@mnemom/mnemom 0.17.20 → 0.17.21

package/dist/commands/agent-sessions.d.ts

@@ -110,11 +110,13 @@ export declare function formatTrailEntry(e: AgentSessionVerdictTrailEntry): stri
  */
 export declare function verdictTrailKey(e: Pick<AgentSessionVerdictTrailEntry, "request_id" | "turn">): string;
 /**
- * Best-effort "has this session ended" check for `--follow`'s exit condition. No field is locked
- * in on the wire yet: MNE-8149 adds an `expired` seal state on the gateway's row, and a later
- * mnemom-api card is expected to carry it through to this response — so this reads defensively,
- * off either the top-level response or the `sealed` block, and returns null (never throws) when
- * neither carries a recognized value, which is every server today.
+ * Best-effort "has this session ended" check for `--follow`'s exit condition. MNE-8234 wired the
+ * seal lifecycle through on the wire (`remote.seal.state`), so that is read first and is
+ * authoritative: `"expired"` there means the prior seal lapsed and ends the watch. The older
+ * top-level `state` and `remote.sealed.state` fallbacks predate that field actually landing on
+ * the response — neither has ever been observed non-null on any real server — and are kept
+ * defensively in case an even older/non-conformant server ever carries one of them; this never
+ * throws, returning null when nothing recognized is present.
  */
 export declare function sessionEndedState(remote: AgentSessionResponse): "expired" | "ended" | null;
 /** Default and floor for `--follow`'s poll interval. */
@@ -152,6 +154,14 @@ export interface ShowJson {
         guardrails: AgentSessionResponse["guardrails"];
         /** R10 (MNE-8200): oldest first (the gateway's own wire order), unlike the human view. */
         verdict_trail: AgentSessionResponse["verdict_trail"];
+        /**
+         * MNE-8234: the seal's lifecycle (state incl. `expired`, version, mode, hashes). Absent on
+         * an older server; `null` when the API reports no seal.
+         */
+        seal: AgentSessionResponse["seal"];
+        /** MNE-8234 (MNE-8166 R4): judging counts under the current seal. */
+        unjudged_turns: AgentSessionResponse["unjudged_turns"];
+        memoised_turns: AgentSessionResponse["memoised_turns"];
     } | {
         source: "gateway";
         available: false;

package/dist/commands/agent-sessions.js

@@ -190,14 +190,21 @@ export function verdictTrailKey(e) {
     return `${e.request_id ?? ""}#${e.turn}`;
 }
 /**
- * Best-effort "has this session ended" check for `--follow`'s exit condition. No field is locked
- * in on the wire yet: MNE-8149 adds an `expired` seal state on the gateway's row, and a later
- * mnemom-api card is expected to carry it through to this response — so this reads defensively,
- * off either the top-level response or the `sealed` block, and returns null (never throws) when
- * neither carries a recognized value, which is every server today.
+ * Best-effort "has this session ended" check for `--follow`'s exit condition. MNE-8234 wired the
+ * seal lifecycle through on the wire (`remote.seal.state`), so that is read first and is
+ * authoritative: `"expired"` there means the prior seal lapsed and ends the watch. The older
+ * top-level `state` and `remote.sealed.state` fallbacks predate that field actually landing on
+ * the response — neither has ever been observed non-null on any real server — and are kept
+ * defensively in case an even older/non-conformant server ever carries one of them; this never
+ * throws, returning null when nothing recognized is present.
  */
 export function sessionEndedState(remote) {
     const as = (v) => v === "expired" || v === "ended" ? v : null;
+    if (remote.seal) {
+        const sealState = as(remote.seal.state);
+        if (sealState)
+            return sealState;
+    }
     const top = as(remote.state);
     if (top)
         return top;
@@ -349,6 +356,12 @@ export function buildShowView(local, remote, reason) {
     else {
         L.push(fmt.dim("  no sealed contract on the gateway for this conversation"));
     }
+    // MNE-8234: the seal's lifecycle — independent of `sealed` above (which carries the contract
+    // body, not whether the seal itself is still live or has lapsed). Absent on an older server.
+    if (remote.seal) {
+        const modeBit = remote.seal.state === "live" ? ` · mode ${remote.seal.mode}` : "";
+        L.push(fmt.label("seal:           ", `${remote.seal.state.toUpperCase()} (v${remote.seal.version})${modeBit}`));
+    }
     if (remote.verdict) {
         const v = remote.verdict;
         L.push(fmt.label("verdict:        ", `${v.verdict.toUpperCase()} at turn ${v.turn} — ${v.reason}`));
@@ -385,6 +398,14 @@ export function buildShowView(local, remote, reason) {
     if (remote.turn !== null) {
         L.push(fmt.label("turn:           ", String(remote.turn)));
     }
+    // MNE-8234 (MNE-8166 R4): judging counts under the current seal. `null`/absent ⇒ no judge
+    // ledger counts (older server, or nothing judged under this seal yet) — no line then.
+    if (remote.unjudged_turns !== null && remote.unjudged_turns !== undefined) {
+        const memoisedBit = remote.memoised_turns !== null && remote.memoised_turns !== undefined
+            ? ` · memoised ${remote.memoised_turns}`
+            : "";
+        L.push(fmt.label("judging:        ", `unjudged ${remote.unjudged_turns}${memoisedBit}`));
+    }
     return L;
 }
 export function buildShowJson(local, remote, reason) {
@@ -400,6 +421,9 @@ export function buildShowJson(local, remote, reason) {
                 turn: remote.turn,
                 guardrails: remote.guardrails,
                 verdict_trail: remote.verdict_trail,
+                seal: remote.seal,
+                unjudged_turns: remote.unjudged_turns,
+                memoised_turns: remote.memoised_turns,
             }
             : { source: "gateway", available: false, reason: reason ?? "unknown" },
     };

