@mnemom/mnemom 0.17.2-next.4 → 0.17.2-next.6

package/dist/commands/agent-slack.d.ts

@@ -0,0 +1,26 @@
+/**
+ * `mnemom agent slack …` — let governed sessions talk in Slack, each under its
+ * own session name, through ONE Slack app per operator (see lib/slack.ts).
+ *
+ *   mnemom agent slack manifest [app-name]   # print the app manifest to paste at api.slack.com
+ *   mnemom agent slack login                 # store the bot + app-level tokens (0600)
+ *   mnemom agent slack logout                # remove them
+ *   mnemom agent slack status                # tokens, bot identity, router, live sessions
+ *   mnemom agent slack post [--channel C] [--thread TS] [--icon-emoji E] <text…|->
+ *   mnemom agent slack inbox [--peek]        # unread messages addressed to THIS session
+ *   mnemom agent slack listen                # this session's channel server (spawned by --slack)
+ *   mnemom agent slack router                # the per-operator Socket Mode router (foreground)
+ *
+ * The poster name is MNEMOM_AGENT_SESSION_NAME, which the launcher sets in the
+ * session's environment — an agent cannot pick another session's name here.
+ */
+/** Entry point for `mnemom agent slack <verb> [args...]`. Throws on misuse. */
+export declare function agentSlackCommand(argv: string[]): Promise<void>;
+interface PostArgs {
+    channel?: string;
+    thread?: string;
+    iconEmoji?: string;
+    text: string;
+}
+export declare function parsePostArgs(argv: string[]): PostArgs;
+export {};

