@mnemom/mnemom 0.17.18 → 0.17.19

package/dist/commands/agent-doctor.js

@@ -14,9 +14,8 @@
  */
 import { spawnSync } from "node:child_process";
 import { existsSync } from "node:fs";
-import { anthropicKeySource, checkRcCapability, defaultConsoleKeyDeps, resolveCliBin, } from "./agent.js";
-import { readConsoleKey } from "../lib/console-key.js";
-import { resolveAgentAuth } from "../lib/subscription-login.js";
+import { anthropicKeySource, checkRcCapability, resolveCliBin } from "./agent.js";
+import { resolveAgentAuth, savedAuthIsRetiredConsole, } from "../lib/subscription-login.js";
 import { isProdGateway, resolveAnthropicDoor, resolveGatewayHost, singleCellError, } from "../lib/agent.js";
 import { getApiUrl, getGatewayUrl } from "../lib/config.js";
 import { LAUNCHER_CONFIG_PATH } from "../lib/launcher-config.js";
@@ -55,17 +54,14 @@ export async function agentDoctorCommand(options = {}) {
         auth = resolveAgentAuth(undefined, env);
     }
     catch (err) {
-        add("miss", `auth: ${err instanceof Error ? err.message : String(err)}`, "`mnemom agent config set auth api-key` (or subscription, console)");
+        add("miss", `auth: ${err instanceof Error ? err.message : String(err)}`, "`mnemom agent config set auth api-key` (or subscription)");
+    }
+    if (savedAuthIsRetiredConsole(env)) {
+        add("info", "auth: console is no longer supported — launches use an Anthropic API key", "`mnemom agent config set auth api-key` (create a key at console.anthropic.com)");
     }
     if (auth === "subscription") {
         add("ok", "auth: subscription — Claude Code uses your claude.ai login (Team/Enterprise plans only); no Anthropic key needed");
     }
-    else if (auth === "console") {
-        if (readConsoleKey(defaultConsoleKeyDeps(env)))
-            add("ok", "auth: console — using the API key your Claude Code Anthropic Console login created");
-        else
-            add("miss", "auth: console — Claude Code has no Anthropic Console login on this machine", 'run `claude`, then /login → "Anthropic Console account" — or `mnemom agent config set auth api-key`');
-    }
     else {
         const keySrc = anthropicKeySource(env);
         if (keySrc === "env")

package/dist/commands/agent.d.ts

@@ -28,7 +28,6 @@
 import { type MnemomKeyDeps } from "../lib/subscription-login.js";
 import { type SessionRecord } from "../lib/agent-ledger.js";
 import { type ExperimentalId } from "../lib/experimental.js";
-import { type ConsoleKeyDeps } from "../lib/console-key.js";
 import { type GovernanceOptIn } from "./agent-setup.js";
 import { type ContextProfile, type LaunchShape, type SealedContractEnvelope } from "../lib/agent.js";
 export interface AgentOptions {
@@ -228,8 +227,6 @@ export declare function recordSessionLaunch(ctx: {
 }): void;
 /** The real I/O behind a subscription launch's Mnemom key (lib/subscription-login.ts). */
 export declare function defaultMnemomKeyDeps(storePath?: string): MnemomKeyDeps;
-/** The real machine behind lib/console-key.ts: the macOS keychain via `security`, no shell. */
-export declare function defaultConsoleKeyDeps(env: NodeJS.ProcessEnv): ConsoleKeyDeps;
 /**
  * Resolve the Anthropic key with NO 1Password dependency (built for external
  * customer adoption), in order:

