@mnemom/mnemom 0.17.0-next.6 → 0.17.0-next.8

package/dist/index.js

@@ -20,12 +20,13 @@ import { apiKeyListCommand, apiKeyCreateCommand, apiKeyRotateCommand, apiKeyRevo
 import { webhooksListCommand, webhooksGetCommand, webhooksCreateCommand, webhooksUpdateCommand, webhooksDeleteCommand, webhooksRotateSecretCommand, webhooksTriggerCommand, webhooksListDeliveriesCommand, webhooksRedeliverCommand, webhooksReplayCommand, } from "./commands/webhooks.js";
 import { listenCommand } from "./commands/listen.js";
 import { tryMeCommand } from "./commands/try-me.js";
-import { codeCommand } from "./commands/code.js";
-import { codeConfigCommand } from "./commands/code-config.js";
-import { codeDoctorCommand } from "./commands/code-doctor.js";
-import { codeSetupCommand } from "./commands/code-setup.js";
-import { codeInviteCommand, runCodeInvocation } from "./commands/code-invite.js";
-import { applyConfigToEnv, loadCodeConfig } from "./lib/code-config.js";
+import { agentCommand } from "./commands/agent.js";
+import { agentConfigCommand } from "./commands/agent-config.js";
+import { agentDoctorCommand } from "./commands/agent-doctor.js";
+import { agentSetupCommand } from "./commands/agent-setup.js";
+import { agentInviteCommand, runAgentInvocation } from "./commands/agent-invite.js";
+import { applyConfigToEnv, loadLauncherConfig } from "./lib/launcher-config.js";
+import { resolveImplicit } from "./lib/agent.js";
 import { wrapCommand } from "./commands/wrap.js";
 import { onboardCommand } from "./commands/onboard.js";
 import { skillsListCommand, skillsDescribeCommand } from "./commands/skills.js";
@@ -82,7 +83,7 @@ program
 });
 // ── code — first-class governed coding-agent launcher ────────────────────────
 //
-// `mnemom code [scenario]` launches your coding-agent CLI (Claude Code in v1) with
+// `mnemom agent [session]` launches your coding-agent CLI (Claude Code in v1) with
 // its dev-time model traffic routed through the Mnemom gateway's /anthropic door
 // for observability + governance, under a governed agent identity (the
 // program-level `--agent`, default "code-agent") and an optional per-conversation
@@ -90,7 +91,7 @@ program
 // (default), --remote-control (interactive RC in this terminal), --server
 // (headless RC dispatcher) — with yolo on by default. `--cli` selects the
 // executable (name or full path; default claude). The us-2/prod door is the
-// DEFAULT; set MNEMOM_CODE_GATEWAY (or --gateway) to point elsewhere. The
+// DEFAULT; set MNEMOM_AGENT_GATEWAY (or --gateway) to point elsewhere. The
 // Anthropic key is resolved with zero 1Password dependency (env → ~/.mnemom store
 // → interactive prompt) inside the launched process and never logged. See
 // commands/code.ts.
@@ -99,10 +100,10 @@ const collectRepeatable = (value, previous) => {
     previous.push(value);
     return previous;
 };
-program
-    .command("code [scenario] [passthrough...]")
-    .description("Launch a governed coding agent through the Mnemom gateway (governed identity + optional sealed contract). Plain `mnemom code` asks for a session name and an optional goal. " +
-    "Sub-verbs: `mnemom code setup` provisions your governed agent; `mnemom code doctor` preflights prerequisites; `mnemom code config …` manages persistent settings (~/.mnemom/code.toml); `mnemom code invite <token>` redeems a Mnemom Code invitation.")
+const agentCmd = program
+    .command("agent [session] [passthrough...]")
+    .description("Launch your governed agent (Claude Code in v1) through the Mnemom gateway — governed identity + optional sealed goal contract. Plain `mnemom agent` asks for a session name and an optional goal. " +
+    "Sub-verbs: `setup` provisions your governed agent; `doctor` preflights prerequisites; `config …` manages persistent settings (~/.mnemom/launcher.toml); `invite <token>` redeems a Mnemom Agent invitation; `list` / `claim` / `move` manage the agents in your orgs.")
