+ *        and per judged turn). Sends `x-mnemom-goal-mode: implicit`, no contract.
+ *      - TYPE a one-line goal: sealed as a contract for the session; the judge
+ *        nudges against it (a little µ per turn). Sends `x-mnemom-contract`.
+ *      - OFF: the session runs governed with goal alignment off — neither header
+ *        is sent, so the gateway's goal hooks are simply not engaged.
+ *
+ * Non-interactive runs (pipes, CI) never prompt — they get a clear error asking
+ * for a name. `--goal` on the command line always wins over the prompt, and a
+ * resolved implicit launch (`--implicit`, or launcher.toml `goal_mode =
+ * "implicit"` with no `--no-implicit`) skips it too. Pure apart from the
+ * injected `ask` functions, so every arm is unit-tested.
+ */
+export interface SessionAsk {
+    askInput(question: string): Promise<string>;
+    askYesNo(question: string, defaultYes: boolean): Promise<boolean>;
+    /** Numbered single-select; resolves the chosen label, or null on no/invalid choice. */
+    askSelect(question: string, options: string[]): Promise<string | null>;
+}
+export interface SessionSetupInput {
+    /** The positional `[scenario]` (session name), if given. */
+    scenario?: string;
+    /** `--goal <statement>`, if given — skips the goal prompt. */
+    goal?: string;
+    /** Resolved implicit mode (flag or config default) — skips the goal prompt; alignment on without a contract. */
+    implicit?: boolean;
+    interactive: boolean;
+    /** For the default session name (tests inject one). */
+    cwd?: string;
+    /** Narration sink (stderr by default; tests capture). */
+    say?: (line?: string) => void;
+}
+export interface SessionSetup {
+    scenario: string;
+    /** The goal statement to seal, or undefined = no sealed contract (implicit or off). */
+    goal?: string;
+    goalAlignment: "on" | "implicit" | "off";
+    /** True when the terminal prompts ran. */
+    prompted: boolean;
+}
+export declare const NO_SESSION_NAME_MESSAGE: string;
+/** The three goal-alignment choices offered by the interactive prompt (labels are the select options). */
+export declare const GOAL_CHOICE_IMPLICIT = "Infer my goal from my messages \u2014 nothing to type; revised as I steer (implicit mode)";
+export declare const GOAL_CHOICE_TYPED = "Type a one-line goal \u2014 sealed as a contract for this session";
+export declare const GOAL_CHOICE_OFF = "Off \u2014 run governed with goal alignment off (Enter)";
+export declare const GOAL_CHOICES: readonly string[];
+export declare const GOAL_CHOICE_QUESTION = "Goal alignment for this session?";
+/** Current folder name, sanitised like an agent slug; "session" when that is empty. */
+export declare function defaultSessionName(cwd?: string): string;
+/** The one-line status printed at launch so the customer always knows the mode. */
+export declare function goalAlignmentLine(mode: boolean | "on" | "implicit" | "off"): string;
+/**
+ * Resolve the session name + goal for this launch. See the module doc for the
+ * rules. Throws NO_SESSION_NAME_MESSAGE when no name was given and we cannot ask.
+ */
+export declare function resolveSessionSetup(input: SessionSetupInput, ask: SessionAsk): Promise<SessionSetup>;

package/dist/commands/agent-session.js

@@ -0,0 +1,114 @@
+/**
+ * `mnemom agent` with no session name — the interactive first-run setup.
+ *
+ * The daily command is just `mnemom agent` (the Claude Code pattern: install
+ * once, then the bare command). When the positional session name is omitted in
+ * a terminal we ask two things, explaining each in a sentence:
+ *
+ *   1. a SESSION NAME — labels the session in traces and the claude.ai session
+ *      list (defaults to the current folder's name);
+ *   2. GOAL ALIGNMENT — one of three:
+ *      - INFER it from your messages (implicit mode): nothing to type; the
+ *        gateway reads your own messages, revises the goal as you steer, and the
+ *        judge nudges the agent back when it drifts (a little µ per new message
+ *        and per judged turn). Sends `x-mnemom-goal-mode: implicit`, no contract.
+ *      - TYPE a one-line goal: sealed as a contract for the session; the judge
+ *        nudges against it (a little µ per turn). Sends `x-mnemom-contract`.
+ *      - OFF: the session runs governed with goal alignment off — neither header
+ *        is sent, so the gateway's goal hooks are simply not engaged.
+ *
+ * Non-interactive runs (pipes, CI) never prompt — they get a clear error asking
+ * for a name. `--goal` on the command line always wins over the prompt, and a
+ * resolved implicit launch (`--implicit`, or launcher.toml `goal_mode =
+ * "implicit"` with no `--no-implicit`) skips it too. Pure apart from the
+ * injected `ask` functions, so every arm is unit-tested.
