@mnemom/mnemom 0.17.31 → 0.17.32-next.1

package/dist/lib/agent.js

@@ -22,6 +22,7 @@
 import { createHash, randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
+import { canonicalJson } from "./canonical-json.js";
 import { getGatewayUrl } from "./config.js";
 import { normSession } from "./slack-route.js";
 /** The us-2/prod gateway host. The default door — never any other cell silently. */
@@ -313,6 +314,13 @@ export function readCcSettings(opts) {
             const view = {};
             if (typeof o.model === "string")
                 view.model = o.model;
+            if (o.attribution === false)
+                view.commitAttribution = false;
+            else if (o.attribution && typeof o.attribution === "object") {
+                const commit = o.attribution.commit;
+                if (typeof commit === "string")
+                    view.commitAttribution = commit;
+            }
             if (o.env && typeof o.env === "object") {
                 view.env = Object.fromEntries(Object.entries(o.env).filter((e) => typeof e[1] === "string"));
             }
@@ -438,6 +446,7 @@ export const AGENT_SUB_VERBS = new Set([
     "move",
     "export",
     "sessions",
+    "fuel",
     "show",
     "goal",
 ]);
@@ -480,23 +489,7 @@ export function isPositiveNumber(value) {
     const n = Number(s);
     return Number.isFinite(n) && n > 0;
 }
-/**
- * Canonical JSON — object keys sorted recursively, arrays in order, no
- * whitespace, `undefined` keys dropped. Byte-identical to the gateway's
- * `canonicalJson` (gateway/src/goal-contract.ts), so the base64 we send and the
- * sha we print match what the gateway seals.
- */
-export function canonicalJson(value) {
-    if (value === null || typeof value !== "object")
-        return JSON.stringify(value);
-    if (Array.isArray(value))
-        return `[${value.map(canonicalJson).join(",")}]`;
-    const obj = value;
-    const keys = Object.keys(obj)
-        .filter((k) => obj[k] !== undefined)
-        .sort();
-    return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(obj[k])}`).join(",")}}`;
-}
+export { canonicalJson } from "./canonical-json.js";
 /** sha256 hex (first 16 chars) of a string — the operator-eyeball contract hash. */
 export function sha256Hex16(text) {
     return createHash("sha256").update(text, "utf8").digest("hex").slice(0, 16);
@@ -652,7 +645,8 @@ export const COMPACTION_INTERCEPT_KEY = "GATEWAY_COMPACTION_INTERCEPT";
 /**
  * The gateway env key that has it measure each request's saving for a single session and put
  * it in the client-facing usage (`mnemom_savings` in the read `usage.iterations` entry), where
- * the status bar reads it from Claude Code's transcript. Default OFF on the gateway; sent `"on"`
+ * it lands in Claude Code's transcript. The status bar never shows it (decision 14: never
+ * "saved"). Default OFF on the gateway; sent `"on"`
  * only while the `measured-savings` experimental feature is on and the launched CLI is Claude
  * Code (`resolveUsageSavings`). Independent of folding, so every profile sends it — `off` too,
  * where the measured saving is honestly $0.00.
@@ -1283,9 +1277,9 @@ export function resolveCompactionIntercept(opts) {
     return !(raw === "0" || raw === "false" || raw === "off" || raw === "no");
 }
 /**
- * Does the gateway measure this launch's saving (`GATEWAY_USAGE_SAVINGS` in the header, and the
- * status bar in measured mode)? Only with the `measured-savings` experimental feature on, and
- * only for Claude Code — the one CLI whose status bar reads the measurement. No flag or
+ * Does the gateway measure this launch's saving (`GATEWAY_USAGE_SAVINGS` in the header)? Only
+ * with the `measured-savings` experimental feature on, and only for Claude Code, whose
+ * transcript keeps the measurement. No flag or
  * launcher.toml key: `mnemom experimental enable measured-savings` is the switch.
