@mnemom/mnemom 0.17.0-next.7 → 0.17.0-next.8

package/README.md

@@ -44,6 +44,32 @@ That's it. `mnemom init` detects your configured AI provider API keys (Anthropic
 | `mnemom card publish <file>`  | Publish alignment card from JSON file                |
 | `mnemom card validate <file>` | Validate card JSON locally                           |
 | `mnemom usage --org <id>`     | Show per-person token and request consumption        |
+| `mnemom agent [name]`         | Launch a governed coding agent through the gateway   |
+
+### `mnemom agent` — goal alignment
+
+`mnemom agent` launches your coding-agent CLI (Claude Code today) with its model traffic
+routed through the Mnemom gateway under a governed identity. Goal alignment — the judge
+nudging the agent back when it drifts from your goal — comes in three modes; a bare
+`mnemom agent` in a terminal asks which one you want (Enter = off, for now):
+
+| Mode         | How                                                                                                            | What is sent                                |
+| ------------ | -------------------------------------------------------------------------------------------------------------- | ------------------------------------------- |
+| **Implicit** | `--implicit` — the gateway infers the goal from your own messages and revises it as you steer; nothing to type | `x-mnemom-goal-mode: implicit`, no contract |
+| **Sealed**   | `--goal "<statement>"` (+ `--requirement/--allow/--forbid/--goal-id`) — sealed as a contract on the first turn | `x-mnemom-contract`                         |
+| **Off**      | neither                                                                                                        | neither header                              |
+
+`--implicit` cannot be combined with the sealed-contract flags: a sealed contract always
+wins on the gateway and would silently switch implicit mode off, so the launch refuses the
+mix. The guardrail ceilings (`--budget`, `--max-turns`, `--stall`, or `guardrails.*` in
+`~/.mnemom/launcher.toml`) apply in both modes — in implicit mode they ride on the mode
+header. In implicit mode the goal lags your steering by one request: a response to a new
+message carries `x-mnemom-goal-steer: queued` and the revision the agent acted under;
+the next request reads the new revision (`x-mnemom-goal-revision`).
+
+Make one mode the standing default with `mnemom agent config set goal_mode implicit`
+(or `off`); `--goal` still seals for that launch and `--no-implicit` turns it off for one
+launch. A sealed contract needs a per-launch statement, so it cannot be the default.
 
 ## How It Works
 

package/dist/commands/agent-config.d.ts

@@ -15,3 +15,15 @@
  */
 /** Entry point for `mnemom agent config <verb> [args...]`. Throws on misuse. */
 export declare function agentConfigCommand(argv: string[]): Promise<void>;
+/**
+ * `$VISUAL` / `$EDITOR` is a program plus optional plain flags (`code --wait`, `emacsclient -t`),
+ * never shell syntax: the value is split on whitespace and every token must be a bare
+ * program name, path, or flag. Anything else (quotes, `;`, `$(`, backticks, redirections, …) is
+ * refused with a remediation rather than handed to spawnSync — the editor is launched WITHOUT a
+ * shell, so such a value could only ever fail confusingly or, via a lookalike binary on PATH, run
+ * something the user did not mean. Exported for the tests.
+ */
+export declare function parseEditorSpec(spec: string): {
+    bin: string;
+    args: string[];
+};

package/dist/commands/agent-config.js

@@ -98,8 +98,8 @@ function editConfig() {
     // Seed a header-only file so $EDITOR opens something with guidance, not a blank.
     if (!existsSync(LAUNCHER_CONFIG_PATH))
         writeLauncherConfig(loadLauncherConfig());
-    const editor = process.env.VISUAL || process.env.EDITOR || fallbackEditor();
-    const res = spawnSync(editor, [LAUNCHER_CONFIG_PATH], { stdio: "inherit" });
+    const { bin: editor, args: editorArgs } = parseEditorSpec(process.env.VISUAL || process.env.EDITOR || fallbackEditor());
+    const res = spawnSync(editor, [...editorArgs, LAUNCHER_CONFIG_PATH], { stdio: "inherit" });
     if (res.error) {
         throw new Error(`mnemom agent config edit: could not launch editor '${editor}': ${res.error.message}\n` +
             `  Set $EDITOR, or edit ${LAUNCHER_CONFIG_PATH} directly.`);
@@ -108,6 +108,23 @@ function editConfig() {
     loadLauncherConfig();
     out(`Saved ${LAUNCHER_CONFIG_PATH}.`);
 }
+/**
+ * `$VISUAL` / `$EDITOR` is a program plus optional plain flags (`code --wait`, `emacsclient -t`),
+ * never shell syntax: the value is split on whitespace and every token must be a bare
+ * program name, path, or flag. Anything else (quotes, `;`, `$(`, backticks, redirections, …) is
+ * refused with a remediation rather than handed to spawnSync — the editor is launched WITHOUT a
+ * shell, so such a value could only ever fail confusingly or, via a lookalike binary on PATH, run
+ * something the user did not mean. Exported for the tests.
+ */
+export function parseEditorSpec(spec) {
+    const tokens = spec.trim().split(/\s+/).filter(Boolean);
+    const SAFE = /^[A-Za-z0-9_./+=:@,-]+$/;
+    if (tokens.length === 0 || !tokens.every((t) => SAFE.test(t))) {
+        throw new Error(`mnemom agent config edit: refusing to run $VISUAL/$EDITOR value '${spec}' — only a program name or path plus plain flags is accepted (no shell syntax).\n` +
+            `  Set $EDITOR to e.g. 'code --wait', or edit ${LAUNCHER_CONFIG_PATH} directly.`);
+    }
+    return { bin: tokens[0], args: tokens.slice(1) };
+}
 function fallbackEditor() {
     for (const cand of ["nano", "vim", "vi"]) {
         const r = spawnSync("sh", ["-c", `command -v "$1" >/dev/null 2>&1`, "sh", cand], {
@@ -158,6 +175,9 @@ function deleteKey(cfg, key) {
         case "effort":
             delete cfg.effort;
             break;
+        case "goal_mode":
+            delete cfg.goalMode;
+            break;
         case "cli":
             delete cfg.cli;
             break;