package/dist/commands/agent-slack.js

@@ -0,0 +1,212 @@
+/**
+ * `mnemom agent slack …` — let governed sessions talk in Slack, each under its
+ * own session name, through ONE Slack app per operator (see lib/slack.ts).
+ *
+ *   mnemom agent slack manifest [app-name]   # print the app manifest to paste at api.slack.com
+ *   mnemom agent slack login                 # store the bot + app-level tokens (0600)
+ *   mnemom agent slack logout                # remove them
+ *   mnemom agent slack status                # tokens, bot identity, router, live sessions
+ *   mnemom agent slack post [--channel C] [--thread TS] [--icon-emoji E] <text…|->
+ *   mnemom agent slack inbox [--peek]        # unread messages addressed to THIS session
+ *   mnemom agent slack listen                # this session's channel server (spawned by --slack)
+ *   mnemom agent slack router                # the per-operator Socket Mode router (foreground)
+ *
+ * The poster name is MNEMOM_AGENT_SESSION_NAME, which the launcher sets in the
+ * session's environment — an agent cannot pick another session's name here.
+ */
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { configKeySpec, loadLauncherConfig, writeLauncherConfig } from "../lib/launcher-config.js";
+import { runChannelServer } from "../lib/slack-channel.js";
+import { mergeStore, readStore } from "../lib/launcher-store.js";
+import { askInput, isInteractive } from "../lib/prompt.js";
+import { explainSlackError, looksLikeAppToken, looksLikeBotToken, postMessage, resolveSlackToken, sessionPosterName, slackAppManifest, slackCall, SLACK_APP_TOKEN_STORE_KEY, SLACK_TOKEN_STORE_KEY, } from "../lib/slack.js";
+import { routerStatus, runRouter } from "../lib/slack-router.js";
+import { normSession } from "../lib/slack-route.js";
+import { liveSessions, readInboxFrom, recordPost, slackDir } from "../lib/slack-state.js";
+const out = (line = "") => console.log(line);
+/** Entry point for `mnemom agent slack <verb> [args...]`. Throws on misuse. */
+export async function agentSlackCommand(argv) {
+    const [verb, ...rest] = argv;
+    switch (verb) {
+        case "manifest":
+            // The manifest holds scope NAMES, never a credential; written to stdout (not logged)
+            // so it can be piped straight into Slack's "create from manifest" box.
+            process.stdout.write(JSON.stringify(slackAppManifest(rest.join(" ") || defaultAppName()), null, 2) + "\n");
+            return;
+        case "login":
+            return login();
+        case "logout":
+            mergeStore({ [SLACK_TOKEN_STORE_KEY]: null, [SLACK_APP_TOKEN_STORE_KEY]: null });
+            out("mnemom agent slack: tokens removed from ~/.mnemom/launcher.json.");
+            return;
+        case undefined:
+        case "status":
+            return status();
+        case "post":
+            return post(rest);
+        case "inbox":
+            return inbox(rest);
+        case "router":
+            return router();
+        case "listen":
+            return listen();
+        default:
+            throw new Error(`mnemom agent slack: unknown verb '${verb}'. Use manifest | login | logout | status | post | inbox | listen | router.`);
+    }
+}
+function defaultAppName() {
+    const user = (process.env.USER ?? "").replace(/[^A-Za-z0-9-]/g, "");
+    return user ? `${user}-agents` : "mnemom-agents";
+}
+function botToken() {
+    const { token } = resolveSlackToken(process.env, readStore(), "bot");
+    if (!token) {
+        throw new Error("mnemom agent slack: no bot token — run `mnemom agent slack login` (or set MNEMOM_SLACK_BOT_TOKEN).");
+    }
+    return token;
+}
+async function login() {
+    if (!isInteractive()) {
+        throw new Error("mnemom agent slack login: needs a terminal (tokens are read masked, never from argv).");
+    }
+    const bot = (await askInput("Bot User OAuth Token (xoxb-…): ", true)).trim();
+    if (!looksLikeBotToken(bot))
+        throw new Error("that is not a bot token (expected xoxb-…).");
+    const auth = await slackCall("auth.test", bot, {});
+    if (!auth.ok)
+        throw new Error(explainSlackError(auth.error));
+    const app = (await askInput("App-Level Token with connections:write (xapp-…, Enter to skip): ", true)).trim();
+    if (app && !looksLikeAppToken(app))
+        throw new Error("that is not an app-level token (expected xapp-…).");
+    mergeStore({
+        [SLACK_TOKEN_STORE_KEY]: bot,
+        ...(app ? { [SLACK_APP_TOKEN_STORE_KEY]: app } : {}),
+    });
+    const cfg = loadLauncherConfig();
+    if (!cfg.slackAllow?.length) {
+        const me = (await askInput("Your Slack member ID — only allowlisted members can reach a session (U…): ")).trim();
+        if (me) {
+            configKeySpec("slack_allow")?.set(cfg, me);
+            writeLauncherConfig(cfg);
+        }
+    }
+    out(`mnemom agent slack: saved. Bot ${String(auth.user)} in ${String(auth.team)}.`);
