@mnemom/mnemom 0.17.32-next.2 → 0.17.32-next.3

package/dist/index.js

@@ -41,6 +41,7 @@ import { isPrerelease } from "./lib/update/semver.js";
 import { applyConfigToEnv, launcherEntries, loadLauncherConfig, withoutDisabledExperimental, } from "./lib/launcher-config.js";
 import { loadExperimentalState } from "./lib/cli-config.js";
 import { assertEnabled, availableFeatures, EXPERIMENTAL_CONTRACT, gateCheck, ignoredSettingLines, reportCliError, } from "./lib/experimental.js";
+import { durableVerbOffLines } from "./durable/gate.js";
 import { experimentalDisableCommand, experimentalEnableCommand, experimentalListCommand, runExperimentalMigration, } from "./commands/experimental.js";
 import { parseCompactAt, parseContextProfile, passthroughIsPrint, resolveImplicitSource, selectLaunchAgent, splitSessionArg, } from "./lib/agent.js";
 import { wrapCommand } from "./commands/wrap.js";
@@ -928,7 +929,7 @@ agentCmd
         : liveAgentShareDeps;
     process.exitCode = await agentShareCommand(opts, deps);
 });
-agentCmd
+const agentSessionsCmd = agentCmd
     .command("sessions")
     .description("List your Mnemom Agent sessions from the local ledger (~/.mnemom/sessions.jsonl), newest first — the last 20 unless --all")
     .option("--all", "Every session, not just the newest 20")
@@ -942,6 +943,56 @@ agentCmd
         process.exit(1);
     }
 });
+/** preAction (and --help) guard for a durable verb: while durable is off it does not exist (C14-R22). */
+function requireDurableVerb(word, what) {
+    const lines = durableVerbOffLines(word, what, loadExperimentalState().enabled);
+    if (lines) {
+        for (const l of lines)
+            console.error(l);
+        process.exit(2);
+    }
+}
+// `mnemom agent sessions adopt` (durable M1, C4): hand the running tracked sessions on this
+// machine to the host daemon, one table and one [Y/n] per agent group. Gated on `durable`.
+const ADOPT_WHAT = "`mnemom agent sessions adopt`";
+const agentSessionsAdoptCmd = agentSessionsCmd
+    .command("adopt", { hidden: hiddenUnless("durable") })
+    .description("EXPERIMENTAL (`mnemom experimental enable durable`): adopt the running sessions on this machine as durable sessions the host daemon runs, one table per agent")
+    .option("--dry-run", "Print the plan (tables, specs, dropped flags) and change nothing")
+    .option("--json", "Output the plan as JSON")
+    .option("--own-agent", "Move each adopted group onto its own agent")
+    .hook("preAction", () => requireDurableVerb("adopt", ADOPT_WHAT))
+    .action(async (opts, cmd) => {
+    try {
+        const { adoptCommand } = await import("./durable/adopt.js");
+        const { liveAdoptDeps } = await import("./durable/adopt-live.js");
+        // `agent` declares --dry-run and `sessions` declares --json, and commander hands a flag to
+        // the first command on the line that declares it: read both with the ancestors' options,
+        // or `adopt --dry-run` would adopt for real.
+        const all = cmd.optsWithGlobals();
+        process.exitCode = await adoptCommand(liveAdoptDeps(), {
+            dryRun: all.dryRun === true,
+            json: all.json === true,
+            ownAgent: opts.ownAgent,
+        });
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+/**
+ * The durable-gated commands (BACKBONE Flags/CLI: off lists no durable verb). The committed
+ * command-tree.json leaves them out whatever the generating machine's experimental state
+ * (scripts/gen-command-tree.mjs); a piece that registers another durable verb adds it here.
+ */
+export const DURABLE_GATED_COMMANDS = new Set([agentSessionsAdoptCmd]);
+// commander answers --help before preAction: gate the help too, so the verb does not exist while off.
+const adoptOutputHelp = agentSessionsAdoptCmd.outputHelp.bind(agentSessionsAdoptCmd);
+agentSessionsAdoptCmd.outputHelp = ((...args) => {
+    requireDurableVerb("adopt", ADOPT_WHAT);
+    adoptOutputHelp(...args);
+});
 agentCmd
     .command("show [ref]")
     .description("Show one session — the local launch record merged with the gateway's live goal state (sealed contract, latest verdict, guardrails). " +

