@mnemom/mnemom 0.17.33 → 0.17.34-next.2

package/dist/host/run.js

@@ -0,0 +1,314 @@
+/**
+ * `mnemom agent host run` (hidden; what the LaunchAgent execs). Startup order (C12-R01, R25, R26,
+ * R39): read-only gate and state checks, then the lock (the first write), then the boot-id
+ * warning (before any network call), then the nonce binding and the state write, then the loop.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { createHash } from "node:crypto";
+import { execFileSync } from "node:child_process";
+import { setTimeout as sleep } from "node:timers/promises";
+import { resolveInstance, hostPaths } from "./instance.js";
+import { durableOnInConfig, GATED_TEXT } from "./gate.js";
+import { readExecutorState, bindNonce, writeExecutorState, stateFileCurrent, } from "./state.js";
+import { acquireHostLock, lockStillHeld } from "./lock.js";
+import { resolveBootId, defaultBootIdDeps, BOOT_ID_IGNORED_WARNING } from "./bootid.js";
+import { executorApi } from "./client.js";
+import { HostDaemon } from "./daemon.js";
+import { Tmux, tmuxRunner } from "./tmux.js";
+import { defaultProcDeps, killTree, alive, seatPids } from "./procs.js";
+import { ccProjectsDir, refreshGuard, findTranscript, ensureTranscript, removeGuard, guardedSessionIds, } from "./transcript.js";
+import { checkIntegrity, packageRootOf } from "./integrity.js";
+import { buildSeatLaunch, seatDoor } from "./seat.js";
+import { socketDir, ensureSocketDir, controlSocketPath, releaseControlSocket, startControlServer, } from "./control.js";
+import { writeRuntime } from "./runtime.js";
+import { autoContinue, interruptedTurnId, turnContinuedJournal, } from "./auto-continue.js";
+import { hostTestPauseAt } from "../durable/test-mode.mjs";
+import { resolvePluginDir } from "../lib/claude-plugin.js";
+/** A tag that names this HOME on a shared tmux server (not secret: a hash of the path). */
+export const homeTag = (home) => createHash("sha256").update(path.resolve(home)).digest("hex").slice(0, 16);
+/** The pinned claude: MNEMOM_AGENT_CLI when absolute, else `claude` on PATH, else null. */
+export function resolveClaudeBin(env) {
+    const v = (env.MNEMOM_AGENT_CLI ?? "").trim();
+    if (v.startsWith("/"))
+        return v;
+    const name = v || "claude";
+    for (const dir of (env.PATH ?? "").split(":")) {
+        if (!dir)
+            continue;
+        const p = path.join(dir, name);
+        try {
+            fs.accessSync(p, fs.constants.X_OK);
+            return p;
+        }
+        catch {
+            /* next */
+        }
+    }
+    return null;
+}
+/** The argv that runs this CLI again: node + the real entry script. */
+export function cliExec() {
+    const entry = process.argv[1] ? fs.realpathSync(process.argv[1]) : "";
+    return [process.execPath, entry];
+}
+/** The read-only part of startup: what `run` does before it takes the lock. */
+export function startupCheck(io) {
+    const instance = resolveInstance(io.env);
+    const paths = hostPaths(io.home, instance);
+    const on = durableOnInConfig(paths.configFile);
+    const st = readExecutorState(paths.stateFile);
+    if (st.kind === "absent") {
+        if (!on)
+            return { kind: "exit", code: 2, message: GATED_TEXT };
+        return {
+            kind: "exit",
+            code: 1,
+            message: "this machine is not enrolled: `mnemom agent host install`",
+        };
+    }
+    if (st.kind === "corrupt")
+        return {
+            kind: "exit",
+            code: 1,
+            message: `the host state file is unreadable (${st.reason}): \`mnemom agent host install\``,
+        };
+    return { kind: "go", paths, instance };
+}
+/**
+ * The boot-bound nonce (C12-R06), bound on first use: the first call compares the recorded boot id
+ * with the OS one, writes a rotated nonce when they differ (or the record is unusable), and caches
+ * the result; later calls return it with no I/O.
+ */
+export function lazyNonce(stateFile, loaded, bootId, log) {
+    let value = null;
+    return () => {
+        if (value !== null)
+            return value;
+        const bound = bindNonce(loaded, bootId);
+        if (!stateFileCurrent(stateFile, bound.state))
+            writeExecutorState(stateFile, bound.state);
+        if (bound.rotated)
+            log("nonce rotated (boot id changed, or no usable boot id in the state file)");
+        value = bound.state.nonce;