+    if (!app)
+        out("  (No app-level token: sessions can post, but cannot receive replies until you add one.)");
+    out("  Invite the bot to a channel with /invite @" + String(auth.user) + " before posting there.");
+}
+async function status() {
+    const store = readStore();
+    const bot = resolveSlackToken(process.env, store, "bot");
+    const app = resolveSlackToken(process.env, store, "app");
+    out(`bot token:      ${bot.source ?? "not set"}`);
+    out(`app token:      ${app.source ?? "not set"}`);
+    if (bot.token) {
+        const a = await slackCall("auth.test", bot.token, {}).catch((e) => ({
+            ok: false,
+            error: e.message,
+        }));
+        out(`bot identity:   ${a.ok ? `${String(a.user)} @ ${String(a.team)}` : explainSlackError(a.error)}`);
+    }
+    out(`default channel: ${loadLauncherConfig().slackChannel ?? "(none — pass --channel)"}`);
+    out(`this session:   ${sessionPosterName(process.env) ?? "(not inside a `mnemom agent` session)"}`);
+    const r = routerStatus();
+    out(`router:         ${r.running ? `running (pid ${r.pid})` : "not running"}`);
+    const live = liveSessions();
+    out(`listening:      ${live.length ? live.join(", ") : "none"}`);
+    const allow = loadLauncherConfig().slackAllow ?? [];
+    out(`allowed senders: ${allow.length ? allow.join(", ") : "none — no message will reach a session"}`);
+}
+export function parsePostArgs(argv) {
+    const res = { text: "" };
+    const words = [];
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        const val = () => {
+            const v = argv[++i];
+            if (v === undefined)
+                throw new Error(`mnemom agent slack post: ${a} needs a value.`);
+            return v;
+        };
+        if (a === "--channel" || a === "-c")
+            res.channel = val();
+        else if (a === "--thread" || a === "-t")
+            res.thread = val();
+        else if (a === "--icon-emoji")
+            res.iconEmoji = val();
+        else if (a === "--") {
+            words.push(...argv.slice(i + 1));
+            break;
+        }
+        else
+            words.push(a);
+    }
+    res.text = words.join(" ");
+    return res;
+}
+async function post(argv) {
+    const args = parsePostArgs(argv);
+    let text = args.text;
+    if (text === "-" || (!text && !process.stdin.isTTY))
+        text = readFileSync(0, "utf8");
+    text = text.trim();
+    if (!text)
+        throw new Error("mnemom agent slack post: nothing to post.");
+    const channel = args.channel ?? loadLauncherConfig().slackChannel;
+    if (!channel) {
+        throw new Error("mnemom agent slack post: no channel — pass --channel or `mnemom agent config set slack_channel <#name>`.");
+    }
+    const session = sessionPosterName(process.env);
+    const res = await postMessage({
+        token: botToken(),
+        channel,
+        text,
+        username: session,
+        iconEmoji: args.iconEmoji,
+        threadTs: args.thread,
+    });
+    if (session)
+        recordPost({ session, channel: res.channel, ts: res.ts, thread_ts: args.thread });
+    out(JSON.stringify({ ok: true, channel: res.channel, ts: res.ts, as: session ?? null }));
+}
+// ── inbox (pull) ─────────────────────────────────────────────────────────────
+// Normalised like the inbox file name, so a session name can never escape offsets/.
+const offsetFile = (session) => join(slackDir(), "offsets", `${normSession(session)}.off`);
+function readOffset(session) {
+    try {
+        return Number(readFileSync(offsetFile(session), "utf8")) || 0;
+    }
+    catch {
+        return 0;
+    }
+}
+/** Print (and, unless --peek, consume) the messages routed to this session. */
+async function inbox(argv) {
+    const session = sessionPosterName(process.env);
+    if (!session)
+        throw new Error("mnemom agent slack inbox: not inside a `mnemom agent` session.");
+    const { messages, offset } = readInboxFrom(session, readOffset(session));
+    if (!argv.includes("--peek")) {
+        mkdirSync(join(slackDir(), "offsets"), { recursive: true, mode: 0o700 });
+        writeFileSync(offsetFile(session), String(offset), { mode: 0o600 });
+    }
+    out(JSON.stringify(messages));
+}
+async function router() {
+    const store = readStore();
+    const app = resolveSlackToken(process.env, store, "app").token;
+    if (!app)
+        throw new Error("mnemom agent slack router: no app-level token — run `mnemom agent slack login`.");
+    await runRouter({
+        botToken: botToken(),
+        appToken: app,
+        allow: loadLauncherConfig().slackAllow ?? [],
+    });
+}
+async function listen() {
+    const session = sessionPosterName(process.env);
+    if (!session)
+        throw new Error("mnemom agent slack listen: not inside a `mnemom agent` session.");
+    await runChannelServer({ session, botToken: botToken() });
+}