package/dist/commands/agent.d.ts

@@ -127,7 +127,7 @@ export interface AgentOptions {
     /**
      * Load the "Mnemom for Claude Code" plugin (`plugins/mnemom`: the Mnemom band,
      * `/mnemom`, the gateway guard, Mnemom attribution) into the launched Claude Code.
-     * Default OFF (not published yet); `--plugin` ⇒ true; `--no-plugin` ⇒ false; undefined ⇒
+     * Default OFF (the plugin lands dark); `--plugin` ⇒ true; `--no-plugin` ⇒ false; undefined ⇒
      * MNEMOM_AGENT_PLUGIN decides (lib/claude-plugin).
      */
     plugin?: boolean;

package/dist/commands/agent.js

@@ -26,7 +26,7 @@
  * an argv value.
  */
 import { spawn, spawnSync } from "node:child_process";
-import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync, renameSync, } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync, renameSync, } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { tmpdir, homedir, hostname } from "node:os";
 import { basename, join, dirname } from "node:path";
@@ -539,7 +539,7 @@ export async function agentCommand(scenarioArg, options = {}) {
         plugin: launchPlugin.line,
     });
     if (pluginWanted && cli.name === "claude" && !bundledPluginDir) {
-        say(fmt.warn("mnemom agent: the Mnemom plugin folder is not in this install (it is not published yet; run from a source checkout) — launching without the Mnemom band and /mnemom."));
+        say(fmt.warn("mnemom agent: the Mnemom plugin folder is not in this install — launching without the Mnemom band and /mnemom."));
     }
     // Non-secret launch facts for the plugin's band and `/mnemom status`. Built here, applied to the
     // child env by each launch shape AFTER it has built that env (lib/claude-plugin, PLUGIN_ENV).
@@ -1303,7 +1303,8 @@ function launchRemoteControl(ctx) {
         }
     }
     const proxyScript = resolveProxyScript();
-    const rcDir = mkdtempSync(join(tmpdir(), "mnemom-code-rc."));
+    const rcDir = mkdtempSync(join(rcStateRoot(), "mnemom-code-rc."));
+    writeFileSync(join(rcDir, "owner.pid"), `${process.pid}\n`, { mode: 0o600 }); // rc-state.mjs sweep
     const proxyLog = process.env.MNEMOM_AGENT_RC_PROXY_LOG || join(rcDir, "proxy.log");
     const proxy = spawn("node", [proxyScript], {
         env: {
@@ -1519,6 +1520,23 @@ function warnServerDrops(options, yolo) {
         say("mnemom agent: yolo (--dangerously-skip-permissions) is not applied under --server; set permissions from the driven sessions.");
     }
 }
+/**
+ * ~/.mnemom/rc, created 0700 — the same root src/rc-state.mjs gives the proxy's CA dir (tsc emits
+ * no .mjs, so this mirrors its rcStateRoot() rather than importing it). Never the OS temp dir,
+ * whose cleaners delete files behind a long session; that is only the fallback when home is not
+ * writable. Read at call time, not from MNEMOM_DIR: HOME can move after import (tests do).
+ */
+function rcStateRoot() {
+    const root = join(homedir(), ".mnemom", "rc");
+    try {
+        mkdirSync(root, { recursive: true, mode: 0o700 });
+        chmodSync(root, 0o700);
+        return root;
+    }
+    catch {
+        return tmpdir();
+    }
+}
 function resolveProxyScript() {
     const here = dirname(fileURLToPath(import.meta.url));
     const cand = join(here, "..", "rc-proxy.mjs");