     .option("--goal <statement>", "Contract goal statement (required if any contract flag is given)")
     .option("--requirement <text>", "Contract requirement (repeatable)", collectRepeatable, [])
     .option("--allow <glob>", "Allowed path/glob (repeatable)", collectRepeatable, [])
@@ -111,9 +112,11 @@ program
     .option("--budget <usd>", "Guardrail: spend ceiling in USD (positive number)")
     .option("--max-turns <n>", "Guardrail: turn ceiling (positive integer)")
     .option("--stall <n>", "Guardrail: consecutive no-write turns (positive integer)")
+    .option("--implicit", "Goal alignment without a sealed contract: the gateway infers the goal from your messages and revises it as you steer (not combinable with --goal/--requirement/--allow/--forbid/--goal-id; the guardrail ceilings still apply)")
+    .option("--no-implicit", "Goal alignment off for this launch even when launcher.toml sets goal_mode = implicit")
     .option("--conversation-id <id>", "x-mnemom-conversation-id (default: auto-generated)")
     .option("--cli <name|path>", "Coding-agent CLI to launch: a name or full path (default: claude)")
-    .option("--gateway <url>", "Gateway host override (default: https://gateway.mnemom.ai; or MNEMOM_CODE_GATEWAY)")
+    .option("--gateway <url>", "Gateway host override (default: https://gateway.mnemom.ai; or MNEMOM_AGENT_GATEWAY)")
     .option("--remote-control", "Interactive Remote Control session in THIS terminal (behind a local proxy)")
     .option("--server", "Headless `claude remote-control` dispatcher (behind a local proxy)")
     .option("--model <alias|id>", "Model to launch (CLI alias or concrete id)")
@@ -125,7 +128,7 @@ program
     "max",
 ]))
     .option("--trim-mcp", "Launch the CLI with no MCP servers (--strict-mcp-config + empty --mcp-config)")
-    .option("--invite <token>", "Redeem a Mnemom Code invitation (pinv_…): unlocks Mnemom Code for you + credits your starter µ; launches too when a session name is given")
+    .option("--invite <token>", "Redeem a Mnemom Agent invitation (pinv_…): unlocks Mnemom Agent for you + credits your starter µ; launches too when a session name is given")
     .option("--setup", "Provision + claim the governed agent before launch (non-interactive opt-in)")
     .option("--no-setup", "Skip governed-agent provisioning entirely for this launch")
     .option("--no-yolo", "Do NOT pass --dangerously-skip-permissions (yolo is on by default)")
@@ -133,58 +136,71 @@ program
     .option("--dry-run", "Print the resolved launch plan and exit — no key read, no spawn")
     .action(async (scenario, passthrough, opts) => {
     try {
-        // Invitation redemption — `mnemom code invite <token>` (sub-verb) or
-        // `mnemom code --invite <token> [scenario]` — composes with the launch in
-        // runCodeInvocation (commands/code-invite.ts, unit-tested); everything below
+        // Invitation redemption — `mnemom agent invite <token>` (sub-verb) or
+        // `mnemom agent --invite <token> [session]` — composes with the launch in
+        // runAgentInvocation (commands/code-invite.ts, unit-tested); everything below
         // is the launch half, running only when a real scenario was given.
-        await runCodeInvocation({ scenario, passthrough, inviteFlag: opts.invite }, { redeem: (token) => codeInviteCommand(token), launch: (scenario) => launchCode(scenario) });
+        await runAgentInvocation({ scenario, passthrough, inviteFlag: opts.invite }, {
+            redeem: (token) => agentInviteCommand(token),
+            launch: (scenario) => launchAgent(scenario),
+        });
     }
     catch (error) {
         console.error("Error:", error instanceof Error ? error.message : error);
         process.exit(1);
     }
-    async function launchCode(scenario) {
-        // Sub-verb: `mnemom code config …` manages persistent settings and never
+    async function launchAgent(scenario) {
+        // Sub-verb: `mnemom agent config …` manages persistent settings and never
         // launches. (A scenario literally named "config" is reserved for this.)
         if (scenario === "config") {
-            await codeConfigCommand(passthrough);
+            await agentConfigCommand(passthrough);
             return;
         }
         if (opts.gateway)
-            process.env.MNEMOM_CODE_GATEWAY = opts.gateway;
-        // Persistent settings (~/.mnemom/code.toml) sit UNDER env and flags:
-        // precedence is flag > env > code.toml > built-in. Env-backed settings are
+            process.env.MNEMOM_AGENT_GATEWAY = opts.gateway;
+        // Persistent settings (~/.mnemom/launcher.toml) sit UNDER env and flags:
+        // precedence is flag > env > launcher.toml > built-in. Env-backed settings are
         // folded into env only when unset (so env/flags still win); the resolvers
         // in lib/code.ts keep the built-in default as the final fallback.
-        const cfg = loadCodeConfig();
+        const cfg = loadLauncherConfig();
         applyConfigToEnv(cfg, process.env);
-        // Sub-verb: `mnemom code doctor` runs a read-only preflight and never
+        // Sub-verb: `mnemom agent doctor` runs a read-only preflight and never
         // launches. Placed after config load so it reports the effective settings.
         if (scenario === "doctor") {
-            await codeDoctorCommand({ cli: opts.cli });
+            await agentDoctorCommand({ cli: opts.cli });
             return;
         }
-        // Sub-verb: `mnemom code setup` provisions/claims the governed agent and
+        // Sub-verb: `mnemom agent setup` provisions/claims the governed agent and
         // never launches. The agent slug follows the same precedence as a launch.
         if (scenario === "setup") {
-            await codeSetupCommand({ agent: program.opts().agent ?? cfg.agent });
+            await agentSetupCommand({ agent: program.opts().agent ?? cfg.agent });
             return;
         }
         const numToStr = (n) => n === undefined ? undefined : String(n);
-        // Config guardrails apply only when a contract is actually intended (a
-        // --goal is present), so a saved ceiling never forces an unrequested
-        // contract (which would then demand --goal and fail the launch).