package/dist/commands/agent.js

@@ -28,13 +28,13 @@
 import { spawn, spawnSync } from "node:child_process";
 import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync, renameSync, } from "node:fs";
 import { randomUUID } from "node:crypto";
-import { tmpdir, homedir, hostname, userInfo } from "node:os";
+import { tmpdir, homedir, hostname } from "node:os";
 import { basename, join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { MEASURED_ENV, statuslineLaunch } from "../lib/statusline.js";
 import { getApiUrl, getGatewayUrl, MNEMOM_DIR } from "../lib/config.js";
 import { createApiKey } from "../lib/api.js";
-import { MNEMOM_KEY_STORE_FIELD, resolveAgentAuth, resolveSubscriptionMnemomKey, subscriptionChildEnv, subscriptionShape, } from "../lib/subscription-login.js";
+import { MNEMOM_KEY_STORE_FIELD, resolveAgentAuth, sayRetiredConsoleNotice, resolveSubscriptionMnemomKey, subscriptionChildEnv, subscriptionShape, } from "../lib/subscription-login.js";
 import { LEDGER_FILE, appendSessionRecord, findResumeCandidate, readSessionRecords, resolveRetentionDays, resumedContextProfile, toLedgerContract, } from "../lib/agent-ledger.js";
 import { isLoggedIn } from "../lib/auth.js";
 import { loadCliConfig } from "../lib/cli-config.js";
@@ -43,7 +43,6 @@ import { experimentalNotice } from "../lib/experimental.js";
 import { fmt } from "../lib/format.js";
 import { askInput, askSelect, askYesNo, isInteractive } from "../lib/prompt.js";
 import { authConfigured, chooseAuth, detectClaudeLogin, readClaudeLoginState, } from "../lib/login-detect.js";
-import { requireConsoleKey, readConsoleKey } from "../lib/console-key.js";
 import { goalAlignmentLine, resolveSessionSetup } from "./agent-session.js";
 import { defaultAgentSlug, ensureClaimedServedAgent, ensureSessionAndBalance, isQuietPreambleExit, resolveDefaultSlug, resolvePreflightedAccount, } from "./agent-setup.js";
 import { assembleContract, buildGoalModeHeader, buildCustomHeaders, buildHandoffMcpConfigJson, buildSessionConfig, buildSessionConfigB64, assertCompactAtCompatible, assertOffProfileCompatible, compactAtWindowWarning, describeCompactAt, launchWindow, resolveCompactAt, applyGatewayHintHeaders, resolveCompactionIntercept, resolveContextHandoff, resolveContextProfile, resolveHandoffGatewayHost, resolveUsageSavings, HANDOFF_RC_KEY_ENV_NAME, isProdGateway, launchPreferenceExplicit, launchPreflighted, remoteControlAllowed, applyToolSearchDefault, DISABLE_1M_ENV, readCcSettings, resolveWindowModel, resolveAnthropicDoor, resolveLaunchModel, resolveConversationId, resolveGatewayHost, singleCellError, resolveLaunchShape, resolveRemoteControlShape, passthroughName, sanitizeAgentName, resumeCommand, sessionDisplayName, SESSION_NAME_ENV, SESSION_CONFIG_HEADER, } from "../lib/agent.js";
@@ -141,13 +140,13 @@ export async function agentCommand(scenarioArg, options = {}) {
     // How Claude Code authenticates: an Anthropic key (default) or the user's claude.ai
     // subscription login (Team/Enterprise; lib/subscription-login.ts).
     let auth = resolveAgentAuth(options.auth, env);
+    sayRetiredConsoleNotice(options.auth, env, say);
     // Nothing configured it yet: detect Claude Code's own login and, when there is a real
     // choice, ask once and save the answer (lib/login-detect.ts). Never on --dry-run.
     if (!options.dryRun && !authConfigured(options.auth, env)) {
         const loginState = readClaudeLoginState(env, homedir(), (path) => readFileSync(path, "utf8"));
         auth = await chooseAuth({
             login: detectClaudeLogin(loginState),
-            consoleKeyAvailable: () => readConsoleKey(defaultConsoleKeyDeps(env)) !== undefined,
             interactive: isInteractive(),
             select: askSelect,
             persist: (choice) => {
@@ -309,9 +308,6 @@ export async function agentCommand(scenarioArg, options = {}) {
             say("mnemom agent: auth = subscription — Claude Code would use your claude.ai login (Team/Enterprise plans only) with a Mnemom API key; no Anthropic key.");
         }
         say(`mnemom agent: the real launch first confirms the agent the gateway serves for '${agent}' is claimed — claiming it into the org the launch bills if it is not — and never runs on an unclaimed agent.`);
-        if (auth === "console") {
-            say("mnemom agent: auth = console — the launch would use the API key your Claude Code Anthropic Console login created.");
-        }
         if (expNotice)
             say(expNotice);
         if (shape !== "terminal") {
@@ -354,12 +350,9 @@ export async function agentCommand(scenarioArg, options = {}) {
     // AFTER the account gate above: an account Mnemom Agent is not enabled for learns that
     // (and how to get access) before it is asked for, or refused for want of, a key.
     // Not on a subscription launch: Claude Code then sends its own claude.ai login instead.
-    // A Console launch uses the key Claude Code's Console login created, then runs as api-key.
     const anthropicKey = auth === "subscription"
         ? undefined
-        : auth === "console"
-            ? requireConsoleKey(defaultConsoleKeyDeps(env))
-            : await resolveAnthropicKey(env, { allowPrompt: true, keySource: options.keySource });
+        : await resolveAnthropicKey(env, { allowPrompt: true, keySource: options.keySource });
     // ── Remote-Control entitlement gate ─────────────────────────────────────────
     // Remote Control (a session steerable from claude.ai / the Claude app) is
     // internal-only. Now that we know the org's entitlement, resolve the final
@@ -837,23 +830,6 @@ export function defaultMnemomKeyDeps(storePath = CODE_STORE) {
         say,
     };
 }
-/** The real machine behind lib/console-key.ts: the macOS keychain via `security`, no shell. */
-export function defaultConsoleKeyDeps(env) {
-    return {
-        platform: process.platform,
-        env,
-        username: () => userInfo().username,
-        readKeychain: (service, account) => {
-            const r = spawnSync("security", ["find-generic-password", "-a", account, "-w", "-s", service], {
-                encoding: "utf8",
-                timeout: 5_000,
-            });
-            return r.status === 0 ? r.stdout : undefined;
-        },
-        claudeJson: readClaudeLoginState(env, homedir(), (path) => readFileSync(path, "utf8"))
-            .claudeJson,
-    };
-}
 /**
  * Resolve the Anthropic key with NO 1Password dependency (built for external
  * customer adoption), in order:

package/dist/index.js

@@ -165,7 +165,7 @@ const agentCmd = program
     // built at load, before any sign-in, so it cannot ask the entitlement; the flags still parse.
     .addOption(new Option("--remote-control", "Interactive Remote Control session in THIS terminal (behind a local proxy)").hideHelp())
     .addOption(new Option("--server", "Headless `claude remote-control` dispatcher (behind a local proxy)").hideHelp())
-    .option("--auth <mode>", "How Claude Code authenticates: api-key (default) | subscription (your Claude Team/Enterprise login) | console (the API key your Claude Code Anthropic Console login created)")
+    .option("--auth <mode>", "How Claude Code authenticates: api-key (default) | subscription (your Claude Team/Enterprise login)")
     .option("--model <alias|id>", "Model to launch (CLI alias or concrete id)")
     .addOption(new Option("--effort <level>", "Reasoning effort").choices([
     "low",

package/dist/lib/launcher-config.d.ts

@@ -15,7 +15,7 @@
  * resolvers in lib/code.ts keep the built-in default as the final fallback);
  * the caller folds the plain-value settings under the CLI flags.
  */
-import { type AgentAuth } from "./subscription-login.js";
+import { type SavedAgentAuth } from "./subscription-login.js";
 import { type ExperimentalId } from "./experimental.js";
 import { type ContextProfile, type GoalModeDefault, type LaunchShape } from "./agent.js";
 /** The human-editable settings file. Secret key lives elsewhere (launcher.json). */
@@ -31,7 +31,7 @@ export interface LauncherConfig {
     cli?: string;
     launch?: LaunchShape;
     /** How Claude Code authenticates (lib/subscription-login.ts); api-key when unset. */
-    auth?: AgentAuth;
+    auth?: SavedAgentAuth;
     keySource?: KeySource;
     /** Standing goal-alignment default when neither --goal nor --implicit is given. */
     goalMode?: GoalModeDefault;