package/dist/commands/agent-session.d.ts

@@ -7,25 +7,35 @@
  *
  *   1. a SESSION NAME — labels the session in traces and the claude.ai session
  *      list (defaults to the current folder's name);
- *   2. an optional GOAL — one line. With a goal, Mnemom seals a goal contract
- *      for the session and the judge nudges the agent back when it drifts (a
- *      little µ per turn). Without one, the session runs governed but with goal
- *      alignment OFF: no contract header is sent, so the gateway's goal hook is
- *      simply not engaged for the conversation.
+ *   2. GOAL ALIGNMENT — one of three:
+ *      - INFER it from your messages (implicit mode): nothing to type; the
+ *        gateway reads your own messages, revises the goal as you steer, and the
+ *        judge nudges the agent back when it drifts (a little µ per new message
+ *        and per judged turn). Sends `x-mnemom-goal-mode: implicit`, no contract.
+ *      - TYPE a one-line goal: sealed as a contract for the session; the judge
+ *        nudges against it (a little µ per turn). Sends `x-mnemom-contract`.
+ *      - OFF: the session runs governed with goal alignment off — neither header
+ *        is sent, so the gateway's goal hooks are simply not engaged.
  *
  * Non-interactive runs (pipes, CI) never prompt — they get a clear error asking
- * for a name. `--goal` on the command line always wins over the prompt. Pure
- * apart from the injected `ask` functions, so every arm is unit-tested.
+ * for a name. `--goal` on the command line always wins over the prompt, and a
+ * resolved implicit launch (`--implicit`, or launcher.toml `goal_mode =
+ * "implicit"` with no `--no-implicit`) skips it too. Pure apart from the
+ * injected `ask` functions, so every arm is unit-tested.
  */
 export interface SessionAsk {
     askInput(question: string): Promise<string>;
     askYesNo(question: string, defaultYes: boolean): Promise<boolean>;
+    /** Numbered single-select; resolves the chosen label, or null on no/invalid choice. */
+    askSelect(question: string, options: string[]): Promise<string | null>;
 }
 export interface SessionSetupInput {
     /** The positional `[scenario]` (session name), if given. */
     scenario?: string;
     /** `--goal <statement>`, if given — skips the goal prompt. */
     goal?: string;
+    /** Resolved implicit mode (flag or config default) — skips the goal prompt; alignment on without a contract. */
+    implicit?: boolean;
     interactive: boolean;
     /** For the default session name (tests inject one). */
     cwd?: string;
@@ -34,17 +44,23 @@ export interface SessionSetupInput {
 }
 export interface SessionSetup {
     scenario: string;
-    /** The goal statement to seal, or undefined = goal alignment off. */
+    /** The goal statement to seal, or undefined = no sealed contract (implicit or off). */
     goal?: string;
-    goalAlignment: "on" | "off";
+    goalAlignment: "on" | "implicit" | "off";
     /** True when the terminal prompts ran. */
     prompted: boolean;
 }
 export declare const NO_SESSION_NAME_MESSAGE: string;
+/** The three goal-alignment choices offered by the interactive prompt (labels are the select options). */
+export declare const GOAL_CHOICE_IMPLICIT = "Infer my goal from my messages \u2014 nothing to type; revised as I steer (implicit mode)";
+export declare const GOAL_CHOICE_TYPED = "Type a one-line goal \u2014 sealed as a contract for this session";
+export declare const GOAL_CHOICE_OFF = "Off \u2014 run governed with goal alignment off (Enter)";
+export declare const GOAL_CHOICES: readonly string[];
+export declare const GOAL_CHOICE_QUESTION = "Goal alignment for this session?";
 /** Current folder name, sanitised like an agent slug; "session" when that is empty. */
 export declare function defaultSessionName(cwd?: string): string;
 /** The one-line status printed at launch so the customer always knows the mode. */
-export declare function goalAlignmentLine(on: boolean): string;
+export declare function goalAlignmentLine(mode: boolean | "on" | "implicit" | "off"): string;
 /**
  * Resolve the session name + goal for this launch. See the module doc for the
  * rules. Throws NO_SESSION_NAME_MESSAGE when no name was given and we cannot ask.

package/dist/commands/agent-session.js

@@ -7,29 +7,50 @@
  *
  *   1. a SESSION NAME — labels the session in traces and the claude.ai session
  *      list (defaults to the current folder's name);
- *   2. an optional GOAL — one line. With a goal, Mnemom seals a goal contract
- *      for the session and the judge nudges the agent back when it drifts (a
- *      little µ per turn). Without one, the session runs governed but with goal
- *      alignment OFF: no contract header is sent, so the gateway's goal hook is
- *      simply not engaged for the conversation.
+ *   2. GOAL ALIGNMENT — one of three:
+ *      - INFER it from your messages (implicit mode): nothing to type; the
+ *        gateway reads your own messages, revises the goal as you steer, and the
+ *        judge nudges the agent back when it drifts (a little µ per new message
+ *        and per judged turn). Sends `x-mnemom-goal-mode: implicit`, no contract.
+ *      - TYPE a one-line goal: sealed as a contract for the session; the judge
+ *        nudges against it (a little µ per turn). Sends `x-mnemom-contract`.
+ *      - OFF: the session runs governed with goal alignment off — neither header
+ *        is sent, so the gateway's goal hooks are simply not engaged.
  *
  * Non-interactive runs (pipes, CI) never prompt — they get a clear error asking
- * for a name. `--goal` on the command line always wins over the prompt. Pure
- * apart from the injected `ask` functions, so every arm is unit-tested.
+ * for a name. `--goal` on the command line always wins over the prompt, and a
+ * resolved implicit launch (`--implicit`, or launcher.toml `goal_mode =
+ * "implicit"` with no `--no-implicit`) skips it too. Pure apart from the
+ * injected `ask` functions, so every arm is unit-tested.
  */
 import { basename } from "node:path";
 import { sanitizeAgentName } from "../lib/agent.js";
 export const NO_SESSION_NAME_MESSAGE = "mnemom agent: a session name is required here (e.g. `mnemom agent onboarding`). " +
     "In a terminal, plain `mnemom agent` asks for one.";
+/** The three goal-alignment choices offered by the interactive prompt (labels are the select options). */
+export const GOAL_CHOICE_IMPLICIT = "Infer my goal from my messages — nothing to type; revised as I steer (implicit mode)";
+export const GOAL_CHOICE_TYPED = "Type a one-line goal — sealed as a contract for this session";
+export const GOAL_CHOICE_OFF = "Off — run governed with goal alignment off (Enter)";
+export const GOAL_CHOICES = [
+    GOAL_CHOICE_IMPLICIT,
+    GOAL_CHOICE_TYPED,
+    GOAL_CHOICE_OFF,
+];
+export const GOAL_CHOICE_QUESTION = "Goal alignment for this session?";
 /** Current folder name, sanitised like an agent slug; "session" when that is empty. */
 export function defaultSessionName(cwd = process.cwd()) {
     return sanitizeAgentName(basename(cwd)) || "session";
 }
 /** The one-line status printed at launch so the customer always knows the mode. */
-export function goalAlignmentLine(on) {
-    return on
+export function goalAlignmentLine(mode) {
+    const m = mode === true ? "on" : mode === false ? "off" : mode;
+    if (m === "implicit") {
+        return ("mnemom agent: goal alignment: on, implicit (no sealed contract — the gateway infers your goal " +
+            "from your own messages, revises it as you steer, and the judge nudges the agent back when it drifts)");
+    }
+    return m === "on"
         ? "mnemom agent: goal alignment: on (the judge nudges the agent back when it drifts from your goal)"
-        : "mnemom agent: goal alignment: off (no goal set — pass --goal or set one when prompted)";
+        : "mnemom agent: goal alignment: off (no goal set — pass --goal or --implicit, or set one when prompted)";
 }
 const defaultSay = (line = "") => console.error(line);
 /**
@@ -39,12 +60,13 @@ const defaultSay = (line = "") => console.error(line);
 export async function resolveSessionSetup(input, ask) {
     const say = input.say ?? defaultSay;
     const flagGoal = (input.goal ?? "").trim();
+    const implicit = input.implicit === true;
     const given = (input.scenario ?? "").trim();
     if (given) {
         return {
             scenario: given,
             goal: flagGoal || undefined,
-            goalAlignment: flagGoal ? "on" : "off",
+            goalAlignment: flagGoal ? "on" : implicit ? "implicit" : "off",
             prompted: false,
         };
     }
@@ -57,22 +79,36 @@ export async function resolveSessionSetup(input, ask) {
     say(`  (Next time you can pass it directly: mnemom agent <name>.)`);
     const typed = await ask.askInput(`Session name [${fallback}]:`);
     const scenario = sanitizeAgentName(typed.trim()) || fallback;
-    // ── 2. goal (skipped when --goal was given) ──
+    // ── 2. goal alignment (skipped when --goal or implicit mode was resolved) ──
     if (flagGoal) {
         return { scenario, goal: flagGoal, goalAlignment: "on", prompted: true };
     }
+    if (implicit) {
+        return { scenario, goalAlignment: "implicit", prompted: true };
+    }
     say();
-    say("Goal alignment — an optional one-line goal for this session.");
-    say("  With a goal, Mnemom's judge watches each turn and nudges the agent back when it drifts");
-    say("  (a little µ per turn). Without one, the session runs governed with goal alignment off.");
-    const wantsGoal = await ask.askYesNo("Set a goal for this session?", true);
-    if (!wantsGoal) {
-        return { scenario, goalAlignment: "off", prompted: true };
+    say("Goal alignment — how Mnemom keeps this session on track. Three choices:");
+    say("  Infer: nothing to type — the gateway reads your own messages, revises the goal as you");
+    say("    steer, and the judge nudges the agent back when it drifts (a little µ per message + turn).");
+    say("  Type a goal: one line, sealed as a contract; the judge nudges against it (a little µ per turn).");
+    say("  Off: the session runs governed with goal alignment off (the default — just press Enter).");
+    say("  (Make one the default: mnemom agent config set goal_mode implicit|off.)");
+    const choice = await ask.askSelect(GOAL_CHOICE_QUESTION, [...GOAL_CHOICES]);
+    if (choice === GOAL_CHOICE_IMPLICIT) {
+        return { scenario, goalAlignment: "implicit", prompted: true };
+    }
+    if (choice === GOAL_CHOICE_TYPED) {
+        const goal = (await ask.askInput("Goal (one line):")).trim();
+        if (!goal) {
+            say("  No goal entered — continuing with goal alignment off.");
+            return { scenario, goalAlignment: "off", prompted: true };
+        }
+        return { scenario, goal, goalAlignment: "on", prompted: true };
     }
-    const goal = (await ask.askInput("Goal (one line):")).trim();
-    if (!goal) {
-        say("  No goal entered — continuing with goal alignment off.");
-        return { scenario, goalAlignment: "off", prompted: true };
+    // Enter (no pick) and any invalid pick both resolve to null → off. Off is the
+    // deliberate default for now: a µ-costing mode is never picked by a bare Enter.
+    if (choice !== GOAL_CHOICE_OFF) {
+        say("  Goal alignment off (press 1 or 2 next time to turn it on).");
     }
-    return { scenario, goal, goalAlignment: "on", prompted: true };
+    return { scenario, goalAlignment: "off", prompted: true };
 }

