@mnemom/mnemom 0.17.32-next.1 → 0.17.32-next.2

package/dist/commands/agent.d.ts

@@ -367,6 +367,15 @@ export declare function prepareStatuslineFeed(o: {
 }): {
     feedFile: string;
 } | null;
+/**
+ * Whether the launch reads or writes Record, and so needs the served agent's org: the conduct
+ * receipt, commit reporting and the fed status line each key on it (lib/record-org).
+ */
+export declare function recordOrgWanted(o: {
+    receipt: boolean;
+    commitReport: boolean;
+    fedStatusline: boolean;
+}): boolean;
 /**
  * Whether this launch feeds the status line measured model cost and μ (W1.4): prerelease
  * builds only (stable stays "mnemom", decision 14), and only when the turn proxy runs, since

package/dist/commands/agent.js

@@ -38,6 +38,7 @@ import { attributionSettings, COMMIT_REPORT_ENV, commitReportEnabled, realGit, s
 import { ALLOW_AUTOCOMPACT_OFF_ENV, dropAutocompactOffEnv, hasOwnSettingsFlag, mergedSettingsArgs, planAutocompactGuard, } from "../lib/autocompact-guard.js";
 import { getApiUrl, getGatewayUrl, MNEMOM_DIR } from "../lib/config.js";
 import { createApiKey } from "../lib/api.js";
+import { recordOrgFor } from "../lib/record-org.js";
 import { MNEMOM_KEY_STORE_FIELD, resolveAgentAuth, sayRetiredConsoleNotice, readMnemomKey, resolveSubscriptionMnemomKey, subscriptionChildEnv, subscriptionShape, } from "../lib/subscription-login.js";
 import { LEDGER_FILE, appendSessionRecord, findResumeCandidate, readSessionRecords, resolveRetentionDays, resumedContextProfile, toLedgerContract, } from "../lib/agent-ledger.js";
 import { isLoggedIn } from "../lib/auth.js";
@@ -706,6 +707,16 @@ export async function agentCommand(scenarioArg, options = {}) {
         }
     }
     if (shape === "terminal") {
+        // Record keys the lineage under the served agent's org, not the account org (lib/record-org).
+        const recordOrgId = recordOrgWanted({
+            receipt: experimental.includes("record"),
+            commitReport: cli.name === "claude" && commitReportEnabled(process.env[COMMIT_REPORT_ENV], CLI_VERSION),
+            fedStatusline: cli.name === "claude" && fedStatuslineWanted(CLI_VERSION, Boolean(goalMode), process.env),
+        }) && account.orgId
+            ? await recordOrgFor(servedAgentId, account.orgId, {
+                onFallback: (reason) => say(fmt.warn(`mnemom agent: record: could not read ${servedAgentId}'s org (${reason}); using ${account.orgId}, which may hold none of this session's record.`)),
+            })
+            : account.orgId;
         launchTerminal({
             cli,
             door,
@@ -735,9 +746,9 @@ export async function agentCommand(scenarioArg, options = {}) {
             knownCcSessionId: cc.id ?? continuedCcSessionId,
             plugin,
             receipt: experimental.includes("record")
-                ? { orgId: account.orgId, agentId: servedAgentId }
+                ? { orgId: recordOrgId, agentId: servedAgentId }
                 : undefined,
-            orgId: account.orgId,
+            orgId: recordOrgId,
             commitReport: cli.name === "claude" &&
                 Boolean(account.orgId) &&
                 commitReportEnabled(process.env[COMMIT_REPORT_ENV], CLI_VERSION),
@@ -1428,6 +1439,13 @@ export function prepareStatuslineFeed(o) {
     o.childEnv[FEED_ENV] = feed.feedFile;
     return feed;
 }
+/**
+ * Whether the launch reads or writes Record, and so needs the served agent's org: the conduct
+ * receipt, commit reporting and the fed status line each key on it (lib/record-org).
+ */
+export function recordOrgWanted(o) {
+    return o.receipt || o.commitReport || o.fedStatusline;
+}
 /**
  * Whether this launch feeds the status line measured model cost and μ (W1.4): prerelease
  * builds only (stable stays "mnemom", decision 14), and only when the turn proxy runs, since