+        return value;
+    };
+}
+export async function hostRun(io) {
+    const s = startupCheck(io);
+    const log = (line) => io.err(`${new Date().toISOString()} ${line}`);
+    // The gated refusal (exit 2) prints the gated text only. Every other start resolves the boot id
+    // first, so an ignored DURABLE_BOOT_ID_FILE is warned about before anything else (C12-R26).
+    if (s.kind === "exit" && s.code === 2) {
+        io.err(s.message);
+        return s.code;
+    }
+    const boot = resolveBootId({ ...defaultBootIdDeps(), env: io.env });
+    if (boot.warn)
+        log(BOOT_ID_IGNORED_WARNING);
+    if (s.kind === "exit") {
+        io.err(s.message);
+        return s.code;
+    }
+    const { paths, instance } = s;
+    // C12-R01: the lock is the first write.
+    const lock = acquireHostLock(paths.lockFile);
+    if (!lock.ok) {
+        io.err(`mnemom agent host: ${lock.message}`);
+        return 1;
+    }
+    let lockLost = () => undefined;
+    const loaded = readExecutorState(paths.stateFile);
+    if (loaded.kind !== "ok") {
+        io.err("the host state file changed under the daemon");
+        return 1;
+    }
+    // The nonce is bound (and the state file rewritten) only when first needed, i.e. before the first
+    // API call; a daemon that starts and stays idle (durable off in config) leaves the file alone.
+    const nonce = lazyNonce(paths.stateFile, loaded.state, boot.bootId, log);
+    log(`host daemon ${instance.label} pid ${process.pid} executor ${loaded.state.executor_id.slice(0, 8)}`);
+    const env = io.env;
+    const tmux = new Tmux(tmuxRunner(instance.tmuxSocket, env));
+    const procs = defaultProcDeps();
+    const tag = homeTag(io.home);
+    const projects = ccProjectsDir(env, io.home);
+    const sockDir = socketDir(paths.runDir, io.home);
+    ensureSocketDir(sockDir);
+    const control = controlSocketPath(sockDir);
+    const pluginDir = resolvePluginDir();
+    const claudeBin = resolveClaudeBin(env) ?? "claude";
+    const door = seatDoor(env, (env.MNEMOM_GATEWAY_URL ?? "").trim() || (await import("../lib/config.js")).getGatewayUrl());
+    const apiUrl = (await import("../lib/config.js")).getApiUrl();
+    let serverUp = false;
+    let guardMode = "link";
+    const lastKnown = new Map();
+    // One file per continued turn (<session>.<turn uuid>); kept across respawns and daemon restarts.
+    const continuedDir = path.join(path.dirname(paths.stateFile), "continued");
+    const pauseAt = hostTestPauseAt({ ...env });
+    const deps = {
+        api: executorApi({
+            apiUrl,
+            key: loaded.state.executor_key,
+            fetch: globalThis.fetch,
+        }),
+        get nonce() {
+            return nonce();
+        },
+        home: io.home,
+        now: () => Date.now(),
+        random: Math.random,
+        log,
+        gateOn: () => durableOnInConfig(paths.configFile),
+        integrity: async () => pluginDir ? checkIntegrity(packageRootOf(pluginDir)) : { ok: false, cause: "no_plugin_dir" },
+        panes: async () => (await tmux.panes()).filter((p) => p.home === tag),
+        claudePid: (panePid) => seatPids(procs.ps(), panePid).claude,
+        alive: (pid) => alive(procs, pid),
+        killSeat: async (session, panePid) => {
+            if (panePid)
+                killTree(procs, [panePid]);
+            await tmux.killSession(session);
+        },
+        spawnSeat: async (req) => {
+            if (!serverUp) {
+                await tmux.ensureServer();
+                serverUp = true;
+            }
+            const launch = buildSeatLaunch({
+                env,
+                cliExec: cliExec(),
+                claudeBin,
+                pluginDir,
+                item: req.item,
+                epoch: req.epoch,
+                spawnId: req.spawnId,
+                newSession: req.newSession,
+                specDir: paths.specDir,
+                controlSocket: control,
+                door,
+            });
+            const r = await tmux.newSeat({
+                name: req.tmuxSession,
+                cwd: req.item.cwd ?? io.home,
+                command: launch.command,
+                env: launch.env,
+                tags: { sid: req.item.id, epoch: req.epoch, spawn: req.spawnId, home: tag },
+            });
+            return { panePid: r.panePid, specPath: launch.specPath };