-        const contractIntended = Boolean(opts.goal && opts.goal.trim());
+        // Implicit mode: --implicit / --no-implicit win; a --goal statement seals
+        // (the standing config default never overrides it); else launcher.toml
+        // `goal_mode`; else off. Pure + unit-tested in lib/agent.ts.
+        const implicit = resolveImplicit({
+            goal: opts.goal,
+            implicit: opts.implicit,
+            configGoalMode: cfg.goalMode,
+        });
+        // Config guardrails apply only when goal alignment is actually intended (a
+        // --goal is present, or implicit mode — where they ride on the mode header),
+        // so a saved ceiling never forces an unrequested contract (which would
+        // then demand --goal and fail the launch).
+        const contractIntended = Boolean(opts.goal && opts.goal.trim()) || implicit;
         // The governed identity rides on the program-level `--agent` (which
         // shadows a subcommand `--agent` under commander@12 — the MNE-238 class),
         // exactly as status/logs/onboard read it.
         const parentOpts = program.opts();
-        await codeCommand(scenario, {
+        await agentCommand(scenario, {
             goal: opts.goal,
             requirement: opts.requirement,
             allow: opts.allow,
             forbid: opts.forbid,
             goalId: opts.goalId,
+            implicit,
             budget: opts.budget ?? (contractIntended ? numToStr(cfg.guardrails?.budgetUsd) : undefined),
             maxTurns: opts.maxTurns ?? (contractIntended ? numToStr(cfg.guardrails?.maxTurns) : undefined),
             stall: opts.stall ?? (contractIntended ? numToStr(cfg.guardrails?.stallTurns) : undefined),
@@ -625,10 +641,10 @@ policyCmd
     await policyEvaluateCommand(file, options);
 });
 // ============================================================================
-// Agent management
+// Agent management — sub-verbs of `mnemom agent` (the launcher above): list / claim / move.
 // ============================================================================
-const agentsCmd = program
-    .command("agents")
+agentCmd
+    .command("list")
     .description("List agents across the orgs you belong to (ADR-062 org-scoped)")
     .option("--org <id>", "Scope to a single org (default: all orgs you belong to)")
     .action(async (opts) => {
@@ -640,7 +656,7 @@ const agentsCmd = program
         process.exit(1);
     }
 });
-agentsCmd
+agentCmd
     .command("claim <id-or-name>")
     .description("Claim an agent into an org (ADR-062 claim-to-org)")
     .option("--org <slug>", "Org slug or id to claim into (default: your ACTIVE org from `mnemom org use`, else your personal org)")
@@ -650,18 +666,10 @@ agentsCmd
     .option("--json", "Output JSON instead of human-readable text")
     .action(async (idOrName, opts) => {
     try {
-        // `agentsCmd` (the parent `agents` command) ALSO defines `--org` (for
-        // `mnemom agents --org <id>` list-scoping). Commander@12 binds a flag
-        // shared by a parent and a subcommand to whichever of the two owns it
-        // and runs first in the parse chain — here that's the parent — so
-        // `agents claim <id> --org <slug>` had its --org silently swallowed by
-        // `agentsCmd` before this subcommand's own `--org` option ever saw it
-        // (MNE-2496: confirmed live, the agent always landed in the caller's
-        // personal org regardless of --org). Same shadow class as the global
-        // `--agent` fix at MNE-238 (see the `advisories list`/`show` actions
-        // below) — resolve the local value first, falling back to the
-        // parent's captured value so either parse order still works.
-        const org = opts.org ?? agentsCmd.opts().org;
+        // The parent `agent` command defines no `--org`, so the MNE-2496 shadow
+        // (a parent-owned flag swallowing the subcommand.s) cannot recur here;
+        // `list` owns its own `--org` as a sibling sub-verb.
+        const org = opts.org;
         await agentsClaimCommand(idOrName, {
             org,
             key: opts.key,
@@ -675,7 +683,7 @@ agentsCmd
         process.exit(1);
     }
 });
-agentsCmd
+agentCmd
     .command("move <id-or-name>")
     .description("Move an agent to another org — requires owner/admin in BOTH the current and destination org " +
     "(role-based; no agent key needed, unlike re-claim)")

package/dist/lib/{code.d.ts → agent.d.ts}

@@ -1,8 +1,8 @@
 /**
- * lib/code.ts — the pure, IO-free core of `mnemom code`, the CLI's first-class
+ * lib/code.ts — the pure, IO-free core of `mnemom agent`, the CLI's first-class
  * governed-coding-agent launcher.
