@mnemom/mnemom 0.17.11-next.1 → 0.17.11

package/dist/commands/agent-doctor.d.ts

@@ -24,6 +24,8 @@ export interface CodeAccessProbe {
     mark: Mark;
     text: string;
     hint?: string;
+    /** May this account use Remote Control? Only a determined `remote_control: true` says yes. */
+    remoteControl: boolean;
 }
 /**
  * The invited-cohort gate, as the doctor reports it. Signed out → info (we can't

package/dist/commands/agent-doctor.js

@@ -23,7 +23,7 @@ import { LAUNCHER_CONFIG_PATH } from "../lib/launcher-config.js";
 import { getAgentByName, getCardSources, getCodeEntitlement, MnemomApiError } from "../lib/api.js";
 import { isLoggedIn } from "../lib/auth.js";
 import { getActiveOrg } from "../lib/cli-config.js";
-import { isCodeNotEnabled, sourceLabel } from "./agent-invite.js";
+import { isCodeNotEnabled, REQUEST_ACCESS_URL, sanitizeTerminalText, sourceLabel, withRequestAccess, } from "./agent-invite.js";
 import { probeUpdateStatus } from "../lib/update/doctor.js";
 import { describeModes, GOVERNANCE_OPT_IN_HINT, resolveDefaultSlug } from "./agent-setup.js";
 const MARK = { ok: "[ ok ]", warn: "[warn]", miss: "[MISS]", info: "[info]" };
@@ -96,26 +96,31 @@ export async function agentDoctorCommand(options = {}) {
     else {
         add("warn", `gateway: ${host} [${cell}] unreachable (${health.detail})`, "check the host (MNEMOM_AGENT_GATEWAY / `mnemom agent config set gateway <url>`) and your network");
     }
-    // ── Remote Control capability ──
-    if (cli) {
+    // ── Mnemom Agent access (invited cohort gate) ── probed here, before the Remote Control
+    // lines, because Remote Control is internal-only: an account the api does not entitle to it
+    // (every customer) never sees those lines at all.
+    const gate = await probeCodeAccess();
+    // ── Remote Control capability (entitled accounts only) ──
+    if (cli && gate.remoteControl) {
         const rc = checkRcCapability(cli);
         if (rc.ok)
             add("ok", "Remote Control: available (node + openssl + --remote-control)");
         else
             add("warn", `Remote Control: unavailable — ${rc.missing.join("; ")}`, "launches fall back to terminal-only until these are in place");
-        // ── claude.ai login (informational — RC needs it) ──
-        if (cli.name === "claude") {
-            const login = claudeLoggedIn(cli.bin);
-            if (login === true)
-                add("ok", "claude.ai login: logged in");
-            else if (login === false)
-                add("info", "claude.ai login: not logged in", "Remote Control needs a claude.ai login; the terminal-only shape does not");
-            else
-                add("info", "claude.ai login: could not determine");
-        }
     }
-    // ── Mnemom Agent access (invited cohort gate) ──
-    const gate = await probeCodeAccess();
+    // ── claude.ai login (informational) ── Remote Control needs it, and so does auth =
+    // subscription; a terminal launch on an Anthropic key does not, so nobody else sees it.
+    if (cli && cli.name === "claude" && (gate.remoteControl || auth === "subscription")) {
+        const login = claudeLoggedIn(cli.bin);
+        if (login === true)
+            add("ok", "claude.ai login: logged in");
+        else if (login === false)
+            add("info", "claude.ai login: not logged in", auth === "subscription"
+                ? "auth = subscription launches Claude Code on your claude.ai login — run `claude` and /login"
+                : "Remote Control needs a claude.ai login; the terminal-only shape does not");
+        else
+            add("info", "claude.ai login: could not determine");
+    }
     add(gate.mark, gate.text, gate.hint);
     // ── governance (off by default for new agents) ──
     const gov = await probeGovernance(options.agent);
@@ -192,7 +197,8 @@ export async function probeCodeAccess() {
         return {
             mark: "info",
             text: "Mnemom Agent access: sign in to check",
-            hint: "run `mnemom login`; @mnemom.ai accounts are enabled by default, others need an invitation (mnemom agent --invite <token>)",
+            hint: `run \`mnemom login\`; @mnemom.ai accounts are enabled by default, others need an invitation (mnemom agent --invite <token>) — request one at ${REQUEST_ACCESS_URL}`,
+            remoteControl: false,
         };
     }
     const org = getActiveOrg();
@@ -202,9 +208,7 @@ export async function probeCodeAccess() {
         return {
             mark: "ok",
             text: `Mnemom Agent access: enabled for ${orgLabel} (${sourceLabel(ent.source)})`,
-            hint: ent.remote_control
-                ? undefined
-                : "Remote Control (steer from claude.ai / the Claude app) is an internal feature — your sessions run terminal-only",
+            remoteControl: ent.remote_control === true,
         };
     }
     catch (err) {
@@ -213,13 +217,18 @@ export async function probeCodeAccess() {
             return {
                 mark: "miss",
                 text: `Mnemom Agent access: not enabled for ${orgLabel}`,
-                hint: typeof hint === "string" && hint
-                    ? hint
-                    : "redeem an invitation: mnemom agent --invite <token>",
+                hint: withRequestAccess(typeof hint === "string" && hint
+                    ? sanitizeTerminalText(hint)
+                    : "redeem an invitation: mnemom agent --invite <token>"),
+                remoteControl: false,
             };
         }
         const detail = err instanceof MnemomApiError || err instanceof Error ? err.message : String(err);
-        return { mark: "info", text: `Mnemom Agent access: could not determine (${detail})` };
+        return {
+            mark: "info",
+            text: `Mnemom Agent access: could not determine (${detail})`,
+            remoteControl: false,
+        };
     }
 }
 const OPT_IN_HINT = GOVERNANCE_OPT_IN_HINT.trim();