package/dist/lib/agent.d.ts

@@ -690,6 +690,13 @@ export declare function buildCustomHeaders(opts: {
     /** `buildSessionConfigB64` output — the per-session env overlay (e.g. fold off). */
     sessionConfigB64?: string;
 }): string;
+/**
+ * Strip the owner's own Mnemom credential env vars from a child env, IN
+ * PLACE — defense in depth against them riding through just because they
+ * happened to sit in the CLI's own process env (an exported shell var, or a
+ * leftover override) when `{ ...process.env }` was spread into it.
+ */
+export declare function stripOwnerCredentialEnv(env: NodeJS.ProcessEnv): void;
 /**
  * Whether context folding is ON for this launch. Folding is a gateway feature
  * that summarises older turns to fit the window; it is ON by default. Precedence:

package/dist/lib/agent.js

@@ -1096,6 +1096,32 @@ export function buildCustomHeaders(opts) {
         lines.push(`${SESSION_CONFIG_HEADER}: ${opts.sessionConfigB64}`);
     return lines.join("\n");
 }
+/**
+ * Env vars that carry the OWNER's own Mnemom credential, in the CLI process's
+ * own env — never the launched session's (MNE-8245). `MNEMOM_API_KEY` /
+ * `MNEMOM_TOKEN` are `lib/auth.ts`'s ambient owner-credential vars (the ones
+ * `resolveAuth` reads to authenticate the CLI's OWN calls, e.g. the session-key
+ * mint); `MNEMOM_AGENT_MNEMOM_KEY` is `lib/subscription-login.ts`'s override for
+ * that same owner credential on a subscription launch. None of the three has
+ * any legitimate reason to reach a launched session's own env: the session's
+ * only Mnemom credential is the minted, session-scoped key already spliced
+ * into its headers/stdin by the caller.
+ */
+const OWNER_CREDENTIAL_ENV_VARS = [
+    "MNEMOM_API_KEY",
+    "MNEMOM_TOKEN",
+    "MNEMOM_AGENT_MNEMOM_KEY",
+];
+/**
+ * Strip the owner's own Mnemom credential env vars from a child env, IN
+ * PLACE — defense in depth against them riding through just because they
+ * happened to sit in the CLI's own process env (an exported shell var, or a
+ * leftover override) when `{ ...process.env }` was spread into it.
+ */
+export function stripOwnerCredentialEnv(env) {
+    for (const k of OWNER_CREDENTIAL_ENV_VARS)
+        Reflect.deleteProperty(env, k);
+}
 /**
  * Whether context folding is ON for this launch. Folding is a gateway feature
  * that summarises older turns to fit the window; it is ON by default. Precedence:

package/dist/lib/api.d.ts

@@ -1181,6 +1181,38 @@ export declare function createApiKey(name: string, scopes: ApiKeyScope[]): Promi
  * moment this returns.
  */
 export declare function rotateApiKey(keyId: string): Promise<ApiKeyCreated>;
+/**
+ * Response shape of `POST /v1/agents/{agent_id}/session-keys` (MNE-8244,
+ * mnemom-api `src/code/session-keys.ts`). `key` is the cleartext secret,
+ * returned once.
+ */
+export interface SessionKeyMinted {
+    key_id: string;
+    key: string;
+    key_prefix: string;
+    scopes: string[];
+    kind: string;
+    agent_id: string;
+    session_id: string | null;
+    expires_at: string;
+    created_at: string;
+}
+/**
+ * POST /v1/agents/{agent_id}/session-keys (MNE-8244) — mint a short-lived
+ * (24h), `['gateway']`-only API key bound to `agentId` (and `sessionId`
+ * when known), using the CALLER'S OWN ambient credential (`postApi`'s
+ * `authHeaders()` — never anything read from a launched session). This is
+ * owner-gated server-side: a 403 `session_credential_forbidden` is what
+ * the API returns if a session key is ever presented here instead.
+ *
+ * `mnemom agent` calls this so the LAUNCHED session never holds the
+ * owner's own key (MNE-8245) — see `lib/session-key.ts` for the
+ * fail-closed wiring around this call.
+ */
+export declare function mintAgentSessionKey(agentId: string, opts?: {
+    orgId?: string;
+    sessionId?: string;
+}): Promise<SessionKeyMinted>;
 /**
  * DELETE /v1/api-keys/{key_id} — soft-revoke. The key row stays for
  * audit; `is_active` flips to false and `revoked_at` is timestamped.