package/dist/lib/launcher-config.js

@@ -15,7 +15,7 @@
  * resolvers in lib/code.ts keep the built-in default as the final fallback);
  * the caller folds the plain-value settings under the CLI flags.
  */
-import { AGENT_AUTH_ENV, AGENT_AUTHS, coerceAgentAuth, } from "./subscription-login.js";
+import { AGENT_AUTH_ENV, AGENT_AUTHS, coerceAgentAuth, parseSavedAgentAuth, } from "./subscription-login.js";
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { parse as parseToml, stringify as stringifyToml, TomlError } from "smol-toml";
@@ -143,7 +143,7 @@ export const CONFIG_KEYS = [
     },
     {
         key: "auth",
-        describe: `How Claude Code authenticates (${AGENT_AUTHS.join("|")}); subscription = your Claude Team/Enterprise login, console = your Claude Code Anthropic Console login's key`,
+        describe: `How Claude Code authenticates (${AGENT_AUTHS.join("|")}); subscription = your Claude Team/Enterprise login`,
         get: (c) => c.auth,
         set: (c, v) => {
             c.auth = coerceAgentAuth(v);
@@ -292,7 +292,7 @@ export function parseLauncherConfig(text) {
     if (raw.launch !== undefined)
         cfg.launch = coerceLaunch(str(raw.launch) ?? "");
     if (raw.auth !== undefined)
-        cfg.auth = coerceAgentAuth(str(raw.auth) ?? "");
+        cfg.auth = parseSavedAgentAuth(str(raw.auth) ?? "");
     if (raw.key_source !== undefined)
         cfg.keySource = coerceKeySource(str(raw.key_source) ?? "");
     if (raw.goal_mode !== undefined)

package/dist/lib/login-detect.d.ts

@@ -6,9 +6,8 @@
  * Four ways Claude Code can be signed in, and what the gateway does with each today:
  *   - Claude subscription, Team or Enterprise → `auth = subscription` (supported).
  *   - Claude subscription, Pro / Max (individual) → not supported (Team/Enterprise only).
- *   - Anthropic Console login (`/login` → Console account) → `auth = console` (supported): the
- *     API key Claude Code created is read from its keychain (lib/console-key.ts). A
- *     `claude auth login --console` profile creates no key → not supported.
+ *   - Anthropic Console login (`/login` → Console account) → not used directly: Console
+ *     customers use an Anthropic API key (created in the Console).
  *   - Third-party provider (Bedrock / Vertex / Foundry) → not supported (no gateway door).
  * An Anthropic API key always works (`auth = api-key`, the default).
  *
@@ -48,13 +47,10 @@ export type UnsupportedLogin = Extract<ClaudeLogin, {
 /** Why a detected login can't be used through the gateway. */
 export declare function unsupportedReason(login: UnsupportedLogin): string;
 export declare const MENU_SUBSCRIPTION = "Claude subscription \u2014 Team or Enterprise (your claude.ai login)";
-export declare const MENU_CONSOLE = "Anthropic Console \u2014 the API key your Claude Code /login created (API billing)";
 export declare const MENU_API_KEY = "Anthropic API key";
 export interface ChooseAuthDeps {
     login: ClaudeLogin;
     interactive: boolean;
-    /** Whether Claude Code's Console-login key is readable (lib/console-key.ts); asked only for a Console login. */
-    consoleKeyAvailable(): boolean;
     select(question: string, options: string[]): Promise<string | null>;
     persist(auth: AgentAuth): void;
     say(line: string): void;
@@ -62,10 +58,11 @@ export interface ChooseAuthDeps {
 /**
  * Pick `auth` when nothing configured it (no --auth, MNEMOM_AGENT_AUTH or launcher.toml).
  *   - No Claude login detected → api-key, silently, nothing saved (today's behaviour).
- *   - A login we can't use → api-key, say why once, save it so the note isn't repeated.
- *   - Team/Enterprise, or a Console login whose key is readable, and non-interactive →
- *     api-key, nothing saved (never switch a script's auth without asking); interactive → a
- *     two-option menu (that login or an API key), answer saved.
+ *   - A login we can't use (personal plan, Console, third-party) → api-key, say why once,
+ *     save it so the note isn't repeated.
+ *   - Team/Enterprise and non-interactive → api-key, nothing saved (never switch a script's
+ *     auth without asking); interactive → a two-option menu (subscription or an API key),
+ *     answer saved.
  */
 export declare function chooseAuth(deps: ChooseAuthDeps): Promise<AgentAuth>;
 /** True when `auth` is already decided: `--auth`, or MNEMOM_AGENT_AUTH (launcher.toml folds in). */

