@mnemom/mnemom 0.17.31-next.0 → 0.17.31

package/dist/commands/auth.js

@@ -1,4 +1,5 @@
 import { getAuthInfo, clearAuthTokens, loginWithBrowser, loginWithDeviceFlow, resolveAuth, } from "../lib/auth.js";
+import { getMe } from "../lib/api.js";
 import { fmt } from "../lib/format.js";
 export async function loginCommand(options = {}) {
     try {
@@ -7,6 +8,7 @@ export async function loginCommand(options = {}) {
         const tokens = options.noBrowser ? await loginWithDeviceFlow() : await loginWithBrowser();
         console.log();
         console.log(fmt.success("Logged in successfully!"));
+        await printSignedInAs();
         printGrant(tokens);
         console.log();
     }
@@ -16,6 +18,24 @@ export async function loginCommand(options = {}) {
         process.exit(1);
     }
 }
+/**
+ * Name the account this login signed in as, so a login finished in the wrong
+ * account (an approval from another browser or device that was signed in as
+ * someone else) is visible straight away. The OAuth token carries no identity,
+ * so this asks the API; if that fails the login still succeeded, so it prints
+ * nothing rather than an error.
+ */
+async function printSignedInAs() {
+    let email;
+    try {
+        email = (await getMe()).email;
+    }
+    catch {
+        return;
+    }
+    if (email)
+        console.log(`Signed in as ${email}`);
+}
 /**
  * Print what the issued token actually grants. OAuth access tokens are scoped
  * and (deliberately) carry no user identity, so we show scope + expiry rather

package/dist/commands/team.js

@@ -105,6 +105,31 @@ export async function teamShowCommand(teamId, opts) {
     }
     console.log();
 }
+/**
+ * What a template write did to the members' SERVED cards (mnemom-platform#2779).
+ *
+ * Before #2779 this printed "Agents recompose: N" for a count of rows merely
+ * FLAGGED for the 15-minute recompose sweep, while `card show` kept serving
+ * the stale composed card. The API now recomposes active members in-request
+ * and reports `agents_recomposed` / `agents_recompose_pending`; an older API
+ * that only flags is reported as queued, never as recomposed.
+ */
+function printRecomposeLines(result) {
+    if (typeof result.agents_recomposed === "number") {
+        const pending = result.agents_recompose_pending ?? 0;
+        console.log(`  Agents recomposed: ${result.agents_recomposed} ` +
+            `(active members of this team; their served card is updated now)`);
+        if (pending > 0) {
+            console.log(`  Agents pending:    ${pending} ` +
+                `(queued for the recompose sweep, ~15 min; confirm with \`mnemom card show --agent <id>\`)`);
+        }
+        return;
+    }
+    if (typeof result.agents_flagged_for_recompose === "number") {
+        console.log(`  Agents queued:     ${result.agents_flagged_for_recompose} ` +
+            `(active members of this team only; served cards update on the next recompose sweep, ~15 min)`);
+    }
+}
 export async function teamTemplateCommand(kind, teamId, opts) {
     await requireAuth();
     if (!teamId) {
@@ -149,10 +174,7 @@ export async function teamTemplateCommand(kind, teamId, opts) {
         console.log(`  Team ID:           ${result.team_id}`);
         console.log(`  Org ID:            ${result.org_id}`);
         console.log(`  Enabled:           ${result.enabled ? "yes" : "no"}`);
-        if (typeof result.agents_flagged_for_recompose === "number") {
-            console.log(`  Agents recompose:  ${result.agents_flagged_for_recompose} ` +
-                `(active members of this team only — not blanket fan-out)`);
-        }
+        printRecomposeLines(result);
         console.log();
         return;
     }
@@ -177,9 +199,7 @@ export async function teamTemplateCommand(kind, teamId, opts) {
         console.log(`  Team ID:           ${result.team_id}`);
         console.log(`  Org ID:            ${result.org_id}`);
         console.log(`  Deleted:           yes`);
-        if (typeof result.agents_flagged_for_recompose === "number") {
-            console.log(`  Agents recompose:  ${result.agents_flagged_for_recompose}`);
-        }
+        printRecomposeLines(result);
         console.log();
         return;
     }