package/dist/lib/api.js

@@ -1477,6 +1477,22 @@ export async function rotateApiKey(keyId) {
     }
     return (await response.json());
 }
+/**
+ * POST /v1/agents/{agent_id}/session-keys (MNE-8244) — mint a short-lived
+ * (24h), `['gateway']`-only API key bound to `agentId` (and `sessionId`
+ * when known), using the CALLER'S OWN ambient credential (`postApi`'s
+ * `authHeaders()` — never anything read from a launched session). This is
+ * owner-gated server-side: a 403 `session_credential_forbidden` is what
+ * the API returns if a session key is ever presented here instead.
+ *
+ * `mnemom agent` calls this so the LAUNCHED session never holds the
+ * owner's own key (MNE-8245) — see `lib/session-key.ts` for the
+ * fail-closed wiring around this call.
+ */
+export async function mintAgentSessionKey(agentId, opts = {}) {
+    const endpoint = `/v1/agents/${encodeURIComponent(agentId)}/session-keys${opts.orgId ? `?org_id=${encodeURIComponent(opts.orgId)}` : ""}`;
+    return postApi(endpoint, opts.sessionId ? { session_id: opts.sessionId } : {});
+}
 /**
  * DELETE /v1/api-keys/{key_id} — soft-revoke. The key row stays for
  * audit; `is_active` flips to false and `revoked_at` is timestamped.

package/dist/lib/experimental.d.ts

@@ -12,7 +12,7 @@
  * Everything here is pure or dependency-injected; index.ts and the command
  * modules are the thin drivers.
  */
-export type ExperimentalId = "context-handoff" | "slack" | "implicit" | "measured-savings" | "record" | "fuel";
+export type ExperimentalId = "context-handoff" | "slack" | "implicit" | "measured-savings" | "record" | "fuel" | "durable";
 /**
  * Features that used to be experimental and are now on by default for everyone. Their ids are
  * no longer in the registry, but `mnemom experimental enable|disable <id>` still accepts them

package/dist/lib/experimental.js

@@ -107,6 +107,19 @@ export const EXPERIMENTAL_FEATURES = [
             env: [],
         },
     },
+    {
+        // Durable governed sessions (M1). Off: every durable verb word exits 2 with the gate pointer
+        // and launches are unchanged; the host daemon reads config.json only, never MNEMOM_EXPERIMENTAL.
+        id: "durable",
+        summary: "Durable sessions: lock a session so this machine keeps it running, and adopt running ones",
+        since: "0.17.27",
+        gates: {
+            flags: [],
+            configKeys: ["durable"],
+            commands: ["mnemom agent sessions adopt"],
+            env: [],
+        },
+    },
 ];
 export const EXPERIMENTAL_IDS = EXPERIMENTAL_FEATURES.map((f) => f.id);
 export const EXPERIMENTAL_ENV = "MNEMOM_EXPERIMENTAL";

