@mnemom/mnemom 0.17.31-next.1 → 0.17.32-next.0

package/dist/lib/contract-hash.js

@@ -0,0 +1,126 @@
+/**
+ * The contract's full sha256 and seal-time check, as the gateway computes them (Doors W3.5).
+ *
+ * Callers that hash contracts outside the gateway (the fuel step's CLI verb and the thin runner,
+ * each in its own change) use this module. It computes a contract's hash, its committed file's
+ * bytes and its repo path; writing the file is the caller's job. It ports the gateway's
+ * `normaliseContractObject` / `checkContractObject` / `canonicalHash` (gateway/src/goal-contract.ts). The full sha256 is the digest whose first 16
+ * hex characters are the gateway's `x-mnemom-contract-hash`: sha256 of the canonical JSON of the
+ * normalised contract, with a default `"nudge"` mode dropped and `"enforce"` kept. The 8 KB
+ * limit is measured, like the gateway's, on the canonical JSON with the mode still present.
+ *
+ * `gateway/test/fixtures/contract-sha256-parity.json` pins the gateway's own outputs; the CLI's
+ * parity suite and mnemom-api's (`src/contract-step/hash.ts`) read the same cases.
+ */
+import { createHash } from "node:crypto";
+import { canonicalJson } from "./canonical-json.js";
+/** The gateway's `CONTRACT_JSON_MAX`: bytes of canonical JSON of the normalised contract. */
+export const CONTRACT_JSON_MAX = 8_192;
+/** The gateway's `STATEMENT_MAX` (its `USER_CLIP`), in characters. */
+export const STATEMENT_MAX = 4_000;
+const MODES = new Set(["nudge", "enforce"]);
+function stringArray(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((v) => typeof v === "string" && v.trim().length > 0);
+}
+function positiveFinite(value) {
+    return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : undefined;
+}
+/** The gateway's `normaliseContractObject`: null without a non-empty statement. Mode defaults to "nudge". */
+export function normaliseContract(obj) {
+    const statement = typeof obj.statement === "string" ? obj.statement.trim() : "";
+    if (!statement)
+        return null;
+    const contract = {
+        statement,
+        requirements: stringArray(obj.requirements),
+        allowed_paths: stringArray(obj.allowed_paths),
+        forbidden_paths: stringArray(obj.forbidden_paths),
+    };
+    if (typeof obj.goal_id === "string" && obj.goal_id.trim())
+        contract.goal_id = obj.goal_id.trim();
+    const maxTurns = positiveFinite(obj.max_turns);
+    if (maxTurns !== undefined)
+        contract.max_turns = maxTurns;
+    const budgetUsd = positiveFinite(obj.budget_usd);
+    if (budgetUsd !== undefined)
+        contract.budget_usd = budgetUsd;
+    const stallTurns = positiveFinite(obj.stall_turns);
+    if (stallTurns !== undefined)
+        contract.stall_turns = stallTurns;
+    const timeLimitS = positiveFinite(obj.time_limit_s);
+    if (timeLimitS !== undefined)
+        contract.time_limit_s = timeLimitS;
+    contract.mode = MODES.has(obj.mode) ? obj.mode : "nudge";
+    return contract;
+}
+/** The gateway's seal-time gate (`checkContractObject`), with the same reasons. */
+export function checkContract(value, label = "contract") {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return { ok: false, reason: "unparseable", message: `${label} must be a JSON object` };
+    }
+    const obj = value;
+    const contract = normaliseContract(obj);
+    if (!contract) {
+        return {
+            ok: false,
+            reason: "statement_missing",
+            message: `${label} needs a non-empty "statement"`,
+        };
+    }
+    if (contract.statement.length > STATEMENT_MAX) {
+        return {
+            ok: false,
+            reason: "statement_too_long",
+            message: `"statement" is ${contract.statement.length} characters; the maximum is ${STATEMENT_MAX}`,
+        };
+    }
+    if (obj.mode !== undefined && !MODES.has(obj.mode)) {
+        return {
+            ok: false,
+            reason: "mode_invalid",
+            message: `"mode" must be "nudge" or "enforce" (got ${JSON.stringify(obj.mode)})`,
+        };
+    }
+    const bytes = contractSizeBytes(contract);
+    if (bytes > CONTRACT_JSON_MAX) {
+        return {
+            ok: false,
+            reason: "contract_too_large",
+            message: `the contract is ${bytes} bytes of canonical JSON; the maximum is ${CONTRACT_JSON_MAX}`,
+        };
+    }
+    return { ok: true, contract };
+}
+/** Bytes the 8 KB limit measures: canonical JSON of the normalised contract, mode included. */
+export function contractSizeBytes(contract) {
+    return Buffer.byteLength(canonicalJson(contract), "utf8");
+}
+/** The hash form: a default "nudge" mode dropped, "enforce" kept (the gateway's `canonicalHash`). */
+export function hashForm(contract) {
+    const form = { ...contract };
+    if ((contract.mode ?? "nudge") === "nudge")
+        delete form.mode;
+    return form;
+}
+/**
+ * The committed contract file's exact bytes: canonical JSON of the hash form, no trailing newline,
+ * so sha256 of the file equals `contractSha256`.
+ */
+export function contractFileText(contract) {
+    return canonicalJson(hashForm(contract));
+}
+/** Full lowercase-hex sha256. Its first 16 characters are the gateway's `x-mnemom-contract-hash`. */
+export function contractSha256(contract) {
+    return createHash("sha256").update(contractFileText(contract), "utf8").digest("hex");
+}
+/**
+ * Where a sealed contract is committed in the repo: content-addressed by its full sha256. Throws
+ * on anything but 64 lowercase hex characters, so the path can never leave `.mnemom/contracts/`.
+ */
+export function contractRepoPath(sha256) {
+    if (!/^[0-9a-f]{64}$/.test(sha256))
+        throw new Error("contract sha256 must be 64 lowercase hex characters");
+    return `.mnemom/contracts/${sha256}.json`;
+}