+ */
+import { basename } from "node:path";
+import { sanitizeAgentName } from "../lib/agent.js";
+export const NO_SESSION_NAME_MESSAGE = "mnemom agent: a session name is required here (e.g. `mnemom agent onboarding`). " +
+    "In a terminal, plain `mnemom agent` asks for one.";
+/** The three goal-alignment choices offered by the interactive prompt (labels are the select options). */
+export const GOAL_CHOICE_IMPLICIT = "Infer my goal from my messages — nothing to type; revised as I steer (implicit mode)";
+export const GOAL_CHOICE_TYPED = "Type a one-line goal — sealed as a contract for this session";
+export const GOAL_CHOICE_OFF = "Off — run governed with goal alignment off (Enter)";
+export const GOAL_CHOICES = [
+    GOAL_CHOICE_IMPLICIT,
+    GOAL_CHOICE_TYPED,
+    GOAL_CHOICE_OFF,
+];
+export const GOAL_CHOICE_QUESTION = "Goal alignment for this session?";
+/** Current folder name, sanitised like an agent slug; "session" when that is empty. */
+export function defaultSessionName(cwd = process.cwd()) {
+    return sanitizeAgentName(basename(cwd)) || "session";
+}
+/** The one-line status printed at launch so the customer always knows the mode. */
+export function goalAlignmentLine(mode) {
+    const m = mode === true ? "on" : mode === false ? "off" : mode;
+    if (m === "implicit") {
+        return ("mnemom agent: goal alignment: on, implicit (no sealed contract — the gateway infers your goal " +
+            "from your own messages, revises it as you steer, and the judge nudges the agent back when it drifts)");
+    }
+    return m === "on"
+        ? "mnemom agent: goal alignment: on (the judge nudges the agent back when it drifts from your goal)"
+        : "mnemom agent: goal alignment: off (no goal set — pass --goal or --implicit, or set one when prompted)";
+}
+const defaultSay = (line = "") => console.error(line);
+/**
+ * Resolve the session name + goal for this launch. See the module doc for the
+ * rules. Throws NO_SESSION_NAME_MESSAGE when no name was given and we cannot ask.
+ */
+export async function resolveSessionSetup(input, ask) {
+    const say = input.say ?? defaultSay;
+    const flagGoal = (input.goal ?? "").trim();
+    const implicit = input.implicit === true;
+    const given = (input.scenario ?? "").trim();
+    if (given) {
+        return {
+            scenario: given,
+            goal: flagGoal || undefined,
+            goalAlignment: flagGoal ? "on" : implicit ? "implicit" : "off",
+            prompted: false,
+        };
+    }
+    if (!input.interactive)
+        throw new Error(NO_SESSION_NAME_MESSAGE);
+    // ── 1. session name ──
+    const fallback = defaultSessionName(input.cwd);
+    say();
+    say("Session name — labels this session in your traces and the claude.ai session list.");
+    say(`  (Next time you can pass it directly: mnemom agent <name>.)`);
+    const typed = await ask.askInput(`Session name [${fallback}]:`);
+    const scenario = sanitizeAgentName(typed.trim()) || fallback;
+    // ── 2. goal alignment (skipped when --goal or implicit mode was resolved) ──
+    if (flagGoal) {
+        return { scenario, goal: flagGoal, goalAlignment: "on", prompted: true };
+    }
+    if (implicit) {
+        return { scenario, goalAlignment: "implicit", prompted: true };
+    }
+    say();
+    say("Goal alignment — how Mnemom keeps this session on track. Three choices:");
+    say("  Infer: nothing to type — the gateway reads your own messages, revises the goal as you");
+    say("    steer, and the judge nudges the agent back when it drifts (a little µ per message + turn).");
+    say("  Type a goal: one line, sealed as a contract; the judge nudges against it (a little µ per turn).");
+    say("  Off: the session runs governed with goal alignment off (the default — just press Enter).");
+    say("  (Make one the default: mnemom agent config set goal_mode implicit|off.)");
+    const choice = await ask.askSelect(GOAL_CHOICE_QUESTION, [...GOAL_CHOICES]);
+    if (choice === GOAL_CHOICE_IMPLICIT) {
+        return { scenario, goalAlignment: "implicit", prompted: true };
+    }
+    if (choice === GOAL_CHOICE_TYPED) {
+        const goal = (await ask.askInput("Goal (one line):")).trim();
+        if (!goal) {
+            say("  No goal entered — continuing with goal alignment off.");
+            return { scenario, goalAlignment: "off", prompted: true };
+        }
+        return { scenario, goal, goalAlignment: "on", prompted: true };
+    }
+    // Enter (no pick) and any invalid pick both resolve to null → off. Off is the
+    // deliberate default for now: a µ-costing mode is never picked by a bare Enter.