package/dist/commands/agent.d.ts

@@ -60,6 +60,8 @@ export interface AgentOptions {
     context?: boolean;
     /** context-hint seed default: commander `--no-context-hint` sets this false. */
     contextHint?: boolean;
+    /** Attach the Slack channel server (`--slack`; lib/slack-launch.ts). */
+    slack?: boolean;
     /**
      * EXPERIMENTAL, off by default (operator directive, MNE-7564): registers the `handoff` MCP
      * tool and tells the gateway `CONTEXT_HANDOFF_ENABLED=true` for this session only. Absent/false

package/dist/commands/agent.js

@@ -26,7 +26,7 @@
  * an argv value.
  */
 import { spawn, spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync, renameSync, } from "node:fs";
+import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync, renameSync, } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { tmpdir, homedir } from "node:os";
 import { basename, join, dirname } from "node:path";
@@ -39,9 +39,11 @@ import { fmt } from "../lib/format.js";
 import { askInput, askYesNo, isInteractive } from "../lib/prompt.js";
 import { goalAlignmentLine, resolveSessionSetup } from "./agent-session.js";
 import { defaultAgentSlug, ensureGovernedAgent, ensureSessionAndBalance, isQuietPreambleExit, resolveDefaultSlug, resolvePreflightedAccount, } from "./agent-setup.js";
-import { assembleContract, buildGoalModeHeader, buildCustomHeaders, buildHandoffMcpConfigJson, buildSessionConfigB64, resolveContextFold, resolveContextHandoff, resolveHandoffGatewayHost, HANDOFF_RC_KEY_ENV_NAME, isProdGateway, launchPreferenceExplicit, launchPreflighted, remoteControlAllowed, resolveAnthropicDoor, resolveConversationId, resolveGatewayHost, resolveLaunchShape, resolveRemoteControlShape, sanitizeAgentName, } from "../lib/agent.js";
+import { assembleContract, buildGoalModeHeader, buildCustomHeaders, buildHandoffMcpConfigJson, buildSessionConfigB64, resolveContextFold, resolveContextHandoff, resolveHandoffGatewayHost, HANDOFF_RC_KEY_ENV_NAME, isProdGateway, launchPreferenceExplicit, launchPreflighted, remoteControlAllowed, resolveAnthropicDoor, resolveConversationId, resolveGatewayHost, resolveLaunchShape, resolveRemoteControlShape, passthroughName, sanitizeAgentName, sessionDisplayName, SESSION_NAME_ENV, } from "../lib/agent.js";
+import { LAUNCHER_STORE_PATH, mergeStore } from "../lib/launcher-store.js";
+import { slackChannelArgs } from "../lib/slack-launch.js";
 /** The CLI's own provider-key store (zero 1Password): ~/.mnemom/launcher.json, 0600. */
-const CODE_STORE = join(MNEMOM_DIR, "launcher.json");
+const CODE_STORE = LAUNCHER_STORE_PATH;
 const say = (line = "") => console.error(line);
 /** Entry point for `mnemom agent [scenario]`. Throws on fatal misconfig. */
 export async function agentCommand(scenarioArg, options = {}) {
@@ -306,6 +308,7 @@ export async function agentCommand(scenarioArg, options = {}) {
             door,
             anthropicKey,
             agent,
+            scenario,
             conversationId,
             envelope,
             goalMode,
@@ -445,13 +448,10 @@ function readStoredKey() {
         return undefined;
     }
 }
-/** Persist the provider key to ~/.mnemom/launcher.json at 0600 (atomic). Best-effort. */
+/** Persist the provider key to ~/.mnemom/launcher.json at 0600 (atomic, merged). Best-effort. */
 function storeKey(key) {
     try {
-        mkdirSync(MNEMOM_DIR, { recursive: true });
-        const tmp = join(MNEMOM_DIR, `.code-tmp-${process.pid}-${Date.now()}.json`);
-        writeFileSync(tmp, JSON.stringify({ anthropic_key: key }, null, 2), { mode: 0o600 });
-        renameSync(tmp, CODE_STORE);
+        mergeStore({ anthropic_key: key }, CODE_STORE);
     }
     catch {
         // best effort — the launch proceeds with the in-memory key either way
@@ -632,6 +632,10 @@ function launchTerminal(ctx) {
     childEnv.ANTHROPIC_BASE_URL = ctx.door;
     childEnv.ANTHROPIC_AUTH_TOKEN = "mnemom-gateway";
     childEnv.ANTHROPIC_CUSTOM_HEADERS = headers;
+    const sessionName = passthroughName(ctx.options.passthrough ?? []) ?? sessionDisplayName(ctx.agent, ctx.scenario);
+    childEnv[SESSION_NAME_ENV] = sessionName;
+    if (ctx.options.slack)
+        args.push(...slackChannelArgs(sessionName));
     if (ctx.contextHint) {
         seedContextHintFlag(childEnv);
         childEnv.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC = "1";
@@ -752,7 +756,7 @@ function spawnRcCli(ctx) {
     // Session name for the claude.ai session list: "<agent>-<scenario>", unless
     // the caller passed their own `--name <x>` after `--` (lifted out here).
     const rawPassthrough = ctx.options.passthrough ?? [];
-    let rcName = sanitizeAgentName(`${ctx.agent}-${ctx.scenario}`) || ctx.agent;
+    let rcName = sessionDisplayName(ctx.agent, ctx.scenario);
     const passthrough = [];
     for (let i = 0; i < rawPassthrough.length; i++) {
         if (rawPassthrough[i] === "--name" && i + 1 < rawPassthrough.length) {
@@ -786,6 +790,7 @@ function spawnRcCli(ctx) {
     childEnv.HTTPS_PROXY = `http://127.0.0.1:${ctx.port}`;
     childEnv.https_proxy = `http://127.0.0.1:${ctx.port}`;
     childEnv.NODE_EXTRA_CA_CERTS = ctx.ca;
+    childEnv[SESSION_NAME_ENV] = rcName;
     // Context handoff (MNE-7564), RC shapes only: the strip list above deliberately removes every
     // ANTHROPIC_* var, so the handoff MCP server has nothing to inherit for the key unless we give
     // it something — a dedicated, non-ANTHROPIC-named var, added AFTER the strip loop so it can
@@ -802,6 +807,9 @@ function spawnRcCli(ctx) {
         warnServerDrops(ctx.options, ctx.yolo);
         if (ctx.options.model)
             childEnv.ANTHROPIC_MODEL = ctx.options.model;
+        if (ctx.options.slack) {
+            say("mnemom agent: --slack is not applied to a headless server (a channel server needs an interactive confirmation); use the terminal or remote-control shape.");
+        }
         args = ["remote-control", "--name", rcName, ...passthrough];
         // Additive, never `--strict-mcp-config`: --trim-mcp is not applied under --server (every
         // dispatched session keeps its full MCP set, unrestricted — see warnServerDrops below), so
@@ -821,6 +829,8 @@ function spawnRcCli(ctx) {
             handoffMcpConfigPath: ctx.handoffMcpConfigPath,
         });
         args = ["--remote-control", rcName, ...flagArgs];
+        if (ctx.options.slack)
+            args.push(...slackChannelArgs(rcName));
         say(`mnemom agent: remote-control: interactive session in THIS terminal with Remote Control on (session name '${rcName}'); it also appears under Remote Control at claude.ai/code and in the Claude app. Exit the CLI to stop everything.`);
     }
     const child = spawn(ctx.cli.bin, args, { stdio: "inherit", env: childEnv });