package/dist/lib/experimental.d.ts

@@ -12,7 +12,7 @@
  * Everything here is pure or dependency-injected; index.ts and the command
  * modules are the thin drivers.
  */
-export type ExperimentalId = "context-handoff" | "slack" | "implicit" | "measured-savings";
+export type ExperimentalId = "context-handoff" | "slack" | "implicit" | "measured-savings" | "record" | "fuel";
 /**
  * Features that used to be experimental and are now on by default for everyone. Their ids are
  * no longer in the registry, but `mnemom experimental enable|disable <id>` still accepts them
@@ -63,6 +63,15 @@ export declare function resolveExperimental(opts: {
     stored: ExperimentalPrefs | undefined;
     env: Record<string, string | undefined>;
 }): ExperimentalState;
+/**
+ * Features a prerelease (`-next.N`) build makes available without `mnemom experimental
+ * enable`: door one's T16 turns implicit goals on by default on `next` (decisions 12 and
+ * 22), so its flag, its launcher.toml value and `mnemom agent goal` are not refused there.
+ * Stable is unchanged.
+ */
+export declare const PRERELEASE_AVAILABLE: readonly ExperimentalId[];
+/** The features whose flags, keys and commands are usable: the enabled ones, plus PRERELEASE_AVAILABLE on a prerelease. */
+export declare function availableFeatures(enabled: readonly ExperimentalId[], prerelease: boolean): ExperimentalId[];
 /** The one-line stderr notice for a launch with experimental features on; null when none are. */
 export declare function experimentalNotice(enabled: readonly ExperimentalId[]): string | null;
 /** The error for using an experimental flag or command while its feature is off. */