package/dist/lib/login-detect.js

@@ -6,9 +6,8 @@
  * Four ways Claude Code can be signed in, and what the gateway does with each today:
  *   - Claude subscription, Team or Enterprise → `auth = subscription` (supported).
  *   - Claude subscription, Pro / Max (individual) → not supported (Team/Enterprise only).
- *   - Anthropic Console login (`/login` → Console account) → `auth = console` (supported): the
- *     API key Claude Code created is read from its keychain (lib/console-key.ts). A
- *     `claude auth login --console` profile creates no key → not supported.
+ *   - Anthropic Console login (`/login` → Console account) → not used directly: Console
+ *     customers use an Anthropic API key (created in the Console).
  *   - Third-party provider (Bedrock / Vertex / Foundry) → not supported (no gateway door).
  * An Anthropic API key always works (`auth = api-key`, the default).
  *
@@ -63,13 +62,12 @@ export function unsupportedReason(login) {
         case "individual":
             return `your Claude ${login.plan} plan is a personal plan — Mnemom supports subscription login on Team and Enterprise plans only`;
         case "console":
-            return "your Anthropic Console login has no API key from Claude Code's /login (Mnemom uses the key /login creates)";
+            return "Claude Code is signed in with an Anthropic Console account, and Mnemom uses an Anthropic API key for Console billing (create one at console.anthropic.com)";
         case "third-party":
-            return `Claude Code is set to use ${PROVIDER_NAMES[login.provider]}, and Mnemom supports Anthropic sign-in only (an Anthropic API key, an Anthropic Console login, or a Claude Team or Enterprise plan)`;
+            return `Claude Code is set to use ${PROVIDER_NAMES[login.provider]}, and Mnemom supports an Anthropic API key or a Claude Team or Enterprise plan`;
     }
 }
 export const MENU_SUBSCRIPTION = "Claude subscription — Team or Enterprise (your claude.ai login)";
-export const MENU_CONSOLE = "Anthropic Console — the API key your Claude Code /login created (API billing)";
 export const MENU_API_KEY = "Anthropic API key";
 const SAVED_HINT = `change it any time with \`mnemom agent config set auth ${AGENT_AUTHS.join("|")}\``;
 function save(deps, auth, line) {
@@ -85,38 +83,25 @@ function save(deps, auth, line) {
 /**
  * Pick `auth` when nothing configured it (no --auth, MNEMOM_AGENT_AUTH or launcher.toml).
  *   - No Claude login detected → api-key, silently, nothing saved (today's behaviour).
- *   - A login we can't use → api-key, say why once, save it so the note isn't repeated.
- *   - Team/Enterprise, or a Console login whose key is readable, and non-interactive →
- *     api-key, nothing saved (never switch a script's auth without asking); interactive → a
- *     two-option menu (that login or an API key), answer saved.
+ *   - A login we can't use (personal plan, Console, third-party) → api-key, say why once,
+ *     save it so the note isn't repeated.
+ *   - Team/Enterprise and non-interactive → api-key, nothing saved (never switch a script's
+ *     auth without asking); interactive → a two-option menu (subscription or an API key),
+ *     answer saved.
  */
 export async function chooseAuth(deps) {
     const { login } = deps;
     if (login.kind === "none")
         return "api-key";
-    if (login.kind === "console" && deps.consoleKeyAvailable()) {
-        if (!deps.interactive)
-            return "api-key";
-        const picked = await deps.select("mnemom agent: Claude Code is signed in with an Anthropic Console account. How should it sign in through Mnemom?", [MENU_CONSOLE, MENU_API_KEY]);
-        if (picked === MENU_CONSOLE) {
-            return save(deps, "console", "mnemom agent: using your Anthropic Console login's API key.");
-        }
-        if (picked === MENU_API_KEY) {
-            return save(deps, "api-key", "mnemom agent: using an Anthropic API key.");
-        }
-        deps.say("mnemom agent: no choice made — using an Anthropic API key for this launch.");
-        return "api-key";
-    }
     if (login.kind !== "subscription") {
         return save(deps, "api-key", `mnemom agent: ${unsupportedReason(login)}, so this launch uses an Anthropic API key.`);
     }
     if (!deps.interactive)
         return "api-key";
-    // Only options that work. The earlier menu also listed Console and Bedrock/Vertex/Foundry
-    // as "(not supported yet)" entries that re-asked when picked: a dead end. Operator ruling
-    // (2026-10-01): the product never offers a choice it can't fulfil, and never advertises
-    // what's coming. A login type comes back here only once it works end to end. Those logins
-    // already skip this menu above with a one-line reason.
+    // Only options that work. The menu never offers a choice it can't fulfil (operator ruling
+    // 2026-10-01). Console and Bedrock/Vertex/Foundry logins skip it above with a one-line
+    // reason; the public CLI supports an Anthropic API key and a Team/Enterprise subscription
+    // only (operator ruling 2026-10-07 retired the Console-login key path).
     const options = [MENU_SUBSCRIPTION, MENU_API_KEY];
     const question = `mnemom agent: Claude Code is signed in with your Claude ${login.plan} plan. How should it sign in through Mnemom?`;
     const picked = await deps.select(question, options);