  *
- * `mnemom code` launches your coding-agent CLI (Claude Code in v1) with its
+ * `mnemom agent` launches your coding-agent CLI (Claude Code in v1) with its
  * dev-time model traffic routed through the Mnemom gateway for observability and
  * governance, under a governed agent identity and (optionally) a governed
  * per-conversation CONTRACT (goal / requirements / path allow-forbid lists +
@@ -16,7 +16,7 @@
  * key resolution, env assembly, and spawning the coding-agent CLI.
  *
  * The us-2/PROD gateway is the DEFAULT door (https://gateway.mnemom.ai). An
- * explicit MNEMOM_CODE_GATEWAY still wins (so any other cell is reachable when
+ * explicit MNEMOM_AGENT_GATEWAY still wins (so any other cell is reachable when
  * NAMED), but prod is never selected silently — see `resolveGatewayHost`.
  */
 /** The us-2/prod gateway host. The default door — never any other cell silently. */
@@ -48,20 +48,28 @@ export interface ContractFlags {
     maxTurns?: string | number;
     budget?: string | number;
     stall?: string | number;
+    /**
+     * `--implicit`: goal alignment WITHOUT a sealed contract. No `x-mnemom-contract`
+     * is sent; the gateway infers the goal from the user's own messages (revision 1
+     * after the first message) and revises it as the user steers. The guardrail
+     * ceilings still apply — they ride on the `x-mnemom-goal-mode` header instead
+     * of inside a contract. Cannot be combined with the sealed-contract flags.
+     */
+    implicit?: boolean;
 }
 /** The three launch shapes the command supports (see commands/code.ts). */
 export type LaunchShape = "terminal" | "remote-control" | "server";
 /**
  * Resolve the gateway HOST (scheme + host, no path). An explicit, non-empty
- * `MNEMOM_CODE_GATEWAY` wins verbatim; otherwise the us-2/prod host. The default
+ * `MNEMOM_AGENT_GATEWAY` wins verbatim; otherwise the us-2/prod host. The default
  * is PROD — an unset var resolves to prod, and any other cell is reached only by
  * NAMING it. Trailing slash trimmed so door concatenation is clean.
  */
 export declare function resolveGatewayHost(env?: NodeJS.ProcessEnv): string;
 /**
  * The Anthropic door the CLI points Claude Code at:
- * `${MNEMOM_CODE_GATEWAY}/anthropic`, or the full-door override
- * `MNEMOM_CODE_ANTHROPIC_GATEWAY` when set. v1 is Anthropic-only (no router door
+ * `${MNEMOM_AGENT_GATEWAY}/anthropic`, or the full-door override
+ * `MNEMOM_AGENT_ANTHROPIC_GATEWAY` when set. v1 is Anthropic-only (no router door
  * / Mnemom key), so the /anthropic door carries the whole contract: x-api-key +
  * x-mnemom-{agent,conversation-id,contract}.
  */
@@ -116,11 +124,20 @@ export interface SealedContractEnvelope {
  * here matches whatever the gateway seals for the same flags.
  */
 export declare function assembleContract(flags: ContractFlags): SealedContractEnvelope | null;
+/** The request header that opts a conversation into implicit goal mode. */
+export declare const GOAL_MODE_HEADER = "x-mnemom-goal-mode";
 /**
- * Resolve the launch shape from the flags and the `MNEMOM_CODE_REMOTE_CONTROL`
+ * The `x-mnemom-goal-mode` header value for `--implicit`, or null when the flag
+ * is absent: `implicit[; max_turns=N][; budget_usd=X][; stall_turns=N]` — the
+ * guardrail ceilings validated exactly as `assembleContract` validates them (a
+ * non-positive ceiling is refused, never silently dropped into an unguarded run).
+ */
+export declare function buildGoalModeHeader(flags: ContractFlags): string | null;
+/**
+ * Resolve the launch shape from the flags and the `MNEMOM_AGENT_REMOTE_CONTROL`
  * env var (the flags win). Default is `terminal` — a plain governed launch in
  * THIS terminal. `--remote-control` → `remote-control` (interactive RC in this
- * terminal); `--server` (or `MNEMOM_CODE_REMOTE_CONTROL=server`) → `server` (the
+ * terminal); `--server` (or `MNEMOM_AGENT_REMOTE_CONTROL=server`) → `server` (the
  * headless `claude remote-control` dispatcher). Throws on an invalid env value.