package/dist/commands/agent-invite.d.ts

@@ -29,6 +29,13 @@ export declare class CodeNotEnabledError extends Error {
 /** `pinv_` + base64url — the product-invite token shape the api mints. */
 export declare const INVITE_TOKEN_RE: RegExp;
 export declare function looksLikeInviteToken(value: unknown): value is string;
+/**
+ * Where someone without an invitation (or a Mnemom contact) asks for access. Every
+ * locked-out message ends with it, so an uninvited customer is never at a dead end.
+ */
+export declare const REQUEST_ACCESS_URL = "https://www.mnemom.ai/contact";
+/** `hint`, plus the request-access pointer unless the hint already carries the URL. */
+export declare function withRequestAccess(hint: string): string;
 /** Drop control characters (ANSI escapes included) from an api-supplied string before
  *  it reaches the terminal — defense in depth; the value is first-party but printed raw. */
 export declare function sanitizeTerminalText(s: string): string;

package/dist/commands/agent-invite.js

@@ -39,6 +39,25 @@ export function looksLikeInviteToken(value) {
     return typeof value === "string" && INVITE_TOKEN_RE.test(value.trim());
 }
 const FALLBACK_HINT = "Ask your Mnemom contact for a Mnemom Agent invitation, then run: mnemom agent --invite <token>";
+/**
+ * Where someone without an invitation (or a Mnemom contact) asks for access. Every
+ * locked-out message ends with it, so an uninvited customer is never at a dead end.
+ */
+export const REQUEST_ACCESS_URL = "https://www.mnemom.ai/contact";
+/** Whether `hint` already names the request-access page, as a whole word (trailing
+ *  punctuation ignored) — a token match, not a substring one. */
+function mentionsRequestAccess(hint) {
+    return hint.split(/\s+/).some((w) => w.replace(/[.,;:!?)]+$/, "") === REQUEST_ACCESS_URL);
+}
+/** `hint`, plus the request-access pointer unless the hint already carries the URL. */
+export function withRequestAccess(hint) {
+    if (mentionsRequestAccess(hint))
+        return hint;
+    let end = hint.length;
+    while (end > 0 && (hint[end - 1] === "." || hint[end - 1].trim() === ""))
+        end--;
+    return `${hint.slice(0, end)}. No invitation yet? Request access at ${REQUEST_ACCESS_URL}`;
+}
 /** Drop control characters (ANSI escapes included) from an api-supplied string before
  *  it reaches the terminal — defense in depth; the value is first-party but printed raw. */
 export function sanitizeTerminalText(s) {
@@ -76,7 +95,7 @@ function printNotEnabled(orgLabel, hint) {
     say();
     say("    mnemom agent --invite <token>");
     say();
-    say(fmt.dim(`  ${hint}`));
+    say(fmt.dim(`  ${withRequestAccess(hint)}`));
 }
 /**
  * Enforce the Mnemom Agent gate for the org the launch targets. Blocks (prints