package/dist/lib/experimental.js

@@ -75,7 +75,7 @@ export const EXPERIMENTAL_FEATURES = [
     {
         // No flag, launcher.toml key or env of its own: `mnemom experimental enable` is the switch.
         id: "measured-savings",
-        summary: "The status bar shows the saving the gateway measured on this session instead of the benchmark estimate",
+        summary: "The gateway measures each request's saving into the response usage (the status bar never shows it)",
         since: "0.17.16",
         gates: {
             flags: [],
@@ -84,6 +84,29 @@ export const EXPERIMENTAL_FEATURES = [
             env: [],
         },
     },
+    {
+        // No flag, launcher.toml key or env of its own: `mnemom experimental enable` is the switch.
+        id: "record",
+        summary: "Print the conduct receipt at exit: the session's measured model cost and μ, or the record link",
+        since: "0.17.32",
+        gates: {
+            flags: [],
+            configKeys: [],
+            commands: [],
+            env: [],
+        },
+    },
+    {
+        id: "fuel",
+        summary: "The fuel step: `mnemom agent fuel <file>` seals a batch of job contracts with one confirmation and commits them to the repo",
+        since: "0.17.32",
+        gates: {
+            flags: [],
+            configKeys: [],
+            commands: ["mnemom agent fuel"],
+            env: [],
+        },
+    },
 ];
 export const EXPERIMENTAL_IDS = EXPERIMENTAL_FEATURES.map((f) => f.id);
 export const EXPERIMENTAL_ENV = "MNEMOM_EXPERIMENTAL";
@@ -126,6 +149,17 @@ export function resolveExperimental(opts) {
         unknown: stored.filter((t) => !isExperimentalId(t)),
     };
 }
+/**
+ * Features a prerelease (`-next.N`) build makes available without `mnemom experimental
+ * enable`: door one's T16 turns implicit goals on by default on `next` (decisions 12 and
+ * 22), so its flag, its launcher.toml value and `mnemom agent goal` are not refused there.
+ * Stable is unchanged.
+ */
+export const PRERELEASE_AVAILABLE = ["implicit"];
+/** The features whose flags, keys and commands are usable: the enabled ones, plus PRERELEASE_AVAILABLE on a prerelease. */
+export function availableFeatures(enabled, prerelease) {
+    return normalize(prerelease ? [...enabled, ...PRERELEASE_AVAILABLE] : enabled);
+}
 /** The one-line stderr notice for a launch with experimental features on; null when none are. */
 export function experimentalNotice(enabled) {
     if (enabled.length === 0)

package/dist/lib/oauth.d.ts

@@ -42,7 +42,8 @@ export interface AuthServerMetadata {
 }
 /**
  * Fetch (and process-cache) the AS metadata document. We resolve it relative to
- * the active API base URL so staging/local point at their own AS.
+ * the active API base URL so local (and any non-default `Environment`) points
+ * at its own AS.
  */
 export declare function discover(): Promise<AuthServerMetadata>;
 /** Reset the process-level discovery cache (used by tests). */
@@ -89,10 +90,35 @@ export interface LoopbackResult {
  * scoped tokens plus the client_id that was used (so the caller can persist it
  * for refresh). `openUrl` is injectable so tests can drive the flow without
  * spawning a real browser.
+ *
+ * Cross-device completion: when the AS advertises a device authorization
+ * endpoint, this also starts an RFC 8628 device authorization for the same
+ * client and prints its code with the verification URI. The login then
+ * finishes on whichever comes first: the loopback redirect (same machine) or an
+ * approval of the device code from any browser (e.g. the phone that opened the
+ * sign-up confirmation email), where the person types the code from this
+ * terminal. The code is never put in the authorize URL or any other link, so
+ * nothing that opens in a browser can approve this login without the person
+ * typing it. Tokens only ever come back to this process: the loopback code
+ * needs our PKCE verifier and the device grant needs our device_code. If the
+ * device authorization cannot be started, the login is exactly the loopback
+ * flow it always was.
  */
 export declare function loginWithLoopback(openUrl?: (url: string) => void, opts?: {
     inviteToken?: string;
+    sleep?: (ms: number) => Promise<void>;
 }): Promise<LoopbackResult>;
+/** How long the loopback listener waits while a device code is live. */
+export declare function crossDeviceWaitMs(expiresInSec: number): number;
+/**
+ * Settle with whichever login path finishes first.
+ *   - The loopback path settles the login either way, exactly as before: a
+ *     denial, a state mismatch or the timeout in the browser ends it.
+ *   - The device path ends it on success, or when the person explicitly denies
+ *     the device code. Any other device failure (expiry, a transport error)
+ *     only drops that path and the loopback wait continues.
+ */
+export declare function firstLogin(viaLoopback: Promise<OAuthTokens>, viaDevice: Promise<OAuthTokens> | null): Promise<OAuthTokens>;
 export interface DeviceResult {
     tokens: OAuthTokens;
     clientId: string;
@@ -169,6 +195,11 @@ export declare function browserOpenerFor(platform: NodeJS.Platform, href: string
  * Returns whether a launch was attempted.
  */
 export declare function openBrowser(url: string): boolean;
+/**
+ * setTimeout-based sleep that resolves early when `signal` aborts, so an
+ * abandoned device poll does not hold the process open after login finishes.
+ */
+export declare function abortableSleep(ms: number, signal: AbortSignal): Promise<void>;
 /**
  * Await `promise` while emitting a heartbeat tick every `intervalMs`, so a long
  * silent wait (a browser sign-in round-trip) doesn't look hung. `onTick` is