package/dist/commands/validate.d.ts

@@ -3,7 +3,7 @@
  * integration). Surface for engineers to check whether staging is safe
  * to promote to production based on the most recent harness run state.
  *
- *   mnemom validate safe-house [--against=staging] [--max-age=24h]
+ *   mnemom validate safe-house [--against=test] [--max-age=24h]
  *                              [--lane=full|fast] [--strict] [--json]
  *
  * Wraps `GET /v1/admin/safe-house/harness-state` (mnemom-staff only).

package/dist/commands/validate.js

@@ -3,7 +3,7 @@
  * integration). Surface for engineers to check whether staging is safe
  * to promote to production based on the most recent harness run state.
  *
- *   mnemom validate safe-house [--against=staging] [--max-age=24h]
+ *   mnemom validate safe-house [--against=test] [--max-age=24h]
  *                              [--lane=full|fast] [--strict] [--json]
  *
  * Wraps `GET /v1/admin/safe-house/harness-state` (mnemom-staff only).
@@ -76,10 +76,12 @@ export async function validateSafeHouseCommand(opts) {
     await requireAuth();
     // `--against` is informational only today (validation is always against
     // the api root the user is authenticated to). Keep the flag for forward-
-    // compat: production gains a separate harness corpus per T1.
-    const against = opts.against ?? "staging";
-    if (against !== "staging" && against !== "production") {
-        console.log(fmt.error(`--against must be 'staging' or 'production' (got '${against}')`) + "\n");
+    // compat: production gains a separate harness corpus per T1. The non-prod
+    // value is `test` (the Azure test cell): `staging` named the retired ring
+    // (MNE-7968) and is rejected so a stale script fails loud, not quietly.
+    const against = opts.against ?? "test";
+    if (against !== "test" && against !== "production") {
+        console.log(fmt.error(`--against must be 'test' or 'production' (got '${against}')`) + "\n");
         process.exit(1);
         return;
     }

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import "./lib/retired-env-guard.js";
 import { program } from "commander";
 export { program };
 /**