package/dist/lib/api.d.ts

@@ -470,7 +470,15 @@ export interface TeamTemplateBody {
     name?: string;
     template: Record<string, unknown> | null;
     enabled: boolean;
+    /** Active members whose canonical rows were flagged for the recompose sweep. */
     agents_flagged_for_recompose?: number;
+    /**
+     * Active members recomposed in-request (mnemom-platform#2779): their served
+     * card already reflects this write. Absent on an API that only flags.
+     */
+    agents_recomposed?: number;
+    /** Active members still waiting on the recompose sweep (cap or compose failure). */
+    agents_recompose_pending?: number;
     deleted?: boolean;
 }
 export type TeamTemplateKind = "alignment" | "protection";
@@ -1326,10 +1334,16 @@ export interface AgentSessionGuardrails {
         turns: number;
         spend_usd: number;
         stall_run: number;
+        /**
+         * Which ceilings this session has crossed. Under `enforce` a crossing refuses the request
+         * (429) without counting it as a turn — the flag is the record of that refusal (#2782) and
+         * stays set even after the owner raises the ceiling and the session runs on.
+         */
         fired: {
             turns?: boolean;
             budget?: boolean;
             stall?: boolean;
+            time?: boolean;
         };
     } | null;
 }
@@ -1340,14 +1354,20 @@ export interface AgentSessionGuardrails {
  * `false` for a conclusive mechanical allowed/forbidden-paths check, `null` when the contract has
  * no fences or the verdict predates the check. This shape is also what MNE-8234 mirrors — keep
  * the field name and member shape stable.
+ *
+ * `refused` (#2782) is not a judge verdict: it records an enforce-mode ceiling refusal — the
+ * request was turned away (429) and not counted, so `turn` is the turn it would have been and
+ * the counter never reached it; `ceilings` names what was crossed and `fence_breach` is null.
  */
 export interface AgentSessionVerdictTrailEntry {
     request_id: string | null;
     turn: number;
-    verdict: "aligned" | "drifting" | "violation";
+    verdict: "aligned" | "drifting" | "violation" | "refused";
     reason: string;
     fence_breach: boolean | null;
     at: string;
+    /** Only on a `refused` entry: the ceilings the refusal named. */
+    ceilings?: Array<"turns" | "budget" | "time">;
 }
 /**
  * The seal's lifecycle (MNE-8149 R2, MNE-8199 D9/R9, MNE-8234/mnemom-api#3541). `live`: a sealed

package/dist/lib/oauth.d.ts

@@ -89,10 +89,35 @@ export interface LoopbackResult {
  * scoped tokens plus the client_id that was used (so the caller can persist it
  * for refresh). `openUrl` is injectable so tests can drive the flow without
  * spawning a real browser.
+ *
+ * Cross-device completion: when the AS advertises a device authorization
+ * endpoint, this also starts an RFC 8628 device authorization for the same
+ * client and prints its code with the verification URI. The login then
+ * finishes on whichever comes first: the loopback redirect (same machine) or an
+ * approval of the device code from any browser (e.g. the phone that opened the
+ * sign-up confirmation email), where the person types the code from this
+ * terminal. The code is never put in the authorize URL or any other link, so
+ * nothing that opens in a browser can approve this login without the person
+ * typing it. Tokens only ever come back to this process: the loopback code
+ * needs our PKCE verifier and the device grant needs our device_code. If the
+ * device authorization cannot be started, the login is exactly the loopback
+ * flow it always was.
  */
 export declare function loginWithLoopback(openUrl?: (url: string) => void, opts?: {
     inviteToken?: string;
+    sleep?: (ms: number) => Promise<void>;
 }): Promise<LoopbackResult>;
+/** How long the loopback listener waits while a device code is live. */
+export declare function crossDeviceWaitMs(expiresInSec: number): number;
+/**
+ * Settle with whichever login path finishes first.
+ *   - The loopback path settles the login either way, exactly as before: a
+ *     denial, a state mismatch or the timeout in the browser ends it.
+ *   - The device path ends it on success, or when the person explicitly denies
+ *     the device code. Any other device failure (expiry, a transport error)
+ *     only drops that path and the loopback wait continues.
+ */
+export declare function firstLogin(viaLoopback: Promise<OAuthTokens>, viaDevice: Promise<OAuthTokens> | null): Promise<OAuthTokens>;
 export interface DeviceResult {
     tokens: OAuthTokens;
     clientId: string;
@@ -169,6 +194,11 @@ export declare function browserOpenerFor(platform: NodeJS.Platform, href: string
  * Returns whether a launch was attempted.
  */
 export declare function openBrowser(url: string): boolean;
+/**
+ * setTimeout-based sleep that resolves early when `signal` aborts, so an
+ * abandoned device poll does not hold the process open after login finishes.
+ */
+export declare function abortableSleep(ms: number, signal: AbortSignal): Promise<void>;
 /**
  * Await `promise` while emitting a heartbeat tick every `intervalMs`, so a long
  * silent wait (a browser sign-in round-trip) doesn't look hung. `onTick` is