package/dist/index.d.ts

@@ -1,3 +1,10 @@
 #!/usr/bin/env node
 import { program } from "commander";
 export { program };
+/**
+ * The entrypoint dispatch. `mnemom agent slack …` owns its own flags (--thread,
+ * --channel, …), which the `agent` launcher options would otherwise reject as
+ * unknown — so it bypasses commander entirely and reaches the sub-verb parser
+ * verbatim. Exported (not auto-run) so the bypass is unit-testable.
+ */
+export declare function runEntrypoint(argv?: string[]): void;

package/dist/index.js

@@ -24,6 +24,7 @@ import { listenCommand } from "./commands/listen.js";
 import { tryMeCommand } from "./commands/try-me.js";
 import { agentCommand } from "./commands/agent.js";
 import { agentConfigCommand } from "./commands/agent-config.js";
+import { agentSlackCommand } from "./commands/agent-slack.js";
 import { agentDoctorCommand } from "./commands/agent-doctor.js";
 import { agentSetupCommand } from "./commands/agent-setup.js";
 import { agentInviteCommand, runAgentInvocation } from "./commands/agent-invite.js";
@@ -135,6 +136,7 @@ const agentCmd = program
     .option("--no-setup", "Skip governed-agent provisioning entirely for this launch")
     .option("--no-yolo", "Do NOT pass --dangerously-skip-permissions (yolo is on by default)")
     .option("--no-context-hint", "Do NOT seed Claude Code's context-hint feature flag before launch")
+    .option("--slack", "Attach the Slack channel: messages addressed to this session arrive in it, and it can reply (see `mnemom agent slack`)")
     .option("--context", "Force context folding ON for this launch even when launcher.toml (context = false) or MNEMOM_AGENT_CONTEXT turns it off")
     .option("--no-context", "Disable context folding for this launch (folding is on by default; tells the gateway to skip it for this session)")
     .option("--context-handoff", "EXPERIMENTAL, off by default: register the `handoff(note)` MCP tool and tell the gateway to turn on the context-handoff capability for this session")
@@ -162,6 +164,12 @@ const agentCmd = program
             await agentConfigCommand(passthrough);
             return;
         }
+        // Sub-verb: `mnemom agent slack …` posts/receives Slack messages as this
+        // session (lib/slack.ts) and never launches.
+        if (scenario === "slack") {
+            await agentSlackCommand(passthrough);
+            return;
+        }
         if (opts.gateway)
             process.env.MNEMOM_AGENT_GATEWAY = opts.gateway;
         // Persistent settings (~/.mnemom/launcher.toml) sit UNDER env and flags:
@@ -220,6 +228,7 @@ const agentCmd = program
             trimMcp: opts.trimMcp,
             yolo: opts.yolo,
             contextHint: opts.contextHint,
+            slack: opts.slack ?? cfg.slackListen,
             context: opts.context,
             contextHandoff: opts.contextHandoff,
             setup: opts.setup,
@@ -1874,6 +1883,22 @@ export { program };
 // Parse argv only when invoked as the CLI entrypoint — not when imported.
 // The symlink-safe guard lives in ./lib/entrypoint so it can be unit-tested
 // without executing this module's top-level parse().
-if (isEntrypoint(import.meta.url, process.argv[1])) {
-    program.parse();
+/**
+ * The entrypoint dispatch. `mnemom agent slack …` owns its own flags (--thread,
+ * --channel, …), which the `agent` launcher options would otherwise reject as
+ * unknown — so it bypasses commander entirely and reaches the sub-verb parser
+ * verbatim. Exported (not auto-run) so the bypass is unit-testable.
+ */
+export function runEntrypoint(argv = process.argv.slice(2)) {
+    if (argv[0] === "agent" && argv[1] === "slack") {
+        agentSlackCommand(argv.slice(2)).catch((err) => {
+            console.error(`error: ${err instanceof Error ? err.message : String(err)}`);
+            process.exit(1);
+        });
+    }
+    else {
+        program.parse();
+    }
 }
+if (isEntrypoint(import.meta.url, process.argv[1]))
+    runEntrypoint();