package/dist/lib/session-key.d.ts

@@ -0,0 +1,68 @@
+/**
+ * MNE-8245 — the LAUNCHED `mnemom agent` session must never hold the owner's
+ * own Mnemom API key: code running inside that session (a shell tool call,
+ * a malicious prompt injection, …) could read it straight out of its own
+ * environment and call owner-only mnemom-api routes as the owner, including
+ * the owner-only `update_contract` endpoint (MNE-8233) — defeating sealed
+ * mode, where a sealed contract changes only through the owner's explicit,
+ * out-of-session update.
+ *
+ * Per the 2026-10-06 ruling: the session gets a minted, session-scoped,
+ * `['gateway']`-only key instead (MNE-8244's `POST
+ * /v1/agents/{agent_id}/session-keys`), and the launch FAILS CLOSED if
+ * minting doesn't succeed — never a fallback to the owner's own credential.
+ *
+ * Pure apart from the injected deps, so every arm (mint success, every
+ * failure mode, revoke success/failure) is unit-tested without a real API.
+ */
+import { type SessionKeyMinted } from "./api.js";
+export interface SessionKeyDeps {
+    mint: (agentId: string, opts: {
+        orgId?: string;
+        sessionId?: string;
+    }) => Promise<SessionKeyMinted>;
+    revoke: (keyId: string) => Promise<void>;
+    say: (line: string) => void;
+    /**
+     * Override the mint/revoke timeout, tests only — real callers never set these, so the real
+     * 10s/3s bounds below always apply in production. Exists so a test can exercise "never
+     * settles" against a short, fast timeout rather than waiting out the real one.
+     */
+    mintTimeoutMs?: number;
+    revokeTimeoutMs?: number;
+}
+/** The real deps: `lib/api.ts`'s `mintAgentSessionKey` / `revokeApiKey`. */
+export declare function defaultSessionKeyDeps(say: (line: string) => void): SessionKeyDeps;
+export interface MintedSessionGatewayKey {
+    /** The cleartext secret — place this ONLY in the launched session's env. */
+    key: string;
+    /** Needed to revoke the key later; never placed in the session's env. */
+    keyId: string;
+    expiresAt: string;
+}
+/**
+ * Mint the ONE gateway-only, session-scoped key a launched session is
+ * allowed to carry.
+ *
+ * FAILS CLOSED: throws on ANY problem — a mint call that rejects (network
+ * error, non-2xx HTTP status, a malformed/empty body) — or a response that
+ * parses fine but is not the credential this is for: no key, no key_id (it
+ * could never be revoked), scopes that are not EXACTLY `['gateway']`, or a
+ * `kind` other than `'session'` when the response reports one. Every arm
+ * throws a `mnemom agent: …`-prefixed `Error` — the caller MUST NOT catch
+ * it and fall back to any other credential; it is meant to propagate all
+ * the way to the CLI's top-level error handler, which exits non-zero
+ * before anything is spawned.
+ */
+export declare function mintSessionGatewayKey(deps: SessionKeyDeps, args: {
+    agentId: string;
+    orgId?: string;
+    sessionId?: string;
+}): Promise<MintedSessionGatewayKey>;
+/**
+ * Best-effort revoke on session exit (clean or not) — a failure here is a
+ * WARNING only, never thrown: the key is 24h-TTL'd regardless, so an
+ * un-revoked key is not a fresh security hole, just a slightly longer-lived
+ * one. Never called with the owner's own key id.
+ */
+export declare function revokeSessionGatewayKey(deps: SessionKeyDeps, keyId: string): Promise<void>;

