@mnemom/mnemom 0.17.34-next.1 → 0.17.34-next.2

package/dist/base-url-proxy.mjs

@@ -15,7 +15,10 @@
 // (> WAIT_MS) → the request is forwarded without it (the gateway then behaves as before).
 //
 // CONFIG (env, none secret)
-//   MNEMOM_AGENT_BU_DOOR         gateway door URL (required, https only), e.g. https://gateway.mnemom.ai/anthropic
+//   MNEMOM_AGENT_BU_DOOR         gateway door URL (required), e.g. https://gateway.mnemom.ai/anthropic;
+//                                https; http only with MNEMOM_AGENT_BU_HTTP_DOOR=1 and on a
+//                                loopback literal (127.0.0.1, [::1], localhost: the C17-R16 seam)
+//   MNEMOM_AGENT_BU_HTTP_DOOR    "1" allows that http door; set by the launcher (see the gate below)
 //   MNEMOM_AGENT_BU_CWD          the session cwd (Claude Code's transcript lives under its slug)
 //   MNEMOM_AGENT_BU_LOG          append log lines here instead of stderr (optional)
 //   MNEMOM_AGENT_BU_PARENT_PID   exit when this pid is gone
@@ -43,7 +46,18 @@ try {
 } catch {
   die("MNEMOM_AGENT_BU_DOOR is required and must be a URL");
 }
-if (DOOR.protocol !== "https:") die("MNEMOM_AGENT_BU_DOOR must be https");
+/** S1 LOOPBACK_HOSTS: the exact hostnames an http door may name (look-alikes such as 127.0.0.1.nip.io fail). */
+const LOOPBACK_HOSTS = new Set(["127.0.0.1", "[::1]", "localhost"]);
+// The C17-R16 http-door seam (T3). The launcher (commands/agent.ts startBaseUrlProxy) sets
+// MNEMOM_AGENT_BU_HTTP_DOOR=1 only when test-mode.mjs testSeamsHonoured / httpDoorAllowed hold, and
+// strips an inherited value otherwise; this proxy reads no test-mode env itself. A proxy spawned
+// directly trusts its parent's flag: the worst case is still http to a loopback literal only.
+const httpDoorAllowed = env.MNEMOM_AGENT_BU_HTTP_DOOR === "1" && LOOPBACK_HOSTS.has(DOOR.hostname);
+if (DOOR.protocol === "http:") {
+  if (!httpDoorAllowed)
+    die("MNEMOM_AGENT_BU_DOOR must be https (http only on a loopback literal with the door flag)");
+} else if (DOOR.protocol !== "https:") die("MNEMOM_AGENT_BU_DOOR must be https");
+const transport = DOOR.protocol === "http:" ? http : https;
 const LOGFILE = env.MNEMOM_AGENT_BU_LOG || "";
 const PARENT = Number(env.MNEMOM_AGENT_BU_PARENT_PID || 0);
 const PORT = Number(env.MNEMOM_AGENT_BU_PORT || 0);
@@ -101,7 +115,7 @@ function recordState(h) {
   }
 }
 
-const agent = new https.Agent({ keepAlive: true, maxSockets: 32 });
+const agent = new transport.Agent({ keepAlive: true, maxSockets: 32 });
 const doorPath = DOOR.pathname.replace(/\/$/, "");
 const isMessages = (u) => u === "/v1/messages" || u.startsWith("/v1/messages?");
 
@@ -123,7 +137,7 @@ function handle(req, res) {
 
   const forward = (note) => {
     const target = new URL(DOOR.origin + doorPath + req.url);
-    const up = https.request(target, { method: req.method, headers, agent }, (ur) => {
+    const up = transport.request(target, { method: req.method, headers, agent }, (ur) => {
       recordState(ur.headers);
       res.writeHead(ur.statusCode, ur.headers);
       ur.pipe(res);