  */
 export function resolveUsageSavings(opts) {
@@ -1333,27 +1327,42 @@ export function buildHandoffMcpConfig(p) {
 export function buildHandoffMcpConfigJson(p) {
     return JSON.stringify(buildHandoffMcpConfig(p));
 }
+/** Does a Claude Code passthrough run headless (`-p` / `--print`)? */
+export function passthroughIsPrint(passthrough) {
+    return passthrough.some((a) => a === "-p" || a === "--print" || a.startsWith("--print="));
+}
 /**
  * Is this launch implicit-mode? Precedence, highest wins:
  *   1. an explicit flag — `--implicit` (true) or `--no-implicit` (false);
  *   2. a `--goal` statement — a sealed contract is a per-launch choice that the
- *      standing config default must never silently override;
+ *      standing config default must never silently override, so a launch never
+ *      runs both modes;
  *   3. the config default `goal_mode` — `"off"` turns alignment off, `"implicit"`
  *      keeps it implicit;
- *   4. with the `implicit` experimental feature ON, IMPLICIT: the gateway infers
- *      the goal from the user's own messages (turn it off for a launch with
- *      `--no-implicit`, or standing with `goal_mode = "off"`); with it OFF (the
- *      default), OFF.
+ *   4. with the `implicit` experimental feature ON, IMPLICIT (as before T16);
+ *   5. on a prerelease (`next`) build, IMPLICIT for an interactive or Remote Control
+ *      launch and OFF for a headless `-p` one (OD-13: T16 never covers `-p`);
+ *   6. otherwise OFF — stable without the experimental feature behaves as today.
  * Pure so every arm is unit-tested; the caller passes the resolved value on to
  * `assembleContract` / `buildGoalModeHeader` (which still refuse `--implicit`
  * combined with a contract flag — that conflict is EXPLICIT and is reported).
  */
-export function resolveImplicit(opts) {
+export function resolveImplicitSource(opts) {
     if (opts.implicit !== undefined)
-        return opts.implicit;
+        return { implicit: opts.implicit, source: "flag" };
     if (hasText(opts.goal))
-        return false;
-    if (opts.experimentalOn === false)
-        return false;
-    return opts.configGoalMode !== "off";
+        return { implicit: false, source: "goal" };
+    const experimentalOn = opts.experimentalOn !== false;
+    if (!experimentalOn && !opts.prerelease)
+        return { implicit: false, source: "default" };
+    if (opts.configGoalMode !== undefined) {
+        return { implicit: opts.configGoalMode === "implicit", source: "config" };
+    }
+    if (experimentalOn)
+        return { implicit: true, source: "experimental" };
+    return { implicit: !opts.print, source: opts.print ? "default" : "prerelease" };
+}
+/** `resolveImplicitSource(opts).implicit`. */
+export function resolveImplicit(opts) {
+    return resolveImplicitSource(opts).implicit;
 }

package/dist/lib/api.d.ts

@@ -236,6 +236,12 @@ export declare function verifyBinding(agentId: string, keyHash: string): Promise
     bound: boolean;
     key_prefix: string | null;
 }>;
+/**
+ * GET /v1/agents/:id, sent with the caller's credentials. The API answers with the projection
+ * the caller may see: the org-member view (claimed_by, org_id, `caller: "org_member"`) for an
+ * agent in one of the caller's orgs, the public view otherwise. A pinned launch needs the member
+ * view, so an unauthenticated read here refuses every pin.
+ */
 export declare function getAgent(id: string): Promise<Agent>;
 export interface AgentListItem {
     id: string;
@@ -431,6 +437,32 @@ export interface MuBalance {
     effectiveMode?: string;
     enforcementPausedReason?: string | null;
 }
+/**
+ * GET /v1/orgs/{org_id}/record/totals?lineage_key= — one lineage's model cost and μ as
+ * decimal-string millimu (`mu_charged_mmu` null until billing commits a charge). Dark unless the
+ * org is in the record-accumulator cohort: a 404 then, like an unknown lineage.