+        },
+        guard: (item) => {
+            if (!item.cc_session_id)
+                return null;
+            const orig = findTranscript(projects, item.cwd, item.cc_session_id);
+            if (orig)
+                lastKnown.set(item.id, orig);
+            const g = refreshGuard(io.home, item.id, orig);
+            if (g.mode)
+                guardMode = g.mode;
+            return orig;
+        },
+        ensureTranscript: (item) => ensureTranscript(io.home, item.id, projects, item.cwd, item.cc_session_id ?? "", lastKnown.get(item.id) ?? null),
+        removeGuard: (id) => removeGuard(io.home, id),
+        guardedIds: () => guardedSessionIds(io.home),
+        pauseAt,
+        pause: async (point) => {
+            log(`test pause at ${point}`);
+            for (;;)
+                await sleep(3600_000);
+        },
+        interruptedAt: (p) => interruptedAtFile(p, (f) => fs.readFileSync(f, "utf8")),
+        autoContinue: (seat, turnId) => autoContinue(seat, turnId, {
+            ...fileContinuedMarkers(continuedDir, fs),
+            journal: turnContinuedJournal(deps.api, () => deps.nonce),
+            capture: (t) => tmux.capturePane(t),
+            send: (t, text) => tmux.sendLine(t, text),
+            sleep,
+            now: () => Date.now(),
+            log,
+        }),
+        publish: (snap) => publishIfLockHeld(() => lockStillHeld(lock.fd, paths.lockFile), () => writeRuntimeOrLog(() => writeRuntime(paths.runtimeFile, {
+            ...snap,
+            instance: instance.label,
+            transcript_guard: guardMode,
+            control_socket: control,
+        }), log), () => lockLost()),
+    };
+    const daemon = new HostDaemon(deps);
+    const server = startControlServer(control, daemon, log);
+    let stopping = false;
+    let released = "closed";
+    const stop = (sig) => {
+        if (stopping)
+            return;
+        stopping = true;
+        log(`${sig}: stopping (seats keep running)`);
+        daemon.stop();
+        released = releaseControlSocket(server, control);
+    };
+    lockLost = () => stop(`${paths.lockFile} was replaced`);
+    process.on("SIGTERM", () => stop("SIGTERM"));
+    process.on("SIGINT", () => stop("SIGINT"));
+    await daemon.run((ms) => sleep(ms));
+    fs.closeSync(lock.fd);
+    exitIfSocketLeft(released, (code) => process.exit(code));
+    return 0;
+}
+/**
+ * The runtime file is written only while this daemon still locks the current host.lock. A replaced
+ * lock file means another daemon may own the state dir: stop instead of writing over its runtime.
+ */
+export function publishIfLockHeld(held, write, lost) {
+    if (!held()) {
+        lost();
+        return;
+    }
+    write();
+}
+/** For tests and status: the OS boot id (macOS sysctl). */
+export function sysctlBootId() {
+    return execFileSync("/usr/sbin/sysctl", ["-n", "kern.bootsessionuuid"], {
+        encoding: "utf8",
+    }).trim();
+}
+export const defaultHome = () => os.homedir();
+/** The interrupted turn of the transcript at `p` (auto-continue.ts), or null when it cannot be read. */
+export function interruptedAtFile(p, read) {
+    try {
+        return interruptedTurnId(read(p));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The auto-continue markers: one file per session and turn in `dir` (0700). The write is exclusive
+ * ("wx"), so marking a turn already marked throws and that turn is never continued twice.
+ */
+export function fileContinuedMarkers(dir, f) {
+    return {
+        continued: (id, turn) => f.existsSync(path.join(dir, `${id}.${turn}`)),
+        markContinued: (id, turn) => {
+            f.mkdirSync(dir, { recursive: true, mode: 0o700 });
+            f.writeFileSync(path.join(dir, `${id}.${turn}`), `${new Date().toISOString()}\n`, {
+                flag: "wx",
+            });
+        },
+    };
+}
+/** Write the runtime file; a failed write is logged and the daemon goes on. */
+export function writeRuntimeOrLog(write, log) {
+    try {
+        write();
+    }
+    catch (e) {
+        log(`runtime file: ${e.message}`);
+    }
+}
+/**
+ * The daemon's last step. Another daemon owns the control socket path now ("left"): leave with
+ * exit, since a normal exit would unlink that daemon's socket.
+ */
+export function exitIfSocketLeft(released, exit) {
+    if (released === "left")
+        exit(0);
+}