+    if (choice !== GOAL_CHOICE_OFF) {
+        say("  Goal alignment off (press 1 or 2 next time to turn it on).");
+    }
+    return { scenario, goalAlignment: "off", prompted: true };
+}

package/dist/commands/{code-setup.d.ts → agent-setup.d.ts}

@@ -1,9 +1,9 @@
 /**
- * `mnemom code setup` + the zero-friction provisioning behind a bare
- * `mnemom code <scenario>`.
+ * `mnemom agent setup` + the zero-friction provisioning behind a bare
+ * `mnemom agent <scenario>`.
  *
- * If a customer names no agent, `mnemom code` launches under a per-customer
- * governed identity `code-<handle>`. This module makes that identity REAL in
+ * If a customer names no agent, `mnemom agent` launches under a per-customer
+ * governed identity `agent-<handle>`. This module makes that identity REAL in
  * their Mnemom org: it births the agent through the gateway, claims it (so the
  * customer owns it), and publishes a sane default coding posture. The CARDS are
  * observe-only (visibility, no active intervention); the goal contract is what
@@ -24,15 +24,15 @@
  * putAlignmentCard/putProtectionCard (lib/api.ts) — rather than reinventing it.
  */
 /**
- * The default governed-agent slug for the current customer: `code-<handle>`,
+ * The default governed-agent slug for the current customer: `agent-<handle>`,
  * where <handle> is the local-part of their mnemom login email (sanitised), or
  * "user" when no email is available (API-key auth / opaque OAuth token).
  */
 export declare function defaultAgentSlug(): string;
 /**
- * The default slug resolved from the authenticated IDENTITY: `code-<handle>` from
+ * The default slug resolved from the authenticated IDENTITY: `agent-<handle>` from
  * the login email fetched via `/v1/auth/me`. The CLI's stored OAuth token carries
- * no email, so the sync `defaultAgentSlug()` alone falls back to "code-user";
+ * no email, so the sync `defaultAgentSlug()` alone falls back to "agent-user";
  * this fetches the real email once a session exists. Falls back to
  * `defaultAgentSlug()` on any failure. Call it AFTER the session is ensured.
  */
@@ -60,12 +60,12 @@ export interface EnsureAgentResult {
  * allowed here (non-interactive without --setup, or not logged in), or when the
  * customer declines the confirm — in all those cases the launch continues under
  * the given slug. THROWS only on an actual provisioning failure (birth/claim/
- * card write) so the caller can decide whether that is fatal (`mnemom code
+ * card write) so the caller can decide whether that is fatal (`mnemom agent
  * setup`) or a warn-and-continue (a bare launch).
  */
 export declare function ensureGovernedAgent(opts: EnsureAgentOptions): Promise<EnsureAgentResult>;
-/** `mnemom code setup [--agent <slug>]` — the explicit provisioning entry point. */
-export declare function codeSetupCommand(opts?: {
+/** `mnemom agent setup [--agent <slug>]` — the explicit provisioning entry point. */
+export declare function agentSetupCommand(opts?: {
     agent?: string;
 }): Promise<void>;
 /** Thrown when the agent's org has no spendable MU balance. The user-facing
@@ -77,7 +77,7 @@ export declare class MuInsufficientError extends Error {
 /**
  * The preamble errors whose guidance is ALREADY printed when thrown — callers
  * exit 1 quietly instead of re-printing them as "Error: …". One predicate so the
- * two catch sites (`mnemom code` and `mnemom code setup`) cannot drift.
+ * two catch sites (`mnemom agent` and `mnemom agent setup`) cannot drift.
  */
 export declare function isQuietPreambleExit(err: unknown): boolean;
 /**
@@ -93,7 +93,7 @@ export declare function ensureMnemomSession(opts?: {
 }): Promise<boolean>;
 /**
  * Enforce a positive Mnemom Units balance on the org the agent lives in.
- * `mnemom code` has NO free tier — a determined zero/negative balance (or an org
+ * `mnemom agent` has NO free tier — a determined zero/negative balance (or an org
  * with no billing account) is BLOCKED with a portal-style top-up message.
  * Fails OPEN on an inconclusive error (transient 5xx / network / 403), since the
  * gateway is the real enforcement and this is a friendly pre-check; hard-blocks
@@ -101,7 +101,7 @@ export declare function ensureMnemomSession(opts?: {
  */
 export declare function assertMuBalance(orgId: string, orgLabel: string): Promise<void>;
 /**
- * The shared pre-launch preamble for `mnemom code` (and `mnemom code setup`):
+ * The shared pre-launch preamble for `mnemom agent` (and `mnemom agent setup`):
  * ensure a Mnemom session (login/sign-up), then enforce the MU balance on the
  * org the agent lives in (default: the user's personal org). Returns the
  * resolved org so the caller can reuse it. Throws with clear guidance when there

package/dist/commands/{code-setup.js → agent-setup.js}

@@ -1,9 +1,9 @@
 /**
- * `mnemom code setup` + the zero-friction provisioning behind a bare
- * `mnemom code <scenario>`.