  */
 export declare function resolveLaunchShape(opts: {
@@ -129,7 +146,7 @@ export declare function resolveLaunchShape(opts: {
 }, env?: NodeJS.ProcessEnv): LaunchShape;
 /**
  * Did anyone EXPLICITLY choose a launch shape — a `--remote-control`/`--server`
- * flag, or a non-empty `MNEMOM_CODE_REMOTE_CONTROL` (which config.launch also
+ * flag, or a non-empty `MNEMOM_AGENT_REMOTE_CONTROL` (which config.launch also
  * sets)? When false, the command is free to AUTO-select the best shape: prefer
  * Remote-Control-in-terminal when the machine can do it, else terminal-only. An
  * explicit `terminal` choice (config `launch = "terminal"` → env "0") is
@@ -142,7 +159,8 @@ export declare function launchPreferenceExplicit(opts: {
 /**
  * Build the `ANTHROPIC_CUSTOM_HEADERS` value for the terminal-only launch: the
  * real Anthropic key as `x-api-key`, plus the governed-identity headers and the
- * sealed contract when present. Newline-separated, exactly the wire shape Claude
+ * sealed contract when present (or the implicit goal-mode header when the launch
+ * is `--implicit` — never both). Newline-separated, exactly the wire shape Claude
  * Code sends to the /anthropic door. NB: the returned string contains the key —
  * callers must place it only in the child's env, never in a log line.
  */
@@ -151,4 +169,28 @@ export declare function buildCustomHeaders(opts: {
     agent: string;
     conversationId: string;
     contractB64?: string;
+    /** `buildGoalModeHeader` output for an `--implicit` launch. */
+    goalMode?: string;
 }): string;
+/**
+ * The persistable goal-alignment default (`launcher.toml` `goal_mode`). Only the
+ * two statement-free modes can be a standing default: a SEALED contract needs a
+ * per-session statement, so it is always a per-launch `--goal`.
+ */
+export type GoalModeDefault = "implicit" | "off";
+/**
+ * Is this launch implicit-mode? Precedence, highest wins:
+ *   1. an explicit flag — `--implicit` (true) or `--no-implicit` (false);
+ *   2. a `--goal` statement — a sealed contract is a per-launch choice that the
+ *      standing config default must never silently override;
+ *   3. the config default `goal_mode = "implicit"`;
+ *   4. off.
+ * Pure so every arm is unit-tested; the caller passes the resolved value on to
+ * `assembleContract` / `buildGoalModeHeader` (which still refuse `--implicit`
+ * combined with a contract flag — that conflict is EXPLICIT and is reported).
+ */
+export declare function resolveImplicit(opts: {
+    goal?: string;
+    implicit?: boolean;
+    configGoalMode?: GoalModeDefault;
+}): boolean;

package/dist/lib/{code.js → agent.js}

@@ -1,8 +1,8 @@
 /**
- * lib/code.ts — the pure, IO-free core of `mnemom code`, the CLI's first-class
+ * lib/code.ts — the pure, IO-free core of `mnemom agent`, the CLI's first-class
  * governed-coding-agent launcher.
  *
- * `mnemom code` launches your coding-agent CLI (Claude Code in v1) with its
+ * `mnemom agent` launches your coding-agent CLI (Claude Code in v1) with its
  * dev-time model traffic routed through the Mnemom gateway for observability and
  * governance, under a governed agent identity and (optionally) a governed
  * per-conversation CONTRACT (goal / requirements / path allow-forbid lists +
@@ -16,7 +16,7 @@
  * key resolution, env assembly, and spawning the coding-agent CLI.
  *
  * The us-2/PROD gateway is the DEFAULT door (https://gateway.mnemom.ai). An
- * explicit MNEMOM_CODE_GATEWAY still wins (so any other cell is reachable when
+ * explicit MNEMOM_AGENT_GATEWAY still wins (so any other cell is reachable when
  * NAMED), but prod is never selected silently — see `resolveGatewayHost`.
  */
 import { createHash, randomUUID } from "node:crypto";
@@ -24,24 +24,24 @@ import { createHash, randomUUID } from "node:crypto";
 export const PROD_GATEWAY_HOST = "https://gateway.mnemom.ai";
 /**
  * Resolve the gateway HOST (scheme + host, no path). An explicit, non-empty
- * `MNEMOM_CODE_GATEWAY` wins verbatim; otherwise the us-2/prod host. The default
+ * `MNEMOM_AGENT_GATEWAY` wins verbatim; otherwise the us-2/prod host. The default
  * is PROD — an unset var resolves to prod, and any other cell is reached only by
  * NAMING it. Trailing slash trimmed so door concatenation is clean.
  */
 export function resolveGatewayHost(env = process.env) {
-    const raw = (env.MNEMOM_CODE_GATEWAY ?? "").trim();
+    const raw = (env.MNEMOM_AGENT_GATEWAY ?? "").trim();
     const host = raw.length > 0 ? raw : PROD_GATEWAY_HOST;
     return host.replace(/\/+$/, "");
 }
 /**
  * The Anthropic door the CLI points Claude Code at:
- * `${MNEMOM_CODE_GATEWAY}/anthropic`, or the full-door override
- * `MNEMOM_CODE_ANTHROPIC_GATEWAY` when set. v1 is Anthropic-only (no router door
+ * `${MNEMOM_AGENT_GATEWAY}/anthropic`, or the full-door override
+ * `MNEMOM_AGENT_ANTHROPIC_GATEWAY` when set. v1 is Anthropic-only (no router door
  * / Mnemom key), so the /anthropic door carries the whole contract: x-api-key +
  * x-mnemom-{agent,conversation-id,contract}.
