@mnemom/mnemom 0.17.30 → 0.17.31-next.1

package/dist/commands/team.js

@@ -105,6 +105,31 @@ export async function teamShowCommand(teamId, opts) {
     }
     console.log();
 }
+/**
+ * What a template write did to the members' SERVED cards (mnemom-platform#2779).
+ *
+ * Before #2779 this printed "Agents recompose: N" for a count of rows merely
+ * FLAGGED for the 15-minute recompose sweep, while `card show` kept serving
+ * the stale composed card. The API now recomposes active members in-request
+ * and reports `agents_recomposed` / `agents_recompose_pending`; an older API
+ * that only flags is reported as queued, never as recomposed.
+ */
+function printRecomposeLines(result) {
+    if (typeof result.agents_recomposed === "number") {
+        const pending = result.agents_recompose_pending ?? 0;
+        console.log(`  Agents recomposed: ${result.agents_recomposed} ` +
+            `(active members of this team; their served card is updated now)`);
+        if (pending > 0) {
+            console.log(`  Agents pending:    ${pending} ` +
+                `(queued for the recompose sweep, ~15 min; confirm with \`mnemom card show --agent <id>\`)`);
+        }
+        return;
+    }
+    if (typeof result.agents_flagged_for_recompose === "number") {
+        console.log(`  Agents queued:     ${result.agents_flagged_for_recompose} ` +
+            `(active members of this team only; served cards update on the next recompose sweep, ~15 min)`);
+    }
+}
 export async function teamTemplateCommand(kind, teamId, opts) {
     await requireAuth();
     if (!teamId) {
@@ -149,10 +174,7 @@ export async function teamTemplateCommand(kind, teamId, opts) {
         console.log(`  Team ID:           ${result.team_id}`);
         console.log(`  Org ID:            ${result.org_id}`);
         console.log(`  Enabled:           ${result.enabled ? "yes" : "no"}`);
-        if (typeof result.agents_flagged_for_recompose === "number") {
-            console.log(`  Agents recompose:  ${result.agents_flagged_for_recompose} ` +
-                `(active members of this team only — not blanket fan-out)`);
-        }
+        printRecomposeLines(result);
         console.log();
         return;
     }
@@ -177,9 +199,7 @@ export async function teamTemplateCommand(kind, teamId, opts) {
         console.log(`  Team ID:           ${result.team_id}`);
         console.log(`  Org ID:            ${result.org_id}`);
         console.log(`  Deleted:           yes`);
-        if (typeof result.agents_flagged_for_recompose === "number") {
-            console.log(`  Agents recompose:  ${result.agents_flagged_for_recompose}`);
-        }
+        printRecomposeLines(result);
         console.log();
         return;
     }

package/dist/lib/api.d.ts

@@ -470,7 +470,15 @@ export interface TeamTemplateBody {
     name?: string;
     template: Record<string, unknown> | null;
     enabled: boolean;
+    /** Active members whose canonical rows were flagged for the recompose sweep. */
     agents_flagged_for_recompose?: number;
+    /**
+     * Active members recomposed in-request (mnemom-platform#2779): their served
+     * card already reflects this write. Absent on an API that only flags.
+     */
+    agents_recomposed?: number;
+    /** Active members still waiting on the recompose sweep (cap or compose failure). */
+    agents_recompose_pending?: number;
     deleted?: boolean;
 }
 export type TeamTemplateKind = "alignment" | "protection";
@@ -1326,10 +1334,16 @@ export interface AgentSessionGuardrails {
         turns: number;
         spend_usd: number;
         stall_run: number;
+        /**
+         * Which ceilings this session has crossed. Under `enforce` a crossing refuses the request
+         * (429) without counting it as a turn — the flag is the record of that refusal (#2782) and
+         * stays set even after the owner raises the ceiling and the session runs on.
+         */
         fired: {
             turns?: boolean;
             budget?: boolean;
             stall?: boolean;
+            time?: boolean;
         };
     } | null;
 }
@@ -1340,14 +1354,20 @@ export interface AgentSessionGuardrails {
  * `false` for a conclusive mechanical allowed/forbidden-paths check, `null` when the contract has
  * no fences or the verdict predates the check. This shape is also what MNE-8234 mirrors — keep
  * the field name and member shape stable.
+ *
+ * `refused` (#2782) is not a judge verdict: it records an enforce-mode ceiling refusal — the
+ * request was turned away (429) and not counted, so `turn` is the turn it would have been and
+ * the counter never reached it; `ceilings` names what was crossed and `fence_breach` is null.
  */
 export interface AgentSessionVerdictTrailEntry {
     request_id: string | null;
     turn: number;
-    verdict: "aligned" | "drifting" | "violation";
+    verdict: "aligned" | "drifting" | "violation" | "refused";
     reason: string;
     fence_breach: boolean | null;
     at: string;
+    /** Only on a `refused` entry: the ceilings the refusal named. */
+    ceilings?: Array<"turns" | "budget" | "time">;
 }
 /**
  * The seal's lifecycle (MNE-8149 R2, MNE-8199 D9/R9, MNE-8234/mnemom-api#3541). `live`: a sealed