package/dist/lib/session-key.js

@@ -0,0 +1,101 @@
+/**
+ * MNE-8245 — the LAUNCHED `mnemom agent` session must never hold the owner's
+ * own Mnemom API key: code running inside that session (a shell tool call,
+ * a malicious prompt injection, …) could read it straight out of its own
+ * environment and call owner-only mnemom-api routes as the owner, including
+ * the owner-only `update_contract` endpoint (MNE-8233) — defeating sealed
+ * mode, where a sealed contract changes only through the owner's explicit,
+ * out-of-session update.
+ *
+ * Per the 2026-10-06 ruling: the session gets a minted, session-scoped,
+ * `['gateway']`-only key instead (MNE-8244's `POST
+ * /v1/agents/{agent_id}/session-keys`), and the launch FAILS CLOSED if
+ * minting doesn't succeed — never a fallback to the owner's own credential.
+ *
+ * Pure apart from the injected deps, so every arm (mint success, every
+ * failure mode, revoke success/failure) is unit-tested without a real API.
+ */
+import { mintAgentSessionKey, revokeApiKey } from "./api.js";
+/** The real deps: `lib/api.ts`'s `mintAgentSessionKey` / `revokeApiKey`. */
+export function defaultSessionKeyDeps(say) {
+    return { mint: mintAgentSessionKey, revoke: revokeApiKey, say };
+}
+/** How long a launch waits on the mint call before giving up (still fails closed — see below). */
+const MINT_TIMEOUT_MS = 10_000;
+/** How long session exit waits on the best-effort revoke before moving on regardless. */
+const REVOKE_TIMEOUT_MS = 3_000;
+/**
+ * Bounds `promise` to `ms`: resolves/rejects exactly as `promise` would, UNLESS `AbortSignal
+ * .timeout(ms)` fires first, in which case this rejects with a fresh timeout Error instead. Does
+ * NOT cancel `promise` itself — `deps.mint`/`deps.revoke` take no signal of their own — this only
+ * bounds how long the CALLER waits, which is exactly what both call sites below need: the launch
+ * (mint) and the exit handler (revoke) must never hang on a stuck network call.
+ */
+function raceTimeout(promise, ms, message) {
+    return new Promise((resolve, reject) => {
+        const signal = AbortSignal.timeout(ms);
+        const onAbort = () => reject(new Error(message));
+        signal.addEventListener("abort", onAbort, { once: true });
+        promise.then((value) => {
+            signal.removeEventListener("abort", onAbort);
+            resolve(value);
+        }, (err) => {
+            signal.removeEventListener("abort", onAbort);
+            reject(err);
+        });
+    });
+}
+/**
+ * Mint the ONE gateway-only, session-scoped key a launched session is
+ * allowed to carry.
+ *
+ * FAILS CLOSED: throws on ANY problem — a mint call that rejects (network
+ * error, non-2xx HTTP status, a malformed/empty body) — or a response that
+ * parses fine but is not the credential this is for: no key, no key_id (it
+ * could never be revoked), scopes that are not EXACTLY `['gateway']`, or a
+ * `kind` other than `'session'` when the response reports one. Every arm
+ * throws a `mnemom agent: …`-prefixed `Error` — the caller MUST NOT catch
+ * it and fall back to any other credential; it is meant to propagate all
+ * the way to the CLI's top-level error handler, which exits non-zero
+ * before anything is spawned.
+ */
+export async function mintSessionGatewayKey(deps, args) {
+    let res;
+    try {
+        const timeoutMs = deps.mintTimeoutMs ?? MINT_TIMEOUT_MS;
+        res = await raceTimeout(deps.mint(args.agentId, { orgId: args.orgId, sessionId: args.sessionId }), timeoutMs, `mint timed out after ${timeoutMs}ms`);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new Error(`mnemom agent: could not mint a session-scoped gateway key for this launch (${msg}) — refusing to launch with the owner's own credential instead.`, { cause: err });
+    }
+    if (!res || typeof res.key !== "string" || res.key.length === 0) {
+        throw new Error("mnemom agent: the session-key mint API returned no key — refusing to launch.");
+    }
+    if (!res.key_id) {
+        throw new Error("mnemom agent: the session-key mint API returned no key_id (it could never be revoked) — refusing to launch.");
+    }
+    const scopes = res.scopes ?? [];
+    if (!(scopes.length === 1 && scopes[0] === "gateway")) {
+        throw new Error(`mnemom agent: the minted key's scopes were ${JSON.stringify(scopes)}, not exactly ['gateway'] — refusing to launch with it.`);
+    }
+    if (res.kind !== undefined && res.kind !== null && res.kind !== "session") {
+        throw new Error(`mnemom agent: the minted key's kind was '${String(res.kind)}', not 'session' — refusing to launch with it.`);
+    }
+    return { key: res.key, keyId: res.key_id, expiresAt: res.expires_at };
+}
+/**
+ * Best-effort revoke on session exit (clean or not) — a failure here is a
+ * WARNING only, never thrown: the key is 24h-TTL'd regardless, so an
+ * un-revoked key is not a fresh security hole, just a slightly longer-lived
+ * one. Never called with the owner's own key id.
+ */
+export async function revokeSessionGatewayKey(deps, keyId) {
+    try {
+        const timeoutMs = deps.revokeTimeoutMs ?? REVOKE_TIMEOUT_MS;
+        await raceTimeout(deps.revoke(keyId), timeoutMs, `revoke timed out after ${timeoutMs}ms`);
+    }
+    catch (err) {
+        deps.say(`mnemom agent: could not revoke the session key (non-fatal — it expires on its own within 24h): ${err instanceof Error ? err.message : String(err)}`);
+    }
+}