+ * `mnemom agent setup` + the zero-friction provisioning behind a bare
+ * `mnemom agent <scenario>`.
  *
- * If a customer names no agent, `mnemom code` launches under a per-customer
- * governed identity `code-<handle>`. This module makes that identity REAL in
+ * If a customer names no agent, `mnemom agent` launches under a per-customer
+ * governed identity `agent-<handle>`. This module makes that identity REAL in
  * their Mnemom org: it births the agent through the gateway, claims it (so the
  * customer owns it), and publishes a sane default coding posture. The CARDS are
  * observe-only (visibility, no active intervention); the goal contract is what
@@ -29,15 +29,15 @@ import { getActiveOrg } from "../lib/cli-config.js";
 import { getWebsiteUrl } from "../lib/config.js";
 import { fmt } from "../lib/format.js";
 import { askYesNo, isInteractive } from "../lib/prompt.js";
-import { resolveGatewayHost, sanitizeAgentName } from "../lib/code.js";
-import { configKeySpec, loadCodeConfig, writeCodeConfig } from "../lib/code-config.js";
+import { resolveGatewayHost, sanitizeAgentName } from "../lib/agent.js";
+import { configKeySpec, loadLauncherConfig, writeLauncherConfig } from "../lib/launcher-config.js";
 import { deriveHashProof } from "./agents.js";
 import { birthThroughGateway } from "./wrap.js";
-import { resolveAnthropicKey } from "./code.js";
-import { assertCodeEnabled, CodeNotEnabledError } from "./code-invite.js";
+import { resolveAnthropicKey } from "./agent.js";
+import { assertCodeEnabled, CodeNotEnabledError } from "./agent-invite.js";
 const say = (line = "") => console.error(line);
 /**
- * The default governed-agent slug for the current customer: `code-<handle>`,
+ * The default governed-agent slug for the current customer: `agent-<handle>`,
  * where <handle> is the local-part of their mnemom login email (sanitised), or
  * "user" when no email is available (API-key auth / opaque OAuth token).
  */
@@ -45,12 +45,12 @@ export function defaultAgentSlug() {
     const email = getAuthInfo()?.email ?? "";
     const local = email.split("@")[0] ?? "";
     const handle = sanitizeAgentName(local) || "user";
-    return `code-${handle}`;
+    return `agent-${handle}`;
 }
 /**
- * The default slug resolved from the authenticated IDENTITY: `code-<handle>` from
+ * The default slug resolved from the authenticated IDENTITY: `agent-<handle>` from
  * the login email fetched via `/v1/auth/me`. The CLI's stored OAuth token carries
- * no email, so the sync `defaultAgentSlug()` alone falls back to "code-user";
+ * no email, so the sync `defaultAgentSlug()` alone falls back to "agent-user";
  * this fetches the real email once a session exists. Falls back to
  * `defaultAgentSlug()` on any failure. Call it AFTER the session is ensured.
  */
@@ -59,7 +59,7 @@ export async function resolveDefaultSlug() {
         const email = (await getMe()).email ?? "";
         const handle = sanitizeAgentName(email.split("@")[0] ?? "");
         if (handle)
-            return `code-${handle}`;
+            return `agent-${handle}`;
     }
     catch {
         // fall through to the token-based best-effort
@@ -72,7 +72,7 @@ export async function resolveDefaultSlug() {
  * allowed here (non-interactive without --setup, or not logged in), or when the
  * customer declines the confirm — in all those cases the launch continues under
  * the given slug. THROWS only on an actual provisioning failure (birth/claim/
- * card write) so the caller can decide whether that is fatal (`mnemom code
+ * card write) so the caller can decide whether that is fatal (`mnemom agent
  * setup`) or a warn-and-continue (a bare launch).