package/dist/commands/agent.d.ts

@@ -345,6 +345,11 @@ export declare function logLaunch(ctx: {
     goalMode: string | null;
     cli: ResolvedCli;
 }): void;
+/**
+ * The agent a signed-out `--dry-run` shows when the caller named none: the real name is
+ * `agent-<handle>` from the Mnemom login, which a dry run (no sign-in) cannot know yet.
+ */
+export declare const DRY_RUN_SIGNED_OUT_AGENT = "agent-<your Mnemom login handle>";
 export declare function printPlan(ctx: {
     scenario: string;
     shape: LaunchShape;

package/dist/commands/agent.js

@@ -36,6 +36,7 @@ import { getApiUrl, getGatewayUrl, MNEMOM_DIR } from "../lib/config.js";
 import { createApiKey } from "../lib/api.js";
 import { MNEMOM_KEY_STORE_FIELD, resolveAgentAuth, resolveSubscriptionMnemomKey, subscriptionChildEnv, subscriptionShape, } from "../lib/subscription-login.js";
 import { LEDGER_FILE, appendSessionRecord, findResumeCandidate, readSessionRecords, resolveRetentionDays, resumedContextProfile, toLedgerContract, } from "../lib/agent-ledger.js";
+import { isLoggedIn } from "../lib/auth.js";
 import { loadCliConfig } from "../lib/cli-config.js";
 import { configKeySpec, loadLauncherConfig, writeLauncherConfig } from "../lib/launcher-config.js";
 import { experimentalNotice } from "../lib/experimental.js";
@@ -261,20 +262,26 @@ export async function agentCommand(scenarioArg, options = {}) {
     // which we only know AFTER sign-in. The entitlement-aware decision
     // (`resolveRemoteControlShape`) happens below, right after
     // `ensureSessionAndBalance`. --dry-run prints the plan BEFORE sign-in, so it
-    // can't know the entitlement; it previews the shape the MACHINE is capable of
-    // (as the pre-gate behaviour did), then notes that the real launch applies the
-    // entitlement gate. `shape` itself stays the requested (ungated) shape.
+    // can't know the entitlement: it previews the REQUESTED shape (terminal unless
+    // --remote-control/--server or `launch` asked otherwise) and never the RC
+    // auto-upgrade, which only an entitled (internal) account gets. An explicit RC
+    // request gets the note that the real launch still applies the entitlement gate.
     if (options.dryRun) {
         const planCli = cli ?? {
             bin: "(not found — pass --cli <path> or `mnemom agent config set cli <path>`)",
             name: basename((options.cli || env.MNEMOM_AGENT_CLI || "claude").trim()),
         };
-        const previewShape = !shapeExplicit && shape === "terminal" && cli && checkRcCapability(cli).ok
-            ? "remote-control"
-            : shape;
+        // A defaulted slug is `agent-<handle>` from the login (resolved for real after
+        // sign-in, below). Signed in: show that name. Signed out, or no usable handle:
+        // say where it comes from rather than print the "agent-user" fallback as if it were it.
+        if (!options.agent?.trim()) {
+            agent =
+                ((await isLoggedIn()) && sanitizeAgentName(await resolveDefaultSlug())) ||
+                    DRY_RUN_SIGNED_OUT_AGENT;
+        }
         printPlan({
             scenario,
-            shape: previewShape,
+            shape,
             agent,
             // The org is only known after sign-in, so a dry run never offers a resume (IG5 #1).
             conversationId: resolveConversationId(options.conversationId),
@@ -298,8 +305,8 @@ export async function agentCommand(scenarioArg, options = {}) {
         }
         if (expNotice)
             say(expNotice);
-        if (previewShape === "remote-control") {
-            say("mnemom agent: the plan shows Remote Control because this machine can run it; the real launch uses it only if your account is entitled (internal Mnemom accounts), else terminal-only.");
+        if (shape !== "terminal") {
+            say("mnemom agent: the real launch uses this shape only if your account is entitled to it, else terminal-only.");
         }
         sayContextProfile(contextProfile);
         sayCompaction(contextProfile, compactionIntercept, compactAt, launchWindow(windowModelFor(options, cli)));
@@ -314,14 +321,6 @@ export async function agentCommand(scenarioArg, options = {}) {
     if (!cli) {
         cli = await promptForCliPath(options.cli, env, cliError);
     }
-    // ── resolve the Anthropic key (zero 1Password; never logged) ──
-    // Not on a subscription launch: Claude Code then sends its own claude.ai login instead.
-    // A Console launch uses the key Claude Code's Console login created, then runs as api-key.
-    const anthropicKey = auth === "subscription"
-        ? undefined
-        : auth === "console"
-            ? requireConsoleKey(defaultConsoleKeyDeps(env))
-            : await resolveAnthropicKey(env, { allowPrompt: true, keySource: options.keySource });
     // ── account + µ-balance gate (no free tier) ─────────────────────────────────
     // mnemom agent runs governed and on µ, so before we seal a contract or launch we
     // (1) ensure a Mnemom session — offering the try-me-style sign-in / sign-up when
@@ -342,6 +341,16 @@ export async function agentCommand(scenarioArg, options = {}) {
             process.exit(1); // guidance already printed
         throw err;
     }
+    // ── resolve the Anthropic key (zero 1Password; never logged) ──
+    // AFTER the account gate above: an account Mnemom Agent is not enabled for learns that
+    // (and how to get access) before it is asked for, or refused for want of, a key.
+    // Not on a subscription launch: Claude Code then sends its own claude.ai login instead.
+    // A Console launch uses the key Claude Code's Console login created, then runs as api-key.
+    const anthropicKey = auth === "subscription"
+        ? undefined
+        : auth === "console"
+            ? requireConsoleKey(defaultConsoleKeyDeps(env))
+            : await resolveAnthropicKey(env, { allowPrompt: true, keySource: options.keySource });
     // ── Remote-Control entitlement gate ─────────────────────────────────────────
     // Remote Control (a session steerable from claude.ai / the Claude app) is
     // internal-only. Now that we know the org's entitlement, resolve the final
@@ -1585,6 +1594,11 @@ export function logLaunch(ctx) {
         say(`mnemom agent: goal mode: ${ctx.goalMode} (inferred from your messages; watch x-mnemom-goal-revision / x-mnemom-goal-steer on each response)`);
     }
 }
+/**
+ * The agent a signed-out `--dry-run` shows when the caller named none: the real name is
+ * `agent-<handle>` from the Mnemom login, which a dry run (no sign-in) cannot know yet.
+ */
+export const DRY_RUN_SIGNED_OUT_AGENT = "agent-<your Mnemom login handle>";
 export function printPlan(ctx) {
     const L = [];
     L.push("mnemom agent — launch plan (dry run)");