package/dist/commands/agent.d.ts

@@ -25,6 +25,7 @@
  * line, or the proxy's stdin under RC). It is never logged, printed, or passed as
  * an argv value.
  */
+import { type LaunchShape, type SealedContractEnvelope } from "../lib/agent.js";
 export interface AgentOptions {
     goal?: string;
     requirement?: string[];
@@ -34,6 +35,12 @@ export interface AgentOptions {
     budget?: string;
     maxTurns?: string;
     stall?: string;
+    /**
+     * `--implicit`: goal alignment with no sealed contract — the gateway infers the
+     * goal from the user's messages and revises it as they steer; the ceilings above
+     * ride on the `x-mnemom-goal-mode` header. Exclusive with the contract flags.
+     */
+    implicit?: boolean;
     /** x-mnemom-agent value (defaults to "code-agent"). */
     agent?: string;
     conversationId?: string;
@@ -131,3 +138,32 @@ export declare function buildCliArgs(options: AgentOptions, ctx: {
     yolo: boolean;
     allowCliFlags: boolean;
 }): string[];
+/**
+ * Which goal-alignment mode the launch status line names: a sealed contract →
+ * "on"; `--implicit` (mode header, no contract) → "implicit"; neither → "off".
+ * A sealed contract and a mode header never coexist (`assembleContract` refuses
+ * the combination), so the first arm winning is not a precedence choice.
+ */
+export declare function goalAlignmentMode(envelope: SealedContractEnvelope | null, goalMode: string | null): "on" | "implicit" | "off";
+export declare function logLaunch(ctx: {
+    shape: LaunchShape;
+    door: string;
+    agent: string;
+    conversationId: string;
+    cellNote: string;
+    envelope: SealedContractEnvelope | null;
+    goalMode: string | null;
+    cli: ResolvedCli;
+}): void;
+export declare function printPlan(ctx: {
+    scenario: string;
+    shape: LaunchShape;
+    agent: string;
+    conversationId: string;
+    door: string;
+    cellNote: string;
+    envelope: SealedContractEnvelope | null;
+    goalMode: string | null;
+    yolo: boolean;
+    cli: ResolvedCli;
+}): void;

