@mnemom/mnemom 0.17.25 → 0.17.26

package/dist/lib/subscription-login.js

@@ -72,30 +72,42 @@ export function resolveAgentAuth(flag, env) {
     return fromEnv ? coerceAgentAuth(fromEnv) : "api-key";
 }
 /**
- * The Mnemom key a subscription launch sends: MNEMOM_AGENT_MNEMOM_KEY, else the stored
- * key, else mint one (gateway scope only) and store it. The key is never printed.
+ * The Mnemom key this machine already has — MNEMOM_AGENT_MNEMOM_KEY, else the stored key — or
+ * undefined. NEVER mints. An unpinned api-key launch sends it (`x-mnemom-api-key`) alongside its
+ * Anthropic key when there is one, so the gateway can serve the key owner's claimed agent of that
+ * name instead of a fresh one per rotated Anthropic key; with none it launches exactly as before.
  */
-export async function resolveSubscriptionMnemomKey(deps) {
+export function readMnemomKey(deps) {
     const fromEnv = headerSafe(deps.env[MNEMOM_KEY_ENV] ?? "");
     if (fromEnv)
         return fromEnv;
     const stored = headerSafe(deps.readStored() ?? "");
-    if (stored)
-        return stored;
+    return stored || undefined;
+}
+/**
+ * The Mnemom key a subscription launch (or a pinned launch, which the gateway honours only with
+ * a verified Mnemom key) sends: MNEMOM_AGENT_MNEMOM_KEY, else the stored key, else mint one
+ * (gateway scope only) and store it. The key is never printed. `purpose` names why in the
+ * one-line notes ("subscription login" by default).
+ */
+export async function resolveSubscriptionMnemomKey(deps, purpose = "subscription login") {
+    const existing = readMnemomKey(deps);
+    if (existing)
+        return existing;
     let minted;
     try {
         minted = headerSafe(await deps.mint());
     }
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
-        throw new Error(`mnemom agent: subscription login needs a Mnemom API key and minting one failed (${msg}).\n` +
+        throw new Error(`mnemom agent: ${purpose} needs a Mnemom API key and minting one failed (${msg}).\n` +
             `  Create one with \`mnemom api-key create --name mnemom-agent --scopes gateway\` and set ${MNEMOM_KEY_ENV}.`, { cause: err });
     }
     if (!minted)
         throw new Error("mnemom agent: the API returned an empty Mnemom key.");
     try {
         deps.store(minted);
-        deps.say("mnemom agent: minted a gateway-only Mnemom API key for subscription login (saved to ~/.mnemom/launcher.json, 0600).");
+        deps.say(`mnemom agent: minted a gateway-only Mnemom API key for ${purpose} (saved to ~/.mnemom/launcher.json, 0600).`);
     }
     catch {
         deps.say("mnemom agent: minted a gateway-only Mnemom API key for this launch but could not save it — the next launch mints another.");

package/dist/mcp/handoff-server.mjs

@@ -85,11 +85,31 @@ function resolveKeyFromEnvName(name, env) {
   return value.trim();
 }
 
+/** A full Mnemom agent id (mirrors AGENT_ID_RE in cli/src/lib/agent.ts). */
+const AGENT_ID_RE = /^mnm-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+
+/**
+ * The Mnemom key the launch's own requests carry, when it has one: the `x-mnemom-api-key:` line
+ * of the inherited `ANTHROPIC_CUSTOM_HEADERS` (terminal), else the dedicated
+ * `MNEMOM_HANDOFF_MNEMOM_KEY` the Remote Control launcher sets. "" when there is none. A pinned
+ * call needs it: the gateway honours `x-mnemom-agent-id` only with a verified Mnemom key.
+ * @param {string} keyEnvName
+ * @param {NodeJS.ProcessEnv} env
+ * @returns {string}
+ */
+function resolveMnemomKey(keyEnvName, env) {
+  if (keyEnvName === "ANTHROPIC_CUSTOM_HEADERS") {
+    const m = (env.ANTHROPIC_CUSTOM_HEADERS ?? "").match(/^x-mnemom-api-key:\s*(.+)$/im);
+    return m ? m[1].trim() : "";
+  }
+  return (env.MNEMOM_HANDOFF_MNEMOM_KEY ?? "").trim();
+}
+
 /**
  * Read the tool's config from env. Throws (message never contains the key value) when a
  * required var is missing, or when the named key-source var resolves to no usable key.
  * @param {NodeJS.ProcessEnv} env
- * @returns {{gatewayHost: string, anthropicKey: string, agent: string, conversationId: string, sessionConfigB64?: string}}
+ * @returns {{gatewayHost: string, anthropicKey: string, mnemomKey?: string, agent: string, agentId?: string, conversationId: string, sessionConfigB64?: string}}
  */
 export function configFromEnv(env) {
   const missing = REQUIRED_ENV.filter((k) => !(env[k] ?? "").trim());
@@ -104,10 +124,16 @@ export function configFromEnv(env) {
         "process's own inherited environment has no usable value for it.",
     );
   }
+  const agentId = (env.MNEMOM_HANDOFF_AGENT_ID ?? "").trim().toLowerCase();
+  if (agentId && !AGENT_ID_RE.test(agentId)) {
+    throw new Error("mnemom-handoff: MNEMOM_HANDOFF_AGENT_ID is not a full mnm-<uuid> agent id.");
+  }
   return {
     gatewayHost: env.MNEMOM_HANDOFF_GATEWAY_HOST.trim(),
     anthropicKey,
+    mnemomKey: resolveMnemomKey(keyEnvName, env) || undefined,
     agent: env.MNEMOM_HANDOFF_AGENT.trim(),
+    agentId: agentId || undefined,
     conversationId: env.MNEMOM_HANDOFF_CONVERSATION_ID.trim(),
     sessionConfigB64: env.MNEMOM_HANDOFF_SESSION_CONFIG?.trim() || undefined,
   };
@@ -115,7 +141,7 @@ export function configFromEnv(env) {
 