+ */
+export interface RecordTotals {
+    lineage_key: string;
+    model_cost_mmu: string;
+    mu_charged_mmu: string | null;
+    as_of: string;
+    row_count: number;
+}
+export declare function getRecordTotals(orgId: string, lineageKey: string, signal?: AbortSignal): Promise<RecordTotals>;
+/**
+ * Report one commit to Record's commit index (Doors W1.8, lib/commit-report.ts):
+ * `POST /v1/orgs/{org}/record/commits`, body RecordCommit/v1. Returns the HTTP
+ * status, never throws on a non-2xx: the caller fails open on every outcome.
+ */
+export declare function postRecordCommit(orgId: string, body: {
+    schema: "RecordCommit/v1";
+    lineage_key: string;
+    repo: string;
+    branch: string;
+    sha: string;
+    patch_id: string;
+}, signal?: AbortSignal): Promise<number>;
 export declare function getMuBalance(orgId?: string): Promise<MuBalance>;
 /**
  * Mint the one-time `cards:write:protection` capability for an agent — the
@@ -1277,6 +1309,40 @@ export interface OrgUsageQuery {
  * the user "org not found" on what is most often just the flag being off.
  */
 export declare function getOrgUsage(orgId: string, opts?: OrgUsageQuery): Promise<OrgUsageResponse>;
+/** One sealed contract in the batch-seal response (mnemom-api migration 582). */
+export interface SealedContractRow {
+    seal_id: string;
+    ordinal: number;
+    contract_sha256: string;
+    /** The deterministic node identity: `contract:<org_id>:<sha256>`. */
+    node_id: string;
+    version: number;
+    job_key: string | null;
+    canon_status: "pending" | "written";
+}
+/** `POST /v1/orgs/{org_id}/contract-step/batch-seal` 200 body. */
+export interface BatchSealResponse {
+    batch_id: string;
+    replayed: boolean;
+    repo: string;
+    seals: SealedContractRow[];
+    /** Whether the sealed contracts were handed to dispatch: off, enqueued, or deferred (fail open). */
+    dispatch: "off" | "enqueued" | "deferred";
+}
+export interface BatchSealRequest {
+    repo: string;
+    source: "cli";
+    contracts: Array<{
+        contract: unknown;
+        job_key?: string;
+    }>;
+}
+/**
+ * Seal a batch of job contracts in one transaction (Doors fuel step, W3.2). The caller passes the
+ * Idempotency-Key and holds it across retries, so a retried confirmation replays the first batch
+ * instead of sealing twice.
+ */
+export declare function sealContractBatch(orgId: string, body: BatchSealRequest, idempotencyKey: string, githubToken: string): Promise<BatchSealResponse>;
 /** `GET /v1/code/entitlement` 200 body — why Mnemom Agent is enabled for the org. */
 export interface CodeEntitlement {
     org_id: string;

package/dist/lib/api.js

@@ -112,14 +112,6 @@ export async function readApiError(response, fallback) {
         specDeviation: parsed.spec_deviation,
     });
 }
-async function fetchApi(endpoint) {
-    const url = validateUrl(`${API_BASE}${endpoint}`);
-    const response = await mnemomFetch(url);
-    if (!response.ok) {
-        throw await readApiError(response, "API request failed");
-    }
-    return response.json();
-}
 export async function postApi(endpoint, body, opts = {}) {
     const url = validateUrl(`${API_BASE}${endpoint}`);
     const headers = {
@@ -197,8 +189,19 @@ async function fetchWithAuthRetry(url, buildInit) {
         return first;
     return mnemomFetch(url, await buildInit());
 }
+/**
+ * GET /v1/agents/:id, sent with the caller's credentials. The API answers with the projection
+ * the caller may see: the org-member view (claimed_by, org_id, `caller: "org_member"`) for an
+ * agent in one of the caller's orgs, the public view otherwise. A pinned launch needs the member
+ * view, so an unauthenticated read here refuses every pin.