package/dist/lib/slack-fs.d.ts

@@ -0,0 +1,15 @@
+/**
+ * lib/slack-fs.ts — the only way the CLI writes a file under ~/.mnemom/slack.
+ *
+ * A sandboxed agent session is allowed to write a few of these files itself (its own
+ * offsets/<session>.off). If it swaps one for a symlink, a plain writeFileSync from the
+ * router or channel server — which run outside the sandbox, as the operator — follows
+ * the link and truncates whatever it points at. So every write here opens the path with
+ * O_NOFOLLOW (a symlink fails with ELOOP instead of being followed), and refuses anything
+ * that is not a regular file with a single link (a hard link to another file is the same
+ * trick) before a single byte is written or truncated.
+ */
+/** Replace `path`'s contents with `data`; never follows a symlink at `path`. */
+export declare function writeFileNoFollow(path: string, data: string, mode?: number): void;
+/** Append `data` to `path`; never follows a symlink at `path`. */
+export declare function appendFileNoFollow(path: string, data: string, mode?: number): void;

package/dist/lib/slack-fs.js

@@ -0,0 +1,36 @@
+/**
+ * lib/slack-fs.ts — the only way the CLI writes a file under ~/.mnemom/slack.
+ *
+ * A sandboxed agent session is allowed to write a few of these files itself (its own
+ * offsets/<session>.off). If it swaps one for a symlink, a plain writeFileSync from the
+ * router or channel server — which run outside the sandbox, as the operator — follows
+ * the link and truncates whatever it points at. So every write here opens the path with
+ * O_NOFOLLOW (a symlink fails with ELOOP instead of being followed), and refuses anything
+ * that is not a regular file with a single link (a hard link to another file is the same
+ * trick) before a single byte is written or truncated.
+ */
+import { closeSync, constants, fstatSync, ftruncateSync, openSync, writeSync } from "node:fs";
+// O_NOFOLLOW is undefined on Windows, where creating symlinks needs elevation anyway.
+const NOFOLLOW = constants.O_NOFOLLOW ?? 0;
+function writeNoFollow(path, data, flags, truncate, mode) {
+    const fd = openSync(path, flags | NOFOLLOW, mode);
+    try {
+        const st = fstatSync(fd);
+        if (!st.isFile() || st.nlink !== 1)
+            throw new Error(`refusing to write ${path}: not a regular file with a single link`);
+        if (truncate)
+            ftruncateSync(fd, 0);
+        writeSync(fd, data);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Replace `path`'s contents with `data`; never follows a symlink at `path`. */
+export function writeFileNoFollow(path, data, mode = 0o600) {
+    writeNoFollow(path, data, constants.O_WRONLY | constants.O_CREAT, true, mode);
+}
+/** Append `data` to `path`; never follows a symlink at `path`. */
+export function appendFileNoFollow(path, data, mode = 0o600) {
+    writeNoFollow(path, data, constants.O_WRONLY | constants.O_CREAT | constants.O_APPEND, false, mode);
+}

package/dist/lib/slack-launch.js

@@ -8,12 +8,13 @@
  * `--dangerously-load-development-channels`, which shows a confirmation dialog;
  * orgs on Team/Enterprise must also enable `channelsEnabled` in managed settings.
  */
-import { mkdirSync, writeFileSync } from "node:fs";
+import { mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { SESSION_NAME_ENV } from "./agent.js";
 import { ensureRouter } from "./slack-router.js";
 import { slackDir } from "./slack-state.js";
 import { normSession } from "./slack-route.js";
+import { writeFileNoFollow } from "./slack-fs.js";
 export const SLACK_CHANNEL_SERVER = "mnemom-slack";
 /** The MCP config document for `session` (pure; unit-tested). */
 export function slackMcpConfig(session, cli) {
@@ -31,7 +32,7 @@ export function slackMcpConfig(session, cli) {
 export function slackChannelArgs(session, cli = [process.execPath, process.argv[1] ?? "mnemom"]) {
     mkdirSync(slackDir(), { recursive: true, mode: 0o700 });
     const path = join(slackDir(), `mcp-${normSession(session)}.json`);
-    writeFileSync(path, JSON.stringify(slackMcpConfig(session, cli), null, 2), { mode: 0o600 });
+    writeFileNoFollow(path, JSON.stringify(slackMcpConfig(session, cli), null, 2));
     ensureRouter(cli);
     return [
         "--mcp-config",