package/dist/commands/experimental.d.ts

@@ -16,3 +16,5 @@ export declare function experimentalEnableCommand(id: string | undefined, deps?:
 export declare function experimentalDisableCommand(id: string | undefined, deps?: ExperimentalDeps): void;
 /** The one-time migration (lib/experimental.ts migrateExperimental) against the real files. */
 export declare function runExperimentalMigration(): void;
+/** Does `dir` exist with anything in it? Unreadable counts as yes (an upgrader keeps the notice). */
+export declare function hasPriorState(dir: string): boolean;

package/dist/commands/experimental.js

@@ -2,8 +2,10 @@
  * `mnemom experimental list [--json] | enable <id> | disable <id>` — turn experimental
  * features on and off (registry: lib/experimental.ts; stored in ~/.mnemom/config.json).
  */
+import { existsSync, readdirSync } from "node:fs";
 import { EXPERIMENTAL_CONTRACT, EXPERIMENTAL_ENV, EXPERIMENTAL_FEATURES, EXPERIMENTAL_IDS, isExperimentalId, migrateExperimental, resolveExperimental, } from "../lib/experimental.js";
 import { loadCliConfig, setExperimentalEnabled } from "../lib/cli-config.js";
+import { MNEMOM_DIR } from "../lib/config.js";
 import { launcherEntries, loadLauncherConfig } from "../lib/launcher-config.js";
 function defaultDeps() {
     return {
@@ -74,5 +76,15 @@ export function runExperimentalMigration() {
         launcherEntries: () => launcherEntries(loadLauncherConfig()),
         persist: (ids) => setExperimentalEnabled(ids),
         writeErr: (line) => void process.stderr.write(line),
+        priorInstall: () => hasPriorState(MNEMOM_DIR),
     });
 }
+/** Does `dir` exist with anything in it? Unreadable counts as yes (an upgrader keeps the notice). */
+export function hasPriorState(dir) {
+    try {
+        return existsSync(dir) && readdirSync(dir).length > 0;
+    }
+    catch {
+        return true;
+    }
+}