+ */
 export async function getAgent(id) {
-    return fetchApi(`/v1/agents/${id}`);
+    const url = validateUrl(`${API_BASE}/v1/agents/${id}`);
+    const response = await fetchWithAuthRetry(url, async () => ({ headers: await authHeaders() }));
+    if (!response.ok) {
+        throw await readApiError(response, "API request failed");
+    }
+    return (await response.json());
 }
 /**
  * Key-compatible agent listing — `GET /v1/agents` is scoped by the caller's
@@ -405,6 +408,28 @@ export async function getMyPersonalOrg() {
 export async function getMe() {
     return gFetch("/v1/auth/me", {}, { fallback: "Could not read your identity" });
 }
+export async function getRecordTotals(orgId, lineageKey, signal) {
+    return gFetch(`/v1/orgs/${encodeURIComponent(orgId)}/record/totals?lineage_key=${encodeURIComponent(lineageKey)}`, signal ? { signal } : {}, { notFoundLabel: "Record totals", fallback: "Could not read record totals" });
+}
+/**
+ * Report one commit to Record's commit index (Doors W1.8, lib/commit-report.ts):
+ * `POST /v1/orgs/{org}/record/commits`, body RecordCommit/v1. Returns the HTTP
+ * status, never throws on a non-2xx: the caller fails open on every outcome.
+ */
+export async function postRecordCommit(orgId, body, signal) {
+    const url = validateUrl(`${API_BASE}/v1/orgs/${encodeURIComponent(orgId)}/record/commits`);
+    const response = await fetchWithAuthRetry(url, async () => ({
+        method: "POST",
+        headers: {
+            ...(await authHeaders()),
+            Accept: "application/json",
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify(body),
+        ...(signal ? { signal } : {}),
+    }));
+    return response.status;
+}
 export async function getMuBalance(orgId) {
     const q = orgId ? `?org_id=${encodeURIComponent(orgId)}` : "";
     return gFetch(`/v1/billing/mu${q}`, {}, { fallback: "Could not read MU balance" });
@@ -747,7 +772,7 @@ function emptyIntegrityRow(agentId) {
 export async function getTraces(id, limit = 10) {
     const data = await gFetch(`/v1/traces?agent_id=${id}&limit=${limit}`, {}, { fallback: "API request failed" });
     // Accept both the envelope shape (current API) and a bare array (defensive
-    // — staging is mid-deploy when a CLI smoke runs against an older API).
+    // — the test cell is mid-deploy when a CLI smoke runs against an older API).
     if (Array.isArray(data))
         return data;
     return data.traces ?? [];
@@ -1308,6 +1333,7 @@ async function gFetch(path, init = {}, opts = {}) {
             ...(init.headers ?? {}),
         },
         body: init.body,
+        ...(init.signal ? { signal: init.signal } : {}),
     }));
     if (!response.ok) {
         if (response.status === 401)
@@ -1569,6 +1595,20 @@ async function codeFetch(path, init = {}, fallback) {
     }
     return (await response.json());
 }
+/**
+ * Seal a batch of job contracts in one transaction (Doors fuel step, W3.2). The caller passes the
+ * Idempotency-Key and holds it across retries, so a retried confirmation replays the first batch
+ * instead of sealing twice.
+ */
+export async function sealContractBatch(orgId, body, idempotencyKey, githubToken) {
+    return codeFetch(`/v1/orgs/${encodeURIComponent(orgId)}/contract-step/batch-seal`, {
+        method: "POST",
+        body: JSON.stringify(body),
+        // The api checks with this token that the caller can write to the repo (OD-10). It reads
+        // it for that check only and never stores it.
+        headers: { "Idempotency-Key": idempotencyKey, "X-GitHub-Token": githubToken },
+    }, "Could not seal the contracts");
+}
 /** The machine-readable code on the gate's 403 when the org is not enabled. */
 export const CODE_NOT_ENABLED = "code_not_enabled";
 /**

package/dist/lib/canonical-json.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Canonical JSON: the one place the CLI serialises a contract for hashing. Kept in its own module,
+ * with no imports, so the contract hash helper and the thin runner can use it without loading
+ * agent.ts. `agent.ts` re-exports it for its existing importers.
+ */
+/**
+ * Canonical JSON — object keys sorted recursively, arrays in order, no
+ * whitespace, `undefined` keys dropped. Byte-identical to the gateway's
+ * `canonicalJson` (gateway/src/goal-contract.ts), so the base64 we send and the
+ * sha we print match what the gateway seals.