package/dist/lib/slack-router.js

@@ -12,11 +12,12 @@
  * in-memory user-name cache.
  */
 import { spawn } from "node:child_process";
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { existsSync, readFileSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { fetchThread, formatThread, messageBody, slackCall, } from "./slack.js";
 import { buildThreadIndex, normSession, routeHits, stripAddressing, } from "./slack-route.js";
 import { appendInbox, inboxSize, listAliases, liveSessions, PENDING_TTL_MS, readAliases, readPosts, readThreadRecords, recordPending, recordRoute, settlePending, slackDir, } from "./slack-state.js";
+import { writeFileNoFollow } from "./slack-fs.js";
 /** How often the router settles held messages (delivered / expired). */
 export const PENDING_SWEEP_MS = 30_000;
 const ttlText = () => `${Math.round(PENDING_TTL_MS / 60_000)} min`;
@@ -92,7 +93,7 @@ export async function runRouter(opts) {
     if (other && other !== process.pid)
         throw new Error(`a router is already running (pid ${other}).`);
     mkdirSync(slackDir(), { recursive: true, mode: 0o700 });
-    writeFileSync(routerPidFile(), String(process.pid), { mode: 0o600 });
+    writeFileNoFollow(routerPidFile(), String(process.pid));
     log(`aliases ${aliasesOn ? "on" : "off"}, sticky threads ${stickyOn ? "on" : "off"}`);
     if (aliasesOn) {
         const sweep = setInterval(() => {

package/dist/lib/slack-state.js

@@ -15,9 +15,10 @@
  * each session's listener is the only reader of its own inbox. No secret is
  * stored here.
  */
-import { appendFileSync, closeSync, existsSync, fstatSync, openSync, readSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { closeSync, existsSync, fstatSync, openSync, readSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, } from "node:fs";
 import { join } from "node:path";
 import { MNEMOM_DIR } from "./config.js";
+import { appendFileNoFollow, writeFileNoFollow } from "./slack-fs.js";
 import { normHandle, normSession, reresolveRoutes, } from "./slack-route.js";
 export function slackDir() {
     return join(MNEMOM_DIR, "slack");
@@ -59,14 +60,14 @@ function readJsonl(path) {
 }
 export function recordPost(p) {
     ensure(slackDir());
-    appendFileSync(postsFile(), JSON.stringify(p) + "\n", { mode: 0o600 });
+    appendFileNoFollow(postsFile(), JSON.stringify(p) + "\n");
 }
 export function readPosts() {
     return readJsonl(postsFile()).slice(-MAX_POSTS);
 }
 export function recordRoute(r) {
     ensure(slackDir());
-    appendFileSync(routesFile(), JSON.stringify(r) + "\n", { mode: 0o600 });
+    appendFileNoFollow(routesFile(), JSON.stringify(r) + "\n");
 }
 /** Sticky routes still within their TTL at `now`, oldest first (capped like posts). */
 export function readRoutes(now = Date.now()) {
@@ -112,9 +113,7 @@ export function freshInbox(messages, now = Date.now()) {
 const fileFor = (session) => `${normSession(session)}`;
 export function appendInbox(session, msg) {
     ensure(inboxDir());
-    appendFileSync(join(inboxDir(), `${fileFor(session)}.jsonl`), JSON.stringify(msg) + "\n", {
-        mode: 0o600,
-    });
+    appendFileNoFollow(join(inboxDir(), `${fileFor(session)}.jsonl`), JSON.stringify(msg) + "\n");
 }
 export function inboxPath(session) {
     return join(inboxDir(), `${fileFor(session)}.jsonl`);
@@ -142,7 +141,7 @@ export function readOffset(session) {
 /** `session` has read its inbox up to byte `offset`. */
 export function writeOffset(session, offset) {
     ensure(offsetDir());
-    writeFileSync(offsetFile(session), String(offset), { mode: 0o600 });
+    writeFileNoFollow(offsetFile(session), String(offset));
 }
 /** True when `session` has saved an offset at all (it has read its inbox before). */
 export function hasOffset(session) {
@@ -150,7 +149,7 @@ export function hasOffset(session) {
 }
 export function recordPending(p) {
     ensure(slackDir());
-    appendFileSync(pendingFile(), JSON.stringify(p) + "\n", { mode: 0o600 });
+    appendFileNoFollow(pendingFile(), JSON.stringify(p) + "\n");
 }
 export function readPending() {
     return readJsonl(pendingFile());
@@ -198,9 +197,7 @@ export function settlePending(now = Date.now()) {
         else
             held.push(p);
     }
-    writeFileSync(pendingFile(), held.map((p) => JSON.stringify(p) + "\n").join(""), {
-        mode: 0o600,
-    });
+    writeFileNoFollow(pendingFile(), held.map((p) => JSON.stringify(p) + "\n").join(""));
     return { delivered, expired, held };
 }
 /** Messages appended after byte `offset`, and the new offset. */
@@ -246,7 +243,7 @@ export function readInboxFrom(session, offset) {
 }
 export function registerLive(session, pid = process.pid) {
     ensure(liveDir());
-    writeFileSync(join(liveDir(), `${fileFor(session)}.json`), JSON.stringify({ session, pid, since: new Date().toISOString() }), { mode: 0o600 });
+    writeFileNoFollow(join(liveDir(), `${fileFor(session)}.json`), JSON.stringify({ session, pid, since: new Date().toISOString() }));
 }
 export function unregisterLive(session) {
     rmSync(join(liveDir(), `${fileFor(session)}.json`), { force: true });
@@ -280,7 +277,7 @@ export function setAlias(handle, session) {
         session: s,
         since: prev && prev.session === s ? prev.since : new Date().toISOString(),
     };
-    writeFileSync(path, JSON.stringify(rec), { mode: 0o600 });
+    writeFileNoFollow(path, JSON.stringify(rec));
     return rec;
 }
 /** Remove `handle`; true when something was removed. */