package/dist/lib/agent.d.ts

@@ -92,6 +92,16 @@ export declare function resolveHandoffGatewayHost(door: string): string;
  * survives (the caller rejects that).
  */
 export declare function sanitizeAgentName(raw: string): string;
+/**
+ * The env var the launcher sets in the child CLI's environment to the session's
+ * display name, so tools running INSIDE the session (e.g. `mnemom agent slack
+ * post`) can identify themselves by the same name the claude.ai session list shows.
+ */
+export declare const SESSION_NAME_ENV = "MNEMOM_AGENT_SESSION_NAME";
+/** The session display name: "<agent>-<scenario>" (sanitised), else the agent slug. */
+export declare function sessionDisplayName(agent: string, scenario: string): string;
+/** A caller's own `--name <x>` in the passthrough args, if any (last one wins). */
+export declare function passthroughName(passthrough: readonly string[]): string | undefined;
 /** A single-line, header-safe conversation id: honour a caller value, else a uuid. */
 export declare function resolveConversationId(raw: string | undefined): string;
 /** A strictly-positive integer (rejects 0, negatives, decimals, NaN, non-numeric strings). */

package/dist/lib/agent.js

@@ -74,6 +74,25 @@ export function sanitizeAgentName(raw) {
         .replace(/^-+/, "")
         .replace(/-+$/, "");
 }
+/**
+ * The env var the launcher sets in the child CLI's environment to the session's
+ * display name, so tools running INSIDE the session (e.g. `mnemom agent slack
+ * post`) can identify themselves by the same name the claude.ai session list shows.
+ */
+export const SESSION_NAME_ENV = "MNEMOM_AGENT_SESSION_NAME";
+/** The session display name: "<agent>-<scenario>" (sanitised), else the agent slug. */
+export function sessionDisplayName(agent, scenario) {
+    return sanitizeAgentName(`${agent}-${scenario}`) || agent;
+}
+/** A caller's own `--name <x>` in the passthrough args, if any (last one wins). */
+export function passthroughName(passthrough) {
+    let name;
+    for (let i = 0; i < passthrough.length - 1; i++) {
+        if (passthrough[i] === "--name")
+            name = passthrough[i + 1];
+    }
+    return name;
+}
 /** A single-line, header-safe conversation id: honour a caller value, else a uuid. */
 export function resolveConversationId(raw) {
     const trimmed = (raw ?? "").replace(/[\r\n]+/g, "").trim();

package/dist/lib/launcher-config.d.ts

@@ -33,6 +33,12 @@ export interface LauncherConfig {
     goalMode?: GoalModeDefault;
     /** Context folding default (on when unset; `false` disables it for every launch). */
     context?: boolean;
+    /** Default channel for `mnemom agent slack post` (the bot token lives in launcher.json). */
+    slackChannel?: string;
+    /** Attach the Slack channel on every launch (as if `--slack` were passed). */
+    slackListen?: boolean;
+    /** Slack member ids whose messages the router may deliver into a session. */
+    slackAllow?: string[];
     /**
      * Context-handoff default (EXPERIMENTAL, off when unset): `true` registers the `handoff`
      * MCP tool and sends `CONTEXT_HANDOFF_ENABLED: "true"` in the per-session config header for