package/dist/lib/record-org.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The org Record keys a launch's lineage under (Doors W1.2, W1.4, W1.8).
+ *
+ * The gateway writes a request's record deltas under the org it bills, which is the served
+ * agent's org. The launcher's account org can differ: with an org API key, the account
+ * preflight resolves the key owner's personal org (`/v1/auth/me/personal-org`, a `pers-*`
+ * id), so a totals read or commit report keyed on it lands on an org that holds no row for
+ * the lineage, and Record answers 404. Every Record read and write of a launch (conduct
+ * receipt, status-line feed, commit reporting) therefore uses the served agent's org.
+ *
+ * FAIL-OPEN, BOUNDED. One agent read, raced against RECORD_ORG_TIMEOUT_MS; a failed, slow or
+ * off-shape answer falls back to the account org (the behaviour before this read existed), and
+ * `onFallback` says why: Record answers a wrong-org read or commit report with 404, which its
+ * callers treat as "dark", so a silent fallback would look like Record being off. Never throws.
+ */
+/** The most the read adds to launch. */
+export declare const RECORD_ORG_TIMEOUT_MS = 1500;
+export interface RecordOrgDeps {
+    /** The served agent's record; only `org_id` is read. */
+    readAgent?: (agentId: string) => Promise<{
+        org_id?: string | null;
+    }>;
+    timeoutMs?: number;
+    /** Told why the account org was used instead (one line, no secret). */
+    onFallback?: (reason: string) => void;
+}
+export declare function recordOrgFor(agentId: string, accountOrgId: string, deps?: RecordOrgDeps): Promise<string>;

package/dist/lib/record-org.js

@@ -0,0 +1,44 @@
+/**
+ * The org Record keys a launch's lineage under (Doors W1.2, W1.4, W1.8).
+ *
+ * The gateway writes a request's record deltas under the org it bills, which is the served
+ * agent's org. The launcher's account org can differ: with an org API key, the account
+ * preflight resolves the key owner's personal org (`/v1/auth/me/personal-org`, a `pers-*`
+ * id), so a totals read or commit report keyed on it lands on an org that holds no row for
+ * the lineage, and Record answers 404. Every Record read and write of a launch (conduct
+ * receipt, status-line feed, commit reporting) therefore uses the served agent's org.
+ *
+ * FAIL-OPEN, BOUNDED. One agent read, raced against RECORD_ORG_TIMEOUT_MS; a failed, slow or
+ * off-shape answer falls back to the account org (the behaviour before this read existed), and
+ * `onFallback` says why: Record answers a wrong-org read or commit report with 404, which its
+ * callers treat as "dark", so a silent fallback would look like Record being off. Never throws.
+ */
+import { getAgent } from "./api.js";
+/** The most the read adds to launch. */
+export const RECORD_ORG_TIMEOUT_MS = 1500;
+const ORG_ID_RE = /^[A-Za-z0-9_-]{1,128}$/;
+export async function recordOrgFor(agentId, accountOrgId, deps = {}) {
+    const readAgent = deps.readAgent ?? getAgent;
+    let timer;
+    const timeout = new Promise((resolve) => {
+        timer = setTimeout(() => resolve(null), deps.timeoutMs ?? RECORD_ORG_TIMEOUT_MS);
+    });
+    try {
+        let failed = false;
+        const agent = await Promise.race([
+            readAgent(agentId).catch(() => {
+                failed = true;
+                return null;
+            }),
+            timeout,
+        ]);
+        const org = agent?.org_id;
+        if (typeof org === "string" && ORG_ID_RE.test(org))
+            return org;
+        deps.onFallback?.(failed ? "agent read failed" : agent ? "agent has no org" : "agent read timed out");
+        return accountOrgId;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemom/mnemom",
-  "version": "0.17.32-next.1",
+  "version": "0.17.32-next.2",
   "description": "Transparent AI agent tracing",
   "type": "module",
   "bin": {