package/dist/turn-origin.mjs

@@ -70,7 +70,13 @@ export function isPromptEntry(entry) {
  * The origin Claude Code recorded for a prompt entry, or null when it recorded none we know
  * (then the entry is not stated at all, and the gateway reads that text as before).
  * Precedence: summary / transcript-only → meta; channel; scheduled; peer; task; isMeta → meta;
- * a human origin or a typed / queued prompt → human.
+ * a human origin or a typed / queued prompt → human; an SDK prompt → human.
+ *
+ * SDK prompts: under the Agent SDK (and `claude -p`) Claude Code records the caller's own
+ * prompts as promptSource / turnOrigin "sdk". The caller is the operator driving the session,
+ * so its prompt is the user's turn. Every non-user kind (wakeup, task notification, peer,
+ * hook or skill text, compaction summary) is matched above it first, so it keeps its own
+ * origin in SDK mode too; `source=sdk` still tells the gateway which surface the turn came from.
  */
 export function entryOrigin(entry) {
   if (!entry) return null;
@@ -85,6 +91,7 @@ export function entryOrigin(entry) {
   if (entry.isMeta === true || turn === "system") return "meta";
   if (turn === "human" || kind === "human") return "human";
   if (entry.promptSource === "typed" || entry.promptSource === "queued") return "human";
+  if (entry.promptSource === "sdk" || turn === "sdk") return "human";
   return null;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemom/mnemom",
-  "version": "0.17.30",
+  "version": "0.17.31-next.1",
   "description": "Transparent AI agent tracing",
   "type": "module",
   "bin": {

package/plugins/mnemom/skills/about-mnemom/SKILL.md

@@ -26,8 +26,9 @@ Mnemom gateway:
 
 This plugin is the visible part: the band above the prompt, the status pane, the ◆ sign on the
 spinner and the turn line, Mnemom trailers in commit attribution, a governance section in the
-system prompt, and a guard that denies Bash commands which would point `ANTHROPIC_BASE_URL`,
-`ANTHROPIC_AUTH_TOKEN` or `ANTHROPIC_CUSTOM_HEADERS` away from the gateway.
+system prompt, and a guard that denies Bash commands which plainly set or unset
+`ANTHROPIC_BASE_URL`, `ANTHROPIC_AUTH_TOKEN` or `ANTHROPIC_CUSTOM_HEADERS` (a text match on the
+command, not a sandbox).
 
 A session that was NOT launched by `mnemom agent` shows an amber "not governed" band. Nothing is
 recorded for it. Tell the person to launch with `mnemom agent` (install: `npm i -g @mnemom/mnemom`,
@@ -79,9 +80,10 @@ server at `https://docs.mnemom.ai/mcp` answers questions from the published docs
 
 - **"Why is there a ◆ on the spinner?"** The session is governed; every model call is being
   checkpointed through the Mnemom gateway. `/mnemom status` shows by whom.
-- **"Can I turn the gateway off for one command?"** Not inside this session: the plugin denies
-  it, by design. Use another terminal, or `mnemom agent --no-plugin` for a session without the
-  guard (the routing itself still comes from the launcher).
+- **"Can I turn the gateway off for one command?"** Not from this session: the plugin denies
+  commands that set or unset those variables, by design, and you must not work around it. Use
+  another terminal, or `mnemom agent --no-plugin` for a session without the guard (the routing
+  itself still comes from the launcher).
 - **"Is my score good?"** Grades A and up are strong; NR means not enough history yet, not a
   bad score. Point them at the public page for the breakdown.
 - **"Who sees what?"** The public rating and its chain attestation are public. Alignment and