package/dist/lib/oauth.js

@@ -35,6 +35,12 @@ const DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 // Loopback login waits at most this long for the browser round-trip before
 // giving up and freeing the port.
 const LOOPBACK_TIMEOUT_MS = 5 * 60 * 1000;
+// Browser login also starts a device authorization (RFC 8628) when the AS offers
+// one, so the login can be approved from ANOTHER device: someone who signs up in
+// the browser and confirms the email on their phone. While that is live the
+// loopback listener waits as long as the device code is valid, capped here, so
+// the port is never left open indefinitely.
+const CROSS_DEVICE_MAX_WAIT_MS = 15 * 60 * 1000;
 // Cadence for the "…still waiting for you to finish signing in" heartbeat that
 // both interactive login poll loops emit, so a multi-minute browser sign-in
 // doesn't read as a hung CLI (matches the card-write retry tick in try-me).
@@ -208,46 +214,120 @@ function tokensFromResponse(data) {
  * scoped tokens plus the client_id that was used (so the caller can persist it
  * for refresh). `openUrl` is injectable so tests can drive the flow without
  * spawning a real browser.
+ *
+ * Cross-device completion: when the AS advertises a device authorization
+ * endpoint, this also starts an RFC 8628 device authorization for the same
+ * client and prints its code with the verification URI. The login then
+ * finishes on whichever comes first: the loopback redirect (same machine) or an
+ * approval of the device code from any browser (e.g. the phone that opened the
+ * sign-up confirmation email), where the person types the code from this
+ * terminal. The code is never put in the authorize URL or any other link, so
+ * nothing that opens in a browser can approve this login without the person
+ * typing it. Tokens only ever come back to this process: the loopback code
+ * needs our PKCE verifier and the device grant needs our device_code. If the
+ * device authorization cannot be started, the login is exactly the loopback
+ * flow it always was.
  */
 export async function loginWithLoopback(openUrl = openBrowser, opts = {}) {
     const meta = await discover();
     const pkce = generatePkce();
     const state = crypto.randomBytes(16).toString("hex");
-    const { port, codePromise, close } = await startLoopbackServer(state);
+    const { port, codePromise, close, setTimeoutMs } = await startLoopbackServer(state);
     const redirectUri = `http://127.0.0.1:${port}/callback`;
-    // Register a client bound to the exact loopback redirect URI. OAuth 2.1
-    // requires exact redirect_uri matching, and the loopback port is ephemeral,
-    // so we register per-login (cheap, public client, no secret).
-    const clientId = await registerClient([redirectUri]);
-    const authUrl = new URL(meta.authorization_endpoint);
-    authUrl.searchParams.set("response_type", "code");
-    authUrl.searchParams.set("client_id", clientId);
-    authUrl.searchParams.set("redirect_uri", redirectUri);
-    authUrl.searchParams.set("scope", negotiateScopes(meta));
-    authUrl.searchParams.set("state", state);
-    authUrl.searchParams.set("code_challenge", pkce.challenge);
-    authUrl.searchParams.set("code_challenge_method", pkce.method);
-    // A Mnemom Agent invitation (`mnemom agent --invite`) rides along so a NEW
-    // invitee who signs up in this browser round-trip skips the confirmation
-    // email: the AS ignores the param but bounces a signed-out browser to /login
-    // with this exact URL as return_to, and sign-up forwards the token to the api.
-    if (opts.inviteToken)
-        authUrl.searchParams.set("invite_token", opts.inviteToken);
-    console.log("Opening browser to authenticate...");
-    console.log(`If the browser doesn't open, visit:\n  ${authUrl.toString()}\n`);
-    openUrl(authUrl.toString());
-    console.log("Waiting for authentication...");
+    const stopPolling = new AbortController();
     try {
-        // Heartbeat while we await the loopback redirect — otherwise the sign-in
-        // round-trip is dead silent and reads as a hung CLI.
-        const code = await withHeartbeat(codePromise, LOGIN_HEARTBEAT_MS, (s) => console.log(`…still waiting for you to finish signing in (${s}s)`));
-        const tokens = await exchangeCode(meta, clientId, code, pkce.verifier, redirectUri);
+        // Register a client bound to the exact loopback redirect URI. OAuth 2.1
+        // requires exact redirect_uri matching, and the loopback port is ephemeral,
+        // so we register per-login (cheap, public client, no secret). The same
+        // client also runs the device grant, so either path refreshes the same way.
+        const clientId = await registerClient([redirectUri]);
+        const device = await startCrossDeviceAuthorization(meta, clientId);