package/dist/host/runtime.d.ts

@@ -0,0 +1,8 @@
+import type { DaemonSnapshot } from "./daemon.js";
+export interface RuntimeFile extends DaemonSnapshot {
+    readonly instance: string;
+    readonly transcript_guard: "link" | "copy";
+    readonly control_socket: string;
+}
+export declare function writeRuntime(file: string, r: RuntimeFile): void;
+export declare function readRuntime(file: string): RuntimeFile | null;

package/dist/host/runtime.js

@@ -0,0 +1,22 @@
+/**
+ * The daemon's runtime file (`host status` reads it): what the daemon knows that the OS does not
+ * (per-session claim-unavailable cause and count, the seat spawn ids, the integrity verdict, idle).
+ * No secret: no key, no nonce, no lease key. Written 0600 by tmp+rename.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+export function writeRuntime(file, r) {
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, `${JSON.stringify(r)}\n`, { mode: 0o600 });
+    fs.renameSync(tmp, file);
+}
+export function readRuntime(file) {
+    try {
+        const r = JSON.parse(fs.readFileSync(file, "utf8"));
+        return r && typeof r === "object" && typeof r.pid === "number" ? r : null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/host/s1-names.d.ts

@@ -0,0 +1,22 @@
+/**
+ * S1 names the host daemon uses, taken from the vendored contract so cli/src/host never spells an
+ * event kind or a durable_* code as a literal (C10-R4; the static check C10-STATIC-001).
+ */
+import { type DurableCode } from "../vendor/shared/durable-contract/codes.js";
+/** Every S1 durable code, keyed by itself: `CODE.durable_hello_late` is checked against S1 at compile time. */
+export declare const CODE: {
+    readonly [K in DurableCode]: K;
+};
+/**
+ * The executor.spawned kind: S1 EXECUTOR_WRITABLE_KINDS[0]. It was M1's only executor-writable kind
+ * (L01); the Doors amendment (ruling 34.06) appended session.waiting after it, which the daemon does
+ * not write.
+ */
+export declare const SPAWNED_KIND: "executor.spawned";
+/** The executor.turn_continued kind: S1 EXECUTOR_WRITABLE_KINDS[2] (lead ruling 2026-10-28). */
+export declare const TURN_CONTINUED_KIND: "executor.turn_continued";
+/**
+ * The control socket's answer when no registered seat has the relayed spawn id. It is local to the
+ * daemon and its seat proxy, never a wire code, so it is not a durable_* code (S1 owns those).
+ */
+export declare const SEAT_UNKNOWN = "seat_unknown";

package/dist/host/s1-names.js

@@ -0,0 +1,21 @@
+/**
+ * S1 names the host daemon uses, taken from the vendored contract so cli/src/host never spells an
+ * event kind or a durable_* code as a literal (C10-R4; the static check C10-STATIC-001).
+ */
+import { DURABLE_CODES } from "../vendor/shared/durable-contract/codes.js";
+import { EXECUTOR_WRITABLE_KINDS } from "../vendor/shared/durable-contract/events.js";
+/** Every S1 durable code, keyed by itself: `CODE.durable_hello_late` is checked against S1 at compile time. */
+export const CODE = Object.freeze(Object.fromEntries(Object.keys(DURABLE_CODES).map((k) => [k, k])));
+/**
+ * The executor.spawned kind: S1 EXECUTOR_WRITABLE_KINDS[0]. It was M1's only executor-writable kind
+ * (L01); the Doors amendment (ruling 34.06) appended session.waiting after it, which the daemon does
+ * not write.
+ */
+export const SPAWNED_KIND = EXECUTOR_WRITABLE_KINDS[0];
+/** The executor.turn_continued kind: S1 EXECUTOR_WRITABLE_KINDS[2] (lead ruling 2026-10-28). */
+export const TURN_CONTINUED_KIND = EXECUTOR_WRITABLE_KINDS[2];
+/**
+ * The control socket's answer when no registered seat has the relayed spawn id. It is local to the
+ * daemon and its seat proxy, never a wire code, so it is not a durable_* code (S1 owns those).
+ */
+export const SEAT_UNKNOWN = "seat_unknown";