+ */
+export declare function canonicalJson(value: unknown): string;

package/dist/lib/canonical-json.js

@@ -0,0 +1,22 @@
+/**
+ * Canonical JSON: the one place the CLI serialises a contract for hashing. Kept in its own module,
+ * with no imports, so the contract hash helper and the thin runner can use it without loading
+ * agent.ts. `agent.ts` re-exports it for its existing importers.
+ */
+/**
+ * Canonical JSON — object keys sorted recursively, arrays in order, no
+ * whitespace, `undefined` keys dropped. Byte-identical to the gateway's
+ * `canonicalJson` (gateway/src/goal-contract.ts), so the base64 we send and the
+ * sha we print match what the gateway seals.
+ */
+export function canonicalJson(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(",")}]`;
+    const obj = value;
+    const keys = Object.keys(obj)
+        .filter((k) => obj[k] !== undefined)
+        .sort();
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(obj[k])}`).join(",")}}`;
+}

package/dist/lib/commit-report.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Door one's commit reporting (Doors W1.8, OD-3, OD-5): the launcher adds the
+ * `Mnemom-Conversation` trailer and reports every commit the session makes to
+ * Record's commit index, so the PR record reads "N of M commits bound" with N
+ * equal to M.
+ *
+ * TRAILER. Claude Code writes `attribution.commit` into each commit it makes; the
+ * launcher passes it through `--settings` (OD-3). The model writes it, so it is
+ * best-effort; the commit index is the proof. The user's own commit attribution
+ * (or Claude Code's default Co-Authored-By line) is kept in front of ours, because
+ * a `--settings` value replaces theirs.
+ *
+ * INDEX. While Claude Code runs, the launcher looks for commits made in this
+ * repository since the launch, on local branches, by this repository's git user,
+ * and POSTs each one (sha, `git patch-id --stable`, branch, repo) to
+ * `POST /v1/orgs/{org}/record/commits` under the session's lineage key: the
+ * gateway's `x-mnemom-lineage-key`, captured by the local proxy into the
+ * record-state file (the CLI never derives one). Every session commit is
+ * reported, trailer or not: a commit is bound when the index holds its sha or
+ * patch-id, never by its trailer alone.
+ *
+ * PRERELEASE DEFAULT. On for a prerelease build (`next`), off for stable;
+ * MNEMOM_AGENT_COMMIT_REPORT=on|off overrides, and any other value reads off.
+ *
+ * FAIL OPEN. Nothing here throws into the launch or changes its exit code. A
+ * dark route (404) stops reporting for the session; a failed POST is retried on
+ * the next poll; a commit whose fields cannot be read is not sent (it stays
+ * unbound rather than a doomed request). The final sweep at exit races a hard
+ * deadline.
+ */
+export declare const COMMIT_REPORT_ENV = "MNEMOM_AGENT_COMMIT_REPORT";
+export declare const TRAILER_KEY = "Mnemom-Conversation";
+/** Claude Code's own commit attribution when none is configured (settings reference, `attribution`). */
+export declare const CC_DEFAULT_COMMIT_ATTRIBUTION = "Co-Authored-By: Claude <noreply@anthropic.com>";
+/** How often the launcher looks for new commits while the session runs. */
+export declare const COMMIT_POLL_MS = 5000;
+/** The final sweep at exit shares W1.3's 2 s exit budget with the conduct receipt. */
+export declare const COMMIT_FINAL_DEADLINE_MS = 1500;
+/** on | off | unset (prerelease default); any other value reads off. */
+export declare function commitReportEnabled(raw: string | undefined, version: string): boolean;
+/**
+ * The `--settings` fragment carrying the trailer. `user` is the commit attribution
+ * the user's settings files give (highest precedence first; `false` hides all
+ * attribution, an empty string hides the commit line): it is kept in front of ours.