package/dist/commands/agent.js

@@ -33,18 +33,28 @@ import { fileURLToPath } from "node:url";
 import { MNEMOM_DIR } from "../lib/config.js";
 import { configKeySpec, loadLauncherConfig, writeLauncherConfig } from "../lib/launcher-config.js";
 import { fmt } from "../lib/format.js";
-import { askInput, askYesNo, isInteractive } from "../lib/prompt.js";
+import { askInput, askSelect, askYesNo, isInteractive } from "../lib/prompt.js";
 import { goalAlignmentLine, resolveSessionSetup } from "./agent-session.js";
 import { defaultAgentSlug, ensureGovernedAgent, ensureSessionAndBalance, isQuietPreambleExit, resolveDefaultSlug, } from "./agent-setup.js";
-import { assembleContract, buildCustomHeaders, isProdGateway, launchPreferenceExplicit, resolveAnthropicDoor, resolveConversationId, resolveGatewayHost, resolveLaunchShape, sanitizeAgentName, } from "../lib/agent.js";
+import { assembleContract, buildGoalModeHeader, buildCustomHeaders, isProdGateway, launchPreferenceExplicit, resolveAnthropicDoor, resolveConversationId, resolveGatewayHost, resolveLaunchShape, sanitizeAgentName, } from "../lib/agent.js";
 /** The CLI's own provider-key store (zero 1Password): ~/.mnemom/launcher.json, 0600. */
 const CODE_STORE = join(MNEMOM_DIR, "launcher.json");
 const say = (line = "") => console.error(line);
 /** Entry point for `mnemom agent [scenario]`. Throws on fatal misconfig. */
 export async function agentCommand(scenarioArg, options = {}) {
     // ── session name + goal ── (a bare `mnemom agent` in a terminal asks for both,
-    // explaining goal alignment; no goal ⇒ no contract header ⇒ goal alignment off)
-    const session = await resolveSessionSetup({ scenario: scenarioArg, goal: options.goal, interactive: isInteractive() }, { askInput: (q) => askInput(q), askYesNo: (q, d) => askYesNo(q, d) });
+    // explaining goal alignment: infer it from your messages (implicit), type a
+    // one-line goal (sealed), or off — no contract header and no mode header)
+    const session = await resolveSessionSetup({
+        scenario: scenarioArg,
+        goal: options.goal,
+        implicit: options.implicit,
+        interactive: isInteractive(),
+    }, {
+        askInput: (q) => askInput(q),
+        askYesNo: (q, d) => askYesNo(q, d),
+        askSelect: (q, o) => askSelect(q, o),
+    });
     const scenario = session.scenario;
     const env = process.env;
     let shape = resolveLaunchShape({ remoteControl: options.remoteControl, server: options.server }, env);
@@ -68,6 +78,15 @@ export async function agentCommand(scenarioArg, options = {}) {
         budget: options.budget,
         maxTurns: options.maxTurns,
         stall: options.stall,
+        implicit: options.implicit,
+    });
+    // ── implicit goal mode (no contract; the gateway infers the goal from the user's
+    // messages) — the guardrail ceilings ride on the mode header instead ──
+    const goalMode = buildGoalModeHeader({
+        implicit: options.implicit,
+        budget: options.budget,
+        maxTurns: options.maxTurns,
+        stall: options.stall,
     });
     // ── door ──
     const gatewayHost = resolveGatewayHost(env);
@@ -117,6 +136,7 @@ export async function agentCommand(scenarioArg, options = {}) {
             door,
             cellNote,
             envelope,
+            goalMode,
             yolo,
             cli: planCli,
         });
@@ -175,8 +195,8 @@ export async function agentCommand(scenarioArg, options = {}) {
             say(fmt.warn(`mnemom agent: agent setup did not complete (${msg}) — launching with the unclaimed identity.`));
         }
     }
-    logLaunch({ shape, door, agent, conversationId, cellNote, envelope, cli });
-    say(goalAlignmentLine(envelope !== null));
+    logLaunch({ shape, door, agent, conversationId, cellNote, envelope, goalMode, cli });
+    say(goalAlignmentLine(goalAlignmentMode(envelope, goalMode)));
     if (shape === "terminal") {
         launchTerminal({
             cli,
@@ -185,6 +205,7 @@ export async function agentCommand(scenarioArg, options = {}) {
             agent,
             conversationId,
             envelope,
+            goalMode,
             options,
             yolo,
             contextHint,
@@ -200,6 +221,7 @@ export async function agentCommand(scenarioArg, options = {}) {
         conversationId,
         scenario,
         envelope,
+        goalMode,
         options,
         yolo,
     });
@@ -220,7 +242,7 @@ export async function resolveAnthropicKey(env, opts) {
     const source = opts.keySource;
     // "prompt" forces the interactive prompt (skips env + store).
     if (source !== "prompt") {
-        const fromEnv = (env.MNEMOM_AGENT_ANTHROPIC_KEY || env.ANTHROPIC_API_KEY || "").trim();
+        const fromEnv = stripCrlf(env.MNEMOM_AGENT_ANTHROPIC_KEY || env.ANTHROPIC_API_KEY || "");
         if (fromEnv)
             return fromEnv;
         // "env" restricts to env only — no store, no prompt.
@@ -231,11 +253,17 @@ export async function resolveAnthropicKey(env, opts) {
         const stored = readStoredKey();
         if (stored)
             return stored;
+        // "store" restricts to env → store — never the interactive prompt.
+        if (source === "store") {
+            throw new Error("mnemom agent: key_source is 'store' but no Anthropic key is set in env or ~/.mnemom/launcher.json.\n" +
+                "  Set one:   export MNEMOM_AGENT_ANTHROPIC_KEY=sk-ant-...   (or ANTHROPIC_API_KEY)\n" +
+                "  Or store it: `mnemom agent config set key_source prompt`, run `mnemom agent` once and accept the save.");
+        }
     }
-    // (source can only be "store", "prompt", or undefined here — "env" threw above.)
+    // (source can only be "prompt" or undefined here — "env" and "store" threw above.)
     if (opts.allowPrompt && isInteractive()) {
         say("mnemom agent: no Anthropic key in env (MNEMOM_AGENT_ANTHROPIC_KEY / ANTHROPIC_API_KEY) or ~/.mnemom/launcher.json.");
-        const entered = (await askInput("Enter your Anthropic API key (sk-ant-…):", true)).trim();
+        const entered = stripCrlf(await askInput("Enter your Anthropic API key (sk-ant-…):", true));
         if (entered) {
             if (await askYesNo("Save it to ~/.mnemom/launcher.json (0600) for next time?", true)) {
                 storeKey(entered);
@@ -265,7 +293,7 @@ export function anthropicKeySource(env = process.env) {
 function readStoredKey() {
     try {
         const data = JSON.parse(readFileSync(CODE_STORE, "utf8"));
-        const key = typeof data.anthropic_key === "string" ? data.anthropic_key.trim() : "";
+        const key = typeof data.anthropic_key === "string" ? stripCrlf(data.anthropic_key) : "";
         return key || undefined;
     }
     catch {
@@ -442,6 +470,7 @@ function launchTerminal(ctx) {
         agent: ctx.agent,
         conversationId: ctx.conversationId,
         contractB64: ctx.envelope?.base64,
+        goalMode: ctx.goalMode ?? undefined,
     });
     const args = buildCliArgs(ctx.options, { yolo: ctx.yolo, allowCliFlags: true });
     // Claude Code logged in via claude.ai (OAuth) PREEMPTS ANTHROPIC_API_KEY, so
@@ -489,6 +518,7 @@ function launchRemoteControl(ctx) {
             MNEMOM_AGENT_RC_AGENT: ctx.agent,
             MNEMOM_AGENT_RC_CONVERSATION_ID: ctx.conversationId,
             MNEMOM_AGENT_RC_CONTRACT_B64: ctx.envelope?.base64 ?? "",
+            MNEMOM_AGENT_RC_GOAL_MODE: ctx.goalMode ?? "",
             MNEMOM_AGENT_RC_PROXY_LOG: proxyLog,
             MNEMOM_AGENT_RC_PARENT_PID: String(process.pid),
         },
@@ -720,14 +750,30 @@ function seedContextHintFlag(childEnv) {
 // ───────────────────────────────────────────────────────────────────────────
 // Human-facing logging (never prints the key)
 // ───────────────────────────────────────────────────────────────────────────
-function logLaunch(ctx) {
+/**
+ * Which goal-alignment mode the launch status line names: a sealed contract →
+ * "on"; `--implicit` (mode header, no contract) → "implicit"; neither → "off".
+ * A sealed contract and a mode header never coexist (`assembleContract` refuses
+ * the combination), so the first arm winning is not a precedence choice.
+ */
+export function goalAlignmentMode(envelope, goalMode) {
+    if (envelope)
+        return "on";
+    if (goalMode)
+        return "implicit";
+    return "off";
+}
+export function logLaunch(ctx) {
     say(`mnemom agent: routing ${ctx.cli.name} through ${ctx.door} [${ctx.cellNote}] as '${ctx.agent}' (conversation ${ctx.conversationId}).`);
     if (ctx.envelope) {
         say(`mnemom agent: contract statement: ${ctx.envelope.contract.statement}`);
         say(`mnemom agent: contract sha256[0:16]: ${ctx.envelope.sha}`);
     }
+    else if (ctx.goalMode) {
+        say(`mnemom agent: goal mode: ${ctx.goalMode} (inferred from your messages; watch x-mnemom-goal-revision / x-mnemom-goal-steer on each response)`);
+    }
 }
-function printPlan(ctx) {
+export function printPlan(ctx) {
     const L = [];
     L.push("mnemom agent — launch plan (dry run)");
     L.push(`  scenario:      ${ctx.scenario}`);
@@ -741,6 +787,10 @@ function printPlan(ctx) {
         L.push(`  contract:      ${ctx.envelope.canonical}`);
         L.push(`  contract sha:  ${ctx.envelope.sha}`);
     }
+    else if (ctx.goalMode) {
+        L.push("  contract:      (none — implicit goal mode: the gateway infers the goal from your messages)");
+        L.push(`  goal mode:     ${ctx.goalMode}`);
+    }
     else {
         L.push("  contract:      (none — no contract flag given)");
     }
@@ -748,3 +798,11 @@ function printPlan(ctx) {
     L.push("  Dry run — no key was read and nothing was launched.");
     process.stdout.write(`${L.join("\n")}\n`);
 }
+/**
+ * Header-value hygiene for the Anthropic key: the key is spliced into the newline-joined
+ * ANTHROPIC_CUSTOM_HEADERS block (`x-api-key: <key>`), so an embedded CR/LF from a multi-line
+ * paste would inject extra header lines. Same rule resolveConversationId applies to its input.
+ */
+function stripCrlf(raw) {
+    return raw.replace(/[\r\n]+/g, "").trim();
+}

package/dist/index.js

@@ -26,6 +26,7 @@ import { agentDoctorCommand } from "./commands/agent-doctor.js";
 import { agentSetupCommand } from "./commands/agent-setup.js";
 import { agentInviteCommand, runAgentInvocation } from "./commands/agent-invite.js";
 import { applyConfigToEnv, loadLauncherConfig } from "./lib/launcher-config.js";
+import { resolveImplicit } from "./lib/agent.js";
 import { wrapCommand } from "./commands/wrap.js";
 import { onboardCommand } from "./commands/onboard.js";
 import { skillsListCommand, skillsDescribeCommand } from "./commands/skills.js";
@@ -111,6 +112,8 @@ const agentCmd = program
     .option("--budget <usd>", "Guardrail: spend ceiling in USD (positive number)")
     .option("--max-turns <n>", "Guardrail: turn ceiling (positive integer)")
     .option("--stall <n>", "Guardrail: consecutive no-write turns (positive integer)")
+    .option("--implicit", "Goal alignment without a sealed contract: the gateway infers the goal from your messages and revises it as you steer (not combinable with --goal/--requirement/--allow/--forbid/--goal-id; the guardrail ceilings still apply)")
+    .option("--no-implicit", "Goal alignment off for this launch even when launcher.toml sets goal_mode = implicit")
     .option("--conversation-id <id>", "x-mnemom-conversation-id (default: auto-generated)")
     .option("--cli <name|path>", "Coding-agent CLI to launch: a name or full path (default: claude)")
     .option("--gateway <url>", "Gateway host override (default: https://gateway.mnemom.ai; or MNEMOM_AGENT_GATEWAY)")
@@ -174,10 +177,19 @@ const agentCmd = program
             return;
         }
         const numToStr = (n) => n === undefined ? undefined : String(n);
-        // Config guardrails apply only when a contract is actually intended (a
-        // --goal is present), so a saved ceiling never forces an unrequested
-        // contract (which would then demand --goal and fail the launch).
-        const contractIntended = Boolean(opts.goal && opts.goal.trim());
+        // Implicit mode: --implicit / --no-implicit win; a --goal statement seals
+        // (the standing config default never overrides it); else launcher.toml
+        // `goal_mode`; else off. Pure + unit-tested in lib/agent.ts.
+        const implicit = resolveImplicit({
+            goal: opts.goal,
+            implicit: opts.implicit,
+            configGoalMode: cfg.goalMode,
+        });
+        // Config guardrails apply only when goal alignment is actually intended (a
+        // --goal is present, or implicit mode — where they ride on the mode header),
+        // so a saved ceiling never forces an unrequested contract (which would
+        // then demand --goal and fail the launch).
+        const contractIntended = Boolean(opts.goal && opts.goal.trim()) || implicit;
         // The governed identity rides on the program-level `--agent` (which
         // shadows a subcommand `--agent` under commander@12 — the MNE-238 class),
         // exactly as status/logs/onboard read it.
@@ -188,6 +200,7 @@ const agentCmd = program
             allow: opts.allow,
             forbid: opts.forbid,
             goalId: opts.goalId,
+            implicit,
             budget: opts.budget ?? (contractIntended ? numToStr(cfg.guardrails?.budgetUsd) : undefined),
             maxTurns: opts.maxTurns ?? (contractIntended ? numToStr(cfg.guardrails?.maxTurns) : undefined),
             stall: opts.stall ?? (contractIntended ? numToStr(cfg.guardrails?.stallTurns) : undefined),