package/dist/lib/subscription-login.d.ts

@@ -17,9 +17,23 @@
  * Pure apart from the injected deps, so every arm is unit-tested.
  */
 import type { LaunchShape } from "./agent.js";
-/** `console` = the API key Claude Code's Anthropic Console login created (lib/console-key.ts). */
-export type AgentAuth = "api-key" | "subscription" | "console";
+export type AgentAuth = "api-key" | "subscription";
 export declare const AGENT_AUTHS: readonly AgentAuth[];
+/**
+ * The retired `console` value (it read the key Claude Code's Anthropic Console /login
+ * created). A saved `auth = console` (launcher.toml / MNEMOM_AGENT_AUTH) now runs as
+ * api-key with a one-line notice instead of failing the launch; Console customers use an
+ * Anthropic API key. An explicit `--auth console` or `config set auth console` is refused.
+ */
+export declare const RETIRED_CONSOLE_AUTH = "console";
+/** What launcher.toml `auth` may hold: a live mode, or the retired `console` (kept so it folds
+ *  into MNEMOM_AGENT_AUTH like any saved value — the notice and the doctor row then see it). */
+export type SavedAgentAuth = AgentAuth | typeof RETIRED_CONSOLE_AUTH;
+export declare const RETIRED_CONSOLE_NOTICE = "mnemom agent: auth = console is no longer supported \u2014 this launch uses an Anthropic API key (create one at console.anthropic.com). Run `mnemom agent config set auth api-key` to stop this notice.";
+/** True when the saved setting (MNEMOM_AGENT_AUTH; launcher.toml folds in) is the retired `console`. */
+export declare function savedAuthIsRetiredConsole(env: Record<string, string | undefined>): boolean;
+/** Print the retired-console notice when the saved setting is `console`; a launch never fails on it. */
+export declare function sayRetiredConsoleNotice(flag: string | undefined, env: Record<string, string | undefined>, say: (line: string) => void): void;
 /** Env override for the setting (the launcher.toml `auth` key folds into it). */
 export declare const AGENT_AUTH_ENV = "MNEMOM_AGENT_AUTH";
 /** Env override for the Mnemom key a subscription launch sends. */
@@ -27,7 +41,12 @@ export declare const MNEMOM_KEY_ENV = "MNEMOM_AGENT_MNEMOM_KEY";
 /** Field in ~/.mnemom/launcher.json (0600) holding the minted key. */
 export declare const MNEMOM_KEY_STORE_FIELD = "mnemom_api_key";
 export declare function coerceAgentAuth(raw: string): AgentAuth;
-/** `--auth` flag > MNEMOM_AGENT_AUTH (launcher.toml folds in here) > api-key. */
+/**
+ * launcher.toml `auth`: the retired `console` is kept as-is (never a load error); it folds into
+ * MNEMOM_AGENT_AUTH, where resolveAgentAuth runs it as api-key and the launch says so once.
+ */
+export declare function parseSavedAgentAuth(raw: string): SavedAgentAuth;
+/** `--auth` flag > MNEMOM_AGENT_AUTH (launcher.toml folds in here; a saved retired `console` → api-key) > api-key. */
 export declare function resolveAgentAuth(flag: string | undefined, env: Record<string, string | undefined>): AgentAuth;
 export interface MnemomKeyDeps {
     env: Record<string, string | undefined>;