  */
 export async function ensureGovernedAgent(opts) {
@@ -83,11 +83,11 @@ export async function ensureGovernedAgent(opts) {
     if (loggedIn) {
         const existing = await getAgentByName(slug).catch(() => null);
         if (existing) {
-            // On an EXPLICIT `mnemom code setup`, repair/complete the cards on the
+            // On an EXPLICIT `mnemom agent setup`, repair/complete the cards on the
             // already-claimed agent (e.g. a protection card that failed on a prior run
             // before we minted its one-time grant). A bare launch leaves it alone.
             if (opts.setup === true) {
-                say(fmt.dim(`mnemom code: '${slug}' is already claimed — refreshing its cards.`));
+                say(fmt.dim(`mnemom agent: '${slug}' is already claimed — refreshing its cards.`));
                 await publishDefaultCards(existing.id);
                 persistAgentSlug(slug);
                 return { slug, provisioned: true };
@@ -106,8 +106,8 @@ export async function ensureGovernedAgent(opts) {
         if (opts.setup === true && !interactive) {
             throw new Error("not authenticated — run `mnemom login` (or set MNEMOM_API_KEY) first.");
         }
-        say(fmt.warn(`mnemom code: not logged in — can't provision '${slug}'.`));
-        say(fmt.dim("  Run `mnemom login`, then `mnemom code setup`. Launching with the unclaimed identity for now."));
+        say(fmt.warn(`mnemom agent: not logged in — can't provision '${slug}'.`));
+        say(fmt.dim("  Run `mnemom login`, then `mnemom agent setup`. Launching with the unclaimed identity for now."));
         return { slug, provisioned: false };
     }
     // 4. Confirm the plan (interactive runs; --setup non-interactive proceeds).
@@ -120,7 +120,7 @@ export async function ensureGovernedAgent(opts) {
         say(fmt.label("  Posture:", "observe (alignment + protection observe-only, all surfaces screened); goal contracts nudge"));
         say(fmt.dim("  Births the agent through the gateway, claims it to your org, and publishes its cards."));
         if (!(await askYesNo("Provision and claim this agent now?", true))) {
-            say(fmt.dim("  Skipped — launching under the unclaimed identity. Run `mnemom code setup` anytime."));
+            say(fmt.dim("  Skipped — launching under the unclaimed identity. Run `mnemom agent setup` anytime."));
             return { slug, provisioned: false };
         }
     }
@@ -129,7 +129,7 @@ export async function ensureGovernedAgent(opts) {
     const agentId = await birthThroughGateway(gatewayUrl, "anthropic", slug, opts.anthropicKey);
     const hashProof = deriveHashProof(opts.anthropicKey, slug);
     await claimAgent(agentId, { hashProof, orgId: org?.org_id });
-    say(fmt.success(`mnemom code: claimed '${slug}' (${agentId}) in ${orgLabel}.`));
+    say(fmt.success(`mnemom agent: claimed '${slug}' (${agentId}) in ${orgLabel}.`));
     // Publish the observe-only cards. A card write that can't complete (propagation
     // right after the claim, or a missing cards:write scope) does NOT abort the
     // provision — the agent is claimed and governed on whatever landed; we warn how
@@ -181,23 +181,23 @@ async function publishDefaultCards(agentId) {
     }
     const prot = await tryPublishCard("protection", () => putProtectionCard(agentId, JSON.stringify(buildCodeProtectionCard(agentId)), "application/json"));
     if (align.ok && prot.ok) {
-        say(fmt.success("mnemom code: observe posture published (alignment + protection observe; goal contracts nudge)."));
+        say(fmt.success("mnemom agent: observe posture published (alignment + protection observe; goal contracts nudge)."));
         return;
     }
     if (align.ok)
-        say(fmt.success("mnemom code: alignment card published (observe)."));
+        say(fmt.success("mnemom agent: alignment card published (observe)."));
     for (const c of [align, prot]) {
         if (c.ok)
             continue;
         // Alignment rides a standing cap, so `mnemom card publish` finishes it; the
         // protection grant is one-time, so re-running setup (which re-mints) is the fix.
-        const publishCmd = c.name === "alignment" ? "mnemom card publish" : "mnemom code setup";
-        say(fmt.warn(`mnemom code: couldn't publish the ${c.name} card — ${c.error}`));
+        const publishCmd = c.name === "alignment" ? "mnemom card publish" : "mnemom agent setup";
+        say(fmt.warn(`mnemom agent: couldn't publish the ${c.name} card — ${c.error}`));
         say(fmt.dim(`  The agent is claimed and running; finish it later with \`${publishCmd}\`.`));
     }
 }
-/** `mnemom code setup [--agent <slug>]` — the explicit provisioning entry point. */
-export async function codeSetupCommand(opts = {}) {
+/** `mnemom agent setup [--agent <slug>]` — the explicit provisioning entry point. */
+export async function agentSetupCommand(opts = {}) {
     const gatewayHost = resolveGatewayHost(process.env);
     // Sign in (offer sign-up) and enforce the MU balance before any account write.
     try {
@@ -209,25 +209,27 @@ export async function codeSetupCommand(opts = {}) {
         throw err;
     }
     const anthropicKey = await resolveAnthropicKey(process.env, { allowPrompt: true });
-    // Session exists now, so derive the real handle from /v1/auth/me (not "code-user").
-    const slug = opts.agent?.trim() ? sanitizeAgentName(opts.agent.trim()) : await resolveDefaultSlug();
+    // Session exists now, so derive the real handle from /v1/auth/me (not "agent-user").