package/dist/host/seat-credential.d.ts

@@ -0,0 +1,27 @@
+/**
+ * A durable seat's provider credential, resolved exactly as `mnemom agent` resolves it (dogfood B6):
+ * the auth mode from MNEMOM_AGENT_AUTH, else launcher.toml `auth` (folded in under env, as the CLI
+ * does), else api-key; on the api-key arm the Anthropic key from agent.ts's own resolver
+ * (MNEMOM_AGENT_ANTHROPIC_KEY / ANTHROPIC_API_KEY env, then ~/.mnemom/launcher.json, honouring
+ * launcher.toml `key_source`), never prompting. A subscription seat carries no key: claude sends
+ * its own claude.ai login. The daemon runs under launchd without the user's shell env, so the
+ * launcher files are usually the only source.
+ *
+ * Pure over injected deps; defaultSeatCredentialDeps wires the real config reader and resolver.
+ */
+import { resolveAnthropicKey } from "../commands/agent.js";
+import { type LauncherConfig } from "../lib/launcher-config.js";
+export type SeatCredential = {
+    readonly ok: true;
+    readonly anthropicKey?: string;
+} | {
+    readonly ok: false;
+    readonly message: string;
+};
+export interface SeatCredentialDeps {
+    readonly env: Readonly<Record<string, string | undefined>>;
+    loadConfig(): LauncherConfig;
+    resolveKey: typeof resolveAnthropicKey;
+}
+export declare function resolveSeatCredential(d: SeatCredentialDeps): Promise<SeatCredential>;
+export declare const defaultSeatCredentialDeps: (env: Readonly<Record<string, string | undefined>>) => SeatCredentialDeps;

package/dist/host/seat-credential.js

@@ -0,0 +1,41 @@
+/**
+ * A durable seat's provider credential, resolved exactly as `mnemom agent` resolves it (dogfood B6):
+ * the auth mode from MNEMOM_AGENT_AUTH, else launcher.toml `auth` (folded in under env, as the CLI
+ * does), else api-key; on the api-key arm the Anthropic key from agent.ts's own resolver
+ * (MNEMOM_AGENT_ANTHROPIC_KEY / ANTHROPIC_API_KEY env, then ~/.mnemom/launcher.json, honouring
+ * launcher.toml `key_source`), never prompting. A subscription seat carries no key: claude sends
+ * its own claude.ai login. The daemon runs under launchd without the user's shell env, so the
+ * launcher files are usually the only source.
+ *
+ * Pure over injected deps; defaultSeatCredentialDeps wires the real config reader and resolver.
+ */
+import { resolveAnthropicKey } from "../commands/agent.js";
+import { applyConfigToEnv, loadLauncherConfig, } from "../lib/launcher-config.js";
+import { resolveAgentAuth } from "../lib/subscription-login.js";
+const messageOf = (e) => (e instanceof Error ? e.message : String(e));
+export async function resolveSeatCredential(d) {
+    let cfg;
+    try {
+        cfg = d.loadConfig();
+    }
+    catch (e) {
+        return { ok: false, message: messageOf(e) };
+    }
+    const env = { ...d.env };
+    applyConfigToEnv(cfg, env);
+    if (resolveAgentAuth(undefined, env) === "subscription")
+        return { ok: true };
+    try {
+        const anthropicKey = await d.resolveKey(env, { allowPrompt: false, keySource: cfg.keySource });
+        return { ok: true, anthropicKey };
+    }
+    catch (e) {
+        // The same refusal `mnemom agent` prints ("no Anthropic key found — refusing to launch un-routed").
+        return { ok: false, message: messageOf(e) };
+    }
+}
+export const defaultSeatCredentialDeps = (env) => ({
+    env,
+    loadConfig: () => loadLauncherConfig(),
+    resolveKey: resolveAnthropicKey,
+});

package/dist/host/seat-launch-main.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/host/seat-launch-main.js