package/dist/lib/subscription-login.js

@@ -16,7 +16,24 @@
  *
  * Pure apart from the injected deps, so every arm is unit-tested.
  */
-export const AGENT_AUTHS = ["api-key", "subscription", "console"];
+export const AGENT_AUTHS = ["api-key", "subscription"];
+/**
+ * The retired `console` value (it read the key Claude Code's Anthropic Console /login
+ * created). A saved `auth = console` (launcher.toml / MNEMOM_AGENT_AUTH) now runs as
+ * api-key with a one-line notice instead of failing the launch; Console customers use an
+ * Anthropic API key. An explicit `--auth console` or `config set auth console` is refused.
+ */
+export const RETIRED_CONSOLE_AUTH = "console";
+export const RETIRED_CONSOLE_NOTICE = "mnemom agent: auth = console is no longer supported — this launch uses an Anthropic API key (create one at console.anthropic.com). Run `mnemom agent config set auth api-key` to stop this notice.";
+/** True when the saved setting (MNEMOM_AGENT_AUTH; launcher.toml folds in) is the retired `console`. */
+export function savedAuthIsRetiredConsole(env) {
+    return (env[AGENT_AUTH_ENV] ?? "").trim().toLowerCase() === RETIRED_CONSOLE_AUTH;
+}
+/** Print the retired-console notice when the saved setting is `console`; a launch never fails on it. */
+export function sayRetiredConsoleNotice(flag, env, say) {
+    if (!flag?.trim() && savedAuthIsRetiredConsole(env))
+        say(RETIRED_CONSOLE_NOTICE);
+}
 /** Env override for the setting (the launcher.toml `auth` key folds into it). */
 export const AGENT_AUTH_ENV = "MNEMOM_AGENT_AUTH";
 /** Env override for the Mnemom key a subscription launch sends. */
@@ -36,10 +53,21 @@ export function coerceAgentAuth(raw) {
         return v;
     throw new Error(`auth must be one of ${AGENT_AUTHS.join(", ")} (got '${raw}').`);
 }
-/** `--auth` flag > MNEMOM_AGENT_AUTH (launcher.toml folds in here) > api-key. */
+/**
+ * launcher.toml `auth`: the retired `console` is kept as-is (never a load error); it folds into
+ * MNEMOM_AGENT_AUTH, where resolveAgentAuth runs it as api-key and the launch says so once.
+ */
+export function parseSavedAgentAuth(raw) {
+    return raw.trim().toLowerCase() === RETIRED_CONSOLE_AUTH
+        ? RETIRED_CONSOLE_AUTH
+        : coerceAgentAuth(raw);
+}
+/** `--auth` flag > MNEMOM_AGENT_AUTH (launcher.toml folds in here; a saved retired `console` → api-key) > api-key. */
 export function resolveAgentAuth(flag, env) {
     if (flag !== undefined && flag.trim())
         return coerceAgentAuth(flag);
+    if (savedAuthIsRetiredConsole(env))
+        return "api-key";
     const fromEnv = (env[AGENT_AUTH_ENV] ?? "").trim();
     return fromEnv ? coerceAgentAuth(fromEnv) : "api-key";
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemom/mnemom",
-  "version": "0.17.18",
+  "version": "0.17.19",
   "description": "Transparent AI agent tracing",
   "type": "module",
   "bin": {

package/dist/lib/console-key.d.ts

@@ -1,40 +0,0 @@
-/**
- * `mnemom agent` with an Anthropic Console login (`auth = console`).
- *
- * Claude Code's `/login` → "Anthropic Console account" uses OAuth only to create a real
- * Anthropic API key, which Claude Code stores and then sends as `x-api-key` ("/login
- * managed key"). This module reads that key from where Claude Code keeps it, so the launch
- * runs exactly like `auth = api-key` — same headers, same birth and claim, same identity —
- * with no key for the user to copy. The key is read per launch and never stored by us.
- *
- * Where Claude Code keeps it (Claude Code 2.1.285, confirmed against the binary and a live
- * probe on 2026-10-02):
- *   - macOS: the login keychain, service `Claude Code`, account $USER. When
- *     CLAUDE_CONFIG_DIR is set the service gains `-<first 8 hex of sha256(the raw
- *     CLAUDE_CONFIG_DIR value, NFC)>`; CLAUDE_SECURESTORAGE_CONFIG_DIR, when set, replaces
- *     that value (empty = no suffix).
- *   - everywhere (and the macOS fallback): `primaryApiKey` in Claude Code's .claude.json.
- *
- * A `claude auth login --console` *profile* (keyless OAuth, ~/.config/anthropic) creates no
- * such key, so it is not read here.
- *
- * Pure apart from the injected deps, so every arm is unit-tested.
- */
-export interface ConsoleKeyDeps {
-    platform: NodeJS.Platform;
-    env: Record<string, string | undefined>;
-    /** os.userInfo().username, for when $USER is unset. */
-    username(): string;
-    /** The keychain password for (service, account), or undefined when absent. */
-    readKeychain(service: string, account: string): string | undefined;
-    /** Parsed .claude.json (see readClaudeLoginState), or undefined. */
-    claudeJson: unknown;
-}
-/** The keychain service name Claude Code stores the managed key under. */
-export declare function claudeKeychainService(env: Record<string, string | undefined>): string;
-/** The keychain account Claude Code uses: $USER, else the OS username, else a fixed name. */
-export declare function claudeKeychainAccount(env: Record<string, string | undefined>, username: () => string): string;
-/** Claude Code's Console-login API key on this machine, or undefined. Never throws. */
-export declare function readConsoleKey(deps: ConsoleKeyDeps): string | undefined;
-/** The key for an `auth = console` launch; throws with what to do when there is none. */
-export declare function requireConsoleKey(deps: ConsoleKeyDeps): string;