package/dist/lib/agent.d.ts

@@ -48,6 +48,14 @@ export interface ContractFlags {
     maxTurns?: string | number;
     budget?: string | number;
     stall?: string | number;
+    /**
+     * `--implicit`: goal alignment WITHOUT a sealed contract. No `x-mnemom-contract`
+     * is sent; the gateway infers the goal from the user's own messages (revision 1
+     * after the first message) and revises it as the user steers. The guardrail
+     * ceilings still apply — they ride on the `x-mnemom-goal-mode` header instead
+     * of inside a contract. Cannot be combined with the sealed-contract flags.
+     */
+    implicit?: boolean;
 }
 /** The three launch shapes the command supports (see commands/code.ts). */
 export type LaunchShape = "terminal" | "remote-control" | "server";
@@ -116,6 +124,15 @@ export interface SealedContractEnvelope {
  * here matches whatever the gateway seals for the same flags.
  */
 export declare function assembleContract(flags: ContractFlags): SealedContractEnvelope | null;
+/** The request header that opts a conversation into implicit goal mode. */
+export declare const GOAL_MODE_HEADER = "x-mnemom-goal-mode";
+/**
+ * The `x-mnemom-goal-mode` header value for `--implicit`, or null when the flag
+ * is absent: `implicit[; max_turns=N][; budget_usd=X][; stall_turns=N]` — the
+ * guardrail ceilings validated exactly as `assembleContract` validates them (a
+ * non-positive ceiling is refused, never silently dropped into an unguarded run).
+ */
+export declare function buildGoalModeHeader(flags: ContractFlags): string | null;
 /**
  * Resolve the launch shape from the flags and the `MNEMOM_AGENT_REMOTE_CONTROL`
  * env var (the flags win). Default is `terminal` — a plain governed launch in
@@ -142,7 +159,8 @@ export declare function launchPreferenceExplicit(opts: {
 /**
  * Build the `ANTHROPIC_CUSTOM_HEADERS` value for the terminal-only launch: the
  * real Anthropic key as `x-api-key`, plus the governed-identity headers and the
- * sealed contract when present. Newline-separated, exactly the wire shape Claude
+ * sealed contract when present (or the implicit goal-mode header when the launch
+ * is `--implicit` — never both). Newline-separated, exactly the wire shape Claude
  * Code sends to the /anthropic door. NB: the returned string contains the key —
  * callers must place it only in the child's env, never in a log line.
  */
@@ -151,4 +169,28 @@ export declare function buildCustomHeaders(opts: {
     agent: string;
     conversationId: string;
     contractB64?: string;
+    /** `buildGoalModeHeader` output for an `--implicit` launch. */
+    goalMode?: string;
 }): string;
+/**
+ * The persistable goal-alignment default (`launcher.toml` `goal_mode`). Only the
+ * two statement-free modes can be a standing default: a SEALED contract needs a
+ * per-session statement, so it is always a per-launch `--goal`.
+ */
+export type GoalModeDefault = "implicit" | "off";
+/**
+ * Is this launch implicit-mode? Precedence, highest wins:
+ *   1. an explicit flag — `--implicit` (true) or `--no-implicit` (false);
+ *   2. a `--goal` statement — a sealed contract is a per-launch choice that the
+ *      standing config default must never silently override;
+ *   3. the config default `goal_mode = "implicit"`;
+ *   4. off.
+ * Pure so every arm is unit-tested; the caller passes the resolved value on to
+ * `assembleContract` / `buildGoalModeHeader` (which still refuse `--implicit`
+ * combined with a contract flag — that conflict is EXPLICIT and is reported).
+ */
+export declare function resolveImplicit(opts: {
+    goal?: string;
+    implicit?: boolean;
+    configGoalMode?: GoalModeDefault;
+}): boolean;

package/dist/lib/agent.js

@@ -132,6 +132,12 @@ function hasText(v) {
  * here matches whatever the gateway seals for the same flags.
  */
 export function assembleContract(flags) {
+    // Implicit goal mode seals nothing: the ceilings ride on the mode header
+    // (`buildGoalModeHeader`), so a `--budget` alone must not demand `--goal` here.
+    if (flags.implicit) {
+        assertImplicitCompatible(flags);
+        return null;
+    }
     if (!contractFlagsPresent(flags))
         return null;
     const statement = (flags.goal ?? "").trim();
@@ -178,6 +184,58 @@ export function assembleContract(flags) {
         sha: sha256Hex16(canonical),
     };
 }
+/** The request header that opts a conversation into implicit goal mode. */
+export const GOAL_MODE_HEADER = "x-mnemom-goal-mode";
+const SEALED_ONLY_FLAGS = "--goal/--requirement/--allow/--forbid/--goal-id";
+/**
+ * `--implicit` and a sealed contract are mutually exclusive: on the gateway a
+ * sealed `x-mnemom-contract` always wins and would silently switch implicit mode
+ * off, so the launch refuses the combination rather than ship a header that does
+ * nothing.
+ */
+function assertImplicitCompatible(flags) {
+    const sealed = hasText(flags.goal) ||
+        (flags.requirement?.length ?? 0) > 0 ||
+        (flags.allow?.length ?? 0) > 0 ||
+        (flags.forbid?.length ?? 0) > 0 ||
+        hasText(flags.goalId);
+    if (sealed) {
+        throw new Error(`--implicit cannot be combined with ${SEALED_ONLY_FLAGS}: a sealed contract always wins on ` +
+            "the gateway and would silently switch implicit mode off. Drop --implicit to seal a " +
+            "contract, or drop the contract flags to let the gateway infer the goal from your messages.");
+    }
+}
+/**
+ * The `x-mnemom-goal-mode` header value for `--implicit`, or null when the flag
+ * is absent: `implicit[; max_turns=N][; budget_usd=X][; stall_turns=N]` — the
+ * guardrail ceilings validated exactly as `assembleContract` validates them (a
+ * non-positive ceiling is refused, never silently dropped into an unguarded run).
+ */
+export function buildGoalModeHeader(flags) {
+    if (!flags.implicit)
+        return null;
+    assertImplicitCompatible(flags);
+    const parts = ["implicit"];
+    if (flags.maxTurns !== undefined) {
+        if (!isPositiveInt(flags.maxTurns)) {
+            throw new Error(`--max-turns must be a positive integer (got '${flags.maxTurns}').`);
+        }
+        parts.push(`max_turns=${Number(flags.maxTurns)}`);
+    }
+    if (flags.budget !== undefined) {
+        if (!isPositiveNumber(flags.budget)) {
+            throw new Error(`--budget must be a positive USD amount (got '${flags.budget}').`);
+        }
+        parts.push(`budget_usd=${Number(flags.budget)}`);
+    }
+    if (flags.stall !== undefined) {
+        if (!isPositiveInt(flags.stall)) {
+            throw new Error(`--stall must be a positive integer (got '${flags.stall}').`);
+        }
+        parts.push(`stall_turns=${Number(flags.stall)}`);
+    }
+    return parts.join("; ");
+}
 /** Trim, drop empties — matches the gateway's `stringArray` filtering. */
 function cleanList(values) {
     return (values ?? []).map((v) => v.trim()).filter((v) => v.length > 0);
@@ -236,7 +294,8 @@ export function launchPreferenceExplicit(opts, env = process.env) {
 /**
  * Build the `ANTHROPIC_CUSTOM_HEADERS` value for the terminal-only launch: the
  * real Anthropic key as `x-api-key`, plus the governed-identity headers and the
- * sealed contract when present. Newline-separated, exactly the wire shape Claude
+ * sealed contract when present (or the implicit goal-mode header when the launch
+ * is `--implicit` — never both). Newline-separated, exactly the wire shape Claude
  * Code sends to the /anthropic door. NB: the returned string contains the key —
  * callers must place it only in the child's env, never in a log line.
  */
@@ -248,5 +307,25 @@ export function buildCustomHeaders(opts) {
     ];
     if (opts.contractB64)
         lines.push(`x-mnemom-contract: ${opts.contractB64}`);
+    if (opts.goalMode)
+        lines.push(`${GOAL_MODE_HEADER}: ${opts.goalMode}`);
     return lines.join("\n");
 }
+/**
+ * Is this launch implicit-mode? Precedence, highest wins:
+ *   1. an explicit flag — `--implicit` (true) or `--no-implicit` (false);
+ *   2. a `--goal` statement — a sealed contract is a per-launch choice that the
+ *      standing config default must never silently override;
+ *   3. the config default `goal_mode = "implicit"`;
+ *   4. off.
+ * Pure so every arm is unit-tested; the caller passes the resolved value on to
+ * `assembleContract` / `buildGoalModeHeader` (which still refuse `--implicit`
+ * combined with a contract flag — that conflict is EXPLICIT and is reported).
+ */
+export function resolveImplicit(opts) {
+    if (opts.implicit !== undefined)
+        return opts.implicit;
+    if (hasText(opts.goal))
+        return false;
+    return opts.configGoalMode === "implicit";
+}