package/dist/commands/agent-config.js

@@ -56,7 +56,8 @@ function listConfig(enabled) {
         out("Set one with:  mnemom agent config set <key> <value>");
         out("");
         out("Settable keys:");
-        for (const spec of CONFIG_KEYS)
+        // The durable key is listed only while `durable` is on (hidden like its verbs; C17).
+        for (const spec of CONFIG_KEYS.filter((k) => k.key !== "durable" || enabled.includes("durable")))
             out(`  ${spec.key.padEnd(22)} ${spec.describe}${configKeyMark(spec.key, undefined, enabled)}`);
         return;
     }
@@ -199,6 +200,9 @@ function deleteKey(cfg, key) {
         case "compaction_intercept":
             delete cfg.compactionIntercept;
             break;
+        case "durable":
+            delete cfg.durable;
+            break;
         case "context_profile":
             delete cfg.contextProfile;
             break;

package/dist/commands/agent-doctor.d.ts

@@ -17,6 +17,15 @@ export interface DoctorOptions {
     cli?: string;
     /** The agent slug a launch would use (--agent / launcher.toml); default agent-<handle>. */
     agent?: string;
+    /**
+     * The durable lock lines (commands/durable-doctor.ts), passed only while the experimental
+     * `durable` gate is on; absent, the doctor is exactly as before.
+     */
+    durable?: () => Promise<Array<{
+        mark: "ok" | "warn" | "info";
+        text: string;
+        hint?: string;
+    }>>;
 }
 /** Run the preflight and print the checklist. Sets process.exitCode on failure. */
 export declare function agentDoctorCommand(options?: DoctorOptions): Promise<void>;

package/dist/commands/agent-doctor.js

@@ -125,6 +125,10 @@ export async function agentDoctorCommand(options = {}) {
     // ── CLI auto-update ──
     const upd = await probeUpdateStatus();
     add(upd.mark, upd.text, upd.hint);
+    // ── durable lock preconditions (gate on only): never a MISS ──
+    if (options.durable)
+        for (const l of await options.durable())
+            add(l.mark, l.text, l.hint);
     // ── render ──
     const door = resolveAnthropicDoor(env);
     out("mnemom agent doctor");

package/dist/commands/agent-session.d.ts

@@ -12,8 +12,7 @@
  * (`x-mnemom-contract`). Implicit alignment — the goal inferred from your own
  * messages (`x-mnemom-goal-mode: implicit`, no contract) — is the experimental
  * `implicit` feature: while it is on a bare launch runs implicit, while it is off
- * (the default) a bare launch runs with alignment off. On a prerelease (`next`)
- * build a bare launch runs implicit unless it is headless `-p` (T16). `--no-implicit` (or
+ * (the default) a bare launch runs with alignment off. `--no-implicit` (or
  * launcher.toml `goal_mode = "off"`) turns it off. The mode is resolved upstream
  * (`resolveImplicit`) and announced on the launch line.
  *

package/dist/commands/agent-session.js

@@ -12,8 +12,7 @@
  * (`x-mnemom-contract`). Implicit alignment — the goal inferred from your own
  * messages (`x-mnemom-goal-mode: implicit`, no contract) — is the experimental
  * `implicit` feature: while it is on a bare launch runs implicit, while it is off
- * (the default) a bare launch runs with alignment off. On a prerelease (`next`)
- * build a bare launch runs implicit unless it is headless `-p` (T16). `--no-implicit` (or
+ * (the default) a bare launch runs with alignment off. `--no-implicit` (or
  * launcher.toml `goal_mode = "off"`) turns it off. The mode is resolved upstream
  * (`resolveImplicit`) and announced on the launch line.
  *

package/dist/commands/agent-setup.d.ts

@@ -288,6 +288,12 @@ export declare function resolvePinnedAgent(id: string): Promise<{
     id: string;
     slug: string;
 }>;
+/**
+ * The x-mnemom-agent value for a pinned agent: its stored name exactly, when that name is a
+ * header-safe token (every api-valid name is: AGENT_NAME_REGEX allows only letters, digits and
+ * hyphens); "" otherwise, which refuses the launch.
+ */
+export declare function pinnedSlugOf(name: string | null | undefined): string;
 /**
  * One line for an api failure that keeps the parts an operator can act on: the
  * message, the error code, and the scope the endpoint said it needed