  */
 export function resolveAnthropicDoor(env = process.env) {
-    const override = (env.MNEMOM_CODE_ANTHROPIC_GATEWAY ?? "").trim();
+    const override = (env.MNEMOM_AGENT_ANTHROPIC_GATEWAY ?? "").trim();
     if (override.length > 0)
         return override.replace(/\/+$/, "");
     return `${resolveGatewayHost(env)}/anthropic`;
@@ -132,6 +132,12 @@ function hasText(v) {
  * here matches whatever the gateway seals for the same flags.
  */
 export function assembleContract(flags) {
+    // Implicit goal mode seals nothing: the ceilings ride on the mode header
+    // (`buildGoalModeHeader`), so a `--budget` alone must not demand `--goal` here.
+    if (flags.implicit) {
+        assertImplicitCompatible(flags);
+        return null;
+    }
     if (!contractFlagsPresent(flags))
         return null;
     const statement = (flags.goal ?? "").trim();
@@ -178,21 +184,73 @@ export function assembleContract(flags) {
         sha: sha256Hex16(canonical),
     };
 }
+/** The request header that opts a conversation into implicit goal mode. */
+export const GOAL_MODE_HEADER = "x-mnemom-goal-mode";
+const SEALED_ONLY_FLAGS = "--goal/--requirement/--allow/--forbid/--goal-id";
+/**
+ * `--implicit` and a sealed contract are mutually exclusive: on the gateway a
+ * sealed `x-mnemom-contract` always wins and would silently switch implicit mode
+ * off, so the launch refuses the combination rather than ship a header that does
+ * nothing.
+ */
+function assertImplicitCompatible(flags) {
+    const sealed = hasText(flags.goal) ||
+        (flags.requirement?.length ?? 0) > 0 ||
+        (flags.allow?.length ?? 0) > 0 ||
+        (flags.forbid?.length ?? 0) > 0 ||
+        hasText(flags.goalId);
+    if (sealed) {
+        throw new Error(`--implicit cannot be combined with ${SEALED_ONLY_FLAGS}: a sealed contract always wins on ` +
+            "the gateway and would silently switch implicit mode off. Drop --implicit to seal a " +
+            "contract, or drop the contract flags to let the gateway infer the goal from your messages.");
+    }
+}
+/**
+ * The `x-mnemom-goal-mode` header value for `--implicit`, or null when the flag
+ * is absent: `implicit[; max_turns=N][; budget_usd=X][; stall_turns=N]` — the
+ * guardrail ceilings validated exactly as `assembleContract` validates them (a
+ * non-positive ceiling is refused, never silently dropped into an unguarded run).
+ */
+export function buildGoalModeHeader(flags) {
+    if (!flags.implicit)
+        return null;
+    assertImplicitCompatible(flags);
+    const parts = ["implicit"];
+    if (flags.maxTurns !== undefined) {
+        if (!isPositiveInt(flags.maxTurns)) {
+            throw new Error(`--max-turns must be a positive integer (got '${flags.maxTurns}').`);
+        }
+        parts.push(`max_turns=${Number(flags.maxTurns)}`);
+    }
+    if (flags.budget !== undefined) {
+        if (!isPositiveNumber(flags.budget)) {
+            throw new Error(`--budget must be a positive USD amount (got '${flags.budget}').`);
+        }
+        parts.push(`budget_usd=${Number(flags.budget)}`);
+    }
+    if (flags.stall !== undefined) {
+        if (!isPositiveInt(flags.stall)) {
+            throw new Error(`--stall must be a positive integer (got '${flags.stall}').`);
+        }
+        parts.push(`stall_turns=${Number(flags.stall)}`);
+    }
+    return parts.join("; ");
+}
 /** Trim, drop empties — matches the gateway's `stringArray` filtering. */
 function cleanList(values) {
     return (values ?? []).map((v) => v.trim()).filter((v) => v.length > 0);
 }
 /**
- * Resolve the launch shape from the flags and the `MNEMOM_CODE_REMOTE_CONTROL`
+ * Resolve the launch shape from the flags and the `MNEMOM_AGENT_REMOTE_CONTROL`
  * env var (the flags win). Default is `terminal` — a plain governed launch in
  * THIS terminal. `--remote-control` → `remote-control` (interactive RC in this
- * terminal); `--server` (or `MNEMOM_CODE_REMOTE_CONTROL=server`) → `server` (the
+ * terminal); `--server` (or `MNEMOM_AGENT_REMOTE_CONTROL=server`) → `server` (the
  * headless `claude remote-control` dispatcher). Throws on an invalid env value.