package/dist/lib/auth.js

@@ -117,7 +117,14 @@ export async function getAccessToken() {
     if (auth.expiresAt > now + 60) {
         return auth.accessToken;
     }
-    // Auto-refresh
+    // Auto-refresh. A *thrown* error from refreshStoredTokens() (transient
+    // exhaustion / non-revoke 4xx from oauthRefreshTokens(), MNE-7394) is
+    // intentionally allowed to propagate here rather than being coerced to the
+    // `null` re-login signal — a momentary AS outage must not masquerade as
+    // "credentials revoked". Only a genuine invalid_grant/invalid_client returns
+    // null (see refreshStoredTokens). Refining caller-side handling (distinguish
+    // propagate-vs-degrade) is tracked under MNE-7394's parent lane card
+    // (keith/oauth-token-lifetime).
     const refreshed = await refreshStoredTokens(auth);
     if (refreshed)
         return refreshed.accessToken;
@@ -139,6 +146,9 @@ export async function forceRefreshAccessToken() {
     const auth = getAuthInfo();
     if (!auth?.refreshToken)
         return null;
+    // As in getAccessToken, a thrown transient-exhaustion / non-revoke error from
+    // refreshStoredTokens() propagates rather than being coerced to null (MNE-7394;
+    // caller-side refinement tracked under keith/oauth-token-lifetime).
     const refreshed = await refreshStoredTokens(auth);
     return refreshed?.accessToken ?? null;
 }
@@ -226,6 +236,16 @@ export async function loginWithDeviceFlow() {
  * Refresh the stored tokens via the OAuth refresh_token grant. Requires both a
  * refresh token and the client_id they were issued to; returns null (rather
  * than throwing) when refresh isn't possible so callers degrade to re-login.
+ *
+ * Note: oauthRefreshTokens() returns null ONLY on a definitive revoke
+ * (invalid_grant/invalid_client) or missing credentials; on transient
+ * exhaustion (repeated 5xx / network faults) or any other non-revoke 4xx it
+ * *throws* (MNE-7394 / R6). That thrown error is intentionally allowed to
+ * propagate through this function to its callers rather than being coerced to
+ * null, so a momentary blip never presents as "credentials revoked". Refining
+ * the caller-side handling (propagate-vs-degrade in
+ * getAccessToken/forceRefreshAccessToken) is tracked under MNE-7394's parent
+ * lane card (keith/oauth-token-lifetime).
  */
 async function refreshStoredTokens(auth) {
     if (!auth.refreshToken || !auth.clientId)

package/dist/lib/launcher-config.d.ts

@@ -15,7 +15,7 @@
  * resolvers in lib/code.ts keep the built-in default as the final fallback);
  * the caller folds the plain-value settings under the CLI flags.
  */
-import { type LaunchShape } from "./agent.js";
+import { type GoalModeDefault, type LaunchShape } from "./agent.js";
 /** The human-editable settings file. Secret key lives elsewhere (launcher.json). */
 export declare const LAUNCHER_CONFIG_PATH: string;
 /** Where the CLI resolves the Anthropic key from; advisory ordering/restriction. */
@@ -29,6 +29,8 @@ export interface LauncherConfig {
     cli?: string;
     launch?: LaunchShape;
     keySource?: KeySource;
+    /** Standing goal-alignment default when neither --goal nor --implicit is given. */
+    goalMode?: GoalModeDefault;
     guardrails?: {
         maxTurns?: number;
         budgetUsd?: number;

package/dist/lib/launcher-config.js

@@ -19,12 +19,13 @@ import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "
 import { dirname, join } from "node:path";
 import { parse as parseToml, stringify as stringifyToml, TomlError } from "smol-toml";
 import { MNEMOM_DIR } from "./config.js";
-import { isPositiveInt, isPositiveNumber } from "./agent.js";
+import { isPositiveInt, isPositiveNumber, } from "./agent.js";
 /** The human-editable settings file. Secret key lives elsewhere (launcher.json). */
 export const LAUNCHER_CONFIG_PATH = join(MNEMOM_DIR, "launcher.toml");
 const LAUNCH_SHAPES = ["terminal", "remote-control", "server"];
 const EFFORTS = ["low", "medium", "high", "xhigh", "max"];
 const KEY_SOURCES = ["env", "store", "prompt"];
+const GOAL_MODES = ["implicit", "off"];
 function coerceLaunch(raw) {
     const v = raw.trim();
     if (LAUNCH_SHAPES.includes(v))
@@ -43,6 +44,12 @@ function coerceKeySource(raw) {
         return v;
     throw new Error(`key_source must be one of ${KEY_SOURCES.join(", ")} (got '${raw}').`);
 }
+function coerceGoalMode(raw) {
+    const v = raw.trim().toLowerCase();
+    if (GOAL_MODES.includes(v))
+        return v;
+    throw new Error(`goal_mode must be one of ${GOAL_MODES.join(", ")} (got '${raw}'). A sealed contract needs a statement, so it is always a per-launch --goal.`);
+}
 function coerceNonEmpty(name, raw) {
     const v = raw.trim();
     if (!v)
@@ -112,6 +119,14 @@ export const CONFIG_KEYS = [
             c.keySource = coerceKeySource(v);
         },
     },
+    {
+        key: "goal_mode",
+        describe: `Goal alignment when no --goal/--implicit is given (${GOAL_MODES.join("|")}); a sealed contract needs a per-launch --goal`,
+        get: (c) => c.goalMode,
+        set: (c, v) => {
+            c.goalMode = coerceGoalMode(v);
+        },
+    },
     {
         key: "guardrails.max_turns",
         describe: "Contract guardrail: turn ceiling (positive integer)",
@@ -176,6 +191,8 @@ export function parseLauncherConfig(text) {
         cfg.launch = coerceLaunch(str(raw.launch) ?? "");
     if (raw.key_source !== undefined)
         cfg.keySource = coerceKeySource(str(raw.key_source) ?? "");
+    if (raw.goal_mode !== undefined)
+        cfg.goalMode = coerceGoalMode(str(raw.goal_mode) ?? "");
     const g = raw.guardrails;
     if (g !== undefined) {
         if (typeof g !== "object" || g === null || Array.isArray(g)) {
@@ -232,6 +249,8 @@ export function serializeLauncherConfig(cfg) {
         doc.launch = cfg.launch;
     if (cfg.keySource !== undefined)
         doc.key_source = cfg.keySource;
+    if (cfg.goalMode !== undefined)
+        doc.goal_mode = cfg.goalMode;
     const g = cfg.guardrails;
     if (g && (g.maxTurns !== undefined || g.budgetUsd !== undefined || g.stallTurns !== undefined)) {
         const gr = {};