package/dist/index.js

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+// MUST stay the first import: it exits cleanly on MNEMOM_ENV=staging before any
+// module below resolves the (retired) staging URLs at import time (MNE-7968).
+import "./lib/retired-env-guard.js";
 import { program, InvalidArgumentError, Option } from "commander";
 import { isEntrypoint } from "./lib/entrypoint.js";
 import { CLI_VERSION } from "./version.js";
@@ -141,7 +144,7 @@ function printAgentHelp(verb) {
 const agentCmd = program
     .command("agent [session] [passthrough...]")
     .description("Launch your governed agent (Claude Code in v1) through the Mnemom gateway — governed identity + optional sealed goal contract. Plain `mnemom agent` asks for a session name. " +
-    "Sub-verbs: `setup` provisions your governed agent; `doctor` preflights prerequisites; `config …` manages persistent settings (~/.mnemom/launcher.toml); `invite <token>` redeems a Mnemom Agent invitation; `list` / `claim` / `move` manage the agents in your orgs; `sessions` lists your past launches and `show [ref]` merges one with its live goal state; `help [verb]` prints help and never launches.")
+    "Sub-verbs: `setup` provisions your governed agent; `doctor` preflights prerequisites; `config …` manages persistent settings (~/.mnemom/launcher.toml); `--invite <token>` redeems a Mnemom Agent invitation (the one-liner your invitation email shows; `invite <token>` is its alias); `list` / `claim` / `move` manage the agents in your orgs; `sessions` lists your past launches and `show [ref]` merges one with its live goal state; `help [verb]` prints help and never launches.")
     .option("--goal <statement>", "Contract goal statement (required if any contract flag is given)")
     .option("--requirement <text>", "Contract requirement (repeatable)", collectRepeatable, [])
     .option("--allow <glob>", "Allowed path/glob (repeatable)", collectRepeatable, [])
@@ -1656,7 +1659,7 @@ const validateCmd = program
 validateCmd
     .command("safe-house")
     .description("Render Safe House harness state per lane (full/fast) — promotion-readiness signal")
-    .option("--against <env>", "Target environment ('staging' or 'production'; informational)", "staging")
+    .option("--against <env>", "Target environment ('test' or 'production'; informational)", "test")
     .option("--max-age <duration>", "Reject runs older than this (e.g. 30m, 2h, 24h, 1d)", "24h")
     .option("--lane <lane>", "Show only one lane ('full', 'fast', or 'both')", "both")
     .option("--strict", "Exit non-zero if any selected lane is stale or red")

package/dist/lib/api.d.ts

@@ -1305,6 +1305,29 @@ export interface AgentSessionVerdictTrailEntry {
     fence_breach: boolean | null;
     at: string;
 }
+/**
+ * The seal's lifecycle (MNE-8149 R2, MNE-8199 D9/R9, MNE-8234/mnemom-api#3541). `live`: a sealed
+ * contract currently governs — `mode` says whether a crossed guardrail only nudges or enforces
+ * (refuses the next request). `expired`: the prior seal lapsed (24h idle) and the next engaged
+ * request will seal afresh; no `mode` because nothing is being enforced.
+ */
+export interface AgentSessionSealLive {
+    state: "live";
+    version: number;
+    hash: string;
+    sealed_at: string;
+    reason: "first" | "after_expiry" | null;
+    expired_hash: string | null;
+    updated_from_hash: string | null;
+    mode: "nudge" | "enforce";
+}
+export interface AgentSessionSealExpired {
+    state: "expired";
+    version: number;
+    hash: string;
+    sealed_at: string;
+}
+export type AgentSessionSeal = AgentSessionSealLive | AgentSessionSealExpired;
 /** `GET /v1/agent/sessions/{conversationId}` 200 body. Nulls mean "nothing stored" — absence is data. */
 export interface AgentSessionResponse {
     conversation_id: string;
@@ -1319,6 +1342,24 @@ export interface AgentSessionResponse {
     guardrails: AgentSessionGuardrails | null;
     /** Absent on an older server (back-compat) — never shown then, never an empty-array assumption. */
     verdict_trail?: AgentSessionVerdictTrailEntry[];
+    /**
+     * MNE-8234: the seal's lifecycle, incl. `expired`. Absent on an older server (back-compat —
+     * never shown then). `null` means the API itself reports no seal: either none was ever made for
+     * this conversation, or the gateway sent a seal payload out of contract and the API dropped it
+     * rather than relay it half-trusted — the two are indistinguishable from this field alone.
+     */
+    seal?: AgentSessionSeal | null;
+    /**
+     * MNE-8166 R4 / MNE-8234: assistant turns under the current seal with no verdict (a cut-off/
+     * aborted response, a judge that failed or never ran, a non-streamed final turn). Absent on an
+     * older server (back-compat). `null` when no judge ledger counts under the current seal.
+     */
+    unjudged_turns?: number | null;
+    /**
+     * MNE-8166 R4 / MNE-8234: turns the judge memo graded (aligned by inheritance, no verdict
+     * stored). Absent on an older server (back-compat). `null` alongside `unjudged_turns`.
+     */
+    memoised_turns?: number | null;
 }
 /**
  * The live goal state of one `mnemom agent` session, read through mnemom-api