package/dist/lib/oauth.js

@@ -35,6 +35,12 @@ const DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 // Loopback login waits at most this long for the browser round-trip before
 // giving up and freeing the port.
 const LOOPBACK_TIMEOUT_MS = 5 * 60 * 1000;
+// Browser login also starts a device authorization (RFC 8628) when the AS offers
+// one, so the login can be approved from ANOTHER device: someone who signs up in
+// the browser and confirms the email on their phone. While that is live the
+// loopback listener waits as long as the device code is valid, capped here, so
+// the port is never left open indefinitely.
+const CROSS_DEVICE_MAX_WAIT_MS = 15 * 60 * 1000;
 // Cadence for the "…still waiting for you to finish signing in" heartbeat that
 // both interactive login poll loops emit, so a multi-minute browser sign-in
 // doesn't read as a hung CLI (matches the card-write retry tick in try-me).
@@ -111,7 +117,8 @@ async function oauthFetch(what, url, init = {}) {
 let cachedMetadata = null;
 /**
  * Fetch (and process-cache) the AS metadata document. We resolve it relative to
- * the active API base URL so staging/local point at their own AS.
+ * the active API base URL so local (and any non-default `Environment`) points
+ * at its own AS.
  */
 export async function discover() {
     if (cachedMetadata)
@@ -208,46 +215,120 @@ function tokensFromResponse(data) {
  * scoped tokens plus the client_id that was used (so the caller can persist it
  * for refresh). `openUrl` is injectable so tests can drive the flow without
  * spawning a real browser.
+ *
+ * Cross-device completion: when the AS advertises a device authorization
+ * endpoint, this also starts an RFC 8628 device authorization for the same
+ * client and prints its code with the verification URI. The login then
+ * finishes on whichever comes first: the loopback redirect (same machine) or an
+ * approval of the device code from any browser (e.g. the phone that opened the
+ * sign-up confirmation email), where the person types the code from this
+ * terminal. The code is never put in the authorize URL or any other link, so
+ * nothing that opens in a browser can approve this login without the person
+ * typing it. Tokens only ever come back to this process: the loopback code
+ * needs our PKCE verifier and the device grant needs our device_code. If the
+ * device authorization cannot be started, the login is exactly the loopback
+ * flow it always was.
  */
 export async function loginWithLoopback(openUrl = openBrowser, opts = {}) {
     const meta = await discover();
     const pkce = generatePkce();
     const state = crypto.randomBytes(16).toString("hex");
-    const { port, codePromise, close } = await startLoopbackServer(state);
+    const { port, codePromise, close, setTimeoutMs } = await startLoopbackServer(state);
     const redirectUri = `http://127.0.0.1:${port}/callback`;
-    // Register a client bound to the exact loopback redirect URI. OAuth 2.1
-    // requires exact redirect_uri matching, and the loopback port is ephemeral,
-    // so we register per-login (cheap, public client, no secret).
-    const clientId = await registerClient([redirectUri]);
-    const authUrl = new URL(meta.authorization_endpoint);
-    authUrl.searchParams.set("response_type", "code");
-    authUrl.searchParams.set("client_id", clientId);
-    authUrl.searchParams.set("redirect_uri", redirectUri);
-    authUrl.searchParams.set("scope", negotiateScopes(meta));
-    authUrl.searchParams.set("state", state);
-    authUrl.searchParams.set("code_challenge", pkce.challenge);
-    authUrl.searchParams.set("code_challenge_method", pkce.method);
-    // A Mnemom Agent invitation (`mnemom agent --invite`) rides along so a NEW
-    // invitee who signs up in this browser round-trip skips the confirmation
-    // email: the AS ignores the param but bounces a signed-out browser to /login
-    // with this exact URL as return_to, and sign-up forwards the token to the api.
-    if (opts.inviteToken)
-        authUrl.searchParams.set("invite_token", opts.inviteToken);
-    console.log("Opening browser to authenticate...");
-    console.log(`If the browser doesn't open, visit:\n  ${authUrl.toString()}\n`);
-    openUrl(authUrl.toString());
-    console.log("Waiting for authentication...");
+    const stopPolling = new AbortController();
     try {
-        // Heartbeat while we await the loopback redirect — otherwise the sign-in
-        // round-trip is dead silent and reads as a hung CLI.
-        const code = await withHeartbeat(codePromise, LOGIN_HEARTBEAT_MS, (s) => console.log(`…still waiting for you to finish signing in (${s}s)`));
-        const tokens = await exchangeCode(meta, clientId, code, pkce.verifier, redirectUri);
+        // Register a client bound to the exact loopback redirect URI. OAuth 2.1
+        // requires exact redirect_uri matching, and the loopback port is ephemeral,