+        const authUrl = new URL(meta.authorization_endpoint);
+        authUrl.searchParams.set("response_type", "code");
+        authUrl.searchParams.set("client_id", clientId);
+        authUrl.searchParams.set("redirect_uri", redirectUri);
+        authUrl.searchParams.set("scope", negotiateScopes(meta));
+        authUrl.searchParams.set("state", state);
+        authUrl.searchParams.set("code_challenge", pkce.challenge);
+        authUrl.searchParams.set("code_challenge_method", pkce.method);
+        // A Mnemom Agent invitation (`mnemom agent --invite`) rides along so a NEW
+        // invitee who signs up in this browser round-trip skips the confirmation
+        // email: the AS ignores the param but bounces a signed-out browser to /login
+        // with this exact URL as return_to, and sign-up forwards the token to the api.
+        if (opts.inviteToken)
+            authUrl.searchParams.set("invite_token", opts.inviteToken);
+        console.log("Opening browser to authenticate...");
+        console.log(`If the browser doesn't open, visit:\n  ${authUrl.toString()}\n`);
+        if (device) {
+            setTimeoutMs(crossDeviceWaitMs(device.expires_in));
+            // The plain verification_uri, never verification_uri_complete: the person
+            // types the code there, so a link alone can never approve this login.
+            console.log(`Confirming on another device? Open ${device.verification_uri} and enter: ${device.user_code}\n`);
+        }
+        openUrl(authUrl.toString());
+        console.log("Waiting for authentication...");
+        const viaLoopback = codePromise.then((code) => exchangeCode(meta, clientId, code, pkce.verifier, redirectUri));
+        const viaDevice = device
+            ? pollDeviceToken(meta, clientId, device, opts.sleep ?? ((ms) => abortableSleep(ms, stopPolling.signal)), 
+            // The loopback wait below already prints the heartbeat.
+            () => { }, stopPolling.signal)
+            : null;
+        // Heartbeat while we wait — otherwise the sign-in round-trip is dead
+        // silent and reads as a hung CLI.
+        const tokens = await withHeartbeat(firstLogin(viaLoopback, viaDevice), LOGIN_HEARTBEAT_MS, (s) => console.log(`…still waiting for you to finish signing in (${s}s)`));
         return { tokens, clientId };
     }
     finally {
+        stopPolling.abort();
         close();
     }
 }
+/**
+ * Start the device authorization that lets a browser login be approved from
+ * another device. Best-effort: an AS without the endpoint, or any failure,
+ * returns null and the login carries on as loopback only.
+ */
+async function startCrossDeviceAuthorization(meta, clientId) {
+    if (!meta.device_authorization_endpoint)
+        return null;
+    try {
+        const authz = await requestDeviceAuthorization(meta.device_authorization_endpoint, meta, clientId);
+        if (typeof authz.device_code !== "string" ||
+            typeof authz.user_code !== "string" ||
+            typeof authz.verification_uri !== "string" ||
+            typeof authz.expires_in !== "number") {
+            return null;
+        }
+        return authz;
+    }
+    catch {
+        return null;
+    }
+}
+/** How long the loopback listener waits while a device code is live. */
+export function crossDeviceWaitMs(expiresInSec) {
+    const ms = Number.isFinite(expiresInSec) ? expiresInSec * 1000 : 0;
+    return Math.min(Math.max(ms, LOOPBACK_TIMEOUT_MS), CROSS_DEVICE_MAX_WAIT_MS);
+}
+/**
+ * Settle with whichever login path finishes first.
+ *   - The loopback path settles the login either way, exactly as before: a
+ *     denial, a state mismatch or the timeout in the browser ends it.
+ *   - The device path ends it on success, or when the person explicitly denies
+ *     the device code. Any other device failure (expiry, a transport error)
+ *     only drops that path and the loopback wait continues.
+ */
+export function firstLogin(viaLoopback, viaDevice) {
+    if (!viaDevice)
+        return viaLoopback;
+    return new Promise((resolve, reject) => {
+        viaLoopback.then(resolve, reject);
+        viaDevice.then(resolve, (err) => {
+            if (err instanceof Error && err.message === DEVICE_ACCESS_DENIED)
+                reject(err);
+        });
+    });
+}
 /**
  * Start a loopback HTTP listener that captures the OAuth redirect
  * (GET /callback?code=...&state=...). Resolves with the authorization code once
@@ -293,13 +373,18 @@ function startLoopbackServer(expectedState) {
     return new Promise((resolve) => {
         server.listen(0, "127.0.0.1", () => {
             const port = server.address().port;
-            const timeout = setTimeout(() => {
+            const giveUp = () => {
                 rejectCode(new Error("Login timed out. Please try again."));