package/dist/lib/claude-plugin.d.ts

@@ -14,13 +14,12 @@
  * Only Claude Code proper (`cli.name === "claude"`) understands `--plugin-dir`; every other
  * adapter launches without the plugin.
  *
- * OFF BY DEFAULT, AND NOT IN THE PUBLISHED PACKAGE YET. The plugin is committed under
- * `cli/plugins/` but `package.json` `files` leaves it out of the npm tarball, so an installed
- * `mnemom` has no folder to load and never looks for one. `--plugin` or
- * MNEMOM_AGENT_PLUGIN=1|true|yes|on opts a launch in (`--no-plugin` or 0|false|off|no wins over
- * the env); from a source checkout that loads the folder, from an install it says the folder is
- * not there and launches without it. Turning it on for everyone later is two edits: `plugins`
- * back into `files`, and `pluginEnabled`'s default to true. It never blocks the launch.
+ * OFF BY DEFAULT. The folder ships in the npm tarball (`package.json` `files`, minus its tests
+ * and checkout-only files) but no launch loads it unless asked: `--plugin` or
+ * MNEMOM_AGENT_PLUGIN=1|true|yes|on opts in (`--no-plugin` or 0|false|off|no wins over the env),
+ * and the flags stay out of `--help`. An install missing the folder says so and launches without
+ * it. Turning it on for everyone is one edit: `pluginEnabled`'s default to true. It never blocks
+ * the launch.
  */
 /** The plugin's `name` in its plugin.json, and its folder under `cli/plugins/`. */
 export declare const CLAUDE_PLUGIN_NAME = "mnemom";
@@ -68,7 +67,7 @@ export declare const PLUGIN_ENV: {
 export type PluginEnvName = (typeof PLUGIN_ENV)[keyof typeof PLUGIN_ENV];
 /**
  * Whether this launch loads the plugin: `--plugin` / `--no-plugin` (an explicit boolean) wins,
- * then MNEMOM_AGENT_PLUGIN (1/true/yes/on ⇒ on), else OFF: the plugin is not published yet.
+ * then MNEMOM_AGENT_PLUGIN (1/true/yes/on ⇒ on), else OFF: the plugin lands dark.
  */
 export declare function pluginEnabled(optionPlugin: boolean | undefined, env: NodeJS.ProcessEnv): boolean;
 /**

package/dist/lib/claude-plugin.js

@@ -14,13 +14,12 @@
  * Only Claude Code proper (`cli.name === "claude"`) understands `--plugin-dir`; every other
  * adapter launches without the plugin.
  *
- * OFF BY DEFAULT, AND NOT IN THE PUBLISHED PACKAGE YET. The plugin is committed under
- * `cli/plugins/` but `package.json` `files` leaves it out of the npm tarball, so an installed
- * `mnemom` has no folder to load and never looks for one. `--plugin` or
- * MNEMOM_AGENT_PLUGIN=1|true|yes|on opts a launch in (`--no-plugin` or 0|false|off|no wins over
- * the env); from a source checkout that loads the folder, from an install it says the folder is
- * not there and launches without it. Turning it on for everyone later is two edits: `plugins`
- * back into `files`, and `pluginEnabled`'s default to true. It never blocks the launch.
+ * OFF BY DEFAULT. The folder ships in the npm tarball (`package.json` `files`, minus its tests
+ * and checkout-only files) but no launch loads it unless asked: `--plugin` or
+ * MNEMOM_AGENT_PLUGIN=1|true|yes|on opts in (`--no-plugin` or 0|false|off|no wins over the env),
+ * and the flags stay out of `--help`. An install missing the folder says so and launches without
+ * it. Turning it on for everyone is one edit: `pluginEnabled`'s default to true. It never blocks
+ * the launch.
  */
 import { existsSync } from "node:fs";
 import { dirname, join, delimiter } from "node:path";
@@ -71,7 +70,7 @@ export const PLUGIN_ENV = {
 const TRUTHY = new Set(["1", "true", "yes", "on"]);
 /**
  * Whether this launch loads the plugin: `--plugin` / `--no-plugin` (an explicit boolean) wins,
- * then MNEMOM_AGENT_PLUGIN (1/true/yes/on ⇒ on), else OFF: the plugin is not published yet.
+ * then MNEMOM_AGENT_PLUGIN (1/true/yes/on ⇒ on), else OFF: the plugin lands dark.
  */
 export function pluginEnabled(optionPlugin, env) {
     if (optionPlugin !== undefined)
@@ -144,6 +143,6 @@ export function pluginPlanLine(pluginDir, enabled) {
     if (!enabled)
         return "off";
     if (!pluginDir)
-        return "off (the plugin folder is not in this install — run from a source checkout)";
+        return "off (the plugin folder is not in this install)";
     return `${CLAUDE_PLUGIN_NAME} (${pluginDir})`;
 }