+ */
+export declare function attributionSettings(conversationId: string, user: string | false | undefined): {
+    attribution: {
+        commit: string;
+    };
+};
+/** `owner/name` from a GitHub remote URL (https, ssh or scp form), or null. */
+export declare function parseRepoSlug(url: string): string | null;
+/** The commit index body's schema tag (shared with the fleet worker's reporter). */
+export declare const COMMIT_SCHEMA = "RecordCommit/v1";
+/** RecordCommit/v1: strings only, every field required; the route rejects an unknown field. */
+export interface RecordCommitBody {
+    schema: typeof COMMIT_SCHEMA;
+    lineage_key: string;
+    repo: string;
+    branch: string;
+    sha: string;
+    patch_id: string;
+}
+/** Runs git in the session's repository; null on any failure. */
+export type Git = (args: string[], input?: string) => string | null;
+export declare function realGit(cwd: string): Git;
+/**
+ * Commits made since `sinceSec` (committer time) on local branches by this
+ * repository's git user, oldest first. Remote-tracking refs are left out, so a
+ * teammate's fetched commit is never reported as this session's.
+ */
+export declare function sessionCommits(git: Git, sinceSec: number): string[];
+/** The body for one commit, or the fields that could not be read. */
+export declare function commitBody(git: Git, sha: string, lineageKey: string): {
+    ok: true;
+    body: RecordCommitBody;
+} | {
+    ok: false;
+    missing: string[];
+};
+export type PostResult = "ok" | "dark" | "retry" | "drop";
+export interface ReporterOptions {
+    orgId: string;
+    /** The proxy's record-state file, carrying the gateway's lineage key. */
+    recordStateFile: string;
+    /** Launch time, seconds since the epoch: commits before it are not the session's. */
+    sinceSec: number;
+    git: Git;
+    intervalMs?: number;
+    /** Test seam; the real one is postRecordCommit. */
+    post?: (orgId: string, body: RecordCommitBody, signal: AbortSignal) => Promise<PostResult>;
+    now?: () => number;
+}
+/** postRecordCommit as a PostResult: 404 dark, 429/5xx/network retry, any other 4xx drop. */
+export declare function postCommit(orgId: string, body: RecordCommitBody, signal: AbortSignal): Promise<PostResult>;
+/** The reporter's state across polls (exported for tests). */
+export interface ReporterState {
+    done: Set<string>;
+    dark: boolean;
+}
+/** One sweep: report every session commit not reported yet. Never throws. */
+export declare function reportOnce(o: ReporterOptions, state: ReporterState, signal: AbortSignal): Promise<void>;
+/**
+ * Poll while the session runs; the returned `finish` runs one last sweep under
+ * a hard deadline and stops the timer. The timer is unref'd.
+ */
+export declare function startCommitReporter(o: ReporterOptions): {
+    finish: (deadlineMs?: number) => Promise<void>;
+};

package/dist/lib/commit-report.js

@@ -0,0 +1,205 @@
+/**
+ * Door one's commit reporting (Doors W1.8, OD-3, OD-5): the launcher adds the
+ * `Mnemom-Conversation` trailer and reports every commit the session makes to
+ * Record's commit index, so the PR record reads "N of M commits bound" with N
+ * equal to M.
+ *
+ * TRAILER. Claude Code writes `attribution.commit` into each commit it makes; the
+ * launcher passes it through `--settings` (OD-3). The model writes it, so it is
+ * best-effort; the commit index is the proof. The user's own commit attribution
+ * (or Claude Code's default Co-Authored-By line) is kept in front of ours, because
+ * a `--settings` value replaces theirs.
+ *
+ * INDEX. While Claude Code runs, the launcher looks for commits made in this
+ * repository since the launch, on local branches, by this repository's git user,
+ * and POSTs each one (sha, `git patch-id --stable`, branch, repo) to
+ * `POST /v1/orgs/{org}/record/commits` under the session's lineage key: the
+ * gateway's `x-mnemom-lineage-key`, captured by the local proxy into the
+ * record-state file (the CLI never derives one). Every session commit is
+ * reported, trailer or not: a commit is bound when the index holds its sha or
+ * patch-id, never by its trailer alone.