                 server.close();
-            }, LOOPBACK_TIMEOUT_MS);
+            };
+            let timeout = setTimeout(giveUp, LOOPBACK_TIMEOUT_MS);
             resolve({
                 port,
                 codePromise,
+                setTimeoutMs: (ms) => {
+                    clearTimeout(timeout);
+                    timeout = setTimeout(giveUp, ms);
+                },
                 close: () => {
                     clearTimeout(timeout);
                     server.close();
@@ -358,18 +443,7 @@ export async function loginWithDevice(opts) {
     // clients"). Register a loopback placeholder — it satisfies validation and is
     // never used, since the device grant never redirects.
     const clientId = await registerClient(["http://127.0.0.1/callback"]);
-    const authzRes = await oauthFetch("Device authorization at", meta.device_authorization_endpoint, {
-        method: "POST",
-        headers: {
-            "Content-Type": "application/x-www-form-urlencoded",
-            Accept: "application/json",
-        },
-        body: new URLSearchParams({ client_id: clientId, scope: negotiateScopes(meta) }),
-    });
-    if (!authzRes.ok) {
-        throw new Error(`Device authorization failed: ${await oauthError(authzRes)}`);
-    }
-    const authz = (await authzRes.json());
+    const authz = await requestDeviceAuthorization(meta.device_authorization_endpoint, meta, clientId);
     display("");
     display("To authenticate, visit:");
     display(`  ${authz.verification_uri}`);
@@ -385,7 +459,26 @@ export async function loginWithDevice(opts) {
     const tokens = await pollDeviceToken(meta, clientId, authz, sleep, display);
     return { tokens, clientId };
 }
-async function pollDeviceToken(meta, clientId, authz, sleep, display) {
+/** POST the device authorization request (RFC 8628 §3.1) for `clientId`. */
+async function requestDeviceAuthorization(endpoint, meta, clientId) {
+    const authzRes = await oauthFetch("Device authorization at", endpoint, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+            Accept: "application/json",
+        },
+        body: new URLSearchParams({ client_id: clientId, scope: negotiateScopes(meta) }),
+    });
+    if (!authzRes.ok) {
+        throw new Error(`Device authorization failed: ${await oauthError(authzRes)}`);
+    }
+    return (await authzRes.json());
+}
+/** The message a device-code denial rejects with (matched by firstLogin). */
+const DEVICE_ACCESS_DENIED = "Authorization was denied.";
+/** Thrown into an abandoned device poll once the other login path has won. */
+const POLL_STOPPED = "Device polling stopped.";
+async function pollDeviceToken(meta, clientId, authz, sleep, display, signal) {
     // RFC 8628 §3.5: default interval is 5s if the server omits it; on slow_down
     // we increase the interval by 5s and keep that as the new minimum.
     let intervalMs = (authz.interval ?? 5) * 1000;
@@ -399,6 +492,8 @@ async function pollDeviceToken(meta, clientId, authz, sleep, display) {
             throw new Error("Device authorization expired before approval. Please try again.");
         }
         await sleep(intervalMs);
+        if (signal?.aborted)
+            throw new Error(POLL_STOPPED);
         waitedMs += intervalMs;
         let res;
         try {
@@ -437,7 +532,7 @@ async function pollDeviceToken(meta, clientId, authz, sleep, display) {
             case "expired_token":
                 throw new Error("Device authorization expired before approval. Please try again.");
             case "access_denied":
-                throw new Error("Authorization was denied.");
+                throw new Error(DEVICE_ACCESS_DENIED);
             default:
                 throw new Error(`Device authorization failed: ${body.error ?? `HTTP ${res.status}`}` +
                     (body.error_description ? ` — ${body.error_description}` : ""));
@@ -623,6 +718,23 @@ export function openBrowser(url) {
 function defaultSleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
+/**
+ * setTimeout-based sleep that resolves early when `signal` aborts, so an
+ * abandoned device poll does not hold the process open after login finishes.
+ */
+export function abortableSleep(ms, signal) {
+    return new Promise((resolve) => {
+        if (signal.aborted)
+            return resolve();
+        const done = () => {
+            clearTimeout(timer);
+            signal.removeEventListener("abort", done);
+            resolve();
+        };
+        const timer = setTimeout(done, ms);
+        signal.addEventListener("abort", done, { once: true });
+    });
+}
 /**
  * Await `promise` while emitting a heartbeat tick every `intervalMs`, so a long
  * silent wait (a browser sign-in round-trip) doesn't look hung. `onTick` is