  */
 export function resolveLaunchShape(opts, env = process.env) {
     let rc = false;
     let server = false;
-    const envRc = (env.MNEMOM_CODE_REMOTE_CONTROL ?? "").trim();
+    const envRc = (env.MNEMOM_AGENT_REMOTE_CONTROL ?? "").trim();
     switch (envRc) {
         case "":
         case "0":
@@ -206,7 +264,7 @@ export function resolveLaunchShape(opts, env = process.env) {
             server = true;
             break;
         default:
-            throw new Error(`MNEMOM_CODE_REMOTE_CONTROL must be 0, 1, terminal or server (got '${envRc}').`);
+            throw new Error(`MNEMOM_AGENT_REMOTE_CONTROL must be 0, 1, terminal or server (got '${envRc}').`);
     }
     if (opts.remoteControl)
         rc = true;
@@ -222,7 +280,7 @@ export function resolveLaunchShape(opts, env = process.env) {
 }
 /**
  * Did anyone EXPLICITLY choose a launch shape — a `--remote-control`/`--server`
- * flag, or a non-empty `MNEMOM_CODE_REMOTE_CONTROL` (which config.launch also
+ * flag, or a non-empty `MNEMOM_AGENT_REMOTE_CONTROL` (which config.launch also
  * sets)? When false, the command is free to AUTO-select the best shape: prefer
  * Remote-Control-in-terminal when the machine can do it, else terminal-only. An
  * explicit `terminal` choice (config `launch = "terminal"` → env "0") is
@@ -231,12 +289,13 @@ export function resolveLaunchShape(opts, env = process.env) {
 export function launchPreferenceExplicit(opts, env = process.env) {
     if (opts.remoteControl || opts.server)
         return true;
-    return (env.MNEMOM_CODE_REMOTE_CONTROL ?? "").trim() !== "";
+    return (env.MNEMOM_AGENT_REMOTE_CONTROL ?? "").trim() !== "";
 }
 /**
  * Build the `ANTHROPIC_CUSTOM_HEADERS` value for the terminal-only launch: the
  * real Anthropic key as `x-api-key`, plus the governed-identity headers and the
- * sealed contract when present. Newline-separated, exactly the wire shape Claude
+ * sealed contract when present (or the implicit goal-mode header when the launch
+ * is `--implicit` — never both). Newline-separated, exactly the wire shape Claude
  * Code sends to the /anthropic door. NB: the returned string contains the key —
  * callers must place it only in the child's env, never in a log line.
  */
@@ -248,5 +307,25 @@ export function buildCustomHeaders(opts) {
     ];
     if (opts.contractB64)
         lines.push(`x-mnemom-contract: ${opts.contractB64}`);
+    if (opts.goalMode)
+        lines.push(`${GOAL_MODE_HEADER}: ${opts.goalMode}`);
     return lines.join("\n");
 }
+/**
+ * Is this launch implicit-mode? Precedence, highest wins:
+ *   1. an explicit flag — `--implicit` (true) or `--no-implicit` (false);
+ *   2. a `--goal` statement — a sealed contract is a per-launch choice that the
+ *      standing config default must never silently override;
+ *   3. the config default `goal_mode = "implicit"`;
+ *   4. off.
+ * Pure so every arm is unit-tested; the caller passes the resolved value on to
+ * `assembleContract` / `buildGoalModeHeader` (which still refuse `--implicit`
+ * combined with a contract flag — that conflict is EXPLICIT and is reported).
+ */
+export function resolveImplicit(opts) {
+    if (opts.implicit !== undefined)
+        return opts.implicit;
+    if (hasText(opts.goal))
+        return false;
+    return opts.configGoalMode === "implicit";
+}

package/dist/lib/api.d.ts

@@ -378,7 +378,7 @@ export declare function moveAgent(agentId: string, destOrgId: string, opts?: {
  */
 export declare function getMyPersonalOrg(): Promise<PersonalOrgRef>;
 /** The authenticated user's identity — `GET /v1/auth/me`. Carries the email the
- *  stored OAuth token does not, so the CLI can derive a real `code-<handle>`. */
+ *  stored OAuth token does not, so the CLI can derive a real `agent-<handle>`. */
 export interface MeResponse {
     user_id: string;
     email?: string | null;
@@ -1204,7 +1204,7 @@ export interface OrgUsageQuery {
  * the user "org not found" on what is most often just the flag being off.
  */
 export declare function getOrgUsage(orgId: string, opts?: OrgUsageQuery): Promise<OrgUsageResponse>;
-/** `GET /v1/code/entitlement` 200 body — why Mnemom Code is enabled for the org. */
+/** `GET /v1/code/entitlement` 200 body — why Mnemom Agent is enabled for the org. */
 export interface CodeEntitlement {
     org_id: string;
     enabled: true;
@@ -1213,7 +1213,7 @@ export interface CodeEntitlement {
 /** The machine-readable code on the gate's 403 when the org is not enabled. */
 export declare const CODE_NOT_ENABLED = "code_not_enabled";
 /**
- * Is Mnemom Code enabled for `orgId` (default: the caller's primary org)?