+    const slug = opts.agent?.trim()
+        ? sanitizeAgentName(opts.agent.trim())
+        : await resolveDefaultSlug();
     if (!slug)
-        throw new Error("mnemom code setup: agent slug sanitised to empty — pass --agent <slug>.");
+        throw new Error("mnemom agent setup: agent slug sanitised to empty — pass --agent <slug>.");
     const result = await ensureGovernedAgent({ slug, anthropicKey, setup: true, gatewayHost });
     if (!result.provisioned) {
         say(fmt.dim(`  '${slug}' is ready (already claimed) or setup was skipped.`));
     }
 }
 function warnUnclaimed(slug) {
-    say(fmt.warn(`mnemom code: agent '${slug}' is not set up in your org — launching with an UNCLAIMED identity (governance is advisory/fail-open).`));
-    say(fmt.dim("  Provision it (creates + claims the agent, publishes observe cards): mnemom code setup"));
+    say(fmt.warn(`mnemom agent: agent '${slug}' is not set up in your org — launching with an UNCLAIMED identity (governance is advisory/fail-open).`));
+    say(fmt.dim("  Provision it (creates + claims the agent, publishes observe cards): mnemom agent setup"));
 }
 function persistAgentSlug(slug) {
     try {
-        const cfg = loadCodeConfig();
+        const cfg = loadLauncherConfig();
         if (!cfg.agent) {
             configKeySpec("agent").set(cfg, slug);
-            writeCodeConfig(cfg);
+            writeLauncherConfig(cfg);
         }
     }
     catch {
@@ -248,7 +250,7 @@ export class MuInsufficientError extends Error {
 /**
  * The preamble errors whose guidance is ALREADY printed when thrown — callers
  * exit 1 quietly instead of re-printing them as "Error: …". One predicate so the
- * two catch sites (`mnemom code` and `mnemom code setup`) cannot drift.
+ * two catch sites (`mnemom agent` and `mnemom agent setup`) cannot drift.
  */
 export function isQuietPreambleExit(err) {
     return err instanceof MuInsufficientError || err instanceof CodeNotEnabledError;
@@ -278,7 +280,7 @@ export async function ensureMnemomSession(opts = {}) {
     if (!interactive)
         return false;
     say(fmt.section("Sign in to Mnemom"));
-    say(fmt.dim("  mnemom code runs your coding session governed and under your Mnemom account,"));
+    say(fmt.dim("  mnemom agent runs your coding session governed and under your Mnemom account,"));
     say(fmt.dim("  so it shows up in your traces and draws on your org's µ balance."));
     say(fmt.dim(`  New to Mnemom? You can create a free account in the same flow (or at ${getWebsiteUrl()}/signup).`));
     if (!(await askYesNo("Sign in or create your account now?", true)))
@@ -304,7 +306,7 @@ export async function ensureMnemomSession(opts = {}) {
 }
 /**
  * Enforce a positive Mnemom Units balance on the org the agent lives in.
- * `mnemom code` has NO free tier — a determined zero/negative balance (or an org
+ * `mnemom agent` has NO free tier — a determined zero/negative balance (or an org
  * with no billing account) is BLOCKED with a portal-style top-up message.
  * Fails OPEN on an inconclusive error (transient 5xx / network / 403), since the
  * gateway is the real enforcement and this is a friendly pre-check; hard-blocks
@@ -333,7 +335,9 @@ export async function assertMuBalance(orgId, orgLabel) {
 }
 function safeBigInt(v) {
     try {
-        return BigInt(String(v ?? "0").trim().split(".")[0] || "0");
+        return BigInt(String(v ?? "0")
+            .trim()
+            .split(".")[0] || "0");
     }
     catch {
         return 0n;
@@ -347,16 +351,16 @@ function safeBigInt(v) {
 function printTopUp(orgLabel, balanceMu) {
     say();
     say(fmt.warn(`No µ balance — ${orgLabel} is at ${balanceMu} µ.`));
-    say(fmt.dim("  mnemom code runs on µ, and there's no free tier. Without µ, Mnemom's safety"));
+    say(fmt.dim("  mnemom agent runs on µ, and there's no free tier. Without µ, Mnemom's safety"));
     say(fmt.dim("  features can't run, so the launch is blocked. Top up to launch a governed session:"));
     say();
     say(`    Top up µ:  ${getWebsiteUrl()}/settings/billing`);
     say(fmt.dim("  If you don't manage billing for this org, ask an admin to top up."));
     say();
-    say(fmt.dim("  Your µ balance updates the moment a top-up completes — then re-run `mnemom code`."));
+    say(fmt.dim("  Your µ balance updates the moment a top-up completes — then re-run `mnemom agent`."));
 }
 /**