package/dist/index.js

@@ -155,8 +155,11 @@ const agentCmd = program
     .option("--conversation-id <id>", "x-mnemom-conversation-id (default: auto-generated)")
     .option("--cli <name|path>", "Coding-agent CLI to launch: a name or full path (default: claude)")
     .option("--gateway <url>", "Gateway host override — must be the same cell as the rest of the CLI (default: that cell's gateway; or MNEMOM_AGENT_GATEWAY)")
-    .option("--remote-control", "Interactive Remote Control session in THIS terminal (behind a local proxy)")
-    .option("--server", "Headless `claude remote-control` dispatcher (behind a local proxy)")
+    // Remote Control is internal-only (the launch gates it on the org's entitlement and runs a
+    // customer terminal-only), so its two shapes stay out of --help for everyone. The help is
+    // built at load, before any sign-in, so it cannot ask the entitlement; the flags still parse.
+    .addOption(new Option("--remote-control", "Interactive Remote Control session in THIS terminal (behind a local proxy)").hideHelp())
+    .addOption(new Option("--server", "Headless `claude remote-control` dispatcher (behind a local proxy)").hideHelp())
     .option("--auth <mode>", "How Claude Code authenticates: api-key (default) | subscription (your Claude Team/Enterprise login) | console (the API key your Claude Code Anthropic Console login created)")
     .option("--model <alias|id>", "Model to launch (CLI alias or concrete id)")
     .addOption(new Option("--effort <level>", "Reasoning effort").choices([

package/dist/lib/experimental.d.ts

@@ -98,6 +98,11 @@ export interface MigrationDeps {
     launcherEntries(): Array<[string, string]>;
     persist(ids: ExperimentalId[]): void;
     writeErr(line: string): void;
+    /**
+     * Did this machine run the CLI before this invocation (~/.mnemom already held something)?
+     * A brand-new install never had implicit on, so it gets no "it used to be on" notice.
+     */
+    priorInstall(): boolean;
 }
 /** One-time notice for users who had implicit goal alignment by default (no goal_mode set). */
 export declare const IMPLICIT_NOW_OFF_NOTICE: string;

package/dist/lib/experimental.js

@@ -213,6 +213,7 @@ export function migrateExperimental(deps) {
     try {
         if (deps.stored() !== undefined)
             return null;
+        const upgrading = deps.priorInstall();
         const entries = deps.launcherEntries();
         const ids = featuresInUse(entries);
         deps.persist(ids);
@@ -220,9 +221,10 @@ export function migrateExperimental(deps) {
             deps.writeErr(`mnemom: ${ids.join(", ")} ${ids.length === 1 ? "is" : "are"} now experimental and kept on because your launcher.toml uses ${ids.length === 1 ? "it" : "them"} — see \`mnemom experimental list\`.\n`);
         }
         // Implicit was the unconfigured DEFAULT, so most users relied on it without a
-        // goal_mode entry. Don't let it switch off silently for them: say so once.
+        // goal_mode entry. Don't let it switch off silently for them: say so once. A fresh
+        // install had no default to lose, so it is told nothing.
         const optedOut = entries.some(([k, v]) => k === "goal_mode" && v === "off");
-        if (!ids.includes("implicit") && !optedOut)
+        if (upgrading && !ids.includes("implicit") && !optedOut)
             deps.writeErr(IMPLICIT_NOW_OFF_NOTICE);
         return ids;
     }

package/dist/lib/launcher-config.js

@@ -135,7 +135,7 @@ export const CONFIG_KEYS = [
     },
     {
         key: "launch",
-        describe: `Launch shape (${LAUNCH_SHAPES.join("|")})`,
+        describe: "Launch shape (terminal)",
         get: (c) => c.launch,
         set: (c, v) => {
             c.launch = coerceLaunch(v);

package/dist/lib/version-gate.js

@@ -74,8 +74,7 @@ export function enforceMinCliVersion(response, exit = process.exit, write = (chu
         write(`\n✓ Updated the Mnemom CLI (was v${CLI_VERSION}; server minimum v${floor}). Re-run your command.\n\n`);
         exit(1);
     }
-    write(`\n✖ Your Mnemom CLI (v${CLI_VERSION}) is too old for this server (minimum v${floor}).\n` +
-        `  Old CLIs can silently drop newer request fields — e.g. \`--org\` on \`mnemom agent claim\`.\n\n` +
+    write(`\n✖ Your Mnemom CLI (v${CLI_VERSION}) is too old for this server (minimum v${floor}).\n\n` +
         `  Upgrade:  npm i -g @mnemom/mnemom@latest\n\n`);
     exit(1);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemom/mnemom",
-  "version": "0.17.11-next.1",
+  "version": "0.17.11",
   "description": "Transparent AI agent tracing",
   "type": "module",
   "bin": {