package/dist/commands/agent-setup.js

@@ -696,12 +696,23 @@ export async function resolvePinnedAgent(id) {
         throw new UnclaimedAgentError(`mnemom agent: agent ${id} is not claimed, and mnemom agent never runs on an unclaimed agent. ` +
             `Claim it first: \`mnemom agent claim ${id} --key <key>\`.`);
     }
-    const slug = sanitizeAgentName(agent.name ?? "");
+    // The stored name goes out verbatim: the gateway compares the pin's name exactly
+    // (agent-identity.ts), and the api allows uppercase and hyphen runs, which sanitizeAgentName
+    // would rewrite (mnemom-test #1061). sanitizeAgentName is for new names only.
+    const slug = pinnedSlugOf(agent.name);
     if (!slug) {
         throw new UnclaimedAgentError(`mnemom agent: agent ${id} has no usable name to send as x-mnemom-agent; rename it, or launch by name.`);
     }
     return { id, slug };
 }
+/**
+ * The x-mnemom-agent value for a pinned agent: its stored name exactly, when that name is a
+ * header-safe token (every api-valid name is: AGENT_NAME_REGEX allows only letters, digits and
+ * hyphens); "" otherwise, which refuses the launch.
+ */
+export function pinnedSlugOf(name) {
+    return typeof name === "string" && /^[A-Za-z0-9-]+$/.test(name) ? name : "";
+}
 /** The refusal for a pinned launch the gateway did not (or could not) honour. */
 function pinRefusal(err, pin, slug) {
     const head = `mnemom agent: the gateway would not run this launch as ${pin}`;

package/dist/commands/agent.d.ts

@@ -33,6 +33,7 @@ import { type ExperimentalId } from "../lib/experimental.js";
 import { conductReceiptFor, type ReceiptLaunch } from "../lib/conduct-receipt.js";
 import { type GovernanceOptIn } from "./agent-setup.js";
 import { type CcSettingsView, type ContextProfile, type LaunchShape, type SealedContractEnvelope } from "../lib/agent.js";
+import type { LauncherKey } from "../vendor/shared/durable-contract/fixlines.js";
 export interface AgentOptions {
     goal?: string;
     requirement?: string[];
@@ -60,6 +61,14 @@ export interface AgentOptions {
     /** launcher.toml `agent_id`: the pin when no `--agent` is given (selectLaunchAgent). */
     agentId?: string;
     conversationId?: string;
+    /**
+     * Durable launch (EXPERIMENTAL `durable`, BACKBONE C1): set only while the gate is on. Absent,
+     * the launch is exactly today's (C17).
+     */
+    durable?: {
+        launcherKey: LauncherKey;
+        newSession: boolean;
+    };
     cli?: string;
     remoteControl?: boolean;
     server?: boolean;
@@ -397,6 +406,8 @@ export declare function exemptLoopbackFromProxy(env: NodeJS.ProcessEnv): void;
 export declare function sayConductReceipt(launch: ReceiptLaunch, trigger?: "exit" | "park", receipt?: typeof conductReceiptFor): Promise<void>;
 /** Whether a terminal implicit launch runs the turn-origin proxy (MNEMOM_AGENT_TURN_HEADER=0 opts out). */
 export declare function turnProxyWanted(env: NodeJS.ProcessEnv): boolean;
+/** The flag that lets base-url-proxy.mjs use an http door on a loopback literal (C17-R16 T3). */
+export declare const BU_HTTP_DOOR_ENV = "MNEMOM_AGENT_BU_HTTP_DOOR";
 /** Test seams for startBaseUrlProxy (every real caller omits them). */
 export interface BaseUrlProxyOptions {
     /** The proxy script (default: the bundled base-url-proxy.mjs beside rc-proxy.mjs). */