+        // so we register per-login (cheap, public client, no secret). The same
+        // client also runs the device grant, so either path refreshes the same way.
+        const clientId = await registerClient([redirectUri]);
+        const device = await startCrossDeviceAuthorization(meta, clientId);
+        const authUrl = new URL(meta.authorization_endpoint);
+        authUrl.searchParams.set("response_type", "code");
+        authUrl.searchParams.set("client_id", clientId);
+        authUrl.searchParams.set("redirect_uri", redirectUri);
+        authUrl.searchParams.set("scope", negotiateScopes(meta));
+        authUrl.searchParams.set("state", state);
+        authUrl.searchParams.set("code_challenge", pkce.challenge);
+        authUrl.searchParams.set("code_challenge_method", pkce.method);
+        // A Mnemom Agent invitation (`mnemom agent --invite`) rides along so a NEW
+        // invitee who signs up in this browser round-trip skips the confirmation
+        // email: the AS ignores the param but bounces a signed-out browser to /login
+        // with this exact URL as return_to, and sign-up forwards the token to the api.
+        if (opts.inviteToken)
+            authUrl.searchParams.set("invite_token", opts.inviteToken);
+        console.log("Opening browser to authenticate...");
+        console.log(`If the browser doesn't open, visit:\n  ${authUrl.toString()}\n`);
+        if (device) {
+            setTimeoutMs(crossDeviceWaitMs(device.expires_in));
+            // The plain verification_uri, never verification_uri_complete: the person
+            // types the code there, so a link alone can never approve this login.
+            console.log(`Confirming on another device? Open ${device.verification_uri} and enter: ${device.user_code}\n`);
+        }
+        openUrl(authUrl.toString());
+        console.log("Waiting for authentication...");
+        const viaLoopback = codePromise.then((code) => exchangeCode(meta, clientId, code, pkce.verifier, redirectUri));
+        const viaDevice = device
+            ? pollDeviceToken(meta, clientId, device, opts.sleep ?? ((ms) => abortableSleep(ms, stopPolling.signal)), 
+            // The loopback wait below already prints the heartbeat.
+            () => { }, stopPolling.signal)
+            : null;
+        // Heartbeat while we wait — otherwise the sign-in round-trip is dead
+        // silent and reads as a hung CLI.
+        const tokens = await withHeartbeat(firstLogin(viaLoopback, viaDevice), LOGIN_HEARTBEAT_MS, (s) => console.log(`…still waiting for you to finish signing in (${s}s)`));
         return { tokens, clientId };
     }
     finally {
+        stopPolling.abort();
         close();
     }
 }
+/**
+ * Start the device authorization that lets a browser login be approved from
+ * another device. Best-effort: an AS without the endpoint, or any failure,
+ * returns null and the login carries on as loopback only.
+ */
+async function startCrossDeviceAuthorization(meta, clientId) {
+    if (!meta.device_authorization_endpoint)
+        return null;
+    try {
+        const authz = await requestDeviceAuthorization(meta.device_authorization_endpoint, meta, clientId);
+        if (typeof authz.device_code !== "string" ||
+            typeof authz.user_code !== "string" ||
+            typeof authz.verification_uri !== "string" ||
+            typeof authz.expires_in !== "number") {
+            return null;
+        }
+        return authz;
+    }
+    catch {
+        return null;
+    }
+}
+/** How long the loopback listener waits while a device code is live. */
+export function crossDeviceWaitMs(expiresInSec) {
+    const ms = Number.isFinite(expiresInSec) ? expiresInSec * 1000 : 0;
+    return Math.min(Math.max(ms, LOOPBACK_TIMEOUT_MS), CROSS_DEVICE_MAX_WAIT_MS);
+}
+/**
+ * Settle with whichever login path finishes first.
+ *   - The loopback path settles the login either way, exactly as before: a
+ *     denial, a state mismatch or the timeout in the browser ends it.
+ *   - The device path ends it on success, or when the person explicitly denies
+ *     the device code. Any other device failure (expiry, a transport error)
+ *     only drops that path and the loopback wait continues.
+ */
+export function firstLogin(viaLoopback, viaDevice) {
+    if (!viaDevice)
+        return viaLoopback;
+    return new Promise((resolve, reject) => {
+        viaLoopback.then(resolve, reject);
+        viaDevice.then(resolve, (err) => {
+            if (err instanceof Error && err.message === DEVICE_ACCESS_DENIED)
+                reject(err);
+        });
+    });
+}
 /**
  * Start a loopback HTTP listener that captures the OAuth redirect
  * (GET /callback?code=...&state=...). Resolves with the authorization code once
@@ -293,13 +374,18 @@ function startLoopbackServer(expectedState) {
     return new Promise((resolve) => {
         server.listen(0, "127.0.0.1", () => {
             const port = server.address().port;