package/dist/lib/statusline.d.ts

@@ -59,12 +59,25 @@ export declare function render(stdin: string, deps?: RenderDeps): string;
 export interface UserStatusLine {
     command: string;
     padding?: number;
+    /** Seconds between timed re-runs (Claude Code's statusLine.refreshInterval). */
+    refreshInterval?: number;
 }
 /**
  * The statusLine Claude Code would use without us: the first settings file (highest
  * precedence first) that sets one. Only a `command` statusLine can be wrapped.
  */
 export declare function userStatusLine(cwd: string, configDir: string): UserStatusLine | null;
+/**
+ * Seconds between timed redraws on a fed launch, the feed's own poll (FEED_INTERVAL_MS).
+ * Claude Code redraws the status line only on conversation events unless refreshInterval is
+ * set, so totals that land after the last turn would never reach the screen.
+ */
+export declare const FED_REFRESH_S = 10;
+/**
+ * The statusLine layer to launch with: none when the segment is off; on a fed launch a timed
+ * redraw, the user's own shorter interval kept.
+ */
+export declare function launchStatusLine(settings: Record<string, unknown> | null, fed: boolean): Record<string, unknown> | null;
 /**
  * Launch args + env that add the segment, or null when it should stay off: the opt-out
  * env, or the user passing their own --settings (two would fight over precedence).

package/dist/lib/statusline.js

@@ -122,12 +122,34 @@ export function userStatusLine(cwd, configDir) {
             continue;
         if (sl.type !== "command" || typeof sl.command !== "string" || !sl.command)
             return null;
-        return typeof sl.padding === "number"
-            ? { command: sl.command, padding: sl.padding }
-            : { command: sl.command };
+        const user = { command: sl.command };
+        if (typeof sl.padding === "number")
+            user.padding = sl.padding;
+        if (typeof sl.refreshInterval === "number" && sl.refreshInterval >= 1)
+            user.refreshInterval = sl.refreshInterval;
+        return user;
     }
     return null;
 }
+/**
+ * Seconds between timed redraws on a fed launch, the feed's own poll (FEED_INTERVAL_MS).
+ * Claude Code redraws the status line only on conversation events unless refreshInterval is
+ * set, so totals that land after the last turn would never reach the screen.
+ */
+export const FED_REFRESH_S = 10;
+/**
+ * The statusLine layer to launch with: none when the segment is off; on a fed launch a timed
+ * redraw, the user's own shorter interval kept.
+ */
+export function launchStatusLine(settings, fed) {
+    if (!settings || !fed)
+        return settings;
+    const sl = settings.statusLine;
+    if (!sl || typeof sl !== "object")
+        return settings;
+    const own = typeof sl.refreshInterval === "number" ? sl.refreshInterval : Infinity;
+    return { ...settings, statusLine: { ...sl, refreshInterval: Math.min(own, FED_REFRESH_S) } };
+}
 const sq = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
 /**
  * Launch args + env that add the segment, or null when it should stay off: the opt-out
@@ -146,6 +168,8 @@ export function statuslineLaunch(o) {
     };
     if (user?.padding !== undefined)
         statusLine.padding = user.padding;
+    if (user?.refreshInterval !== undefined)
+        statusLine.refreshInterval = user.refreshInterval;
     const env = user ? { [INNER_ENV]: user.command } : {};
     // `settings` is the same layer as `args`, for a caller that merges it with its own (Claude Code
     // keeps only the last --settings it is given).

package/dist/lib/subscription-login.d.ts

@@ -16,7 +16,7 @@
  *
  * Pure apart from the injected deps, so every arm is unit-tested.
  */
-import type { LaunchShape } from "./agent.js";
+import { type LaunchShape } from "./agent.js";
 export type AgentAuth = "api-key" | "subscription";
 export declare const AGENT_AUTHS: readonly AgentAuth[];
 /**

package/dist/lib/subscription-login.js

@@ -16,6 +16,7 @@
  *
  * Pure apart from the injected deps, so every arm is unit-tested.
  */
+import { stripOwnerCredentialEnv } from "./agent.js";
 export const AGENT_AUTHS = ["api-key", "subscription"];
 /**
  * The retired `console` value (it read the key Claude Code's Anthropic Console /login
@@ -140,7 +141,9 @@ export function subscriptionChildEnv(base, door, headers) {
     delete env.ANTHROPIC_API_KEY;
     delete env.ANTHROPIC_AUTH_TOKEN;
     // The key already rides in the headers; the child process has no other use for it.
-    delete env.MNEMOM_AGENT_MNEMOM_KEY;
+    // MNE-8245 defense-in-depth: also strips MNEMOM_API_KEY/MNEMOM_TOKEN, in case the
+    // owner's own ambient credential sits in the CLI's process env for an unrelated reason.
+    stripOwnerCredentialEnv(env);
     env.ANTHROPIC_BASE_URL = door;
     env.ANTHROPIC_CUSTOM_HEADERS = headers;
     return env;