package/dist/lib/config.d.ts

@@ -7,10 +7,21 @@
  */
 /** Base directory for mnemom CLI state (auth tokens, caches). */
 export declare const MNEMOM_DIR: string;
-export type Environment = "production" | "staging" | "local";
+export type Environment = "production" | "local";
+/**
+ * Thrown for `MNEMOM_ENV=staging`: the value used to be accepted, and the ring
+ * it named is gone (MNE-7968). Failing loud is deliberate — the two silent
+ * alternatives are both wrong: resolving to the dead staging hostnames makes
+ * every call fail with a DNS/connection error that does not say why, and
+ * falling through to production would send a caller who asked for a non-prod
+ * ring at real customer data.
+ */
+export declare class RetiredEnvironmentError extends Error {
+    constructor();
+}
 /**
  * Resolve the active environment from MNEMOM_ENV.
- * Defaults to production.
+ * Defaults to production. `staging` throws (see RetiredEnvironmentError).
  */
 export declare function getEnvironment(): Environment;
 export type CellRing = "us-1";

package/dist/lib/config.js

@@ -11,27 +11,43 @@ import * as os from "node:os";
 export const MNEMOM_DIR = path.join(os.homedir(), ".mnemom");
 const API_URLS = {
     production: "https://api.mnemom.ai",
-    staging: "https://api-staging.mnemom.ai",
     local: "http://localhost:8787",
 };
 const GATEWAY_URLS = {
     production: "https://gateway.mnemom.ai",
-    staging: "https://gateway-staging.mnemom.ai",
     local: "http://localhost:8787",
 };
 const WEBSITE_URLS = {
     production: "https://www.mnemom.ai",
-    staging: "https://staging.mnemom.ai",
     local: "http://localhost:5173",
 };
+/**
+ * Thrown for `MNEMOM_ENV=staging`: the value used to be accepted, and the ring
+ * it named is gone (MNE-7968). Failing loud is deliberate — the two silent
+ * alternatives are both wrong: resolving to the dead staging hostnames makes
+ * every call fail with a DNS/connection error that does not say why, and
+ * falling through to production would send a caller who asked for a non-prod
+ * ring at real customer data.
+ */
+export class RetiredEnvironmentError extends Error {
+    constructor() {
+        super("MNEMOM_ENV=staging is no longer supported: the staging ring was retired (MNE-7968) " +
+            "and nothing serves api-staging / gateway-staging.mnemom.ai. " +
+            "Use MNEMOM_RING=us-1 for the preview cell, MNEMOM_ENV=local for a local stack, " +
+            "or set MNEMOM_API_URL / MNEMOM_GATEWAY_URL / MNEMOM_WEBSITE_URL to target another cell.");
+        this.name = "RetiredEnvironmentError";
+    }
+}
 /**
  * Resolve the active environment from MNEMOM_ENV.
- * Defaults to production.
+ * Defaults to production. `staging` throws (see RetiredEnvironmentError).
  */
 export function getEnvironment() {
     const env = process.env.MNEMOM_ENV;
-    if (env === "staging" || env === "local")
+    if (env === "local")
         return env;
+    if (env === "staging")
+        throw new RetiredEnvironmentError();
     return "production";
 }
 const RING_URLS = {
@@ -61,7 +77,7 @@ export function getRing() {
     const env = process.env.MNEMOM_RING?.trim();
     return env && isCellRing(env) ? env : undefined;
 }
-// Process-level base overrides. MNEMOM_ENV only selects prod/staging/local;
+// Process-level base overrides. MNEMOM_ENV only selects prod/local;
 // to target an arbitrary ring (preview/us-1, test) a command can set an
 // explicit override (e.g. `try-me --api <ring>`) or the operator can export
 // MNEMOM_API_URL / MNEMOM_GATEWAY_URL / MNEMOM_WEBSITE_URL. Crucially these