-            const timeout = setTimeout(() => {
+            const giveUp = () => {
                 rejectCode(new Error("Login timed out. Please try again."));
                 server.close();
-            }, LOOPBACK_TIMEOUT_MS);
+            };
+            let timeout = setTimeout(giveUp, LOOPBACK_TIMEOUT_MS);
             resolve({
                 port,
                 codePromise,
+                setTimeoutMs: (ms) => {
+                    clearTimeout(timeout);
+                    timeout = setTimeout(giveUp, ms);
+                },
                 close: () => {
                     clearTimeout(timeout);
                     server.close();
@@ -358,18 +444,7 @@ export async function loginWithDevice(opts) {
     // clients"). Register a loopback placeholder — it satisfies validation and is
     // never used, since the device grant never redirects.
     const clientId = await registerClient(["http://127.0.0.1/callback"]);
-    const authzRes = await oauthFetch("Device authorization at", meta.device_authorization_endpoint, {
-        method: "POST",
-        headers: {
-            "Content-Type": "application/x-www-form-urlencoded",
-            Accept: "application/json",
-        },
-        body: new URLSearchParams({ client_id: clientId, scope: negotiateScopes(meta) }),
-    });
-    if (!authzRes.ok) {
-        throw new Error(`Device authorization failed: ${await oauthError(authzRes)}`);
-    }
-    const authz = (await authzRes.json());
+    const authz = await requestDeviceAuthorization(meta.device_authorization_endpoint, meta, clientId);
     display("");
     display("To authenticate, visit:");
     display(`  ${authz.verification_uri}`);
@@ -385,7 +460,26 @@ export async function loginWithDevice(opts) {
     const tokens = await pollDeviceToken(meta, clientId, authz, sleep, display);
     return { tokens, clientId };
 }
-async function pollDeviceToken(meta, clientId, authz, sleep, display) {
+/** POST the device authorization request (RFC 8628 §3.1) for `clientId`. */
+async function requestDeviceAuthorization(endpoint, meta, clientId) {
+    const authzRes = await oauthFetch("Device authorization at", endpoint, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+            Accept: "application/json",
+        },
+        body: new URLSearchParams({ client_id: clientId, scope: negotiateScopes(meta) }),
+    });
+    if (!authzRes.ok) {
+        throw new Error(`Device authorization failed: ${await oauthError(authzRes)}`);
+    }
+    return (await authzRes.json());
+}
+/** The message a device-code denial rejects with (matched by firstLogin). */
+const DEVICE_ACCESS_DENIED = "Authorization was denied.";
+/** Thrown into an abandoned device poll once the other login path has won. */
+const POLL_STOPPED = "Device polling stopped.";
+async function pollDeviceToken(meta, clientId, authz, sleep, display, signal) {
     // RFC 8628 §3.5: default interval is 5s if the server omits it; on slow_down
     // we increase the interval by 5s and keep that as the new minimum.
     let intervalMs = (authz.interval ?? 5) * 1000;
@@ -399,6 +493,8 @@ async function pollDeviceToken(meta, clientId, authz, sleep, display) {
             throw new Error("Device authorization expired before approval. Please try again.");
         }
         await sleep(intervalMs);
+        if (signal?.aborted)
+            throw new Error(POLL_STOPPED);
         waitedMs += intervalMs;
         let res;
         try {
@@ -437,7 +533,7 @@ async function pollDeviceToken(meta, clientId, authz, sleep, display) {
             case "expired_token":
                 throw new Error("Device authorization expired before approval. Please try again.");
             case "access_denied":
-                throw new Error("Authorization was denied.");
+                throw new Error(DEVICE_ACCESS_DENIED);
             default:
                 throw new Error(`Device authorization failed: ${body.error ?? `HTTP ${res.status}`}` +
                     (body.error_description ? ` — ${body.error_description}` : ""));
@@ -623,6 +719,23 @@ export function openBrowser(url) {
 function defaultSleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
+/**
+ * setTimeout-based sleep that resolves early when `signal` aborts, so an
+ * abandoned device poll does not hold the process open after login finishes.
+ */
+export function abortableSleep(ms, signal) {
+    return new Promise((resolve) => {
+        if (signal.aborted)
+            return resolve();
+        const done = () => {
+            clearTimeout(timer);
+            signal.removeEventListener("abort", done);
+            resolve();
+        };
+        const timer = setTimeout(done, ms);
+        signal.addEventListener("abort", done, { once: true });
+    });
+}
 /**
  * Await `promise` while emitting a heartbeat tick every `intervalMs`, so a long
  * silent wait (a browser sign-in round-trip) doesn't look hung. `onTick` is