package/dist/lib/launcher-config.js

@@ -66,6 +66,17 @@ function coerceNonEmpty(name, raw) {
         throw new Error(`${name} must be a non-empty string.`);
     return v;
 }
+function coerceMemberIds(raw) {
+    const ids = raw
+        .split(/[\s,]+/)
+        .map((x) => x.trim())
+        .filter(Boolean);
+    const bad = ids.filter((x) => !/^[UW][A-Z0-9]{6,}$/.test(x));
+    if (!ids.length || bad.length) {
+        throw new Error(`slack_allow must be Slack member ids like U012ABCDEF (Profile → ⋯ → Copy member ID); got '${raw}'.`);
+    }
+    return ids;
+}
 function ensureGuardrails(cfg) {
     if (!cfg.guardrails)
         cfg.guardrails = {};
@@ -145,6 +156,30 @@ export const CONFIG_KEYS = [
             c.context = coerceBool("context", v);
         },
     },
+    {
+        key: "slack_channel",
+        describe: "Default channel for `mnemom agent slack post` (e.g. #mnemom-allstars)",
+        get: (c) => c.slackChannel,
+        set: (c, v) => {
+            c.slackChannel = coerceNonEmpty("slack_channel", v);
+        },
+    },
+    {
+        key: "slack_listen",
+        describe: "Attach the Slack channel on every launch (as if --slack were passed)",
+        get: (c) => c.slackListen,
+        set: (c, v) => {
+            c.slackListen = coerceBool("slack_listen", v);
+        },
+    },
+    {
+        key: "slack_allow",
+        describe: "Slack member ids (comma-separated) whose messages may reach a session",
+        get: (c) => c.slackAllow?.join(","),
+        set: (c, v) => {
+            c.slackAllow = coerceMemberIds(v);
+        },
+    },
     {
         key: "context_handoff",
         describe: "EXPERIMENTAL: register the `handoff` MCP tool + tell the gateway CONTEXT_HANDOFF_ENABLED=true (off by default)",
@@ -221,6 +256,14 @@ export function parseLauncherConfig(text) {
         cfg.goalMode = coerceGoalMode(str(raw.goal_mode) ?? "");
     if (raw.context !== undefined)
         cfg.context = coerceBool("context", str(raw.context) ?? "");
+    if (raw.slack_listen !== undefined)
+        cfg.slackListen = coerceBool("slack_listen", str(raw.slack_listen) ?? "");
+    if (raw.slack_allow !== undefined) {
+        const v = raw.slack_allow;
+        cfg.slackAllow = coerceMemberIds(Array.isArray(v) ? v.map(String).join(",") : String(v));
+    }
+    if (raw.slack_channel !== undefined)
+        cfg.slackChannel = coerceNonEmpty("slack_channel", str(raw.slack_channel) ?? "");
     if (raw.context_handoff !== undefined)
         cfg.contextHandoff = coerceBool("context_handoff", str(raw.context_handoff) ?? "");
     const g = raw.guardrails;
@@ -283,6 +326,12 @@ export function serializeLauncherConfig(cfg) {
         doc.goal_mode = cfg.goalMode;
     if (cfg.context !== undefined)
         doc.context = cfg.context;
+    if (cfg.slackChannel !== undefined)
+        doc.slack_channel = cfg.slackChannel;
+    if (cfg.slackListen !== undefined)
+        doc.slack_listen = cfg.slackListen;
+    if (cfg.slackAllow !== undefined)
+        doc.slack_allow = cfg.slackAllow;
     if (cfg.contextHandoff !== undefined)
         doc.context_handoff = cfg.contextHandoff;
     const g = cfg.guardrails;

package/dist/lib/launcher-store.d.ts

@@ -0,0 +1,21 @@
+/**
+ * lib/launcher-store.ts — the launcher's SECRET store, ~/.mnemom/launcher.json (0600).
+ *
+ * The human-editable settings live in launcher.toml (lib/launcher-config.ts); the
+ * credentials `mnemom agent` needs live here instead, so the file customers open,
+ * edit and share never carries one. Keys today:
+ *
+ *   anthropic_key     the provider key (commands/agent.ts)
+ *   slack_bot_token   the Slack bot token behind `mnemom agent slack` (lib/slack.ts)
+ *
+ * Every write MERGES into the existing document — a save of one secret must never
+ * erase another.
+ */
+export declare const LAUNCHER_STORE_PATH: string;
+/** The store's JSON object, or {} when missing/corrupt. Never throws. */
+export declare function readStore(path?: string): Record<string, unknown>;
+/**
+ * Merge `patch` into the store atomically (temp+rename, 0600). A `null` value
+ * removes that key. Throws on an fs failure so the caller can report it.
+ */
+export declare function mergeStore(patch: Record<string, unknown>, path?: string): void;