package/dist/lib/console-key.js

@@ -1,77 +0,0 @@
-/**
- * `mnemom agent` with an Anthropic Console login (`auth = console`).
- *
- * Claude Code's `/login` → "Anthropic Console account" uses OAuth only to create a real
- * Anthropic API key, which Claude Code stores and then sends as `x-api-key` ("/login
- * managed key"). This module reads that key from where Claude Code keeps it, so the launch
- * runs exactly like `auth = api-key` — same headers, same birth and claim, same identity —
- * with no key for the user to copy. The key is read per launch and never stored by us.
- *
- * Where Claude Code keeps it (Claude Code 2.1.285, confirmed against the binary and a live
- * probe on 2026-10-02):
- *   - macOS: the login keychain, service `Claude Code`, account $USER. When
- *     CLAUDE_CONFIG_DIR is set the service gains `-<first 8 hex of sha256(the raw
- *     CLAUDE_CONFIG_DIR value, NFC)>`; CLAUDE_SECURESTORAGE_CONFIG_DIR, when set, replaces
- *     that value (empty = no suffix).
- *   - everywhere (and the macOS fallback): `primaryApiKey` in Claude Code's .claude.json.
- *
- * A `claude auth login --console` *profile* (keyless OAuth, ~/.config/anthropic) creates no
- * such key, so it is not read here.
- *
- * Pure apart from the injected deps, so every arm is unit-tested.
- */
-import { createHash } from "node:crypto";
-const ACCOUNT_RE = /^[a-zA-Z0-9._-]+$/;
-/** The keychain service name Claude Code stores the managed key under. */
-export function claudeKeychainService(env) {
-    const secure = env.CLAUDE_SECURESTORAGE_CONFIG_DIR;
-    const dir = secure !== undefined ? secure : (env.CLAUDE_CONFIG_DIR ?? "");
-    if (!dir)
-        return "Claude Code";
-    const hash = createHash("sha256").update(dir.normalize("NFC")).digest("hex").slice(0, 8);
-    return `Claude Code-${hash}`;
-}
-/** The keychain account Claude Code uses: $USER, else the OS username, else a fixed name. */
-export function claudeKeychainAccount(env, username) {
-    let name;
-    try {
-        name = env.USER || username();
-    }
-    catch {
-        name = "";
-    }
-    return ACCOUNT_RE.test(name) ? name : "claude-code-user";
-}
-/** The key is spliced into a newline-joined header block, so CR/LF must never survive. */
-function clean(raw) {
-    const v = (raw ?? "").replace(/[\r\n]+/g, "").trim();
-    return v || undefined;
-}
-/** Claude Code's Console-login API key on this machine, or undefined. Never throws. */
-export function readConsoleKey(deps) {
-    if (deps.platform === "darwin") {
-        let fromKeychain;
-        try {
-            fromKeychain = clean(deps.readKeychain(claudeKeychainService(deps.env), claudeKeychainAccount(deps.env, deps.username)));
-        }
-        catch {
-            fromKeychain = undefined;
-        }
-        if (fromKeychain)
-            return fromKeychain;
-    }
-    const json = deps.claudeJson;
-    const stored = json && typeof json === "object"
-        ? json.primaryApiKey
-        : undefined;
-    return typeof stored === "string" ? clean(stored) : undefined;
-}
-/** The key for an `auth = console` launch; throws with what to do when there is none. */
-export function requireConsoleKey(deps) {
-    const key = readConsoleKey(deps);
-    if (key)
-        return key;
-    throw new Error("mnemom agent: auth = console, but Claude Code has no Anthropic Console login on this machine.\n" +
-        '  Sign in: run `claude`, then /login → "Anthropic Console account".\n' +
-        "  Or use a key instead: `mnemom agent config set auth api-key`.");
-}