+ *
+ * PRERELEASE DEFAULT. On for a prerelease build (`next`), off for stable;
+ * MNEMOM_AGENT_COMMIT_REPORT=on|off overrides, and any other value reads off.
+ *
+ * FAIL OPEN. Nothing here throws into the launch or changes its exit code. A
+ * dark route (404) stops reporting for the session; a failed POST is retried on
+ * the next poll; a commit whose fields cannot be read is not sent (it stays
+ * unbound rather than a doomed request). The final sweep at exit races a hard
+ * deadline.
+ */
+import { spawnSync } from "node:child_process";
+import { postRecordCommit } from "./api.js";
+import { readLineage } from "./statusline-feed.js";
+import { isPrerelease } from "./update/semver.js";
+export const COMMIT_REPORT_ENV = "MNEMOM_AGENT_COMMIT_REPORT";
+export const TRAILER_KEY = "Mnemom-Conversation";
+/** Claude Code's own commit attribution when none is configured (settings reference, `attribution`). */
+export const CC_DEFAULT_COMMIT_ATTRIBUTION = "Co-Authored-By: Claude <noreply@anthropic.com>";
+/** How often the launcher looks for new commits while the session runs. */
+export const COMMIT_POLL_MS = 5_000;
+/** The final sweep at exit shares W1.3's 2 s exit budget with the conduct receipt. */
+export const COMMIT_FINAL_DEADLINE_MS = 1_500;
+const HEX40 = /^[0-9a-f]{40}$/;
+const REPO_SLUG = /^[A-Za-z0-9_.-]{1,100}\/[A-Za-z0-9_.-]{1,100}$/;
+const BRANCH_MAX = 255;
+/** on | off | unset (prerelease default); any other value reads off. */
+export function commitReportEnabled(raw, version) {
+    const v = (raw ?? "").trim().toLowerCase();
+    if (v === "")
+        return isPrerelease(version);
+    return ["on", "1", "true", "yes"].includes(v);
+}
+/**
+ * The `--settings` fragment carrying the trailer. `user` is the commit attribution
+ * the user's settings files give (highest precedence first; `false` hides all
+ * attribution, an empty string hides the commit line): it is kept in front of ours.
+ */
+export function attributionSettings(conversationId, user) {
+    const ours = `${TRAILER_KEY}: ${conversationId}`;
+    const base = user === undefined ? CC_DEFAULT_COMMIT_ATTRIBUTION : user === false ? "" : user;
+    return { attribution: { commit: base.trim() ? `${base.trimEnd()}\n${ours}` : ours } };
+}
+/** `owner/name` from a GitHub remote URL (https, ssh or scp form), or null. */
+export function parseRepoSlug(url) {
+    const m = /github\.com[:/]+([^/\s]+)\/([^/\s]+?)(?:\.git)?\/?$/i.exec(url.trim());
+    if (!m)
+        return null;
+    const slug = `${m[1]}/${m[2]}`;
+    return REPO_SLUG.test(slug) ? slug : null;
+}
+/** The commit index body's schema tag (shared with the fleet worker's reporter). */
+export const COMMIT_SCHEMA = "RecordCommit/v1";
+export function realGit(cwd) {
+    return (args, input) => {
+        const r = spawnSync("git", args, { cwd, encoding: "utf8", input, timeout: 10_000 });
+        return r.status === 0 ? r.stdout : null;
+    };
+}
+/**
+ * Commits made since `sinceSec` (committer time) on local branches by this
+ * repository's git user, oldest first. Remote-tracking refs are left out, so a
+ * teammate's fetched commit is never reported as this session's.