package/dist/lib/launcher-store.js

@@ -0,0 +1,41 @@
+/**
+ * lib/launcher-store.ts — the launcher's SECRET store, ~/.mnemom/launcher.json (0600).
+ *
+ * The human-editable settings live in launcher.toml (lib/launcher-config.ts); the
+ * credentials `mnemom agent` needs live here instead, so the file customers open,
+ * edit and share never carries one. Keys today:
+ *
+ *   anthropic_key     the provider key (commands/agent.ts)
+ *   slack_bot_token   the Slack bot token behind `mnemom agent slack` (lib/slack.ts)
+ *
+ * Every write MERGES into the existing document — a save of one secret must never
+ * erase another.
+ */
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { MNEMOM_DIR } from "./config.js";
+export const LAUNCHER_STORE_PATH = join(MNEMOM_DIR, "launcher.json");
+/** The store's JSON object, or {} when missing/corrupt. Never throws. */
+export function readStore(path = LAUNCHER_STORE_PATH) {
+    try {
+        const data = JSON.parse(readFileSync(path, "utf8"));
+        return data && typeof data === "object" && !Array.isArray(data)
+            ? data
+            : {};
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Merge `patch` into the store atomically (temp+rename, 0600). A `null` value
+ * removes that key. Throws on an fs failure so the caller can report it.
+ */
+export function mergeStore(patch, path = LAUNCHER_STORE_PATH) {
+    const next = Object.fromEntries(Object.entries({ ...readStore(path), ...patch }).filter(([, v]) => v !== null));
+    const dir = dirname(path);
+    mkdirSync(dir, { recursive: true });
+    const tmp = join(dir, `.launcher-store-tmp-${process.pid}-${Date.now()}.json`);
+    writeFileSync(tmp, JSON.stringify(next, null, 2), { mode: 0o600 });
+    renameSync(tmp, path);
+}

package/dist/lib/oauth.d.ts

@@ -133,14 +133,33 @@ export declare function refreshTokens(refreshToken: string, clientId: string, op
     sleep?: (ms: number) => Promise<void>;
 }): Promise<OAuthTokens | null>;
 /**
- * Open `url` in the user's default browser WITHOUT a shell. The URL is always
- * passed as a separate argv element (never concatenated into a command string),
- * so shell metacharacters — `$(...)`, backticks, `\` — in the URL can never be
- * interpreted as a command. Fire-and-forget: any failure (no opener installed,
- * headless host) is swallowed because callers already print a manual-URL
- * fallback, so a missing browser must not crash login.
+ * Parse and allowlist a URL before it is handed to an OS opener. Returns the
+ * normalized `href` (WHATWG-serialized, so spaces, quotes and other
+ * metacharacters are percent-encoded) or `null` when the URL must not be
+ * launched. Only `https:` is accepted, plus `http:` on a loopback host. This
+ * rejects `file:`, `javascript:`, custom protocol handlers and anything that
+ * could be read by an opener as a flag (a string starting with `-` is never a
+ * parseable absolute https URL).
  */
-export declare function openBrowser(url: string): void;
+export declare function validateBrowserUrl(url: string): string | null;
+/**
+ * Resolve the platform opener as `[command, argv]`. No entry is a shell: the
+ * Windows path deliberately uses `rundll32 url.dll,FileProtocolHandler` rather
+ * than `cmd /c start`, because cmd.exe re-parses its command line and would
+ * interpret `&`, `|`, `^` etc. inside the URL (OAuth query strings always
+ * contain `&`) — both a truncation bug and a command-injection vector.
+ */
+export declare function browserOpenerFor(platform: NodeJS.Platform, href: string): [command: string, args: string[]];
+/**
+ * Open `url` in the user's default browser WITHOUT a shell. The URL is first
+ * validated (https, or http on loopback) and then passed as a separate argv
+ * element to a non-shell opener, so shell metacharacters in it can never be
+ * interpreted as a command. Fire-and-forget: any failure (invalid URL, no
+ * opener installed, headless host) is swallowed because callers already print
+ * the URL as a manual fallback, so a missing browser must not crash login.
+ * Returns whether a launch was attempted.
+ */
+export declare function openBrowser(url: string): boolean;
 /**
  * Await `promise` while emitting a heartbeat tick every `intervalMs`, so a long
  * silent wait (a browser sign-in round-trip) doesn't look hung. `onTick` is