@@ -0,0 +1,59 @@
+/**
+ * Thin driver for the seat launcher (seat-launch.ts): what a durable seat's tmux pane execs. Not a
+ * CLI word; the host daemon starts it by path. All behaviour lives in runSeatLaunch.
+ */
+import { spawn } from "node:child_process";
+import * as fs from "node:fs";
+import * as net from "node:net";
+import * as os from "node:os";
+import * as path from "node:path";
+import { DURABLE_DIR } from "../vendor/shared/durable-contract/paths.js";
+import { defaultSeatCredentialDeps, resolveSeatCredential } from "./seat-credential.js";
+import { openProxyLog, parseSeatLaunchArgs, runSeatLaunch, seatLaunchDeps, seatProxyLogPath, } from "./seat-launch.js";
+function request(socketPath, frame) {
+    return new Promise((resolve, reject) => {
+        const sock = net.createConnection({ path: socketPath });
+        let buf = "";
+        const timer = setTimeout(() => {
+            sock.destroy();
+            reject(new Error("control socket timeout"));
+        }, 10_000);
+        sock.on("connect", () => sock.write(`${JSON.stringify(frame)}\n`));
+        sock.on("data", (d) => {
+            buf += d.toString("utf8");
+            const i = buf.indexOf("\n");
+            if (i < 0)
+                return;
+            clearTimeout(timer);
+            sock.end();
+            try {
+                resolve(JSON.parse(buf.slice(0, i)));
+            }
+            catch (e) {
+                reject(e);
+            }
+        });
+        sock.on("error", (e) => {
+            clearTimeout(timer);
+            reject(e);
+        });
+    });
+}
+const parsed = parseSeatLaunchArgs(process.argv.slice(2));
+if (!parsed.ok) {
+    process.stderr.write(`mnemom seat: ${parsed.error}\n`);
+    process.exit(2);
+}
+else {
+    const proxyLog = seatProxyLogPath(path.join(os.homedir(), DURABLE_DIR, "logs"), parsed.args.session, parsed.args.spawnId);
+    void runSeatLaunch(parsed.args, seatLaunchDeps({
+        env: process.env,
+        execPath: process.execPath,
+        credential: () => resolveSeatCredential(defaultSeatCredentialDeps(process.env)),
+        request,
+        spawn: (cmd, args, opts) => spawn(cmd, args, opts),
+        stderr: (line) => void process.stderr.write(line),
+        proxyLog,
+        proxyLogFd: openProxyLog(proxyLog, fs),
+    })).then((code) => process.exit(code));
+}