package/dist/lib/oauth.d.ts

@@ -105,11 +105,33 @@ export declare function loginWithDevice(opts?: {
     sleep?: (ms: number) => Promise<void>;
 }): Promise<DeviceResult>;
 /**
- * Exchange a refresh token for a fresh access token. Returns null if refresh is
- * not possible (no refresh token, or the AS rejects it — e.g. revoked/expired),
- * so callers can fall back to prompting for re-login rather than crashing.
+ * Exchange a refresh token for a fresh access token.
+ *
+ * Failure classification (R6 / MNE-7394) — a transient failure must never be
+ * indistinguishable from a revoked credential:
+ *   - 2xx → return the fresh tokens (carrying the prior refresh token forward
+ *     per RFC 6749 §6 when the AS omits a new one).
+ *   - A 4xx whose OAuth body `error` is `invalid_grant` / `invalid_client` →
+ *     return `null`, the re-login signal. RFC 6749 §5.2 defines these as the
+ *     errors that mean the presented grant/client credential is genuinely no
+ *     longer valid, so a fresh login is the correct remedy. No retry.
+ *   - Any other 4xx (e.g. `invalid_request`, `429`, an unrecognized/absent body
+ *     error, a non-JSON body) → throw. Something is wrong, but it does NOT mean
+ *     the credentials are revoked, so we must not discard the session.
+ *   - `res.status >= 500` or a fetch/network exception → retry with bounded
+ *     exponential backoff (~1s/2s/4s, REFRESH_MAX_ATTEMPTS attempts); if the
+ *     retries are exhausted, throw. Exhausting transient retries must NOT
+ *     masquerade as "credentials revoked" (fail-closed, MNE-442) — throwing
+ *     preserves the stored session so a later invocation can succeed once the
+ *     AS recovers.
+ *
+ * `null` is therefore narrowed to exactly the two re-login errors; every other
+ * outcome is a success, a retry, or a thrown error. `opts.sleep` is injectable
+ * so tests drive the backoff without real timers.
  */
-export declare function refreshTokens(refreshToken: string, clientId: string): Promise<OAuthTokens | null>;
+export declare function refreshTokens(refreshToken: string, clientId: string, opts?: {
+    sleep?: (ms: number) => Promise<void>;
+}): Promise<OAuthTokens | null>;
 /**
  * Open `url` in the user's default browser WITHOUT a shell. The URL is always
  * passed as a separate argv element (never concatenated into a command string),

package/dist/lib/oauth.js

@@ -39,6 +39,14 @@ const LOOPBACK_TIMEOUT_MS = 5 * 60 * 1000;
 // both interactive login poll loops emit, so a multi-minute browser sign-in
 // doesn't read as a hung CLI (matches the card-write retry tick in try-me).
 const LOGIN_HEARTBEAT_MS = 15 * 1000;
+// Refresh-token retry policy (R6 / MNE-7394). A transient AS 5xx or a dropped
+// network connection during refresh must be retried with bounded exponential
+// backoff rather than collapsed into the re-login signal — a one-second AS
+// hiccup or a flaky Wi-Fi moment must not invalidate a valid, long-lived
+// session. Per-attempt delay is REFRESH_BACKOFF_BASE_MS * 2**attemptIndex →
+// ~1s / 2s / 4s across REFRESH_MAX_ATTEMPTS attempts.
+const REFRESH_MAX_ATTEMPTS = 3;
+const REFRESH_BACKOFF_BASE_MS = 1000;
 let cachedMetadata = null;
 /**
  * Fetch (and process-cache) the AS metadata document. We resolve it relative to
@@ -359,40 +367,101 @@ async function pollDeviceToken(meta, clientId, authz, sleep, display) {
 // Refresh (RFC 6749 §6)
 // ============================================================================
 /**
- * Exchange a refresh token for a fresh access token. Returns null if refresh is
- * not possible (no refresh token, or the AS rejects it — e.g. revoked/expired),
- * so callers can fall back to prompting for re-login rather than crashing.
+ * Exchange a refresh token for a fresh access token.
+ *
+ * Failure classification (R6 / MNE-7394) — a transient failure must never be
+ * indistinguishable from a revoked credential:
+ *   - 2xx → return the fresh tokens (carrying the prior refresh token forward
+ *     per RFC 6749 §6 when the AS omits a new one).
+ *   - A 4xx whose OAuth body `error` is `invalid_grant` / `invalid_client` →
+ *     return `null`, the re-login signal. RFC 6749 §5.2 defines these as the
+ *     errors that mean the presented grant/client credential is genuinely no
+ *     longer valid, so a fresh login is the correct remedy. No retry.
+ *   - Any other 4xx (e.g. `invalid_request`, `429`, an unrecognized/absent body
+ *     error, a non-JSON body) → throw. Something is wrong, but it does NOT mean
+ *     the credentials are revoked, so we must not discard the session.
+ *   - `res.status >= 500` or a fetch/network exception → retry with bounded
+ *     exponential backoff (~1s/2s/4s, REFRESH_MAX_ATTEMPTS attempts); if the
+ *     retries are exhausted, throw. Exhausting transient retries must NOT
+ *     masquerade as "credentials revoked" (fail-closed, MNE-442) — throwing
+ *     preserves the stored session so a later invocation can succeed once the
+ *     AS recovers.
+ *
+ * `null` is therefore narrowed to exactly the two re-login errors; every other
+ * outcome is a success, a retry, or a thrown error. `opts.sleep` is injectable
+ * so tests drive the backoff without real timers.
  */
-export async function refreshTokens(refreshToken, clientId) {
+export async function refreshTokens(refreshToken, clientId, opts) {
     if (!refreshToken || !clientId)
         return null;
-    try {
-        const meta = await discover();
-        const res = await fetch(meta.token_endpoint, {
-            method: "POST",
-            headers: {
-                "Content-Type": "application/x-www-form-urlencoded",
-                Accept: "application/json",
-            },
-            body: new URLSearchParams({
-                grant_type: "refresh_token",
-                refresh_token: refreshToken,
-                client_id: clientId,
-            }),
-        });
-        if (!res.ok)
+    const sleep = opts?.sleep ?? defaultSleep;
+    // Discovery is not part of the refresh retry budget; a discovery failure
+    // propagates as it does today (it is already thrown by discover()).
+    const meta = await discover();
+    let lastTransient = "";
+    for (let attempt = 0; attempt < REFRESH_MAX_ATTEMPTS; attempt++) {
+        let res;
+        try {
+            res = await fetch(meta.token_endpoint, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/x-www-form-urlencoded",
+                    Accept: "application/json",
+                },
+                body: new URLSearchParams({
+                    grant_type: "refresh_token",
+                    refresh_token: refreshToken,
+                    client_id: clientId,
+                }),
+            });
+        }
+        catch (err) {
+            // Network/fetch exception (DNS failure, connection reset, timeout) — this
+            // is unrelated to the validity of the refresh token, so retry it.
+            lastTransient = err instanceof Error ? err.message : String(err);
+            if (attempt < REFRESH_MAX_ATTEMPTS - 1) {
+                await sleep(REFRESH_BACKOFF_BASE_MS * 2 ** attempt);
+                continue;
+            }
+            break;
+        }
+        if (res.ok) {
+            const data = (await res.json());
+            const tokens = tokensFromResponse(data);
+            // Per RFC 6749 §6, a refresh response MAY omit a new refresh token, in
+            // which case the old one remains valid — preserve it so the next refresh
+            // works.
+            if (!tokens.refreshToken)
+                tokens.refreshToken = refreshToken;
+            return tokens;
+        }
+        if (res.status >= 500) {
+            // Transient AS outage — retry with backoff, then fall through to the
+            // "exhausted" throw once no attempts remain.
+            lastTransient = `HTTP ${res.status}`;
+            if (attempt < REFRESH_MAX_ATTEMPTS - 1) {
+                await sleep(REFRESH_BACKOFF_BASE_MS * 2 ** attempt);
+                continue;
+            }
+            break;
+        }
+        // 4xx — a definitive client-side rejection, never retried. Only
+        // invalid_grant / invalid_client map to the null re-login signal; every
+        // other 4xx surfaces as a thrown error rather than a silent null that would
+        // wrongly discard a valid session.
+        const body = (await res.json().catch(() => ({})));
+        if (body.error === "invalid_grant" || body.error === "invalid_client") {
             return null;
-        const data = (await res.json());
-        const tokens = tokensFromResponse(data);
-        // Per RFC 6749 §6, a refresh response MAY omit a new refresh token, in which
-        // case the old one remains valid — preserve it so the next refresh works.
-        if (!tokens.refreshToken)
-            tokens.refreshToken = refreshToken;
-        return tokens;
-    }
-    catch {
-        return null;
+        }
+        const detail = body.error
+            ? body.error + (body.error_description ? ` — ${body.error_description}` : "")
+            : `HTTP ${res.status}`;
+        throw new Error(`Token refresh failed: ${detail}`);
     }
+    // Retries exhausted on a 5xx or a network exception (fail-closed, MNE-442):
+    // throw rather than return null so the session is preserved for a later retry.
+    throw new Error(`Token refresh failed after ${REFRESH_MAX_ATTEMPTS} attempts ` +
+        `(last error: ${lastTransient || "unknown transient failure"}).`);
 }
 // ============================================================================
 // Helpers