package/dist/lib/first-run/governed.js

@@ -123,11 +123,14 @@ export class Governance {
             if (!r.cc_session_id && t !== null)
                 this.windows.push(["registry_window", t]);
         }
-        // Remote Control proxy logs: $TMPDIR/mnemom-code-rc.*/proxy.log, ~/.mnemom/*rc-proxy*.log
+        // Remote Control proxy logs: ~/.mnemom/rc/mnemom-code-rc.*/proxy.log (the launcher's dir),
+        // $TMPDIR/mnemom-code-rc.*/proxy.log (where older CLIs put it), ~/.mnemom/*rc-proxy*.log
         const logs = [];
-        for (const d of safeList(tmp)) {
-            if (d.startsWith("mnemom-code-rc."))
-                logs.push(join(tmp, d, "proxy.log"));
+        for (const base of [join(mnemomDir, "rc"), tmp]) {
+            for (const d of safeList(base)) {
+                if (d.startsWith("mnemom-code-rc."))
+                    logs.push(join(base, d, "proxy.log"));
+            }
         }
         for (const f of safeList(mnemomDir)) {
             if (f.includes("rc-proxy") && f.endsWith(".log"))

package/dist/lib/retired-env-guard.d.ts

@@ -0,0 +1,7 @@
+export declare const RETIRED_ENV_EXIT_CODE = 2;
+/**
+ * The startup error line when any CLI base URL would resolve via the retired
+ * `MNEMOM_ENV=staging`, else undefined. Exported for the unit test; the module
+ * body below is what the CLI relies on.
+ */
+export declare function retiredEnvMessage(): string | undefined;

package/dist/lib/retired-env-guard.js

@@ -0,0 +1,46 @@
+/**
+ * Startup guard for `MNEMOM_ENV=staging` (MNE-7968).
+ *
+ * `getEnvironment()` throws `RetiredEnvironmentError` for that value, and three
+ * modules resolve the API base at MODULE-EVAL time (`lib/api.ts`,
+ * `lib/webhooks-api.ts`, `commands/listen.ts` — see the note at the top of
+ * `__tests__/cli-api-integration.test.ts`). Those modules are statically
+ * imported by `index.ts`, so without this guard the throw surfaces during ESM
+ * linking — before `runEntrypoint()`, before commander, before any try/catch —
+ * and every invocation, `mnemom --help` included, dies with a raw Node stack
+ * trace. This module is the FIRST import of `index.ts`, so it evaluates before
+ * any of them: it prints the same message on one line and exits 2 (the CLI's
+ * usage-error code).
+ *
+ * The guard decides by running config.ts's own resolvers rather than reading
+ * MNEMOM_ENV, so it follows their precedence exactly (raw MNEMOM_*_URL > ring >
+ * MNEMOM_ENV): when a valid MNEMOM_RING, or all three MNEMOM_*_URL overrides,
+ * answer every base URL, MNEMOM_ENV is never consulted and a stale
+ * `MNEMOM_ENV=staging` beside them is harmless. Importing this module has no
+ * effect unless some base URL would resolve via the retired environment.
+ */
+import { getApiUrl, getGatewayUrl, getWebsiteUrl, RetiredEnvironmentError } from "./config.js";
+export const RETIRED_ENV_EXIT_CODE = 2;
+/**
+ * The startup error line when any CLI base URL would resolve via the retired
+ * `MNEMOM_ENV=staging`, else undefined. Exported for the unit test; the module
+ * body below is what the CLI relies on.
+ */
+export function retiredEnvMessage() {
+    try {
+        getApiUrl();
+        getGatewayUrl();
+        getWebsiteUrl();
+        return undefined;
+    }
+    catch (err) {
+        if (err instanceof RetiredEnvironmentError)
+            return `error: ${err.message}`;
+        throw err;
+    }
+}
+const message = retiredEnvMessage();
+if (message !== undefined) {
+    console.error(message);
+    process.exit(RETIRED_ENV_EXIT_CODE);
+}