package/dist/host/seat-launch.d.ts

@@ -0,0 +1,116 @@
+import type { Readable, Writable } from "node:stream";
+import type { SeatCredential } from "./seat-credential.js";
+export interface SeatLaunchArgs {
+    readonly control: string;
+    readonly session: string;
+    readonly epoch: number;
+    readonly spawnId: string;
+    readonly conversation: string;
+    readonly agentId: string;
+    readonly door: string;
+    readonly cwd: string;
+    readonly cliEntry: string;
+    readonly claude: readonly string[];
+}
+/** How long the proxy has to print READY (it reads the key, takes the conversation lock, listens). */
+export declare const READY_TIMEOUT_MS = 15000;
+export declare function parseSeatLaunchArgs(argv: readonly string[]): {
+    ok: true;
+    args: SeatLaunchArgs;
+} | {
+    ok: false;
+    error: string;
+};
+/** C3's seat-proxy argv (after the node binary): the seat ids, and the daemon socket as the hello relay. */
+export declare function proxyArgv(a: SeatLaunchArgs): string[];
+/**
+ * The proxy reads its seat ids from argv; it gets no seat fact and no Anthropic credential from env
+ * (the provider credential reaches it only per request, from claude, and passes through).
+ */
+export declare const proxyEnv: (env: Readonly<Record<string, string | undefined>>) => Record<string, string>;
+/**
+ * claude's env: `mnemom agent`'s own env for the resolved credential (launchChildEnv over
+ * buildCustomHeaders), pointed at the loopback proxy, plus the seat socket for the plugin's hello.
+ * The headers' x-mnemom-* lines are replaced by the proxy from the lease; their x-api-key line (the
+ * api-key arm) is what reaches the door. The plugin's hello hook runs `node`, so the directory of
+ * the node running this launcher goes LAST on PATH: a node already on PATH still wins, and a PATH
+ * without one (a version-manager shim that has since gone) still finds this one. Claude Code's
+ * gateway hint headers come with launchChildEnv, as for `mnemom agent`: without x-claude-code-request-class and
+ * x-claude-code-prompt-id the proxy can only chain a turn to the newest prompt already in the
+ * transcript, which for a seat's first typed turn is the launch prompt (dogfood B8).
+ */
+export declare function claudeEnv(env: Readonly<Record<string, string | undefined>>, port: number, socketPath: string, seat: {
+    readonly agentId: string;
+    readonly conversation: string;
+    readonly anthropicKey?: string;
+}, nodeDir?: string): Record<string, string>;
+export declare function parseReady(line: string): {
+    port: number;
+    socketPath: string;
+} | null;
+export interface LaunchChild {
+    readonly pid?: number;
+    readonly stdin: Writable | null;
+    readonly stdout: Readable | null;
+    kill(signal: NodeJS.Signals): boolean;
+    on(event: "exit", listener: (code: number | null, signal: NodeJS.Signals | null) => void): this;
+}
+export interface SeatLaunchDeps {
+    readonly env: Readonly<Record<string, string | undefined>>;
+    /** The node binary that runs the CLI again (the proxy). */
+    readonly execPath: string;
+    /** The owner's provider credential, resolved as `mnemom agent` does (seat-credential.ts). */
+    credential(): Promise<SeatCredential>;
+    /** One newline-JSON request on a unix socket, one reply line parsed. */
+    request(socketPath: string, frame: Record<string, unknown>): Promise<Record<string, unknown>>;
+    /**
+     * role "proxy": stdin and stdout piped, stderr to the seat's proxy log (seatProxyStdio), never the
+     * pane. role "claude": stdio inherited.
+     */
+    spawn(cmd: string, args: readonly string[], opts: {
+        env: Record<string, string>;
+        role: "proxy" | "claude";
+    }): LaunchChild;
+    stderr(line: string): void;
+    /** Where the proxy's stderr goes (seatProxyLogPath), named when the proxy fails; absent: nowhere. */
+    readonly proxyLog?: string;
+    readonly readyTimeoutMs?: number;
+}
+/**
+ * The seat proxy's log: its per-request lines (`seat-proxy /v1/messages -> 200 …`) and its errors.
+ * The pane belongs to claude; a proxy line written to the tty is drawn over Claude Code's input box
+ * and reads like a half-typed prompt (dogfood cosmetic finding).
+ */
+export declare function seatProxyLogPath(logDir: string, session: string, spawnId: string): string;
+/** The proxy's stdio: stdin and stdout piped (key in, READY out), stderr to the log fd or dropped. */
+export declare function seatProxyStdio(logFd: number | null): ["pipe", "pipe", number | "ignore"];
+/** The fs calls openProxyLog makes. */
+export interface ProxyLogFs {
+    mkdirSync(dir: string, o: {
+        recursive: true;
+        mode: number;
+    }): unknown;
+    openSync(file: string, flags: string, mode: number): number;
+}
+/** Open the seat proxy's log (append, 0600, in the 0700 durable log dir); null when it cannot. */
+export declare function openProxyLog(file: string, f: ProxyLogFs): number | null;
+/** A node-style spawn: what seat-launch-main.ts passes from node:child_process. */
+export type NodeSpawn = (cmd: string, args: string[], opts: {
+    env: Record<string, string>;
+    stdio: "inherit" | ReturnType<typeof seatProxyStdio>;
+}) => unknown;
+/**
+ * runSeatLaunch's deps over the process's own: the proxy's stderr goes to its log fd
+ * (seatProxyStdio), claude inherits the pane, and the log is named only when it opened.
+ */
+export declare function seatLaunchDeps(io: {
+    env: SeatLaunchDeps["env"];
+    execPath: string;
+    credential: SeatLaunchDeps["credential"];
+    request: SeatLaunchDeps["request"];
+    spawn: NodeSpawn;
+    stderr: SeatLaunchDeps["stderr"];
+    proxyLog: string;
+    proxyLogFd: number | null;
+}): SeatLaunchDeps;
+export declare function runSeatLaunch(a: SeatLaunchArgs, d: SeatLaunchDeps): Promise<number>;