package/dist/lib/slack-fs.d.ts

@@ -0,0 +1,15 @@
+/**
+ * lib/slack-fs.ts — the only way the CLI writes a file under ~/.mnemom/slack.
+ *
+ * A sandboxed agent session is allowed to write a few of these files itself (its own
+ * offsets/<session>.off). If it swaps one for a symlink, a plain writeFileSync from the
+ * router or channel server — which run outside the sandbox, as the operator — follows
+ * the link and truncates whatever it points at. So every write here opens the path with
+ * O_NOFOLLOW (a symlink fails with ELOOP instead of being followed), and refuses anything
+ * that is not a regular file with a single link (a hard link to another file is the same
+ * trick) before a single byte is written or truncated.
+ */
+/** Replace `path`'s contents with `data`; never follows a symlink at `path`. */
+export declare function writeFileNoFollow(path: string, data: string, mode?: number): void;
+/** Append `data` to `path`; never follows a symlink at `path`. */
+export declare function appendFileNoFollow(path: string, data: string, mode?: number): void;

package/dist/lib/slack-fs.js

@@ -0,0 +1,36 @@
+/**
+ * lib/slack-fs.ts — the only way the CLI writes a file under ~/.mnemom/slack.
+ *
+ * A sandboxed agent session is allowed to write a few of these files itself (its own
+ * offsets/<session>.off). If it swaps one for a symlink, a plain writeFileSync from the
+ * router or channel server — which run outside the sandbox, as the operator — follows
+ * the link and truncates whatever it points at. So every write here opens the path with
+ * O_NOFOLLOW (a symlink fails with ELOOP instead of being followed), and refuses anything
+ * that is not a regular file with a single link (a hard link to another file is the same
+ * trick) before a single byte is written or truncated.
+ */
+import { closeSync, constants, fstatSync, ftruncateSync, openSync, writeSync } from "node:fs";
+// O_NOFOLLOW is undefined on Windows, where creating symlinks needs elevation anyway.
+const NOFOLLOW = constants.O_NOFOLLOW ?? 0;
+function writeNoFollow(path, data, flags, truncate, mode) {
+    const fd = openSync(path, flags | NOFOLLOW, mode);
+    try {
+        const st = fstatSync(fd);
+        if (!st.isFile() || st.nlink !== 1)
+            throw new Error(`refusing to write ${path}: not a regular file with a single link`);
+        if (truncate)
+            ftruncateSync(fd, 0);
+        writeSync(fd, data);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Replace `path`'s contents with `data`; never follows a symlink at `path`. */
+export function writeFileNoFollow(path, data, mode = 0o600) {
+    writeNoFollow(path, data, constants.O_WRONLY | constants.O_CREAT, true, mode);
+}
+/** Append `data` to `path`; never follows a symlink at `path`. */
+export function appendFileNoFollow(path, data, mode = 0o600) {
+    writeNoFollow(path, data, constants.O_WRONLY | constants.O_CREAT | constants.O_APPEND, false, mode);
+}

package/dist/lib/slack-launch.js

@@ -8,12 +8,13 @@
  * `--dangerously-load-development-channels`, which shows a confirmation dialog;
  * orgs on Team/Enterprise must also enable `channelsEnabled` in managed settings.
  */
-import { mkdirSync, writeFileSync } from "node:fs";
+import { mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { SESSION_NAME_ENV } from "./agent.js";
 import { ensureRouter } from "./slack-router.js";
 import { slackDir } from "./slack-state.js";
 import { normSession } from "./slack-route.js";
+import { writeFileNoFollow } from "./slack-fs.js";
 export const SLACK_CHANNEL_SERVER = "mnemom-slack";
 /** The MCP config document for `session` (pure; unit-tested). */
 export function slackMcpConfig(session, cli) {
@@ -31,7 +32,7 @@ export function slackMcpConfig(session, cli) {
 export function slackChannelArgs(session, cli = [process.execPath, process.argv[1] ?? "mnemom"]) {
     mkdirSync(slackDir(), { recursive: true, mode: 0o700 });
     const path = join(slackDir(), `mcp-${normSession(session)}.json`);
-    writeFileSync(path, JSON.stringify(slackMcpConfig(session, cli), null, 2), { mode: 0o600 });
+    writeFileNoFollow(path, JSON.stringify(slackMcpConfig(session, cli), null, 2));
     ensureRouter(cli);
     return [
         "--mcp-config",