package/dist/rc-proxy.mjs

@@ -19,7 +19,7 @@
 //   * Inside api.anthropic.com, only `POST /v1/messages[?…]` is rewritten to the Mnemom
 //     gateway door: the real Anthropic key rides as `x-api-key` (API-key billing), plus
 //     `x-mnemom-agent`, `x-mnemom-conversation-id`, and optionally `x-mnemom-api-key`,
-//     `x-mnemom-provider`, `x-mnemom-egress-key`, `x-mnemom-contract` — the exact header set
+//     `x-mnemom-provider`, `x-mnemom-egress-key`, `x-mnemom-contract` / `x-mnemom-goal-mode` — the exact header set
 //     the non-RC launch sends via ANTHROPIC_CUSTOM_HEADERS. The OAuth `authorization` bearer
 //     is STRIPPED on that leg (it never leaves the machine) and `oauth-*` tokens are removed
 //     from `anthropic-beta`. Everything else under api.anthropic.com (OAuth refresh, the
@@ -62,6 +62,8 @@
 //   MNEMOM_AGENT_RC_AGENT             x-mnemom-agent value (required)
 //   MNEMOM_AGENT_RC_CONVERSATION_ID   x-mnemom-conversation-id value (required)
 //   MNEMOM_AGENT_RC_CONTRACT_B64      base64 contract for x-mnemom-contract (optional)
+//   MNEMOM_AGENT_RC_GOAL_MODE         x-mnemom-goal-mode value (optional; `--implicit` — no contract,
+//                                  the gateway infers the goal from the user's messages)
 //   MNEMOM_AGENT_RC_PROVIDER          x-mnemom-provider directive JSON (optional; router door)
 //   MNEMOM_AGENT_RC_THREAD_MODE       `reject` (default: answer thread-bearing requests locally,
 //                                  see above) | `strip` (legacy: delete `thread`, forward)
@@ -98,6 +100,7 @@ const AGENT = env.MNEMOM_AGENT_RC_AGENT || die("MNEMOM_AGENT_RC_AGENT is require
 const CONV =
   env.MNEMOM_AGENT_RC_CONVERSATION_ID || die("MNEMOM_AGENT_RC_CONVERSATION_ID is required");
 const CONTRACT_B64 = env.MNEMOM_AGENT_RC_CONTRACT_B64 || "";
+const GOAL_MODE = env.MNEMOM_AGENT_RC_GOAL_MODE || "";
 const PROVIDER = env.MNEMOM_AGENT_RC_PROVIDER || "";
 const THREAD_MODE = env.MNEMOM_AGENT_RC_THREAD_MODE || "reject";
 if (THREAD_MODE !== "reject" && THREAD_MODE !== "strip")
@@ -107,7 +110,9 @@ const PARENT = Number(env.MNEMOM_AGENT_RC_PARENT_PID || 0);
 const PORT = Number(env.MNEMOM_AGENT_RC_PORT || 0);
 
 const log = (line) => {
-  const s = `${new Date().toISOString()} ${line}\n`;
+  // One record per line: gateway header values and error bodies are spliced into log lines, so a
+  // CR/LF inside them must not fabricate extra records (log injection).
+  const s = `${new Date().toISOString()} ${String(line).replace(/[\r\n]+/g, " ")}\n`;
   if (LOGFILE) {
     try {
       fs.appendFileSync(LOGFILE, s);
@@ -345,6 +350,7 @@ function handle(req, res, viaPlain) {
     if (PROVIDER) headers["x-mnemom-provider"] = PROVIDER;
     if (secrets.openai) headers["x-mnemom-egress-key"] = secrets.openai;
     if (CONTRACT_B64) headers["x-mnemom-contract"] = CONTRACT_B64;
+    if (GOAL_MODE) headers["x-mnemom-goal-mode"] = GOAL_MODE;
     if (headers["anthropic-beta"]) {
       // drop the OAuth-only beta tokens
       const b = String(headers["anthropic-beta"])
@@ -388,8 +394,12 @@ function handle(req, res, viaPlain) {
         });
       }
       ur.pipe(res);
+      const goalRev = ur.headers["x-mnemom-goal-revision"];
+      const steer = ur.headers["x-mnemom-goal-steer"];
       const ident = toGateway
-        ? ` agent=${ur.headers["x-mnemom-agent"] || "-"} verdict=${ur.headers["x-mnemom-goal-verdict"] || "-"}`
+        ? ` agent=${ur.headers["x-mnemom-agent"] || "-"} verdict=${ur.headers["x-mnemom-goal-verdict"] || "-"}` +
+          (goalRev ? ` goal-rev=${goalRev}` : "") +
+          (steer ? ` steer=${steer}` : "")
         : "";
       ur.on("end", () => {
         let bodyNote = "";
@@ -488,7 +498,7 @@ proxy.on("clientError", (e, sock) => {
 proxy.listen(PORT, "127.0.0.1", () => {
   const { port } = proxy.address();
   log(
-    `listening 127.0.0.1:${port} agent=${AGENT} conv=${CONV} door=${GATEWAY.href} contract=${CONTRACT_B64 ? "yes" : "no"} provider=${PROVIDER || "-"} thread=${THREAD_MODE}`,
+    `listening 127.0.0.1:${port} agent=${AGENT} conv=${CONV} door=${GATEWAY.href} contract=${CONTRACT_B64 ? "yes" : "no"} goal_mode=${GOAL_MODE || "-"} provider=${PROVIDER || "-"} thread=${THREAD_MODE}`,
   );
   process.stdout.write(`READY ${port} ${p("ca.pem")}\n`);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemom/mnemom",
-  "version": "0.17.0-next.7",
+  "version": "0.17.0-next.8",
   "description": "Transparent AI agent tracing",
   "type": "module",
   "bin": {
@@ -26,10 +26,10 @@
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^20.10.0",
-    "@vitest/coverage-v8": "^4.1.10",
+    "@vitest/coverage-v8": "^4.1.11",
     "tsx": "^4.23.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "files": [
     "dist",
@@ -65,5 +65,9 @@
   },
   "engines": {
     "node": ">=18.0.0"
+  },
+  "overrides": {
+    "@vitest/mocker": "^4.1.11",
+    "nanoid": "^3.3.18"
   }
 }