- * The shared pre-launch preamble for `mnemom code` (and `mnemom code setup`):
+ * The shared pre-launch preamble for `mnemom agent` (and `mnemom agent setup`):
  * ensure a Mnemom session (login/sign-up), then enforce the MU balance on the
  * org the agent lives in (default: the user's personal org). Returns the
  * resolved org so the caller can reuse it. Throws with clear guidance when there
@@ -366,14 +370,14 @@ export async function ensureSessionAndBalance(opts) {
     const interactive = opts.interactive ?? isInteractive();
     const haveSession = await ensureMnemomSession({ interactive });
     if (!haveSession) {
-        throw new Error("mnemom code needs a Mnemom account — it runs your coding session governed and on your org's µ balance.\n" +
+        throw new Error("mnemom agent needs a Mnemom account — it runs your coding session governed and on your org's µ balance.\n" +
             "  Sign in:   mnemom login   (or set MNEMOM_API_KEY)\n" +
             `  New here?  create a free account, then top up µ: ${getWebsiteUrl()}/settings/billing`);
     }
     const active = getActiveOrg();
     const orgId = active?.org_id ?? (await getMyPersonalOrg()).org_id;
     const orgLabel = active ? `${active.name} (${active.slug})` : "your personal org";
-    // Invited-cohort gate FIRST: an org that is not enabled for Mnemom Code gets
+    // Invited-cohort gate FIRST: an org that is not enabled for Mnemom Agent gets
     // the invite guidance, not a top-up message (the µ check would be moot).
     await assertCodeEnabled(orgId, orgLabel);
     await assertMuBalance(orgId, orgLabel);

package/dist/commands/{code.d.ts → agent.d.ts}

@@ -1,5 +1,5 @@
 /**
- * `mnemom code <scenario>` — the CLI's first-class governed-coding-agent launcher.
+ * `mnemom agent <scenario>` — the CLI's first-class governed-coding-agent launcher.
  *
  * Launches your coding-agent CLI (Claude Code in v1) with its dev-time model
  * traffic routed through the Mnemom gateway's /anthropic door for observability +
@@ -11,7 +11,7 @@
  *     no router door / Mnemom key). `--cli` selects the executable to run (name or
  *     full path) so codex/cursor/github adapters can be added later.
  *   - The us-2/PROD gateway is the DEFAULT door (https://gateway.mnemom.ai); an
- *     explicit MNEMOM_CODE_GATEWAY / --gateway still wins, never silently prod.
+ *     explicit MNEMOM_AGENT_GATEWAY / --gateway still wins, never silently prod.
  *   - Three launch shapes: `terminal` (DEFAULT), `remote-control` (interactive RC
  *     in this terminal), `server` (headless RC dispatcher). RC runs the CLI
  *     UNTOUCHED behind a bundled local TLS proxy (rc-proxy.mjs) — Claude Code
@@ -20,12 +20,13 @@
  *   - yolo (`--dangerously-skip-permissions`) is ON by default; `--no-yolo` opts out.
  *
  * The Anthropic key is resolved from a credential source with ZERO 1Password
- * dependency (env → the CLI's own ~/.mnemom/code.json store → interactive
+ * dependency (env → the CLI's own ~/.mnemom/launcher.json store → interactive
  * prompt) and placed ONLY in the launched process (an `ANTHROPIC_CUSTOM_HEADERS`
  * line, or the proxy's stdin under RC). It is never logged, printed, or passed as
  * an argv value.
  */
-export interface CodeOptions {
+import { type LaunchShape, type SealedContractEnvelope } from "../lib/agent.js";
+export interface AgentOptions {
     goal?: string;
     requirement?: string[];
     allow?: string[];
@@ -34,6 +35,12 @@ export interface CodeOptions {
     budget?: string;
     maxTurns?: string;
     stall?: string;
+    /**
+     * `--implicit`: goal alignment with no sealed contract — the gateway infers the
+     * goal from the user's messages and revises it as they steer; the ceilings above
+     * ride on the `x-mnemom-goal-mode` header. Exclusive with the contract flags.
+     */
+    implicit?: boolean;
     /** x-mnemom-agent value (defaults to "code-agent"). */
     agent?: string;
     conversationId?: string;
@@ -54,7 +61,7 @@ export interface CodeOptions {
      */
     setup?: boolean;
     /**
-     * Where to source the Anthropic key (from ~/.mnemom/code.toml `key_source`).
+     * Where to source the Anthropic key (from ~/.mnemom/launcher.toml `key_source`).
      * Restricts the default env → store → prompt search: "env" uses env only,
      * "store" uses env → store (no prompt), "prompt" forces the interactive prompt.
      * Undefined = the full default order.