package/dist/lib/slack-router.js

@@ -12,11 +12,12 @@
  * in-memory user-name cache.
  */
 import { spawn } from "node:child_process";
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { existsSync, readFileSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { fetchThread, formatThread, messageBody, slackCall, } from "./slack.js";
 import { buildThreadIndex, normSession, routeHits, stripAddressing, } from "./slack-route.js";
 import { appendInbox, inboxSize, listAliases, liveSessions, PENDING_TTL_MS, readAliases, readPosts, readThreadRecords, recordPending, recordRoute, settlePending, slackDir, } from "./slack-state.js";
+import { writeFileNoFollow } from "./slack-fs.js";
 /** How often the router settles held messages (delivered / expired). */
 export const PENDING_SWEEP_MS = 30_000;
 const ttlText = () => `${Math.round(PENDING_TTL_MS / 60_000)} min`;
@@ -92,7 +93,7 @@ export async function runRouter(opts) {
     if (other && other !== process.pid)
         throw new Error(`a router is already running (pid ${other}).`);
     mkdirSync(slackDir(), { recursive: true, mode: 0o700 });
-    writeFileSync(routerPidFile(), String(process.pid), { mode: 0o600 });
+    writeFileNoFollow(routerPidFile(), String(process.pid));
     log(`aliases ${aliasesOn ? "on" : "off"}, sticky threads ${stickyOn ? "on" : "off"}`);
     if (aliasesOn) {
         const sweep = setInterval(() => {

package/dist/lib/slack-state.js

@@ -15,9 +15,10 @@
  * each session's listener is the only reader of its own inbox. No secret is
  * stored here.
  */
-import { appendFileSync, closeSync, existsSync, fstatSync, openSync, readSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { closeSync, existsSync, fstatSync, openSync, readSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, } from "node:fs";
 import { join } from "node:path";
 import { MNEMOM_DIR } from "./config.js";
+import { appendFileNoFollow, writeFileNoFollow } from "./slack-fs.js";
 import { normHandle, normSession, reresolveRoutes, } from "./slack-route.js";
 export function slackDir() {
     return join(MNEMOM_DIR, "slack");
@@ -59,14 +60,14 @@ function readJsonl(path) {
 }
 export function recordPost(p) {
     ensure(slackDir());
-    appendFileSync(postsFile(), JSON.stringify(p) + "\n", { mode: 0o600 });
+    appendFileNoFollow(postsFile(), JSON.stringify(p) + "\n");
 }
 export function readPosts() {
     return readJsonl(postsFile()).slice(-MAX_POSTS);
 }
 export function recordRoute(r) {
     ensure(slackDir());
-    appendFileSync(routesFile(), JSON.stringify(r) + "\n", { mode: 0o600 });
+    appendFileNoFollow(routesFile(), JSON.stringify(r) + "\n");
 }
 /** Sticky routes still within their TTL at `now`, oldest first (capped like posts). */
 export function readRoutes(now = Date.now()) {
@@ -112,9 +113,7 @@ export function freshInbox(messages, now = Date.now()) {
 const fileFor = (session) => `${normSession(session)}`;
 export function appendInbox(session, msg) {
     ensure(inboxDir());
-    appendFileSync(join(inboxDir(), `${fileFor(session)}.jsonl`), JSON.stringify(msg) + "\n", {
-        mode: 0o600,
-    });
+    appendFileNoFollow(join(inboxDir(), `${fileFor(session)}.jsonl`), JSON.stringify(msg) + "\n");
 }
 export function inboxPath(session) {
     return join(inboxDir(), `${fileFor(session)}.jsonl`);
@@ -142,7 +141,7 @@ export function readOffset(session) {
 /** `session` has read its inbox up to byte `offset`. */
 export function writeOffset(session, offset) {
     ensure(offsetDir());
-    writeFileSync(offsetFile(session), String(offset), { mode: 0o600 });
+    writeFileNoFollow(offsetFile(session), String(offset));
 }
 /** True when `session` has saved an offset at all (it has read its inbox before). */
 export function hasOffset(session) {
@@ -150,7 +149,7 @@ export function hasOffset(session) {
 }
 export function recordPending(p) {
     ensure(slackDir());
-    appendFileSync(pendingFile(), JSON.stringify(p) + "\n", { mode: 0o600 });
+    appendFileNoFollow(pendingFile(), JSON.stringify(p) + "\n");
 }
 export function readPending() {
     return readJsonl(pendingFile());
@@ -198,9 +197,7 @@ export function settlePending(now = Date.now()) {
         else
             held.push(p);
     }
-    writeFileSync(pendingFile(), held.map((p) => JSON.stringify(p) + "\n").join(""), {
-        mode: 0o600,
-    });
+    writeFileNoFollow(pendingFile(), held.map((p) => JSON.stringify(p) + "\n").join(""));
     return { delivered, expired, held };
 }
 /** Messages appended after byte `offset`, and the new offset. */
@@ -246,7 +243,7 @@ export function readInboxFrom(session, offset) {
 }
 export function registerLive(session, pid = process.pid) {
     ensure(liveDir());
-    writeFileSync(join(liveDir(), `${fileFor(session)}.json`), JSON.stringify({ session, pid, since: new Date().toISOString() }), { mode: 0o600 });
+    writeFileNoFollow(join(liveDir(), `${fileFor(session)}.json`), JSON.stringify({ session, pid, since: new Date().toISOString() }));
 }
 export function unregisterLive(session) {
     rmSync(join(liveDir(), `${fileFor(session)}.json`), { force: true });
@@ -280,7 +277,7 @@ export function setAlias(handle, session) {
         session: s,
         since: prev && prev.session === s ? prev.since : new Date().toISOString(),
     };
-    writeFileSync(path, JSON.stringify(rec), { mode: 0o600 });
+    writeFileNoFollow(path, JSON.stringify(rec));
     return rec;
 }
 /** Remove `handle`; true when something was removed. */