+ */
+export function sessionCommits(git, sinceSec) {
+    const email = (git(["config", "user.email"]) ?? "").trim();
+    if (!email)
+        return [];
+    const out = git(["log", "--branches", "--reverse", `--since=@${sinceSec}`, "--format=%H%x09%ce"]);
+    if (out === null)
+        return [];
+    return out
+        .split("\n")
+        .map((l) => l.split("\t"))
+        .filter(([sha, ce]) => sha !== undefined && HEX40.test(sha) && ce === email)
+        .map(([sha]) => sha);
+}
+/** The body for one commit, or the fields that could not be read. */
+export function commitBody(git, sha, lineageKey) {
+    const diff = git(["diff-tree", "-p", "--root", sha]);
+    const patchId = diff
+        ? (/^\s*([0-9a-f]{40})\b/.exec(git(["patch-id", "--stable"], diff) ?? "")?.[1] ?? "")
+        : "";
+    const current = (git(["symbolic-ref", "--quiet", "--short", "HEAD"]) ?? "").trim();
+    const holders = (git(["for-each-ref", "--contains", sha, "--format=%(refname:short)", "refs/heads"]) ?? "")
+        .split("\n")
+        .map((s) => s.trim())
+        .filter(Boolean);
+    const branch = holders.includes(current) ? current : (holders[0] ?? "");
+    const repo = parseRepoSlug(git(["remote", "get-url", "origin"]) ?? "") ?? "";
+    const missing = [];
+    if (!HEX40.test(sha))
+        missing.push("sha");
+    // A merge commit's or an empty commit's diff has no patch-id.
+    if (!HEX40.test(patchId))
+        missing.push("patch_id");
+    if (!branch || branch.length > BRANCH_MAX)
+        missing.push("branch");
+    if (!repo)
+        missing.push("repo");
+    if (missing.length > 0)
+        return { ok: false, missing };
+    return {
+        ok: true,
+        body: { schema: COMMIT_SCHEMA, lineage_key: lineageKey, repo, branch, sha, patch_id: patchId },
+    };
+}
+/** postRecordCommit as a PostResult: 404 dark, 429/5xx/network retry, any other 4xx drop. */
+export async function postCommit(orgId, body, signal) {
+    try {
+        const status = await postRecordCommit(orgId, body, signal);
+        if (status >= 200 && status < 300)
+            return "ok";
+        if (status === 404)
+            return "dark";
+        if (status === 429 || status >= 500)
+            return "retry";
+        return "drop";
+    }
+    catch {
+        return "retry";
+    }
+}
+/** One sweep: report every session commit not reported yet. Never throws. */
+export async function reportOnce(o, state, signal) {
+    if (state.dark)
+        return;
+    const lineageKey = readLineage(o.recordStateFile);
+    if (!lineageKey)
+        return;
+    for (const sha of sessionCommits(o.git, o.sinceSec)) {
+        if (state.done.has(sha) || signal.aborted)
+            continue;
+        const built = commitBody(o.git, sha, lineageKey);
+        if (!built.ok) {
+            state.done.add(sha);
+            continue;
+        }
+        const r = await (o.post ?? postCommit)(o.orgId, built.body, signal);
+        if (r === "dark") {
+            state.dark = true;
+            return;
+        }
+        if (r !== "retry")
+            state.done.add(sha);
+    }
+}
+/**
+ * Poll while the session runs; the returned `finish` runs one last sweep under
+ * a hard deadline and stops the timer. The timer is unref'd.
+ */
+export function startCommitReporter(o) {
+    const state = { done: new Set(), dark: false };
+    let running = null;
+    const sweep = (signal) => {
+        running ??= reportOnce(o, state, signal)
+            .catch(() => undefined)
+            .finally(() => {
+            running = null;
+        });
+        return running;
+    };
+    const timer = setInterval(() => void sweep(AbortSignal.timeout(o.intervalMs ?? COMMIT_POLL_MS)), o.intervalMs ?? COMMIT_POLL_MS);
+    timer.unref();
+    return {
+        async finish(deadlineMs = COMMIT_FINAL_DEADLINE_MS) {
+            clearInterval(timer);
+            const signal = AbortSignal.timeout(deadlineMs);
+            let timeout;
+            const deadline = new Promise((r) => {
+                timeout = setTimeout(r, deadlineMs);
+                timeout.unref();
+            });
+            // Let an in-flight poll finish first, then sweep once more; both inside the deadline.
+            await Promise.race([
+                (async () => {
+                    if (running)
+                        await running;
+                    await sweep(signal);
+                })(),
+                deadline,
+            ]);
+            clearTimeout(timeout);
+        },
+    };
+}