@@ -64,13 +71,13 @@ export interface CodeOptions {
     /** Print the resolved launch plan and exit — no key read, no spawn. */
     dryRun?: boolean;
 }
-/** Entry point for `mnemom code [scenario]`. Throws on fatal misconfig. */
-export declare function codeCommand(scenarioArg: string | undefined, options?: CodeOptions): Promise<void>;
+/** Entry point for `mnemom agent [scenario]`. Throws on fatal misconfig. */
+export declare function agentCommand(scenarioArg: string | undefined, options?: AgentOptions): Promise<void>;
 /**
  * Resolve the Anthropic key with NO 1Password dependency (built for external
  * customer adoption), in order:
- *   1. env: MNEMOM_CODE_ANTHROPIC_KEY, else ANTHROPIC_API_KEY
- *   2. the CLI's own store: ~/.mnemom/code.json (`anthropic_key`)
+ *   1. env: MNEMOM_AGENT_ANTHROPIC_KEY, else ANTHROPIC_API_KEY
+ *   2. the CLI's own store: ~/.mnemom/launcher.json (`anthropic_key`)
  *   3. interactive prompt (masked), offering to save it to the store
  * Never logged / printed. Throws with guidance when nothing resolves — we refuse
  * to launch un-routed.
@@ -81,8 +88,8 @@ export declare function resolveAnthropicKey(env: NodeJS.ProcessEnv, opts: {
 }): Promise<string>;
 /**
  * Where an Anthropic key would resolve from RIGHT NOW, without reading its value:
- * "env" (MNEMOM_CODE_ANTHROPIC_KEY / ANTHROPIC_API_KEY), "store" (~/.mnemom/code.json),
- * or null (would fall to the interactive prompt). For `mnemom code doctor`.
+ * "env" (MNEMOM_AGENT_ANTHROPIC_KEY / ANTHROPIC_API_KEY), "store" (~/.mnemom/launcher.json),
+ * or null (would fall to the interactive prompt). For `mnemom agent doctor`.
  */
 export declare function anthropicKeySource(env?: NodeJS.ProcessEnv): "env" | "store" | null;
 export interface ResolvedCli {
@@ -92,7 +99,7 @@ export interface ResolvedCli {
     name: string;
 }
 /**
- * Resolve which coding-agent CLI to launch. `--cli` (or MNEMOM_CODE_CLI) is a
+ * Resolve which coding-agent CLI to launch. `--cli` (or MNEMOM_AGENT_CLI) is a
  * name or a full path; default "claude". A value with a path separator is used
  * verbatim (must exist); a bare name is resolved on PATH, then — for claude — the
  * fnm/nvm/asdf install dirs (a version-manager shim / shell function is absent in
@@ -116,7 +123,7 @@ export interface RcCapability {
 /**
  * Can we launch the DEFAULT Remote-Control-in-terminal shape on this machine?
  * Needs node + openssl (the local proxy mints an ephemeral CA) and a claude
- * adapter that advertises `--remote-control`. Used both by `mnemom code doctor`
+ * adapter that advertises `--remote-control`. Used both by `mnemom agent doctor`
  * and by the auto-default selection (a bare launch prefers RC when capable).
  */
 export declare function checkRcCapability(cli: ResolvedCli): RcCapability;
@@ -127,7 +134,36 @@ export declare function checkRcCapability(cli: ResolvedCli): RcCapability;
  * appends `--strict-mcp-config --mcp-config {}` LAST so it wins over any
  * caller-supplied --mcp-config.
  */
-export declare function buildCliArgs(options: CodeOptions, ctx: {
+export declare function buildCliArgs(options: AgentOptions, ctx: {
     yolo: boolean;
     allowCliFlags: boolean;
 }): string[];
+/**
+ * Which goal-alignment mode the launch status line names: a sealed contract →
+ * "on"; `--implicit` (mode header, no contract) → "implicit"; neither → "off".
+ * A sealed contract and a mode header never coexist (`assembleContract` refuses
+ * the combination), so the first arm winning is not a precedence choice.
+ */
+export declare function goalAlignmentMode(envelope: SealedContractEnvelope | null, goalMode: string | null): "on" | "implicit" | "off";
+export declare function logLaunch(ctx: {
+    shape: LaunchShape;
+    door: string;
+    agent: string;
+    conversationId: string;
+    cellNote: string;
+    envelope: SealedContractEnvelope | null;
+    goalMode: string | null;
+    cli: ResolvedCli;
+}): void;
+export declare function printPlan(ctx: {
+    scenario: string;
+    shape: LaunchShape;
+    agent: string;
+    conversationId: string;
+    door: string;
+    cellNote: string;
+    envelope: SealedContractEnvelope | null;
+    goalMode: string | null;
+    yolo: boolean;
+    cli: ResolvedCli;
+}): void;