package/dist/turn-origin.mjs

@@ -70,7 +70,13 @@ export function isPromptEntry(entry) {
  * The origin Claude Code recorded for a prompt entry, or null when it recorded none we know
  * (then the entry is not stated at all, and the gateway reads that text as before).
  * Precedence: summary / transcript-only → meta; channel; scheduled; peer; task; isMeta → meta;
- * a human origin or a typed / queued prompt → human.
+ * a human origin or a typed / queued prompt → human; an SDK prompt → human.
+ *
+ * SDK prompts: under the Agent SDK (and `claude -p`) Claude Code records the caller's own
+ * prompts as promptSource / turnOrigin "sdk". The caller is the operator driving the session,
+ * so its prompt is the user's turn. Every non-user kind (wakeup, task notification, peer,
+ * hook or skill text, compaction summary) is matched above it first, so it keeps its own
+ * origin in SDK mode too; `source=sdk` still tells the gateway which surface the turn came from.
  */
 export function entryOrigin(entry) {
   if (!entry) return null;
@@ -85,6 +91,7 @@ export function entryOrigin(entry) {
   if (entry.isMeta === true || turn === "system") return "meta";
   if (turn === "human" || kind === "human") return "human";
   if (entry.promptSource === "typed" || entry.promptSource === "queued") return "human";
+  if (entry.promptSource === "sdk" || turn === "sdk") return "human";
   return null;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemom/mnemom",
-  "version": "0.17.31-next.0",
+  "version": "0.17.31",
   "description": "Transparent AI agent tracing",
   "type": "module",
   "bin": {
@@ -26,10 +26,10 @@
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^20.10.0",
-    "@vitest/coverage-v8": "^4.1.11",
+    "@vitest/coverage-v8": "^4.1.12",
     "tsx": "^4.23.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.11"
+    "vitest": "^4.1.12"
   },
   "files": [
     "dist",
@@ -71,7 +71,7 @@
     "node": ">=18.0.0"
   },
   "overrides": {
-    "@vitest/mocker": "^4.1.11",
+    "@vitest/mocker": "^4.1.12",
     "nanoid": "^3.3.18"
   }
 }

package/plugins/mnemom/skills/about-mnemom/SKILL.md

@@ -26,8 +26,9 @@ Mnemom gateway:
 
 This plugin is the visible part: the band above the prompt, the status pane, the ◆ sign on the
 spinner and the turn line, Mnemom trailers in commit attribution, a governance section in the
-system prompt, and a guard that denies Bash commands which would point `ANTHROPIC_BASE_URL`,
-`ANTHROPIC_AUTH_TOKEN` or `ANTHROPIC_CUSTOM_HEADERS` away from the gateway.
+system prompt, and a guard that denies Bash commands which plainly set or unset
+`ANTHROPIC_BASE_URL`, `ANTHROPIC_AUTH_TOKEN` or `ANTHROPIC_CUSTOM_HEADERS` (a text match on the
+command, not a sandbox).
 
 A session that was NOT launched by `mnemom agent` shows an amber "not governed" band. Nothing is
 recorded for it. Tell the person to launch with `mnemom agent` (install: `npm i -g @mnemom/mnemom`,
@@ -79,9 +80,10 @@ server at `https://docs.mnemom.ai/mcp` answers questions from the published docs
 
 - **"Why is there a ◆ on the spinner?"** The session is governed; every model call is being
   checkpointed through the Mnemom gateway. `/mnemom status` shows by whom.
-- **"Can I turn the gateway off for one command?"** Not inside this session: the plugin denies
-  it, by design. Use another terminal, or `mnemom agent --no-plugin` for a session without the
-  guard (the routing itself still comes from the launcher).
+- **"Can I turn the gateway off for one command?"** Not from this session: the plugin denies
+  commands that set or unset those variables, by design, and you must not work around it. Use
+  another terminal, or `mnemom agent --no-plugin` for a session without the guard (the routing
+  itself still comes from the launcher).
 - **"Is my score good?"** Grades A and up are strong; NR means not enough history yet, not a
   bad score. Point them at the public page for the breakdown.
 - **"Who sees what?"** The public rating and its chain attestation are public. Alignment and