+ * Is Mnemom Agent enabled for `orgId` (default: the caller's primary org)?
  * Resolves on 200; throws MnemomApiError with `.code === "code_not_enabled"`
  * (and `.details.hint`) when the org is not enabled, or a plain MnemomApiError
  * for membership/transport failures.
@@ -1229,6 +1229,6 @@ export interface AcceptProductInviteResult {
     products: string[];
     grant?: "fired" | "deferred";
 }
-/** Redeem a `pinv_…` product invite (a Mnemom Code invitation) for the signed-in user. */
+/** Redeem a `pinv_…` product invite (a Mnemom Agent invitation) for the signed-in user. */
 export declare function acceptProductInvite(token: string): Promise<AcceptProductInviteResult>;
 export {};

package/dist/lib/api.js

@@ -898,7 +898,7 @@ export async function resolveAgentId(agentName) {
     const name = agentName ?? process.env.MNEMOM_AGENT;
     if (!name) {
         console.error("\nAgent required. Use --agent <name> or set MNEMOM_AGENT.\n");
-        console.error("List your agents with: mnemom agents\n");
+        console.error("List your agents with: mnemom agent list\n");
         process.exit(1);
     }
     // If it looks like an agent ID, use directly (no server call needed)
@@ -919,9 +919,9 @@ export async function resolveAgentId(agentName) {
         }
     }
     console.error(`\nAgent not found: ${name}`);
-    console.error("List your agents with: mnemom agents\n");
+    console.error("List your agents with: mnemom agent list\n");
     console.error(`\nThis can happen when the agent was auto-created by the gateway and has not been claimed to your account yet.`);
-    console.error(`To claim it, run: mnemom agents claim <agent-id> --name ${name} --key <your-provider-key>`);
+    console.error(`To claim it, run: mnemom agent claim <agent-id> --name ${name} --key <your-provider-key>`);
     console.error(`The <agent-id> (mnm-...) is the X-Mnemom-Agent value returned in the gateway response headers.`);
     console.error(`See: https://docs.mnemom.ai/quickstart/gateway\n`);
     process.exit(1);
@@ -1495,12 +1495,12 @@ export async function getOrgUsage(orgId, opts = {}) {
     const qs = params.toString() ? `?${params.toString()}` : "";
     return gFetch(`/v1/orgs/${encodeURIComponent(orgId)}/usage/by-person${qs}`, {}, { fallback: "Failed to fetch usage" });
 }
-// ─── Mnemom Code — feature gate + invitation redemption ──────────────────────
+// ─── Mnemom Agent — feature gate + invitation redemption ──────────────────────
 //
-// `mnemom code` is rolling out to an invited cohort. Two api calls back that:
+// `mnemom agent` is rolling out to an invited cohort. Two api calls back that:
 // the per-org gate (`GET /v1/code/entitlement`) the launch preamble checks, and
 // the product-invite accept (`POST /v1/invites/accept`) behind
-// `mnemom code --invite <token>`. Both go through `codeFetch` rather than
+// `mnemom agent --invite <token>`. Both go through `codeFetch` rather than
 // `gFetch`: gFetch flattens EVERY 403 into "Permission denied (need org admin /
 // membership)", but the gate's 403 carries a machine-readable
 // `code_not_enabled` + a hint the command layer must print verbatim, and the
@@ -1529,16 +1529,16 @@ async function codeFetch(path, init = {}, fallback) {
 /** The machine-readable code on the gate's 403 when the org is not enabled. */
 export const CODE_NOT_ENABLED = "code_not_enabled";
 /**
- * Is Mnemom Code enabled for `orgId` (default: the caller's primary org)?
+ * Is Mnemom Agent enabled for `orgId` (default: the caller's primary org)?
  * Resolves on 200; throws MnemomApiError with `.code === "code_not_enabled"`
  * (and `.details.hint`) when the org is not enabled, or a plain MnemomApiError
  * for membership/transport failures.
  */
 export async function getCodeEntitlement(orgId) {
     const q = orgId ? `?org_id=${encodeURIComponent(orgId)}` : "";
-    return codeFetch(`/v1/code/entitlement${q}`, {}, "Could not check Mnemom Code access");
+    return codeFetch(`/v1/code/entitlement${q}`, {}, "Could not check Mnemom Agent access");
 }
-/** Redeem a `pinv_…` product invite (a Mnemom Code invitation) for the signed-in user. */
+/** Redeem a `pinv_…` product invite (a Mnemom Agent invitation) for the signed-in user. */
 export async function acceptProductInvite(token) {
     return codeFetch("/v1/invites/accept", { method: "POST", body: JSON.stringify({ token }) }, "Could not redeem the invitation");
 }