package/dist/lib/statusline-bin.d.ts

@@ -1,5 +1,5 @@
 /**
- * Entry for the `mnemom agent` status-bar counter (lib/statusline.ts). Claude Code runs it
- * on every status update, so it imports only the counter — not the whole CLI.
+ * Entry for the `mnemom agent` status-bar segment (lib/statusline.ts). Claude Code runs it
+ * on every status update, so it imports only the segment — not the whole CLI.
  */
 export {};

package/dist/lib/statusline-bin.js

@@ -1,17 +1,14 @@
 /**
- * Entry for the `mnemom agent` status-bar counter (lib/statusline.ts). Claude Code runs it
- * on every status update, so it imports only the counter — not the whole CLI.
+ * Entry for the `mnemom agent` status-bar segment (lib/statusline.ts). Claude Code runs it
+ * on every status update, so it imports only the segment — not the whole CLI.
  */
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { INNER_ENV, measuredMode, render } from "./statusline.js";
+import { FEED_ENV, INNER_ENV, render } from "./statusline.js";
 const chunks = [];
 process.stdin.on("data", (c) => chunks.push(c));
 process.stdin.on("end", () => {
     const line = render(Buffer.concat(chunks).toString("utf8"), {
-        stateDir: join(homedir(), ".mnemom", "statusline"),
         inner: process.env[INNER_ENV] || undefined,
-        measured: measuredMode(process.env),
+        feed: process.env[FEED_ENV] || undefined,
     });
     process.stdout.write(`${line}\n`);
 });

package/dist/lib/statusline-feed.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The launcher side of the fed status line (W1.4, decision 14), prerelease only.
+ *
+ * The local base-URL proxy records the gateway's `x-mnemom-lineage-key` for this session in
+ * its record-state file (the one the conduct receipt reads). While Claude Code runs, the launcher reads Record's accumulator totals for that
+ * lineage every few seconds and writes them to the feed file the status-line bin reads
+ * (lib/statusline.ts). The bin never touches the network.
+ *
+ * Fail open everywhere: no lineage yet, a dark route (404), a non-billing role (403) or any
+ * error leaves the feed as it was, so the status line stays "mnemom" until fed.
+ */
+import { type RecordTotals } from "./api.js";
+/** How often the launcher re-reads the totals. */
+export declare const FEED_INTERVAL_MS = 10000;
+export interface FeedOptions {
+    /** The proxy's record-state JSON (MNEMOM_AGENT_BU_RECORD_STATE), carrying `lineage_key`. */
+    recordStateFile: string;
+    /** Read by the status-line bin (MNEMOM_STATUSLINE_FEED). */
+    feedFile: string;
+    orgId: string;
+    intervalMs?: number;
+    /** Test seam; the real read is getRecordTotals (throws on any non-200). */
+    fetchTotals?: (orgId: string, lineageKey: string) => Promise<RecordTotals | null>;
+}
+/**
+ * The lineage key the proxy recorded, or null when there is none (yet) or it is not the
+ * gateway's `cid:`/`cr:` shape (the proxy's own check is looser; this read is exact).
+ */
+export declare function readLineage(path: string): string | null;
+/** One poll: read the lineage, fetch its totals, write the feed. Never throws. */
+export declare function feedOnce(o: FeedOptions): Promise<boolean>;
+/** Poll until stopped. The timer is unref'd, so it never holds the launcher open. */
+export declare function startFeed(o: FeedOptions): () => void;