 /**
  * Build the fetch call. Exported so a test can assert the wire shape without mocking fetch.
- * @param {{gatewayHost: string, anthropicKey: string, agent: string, conversationId: string, sessionConfigB64?: string}} cfg
+ * @param {{gatewayHost: string, anthropicKey: string, mnemomKey?: string, agent: string, agentId?: string, conversationId: string, sessionConfigB64?: string}} cfg
  * @param {string} note
  */
 export function buildHandoffRequest(cfg, note) {
@@ -124,6 +150,8 @@ export function buildHandoffRequest(cfg, note) {
     "x-api-key": cfg.anthropicKey,
     "x-mnemom-agent": cfg.agent,
   };
+  if (cfg.mnemomKey) headers["x-mnemom-api-key"] = cfg.mnemomKey;
+  if (cfg.agentId) headers["x-mnemom-agent-id"] = cfg.agentId;
   if (cfg.sessionConfigB64) headers["x-mnemom-session-config"] = cfg.sessionConfigB64;
   return {
     url: `${cfg.gatewayHost.replace(/\/+$/, "")}${HANDOFF_PATH}`,
@@ -150,7 +178,7 @@ function extractGatewayError(body) {
  * Call the route and render the result. NEVER throws: a network failure, a non-2xx status, or
  * an unparseable body all come back as `{ok:false, message}` for the caller to surface as an
  * MCP tool error — the tool must never crash the server or the session over a bad response.
- * @param {{gatewayHost: string, anthropicKey: string, agent: string, conversationId: string, sessionConfigB64?: string}} cfg
+ * @param {{gatewayHost: string, anthropicKey: string, mnemomKey?: string, agent: string, agentId?: string, conversationId: string, sessionConfigB64?: string}} cfg
  * @param {string} note
  * @param {typeof fetch} fetchImpl
  */

package/dist/rc-proxy.mjs

@@ -62,6 +62,9 @@
 // CONFIG (env, none secret)
 //   MNEMOM_AGENT_RC_DOOR              gateway door URL (required), e.g. https://gateway.mnemom.ai/anthropic
 //   MNEMOM_AGENT_RC_AGENT             x-mnemom-agent value (required)
+//   MNEMOM_AGENT_RC_AGENT_ID          x-mnemom-agent-id value (optional; a full mnm-<uuid> pin — the
+//                                  gateway then serves exactly that agent or refuses; needs the
+//                                  Mnemom key on stdin line 2)
 //   MNEMOM_AGENT_RC_CONVERSATION_ID   x-mnemom-conversation-id value (required)
 //   MNEMOM_AGENT_RC_CONTRACT_B64      base64 contract for x-mnemom-contract (optional)
 //   MNEMOM_AGENT_RC_GOAL_MODE         x-mnemom-goal-mode value (optional; `--implicit` — no contract,
@@ -111,6 +114,12 @@ try {
 }
 if (GATEWAY.protocol !== "https:") die("MNEMOM_AGENT_RC_DOOR must be https");
 const AGENT = env.MNEMOM_AGENT_RC_AGENT || die("MNEMOM_AGENT_RC_AGENT is required");
+const AGENT_ID = (env.MNEMOM_AGENT_RC_AGENT_ID || "").trim().toLowerCase();
+if (
+  AGENT_ID &&
+  !/^mnm-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(AGENT_ID)
+)
+  die("MNEMOM_AGENT_RC_AGENT_ID must be a full mnm-<uuid> agent id");
 const CONV =
   env.MNEMOM_AGENT_RC_CONVERSATION_ID || die("MNEMOM_AGENT_RC_CONVERSATION_ID is required");
 const CONTRACT_B64 = env.MNEMOM_AGENT_RC_CONTRACT_B64 || "";
@@ -168,6 +177,8 @@ try {
 } catch {
   die("expected three lines of secrets on stdin (anthropic, mnemom, openai)");
 }
+if (AGENT_ID && !secrets.mnemom)
+  die("a pinned agent (MNEMOM_AGENT_RC_AGENT_ID) needs the Mnemom key (stdin line 2)");
 if (SUBSCRIPTION) {
   if (!secrets.mnemom) die("subscription login needs the Mnemom key (stdin line 2)");
 } else if (!secrets.anthropic) die("the Anthropic key (stdin line 1) is empty");
@@ -519,6 +530,9 @@ function handle(req, res, viaPlain) {
       headers["x-api-key"] = secrets.anthropic;
     }
     headers["x-mnemom-agent"] = AGENT;
+    // The pin is this proxy's to state: a client-supplied one is dropped, like x-mnemom-turn.
+    delete headers["x-mnemom-agent-id"];
+    if (AGENT_ID) headers["x-mnemom-agent-id"] = AGENT_ID;
     headers["x-mnemom-conversation-id"] = CONV;
     if (secrets.mnemom) headers["x-mnemom-api-key"] = secrets.mnemom;
     if (PROVIDER) headers["x-mnemom-provider"] = PROVIDER;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemom/mnemom",
-  "version": "0.17.25",
+  "version": "0.17.26",
   "description": "Transparent AI agent tracing",
   "type": "module",
   "bin": {