package/dist/commands/agent.js

@@ -39,8 +39,10 @@ import { ALLOW_AUTOCOMPACT_OFF_ENV, dropAutocompactOffEnv, hasOwnSettingsFlag, m
 import { getApiUrl, getGatewayUrl, MNEMOM_DIR } from "../lib/config.js";
 import { createApiKey } from "../lib/api.js";
 import { recordOrgFor } from "../lib/record-org.js";
+import { httpDoorAllowed } from "../durable/test-mode.mjs";
 import { defaultSessionKeyDeps, mintSessionGatewayKey, revokeSessionGatewayKey, startSessionKeyRenewal, } from "../lib/session-key.js";
-import { MNEMOM_KEY_STORE_FIELD, resolveAgentAuth, sayRetiredConsoleNotice, readMnemomKey, resolveSubscriptionMnemomKey, subscriptionChildEnv, subscriptionShape, } from "../lib/subscription-login.js";
+import { MNEMOM_KEY_STORE_FIELD, resolveAgentAuth, sayRetiredConsoleNotice, readMnemomKey, resolveSubscriptionMnemomKey, launchChildEnv, subscriptionShape, } from "../lib/subscription-login.js";
+import { clearLaunching, liveLaunchingDeps, markLaunching } from "../lib/durable/launching.js";
 import { LEDGER_FILE, appendSessionRecord, findResumeCandidate, readSessionRecords, resolveRetentionDays, resumedContextProfile, toLedgerContract, } from "../lib/agent-ledger.js";
 import { isLoggedIn } from "../lib/auth.js";
 import { loadCliConfig } from "../lib/cli-config.js";
@@ -57,6 +59,9 @@ import { LAUNCHER_STORE_PATH, mergeStore } from "../lib/launcher-store.js";
 import { slackChannelArgs } from "../lib/slack-launch.js";
 import { appendPluginDirsEnv, applyPluginEnv, pluginEnabled, pluginPlanLine, resolvePluginDir, } from "../lib/claude-plugin.js";
 import { CLI_VERSION } from "../version.js";
+import { attachToSeat, firstTurnRow, locksAfterFirstTurn, planDurableLaunch, preReadRegistry, } from "../lib/durable/launch.js";
+import { liveDurableApi, liveHomeFacts, livePlanDeps, liveRegistryReads, liveSeatDeps, liveLockAfterFirstTurn, lockInsteadOfSpawn, createLockedInsteadOfSpawn, liveParentAfterChildEnded, registerDurableSession, saveTtyMode, } from "../lib/durable/live.js";
+import { mayBeHandover } from "../lib/durable/handover.js";
 import { fetchTierIndex, profileMayMisfit, profileTierWarning, resolveTier, tierLaunchModel, } from "../lib/model-tier.js";
 /** The CLI's own provider-key store (zero 1Password): ~/.mnemom/launcher.json, 0600. */
 const CODE_STORE = LAUNCHER_STORE_PATH;
@@ -175,8 +180,7 @@ export async function agentCommand(scenarioArg, options = {}) {
     liftPassthroughName(options.passthrough ?? []);
     // ── session name + goal ── (a bare `mnemom agent` in a terminal asks for the name;
     // goal alignment is resolved upstream: --goal seals a contract, implicit alignment
-    // is on by default while the `implicit` experimental feature is on, and on a `next`
-    // build for every launch but `-p` (T16).
+    // is on by default only while the `implicit` experimental feature is on.
     const session = await resolveSessionSetup({
         scenario: scenarioArg,
         goal: options.goal,
@@ -187,8 +191,24 @@ export async function agentCommand(scenarioArg, options = {}) {
         askYesNo: (q, d) => askYesNo(q, d),
     });
     const scenario = session.scenario;
+    // ── durable (gate on only): read the registry FIRST, before any other API call, so a registry
+    // that is down refuses with session_registry_unavailable within REGISTRY_TIMEOUT_MS and nothing
+    // is minted, spawned or written (C01-R18). The plan below decides from these rows; a caller not
+    // signed in yet (401) is read again by the plan after sign-in.
+    // A server-shape launch hosts many Claude Code sessions and pins none: it is never registered
+    // (legacy), so neither the read nor the plan runs for it.
     const env = process.env;
     let shape = resolveLaunchShape({ remoteControl: options.remoteControl, server: options.server }, env);
+    const durableLaunch = Boolean(options.durable && scenario) && shape !== "server";
+    // Until the session registers, a lock by this name answers first_turn_pending, not "no session".
+    if (durableLaunch && scenario && !options.dryRun) {
+        const ld = liveLaunchingDeps(MNEMOM_DIR);
+        markLaunching(scenario, process.pid, ld);
+        process.on("exit", () => clearLaunching(scenario, ld));
+    }
+    const durableRows = durableLaunch && scenario && !options.dryRun
+        ? await preReadRegistry(liveRegistryReads(liveDurableApi()), scenario)
+        : undefined;
     const shapeExplicit = launchPreferenceExplicit({ remoteControl: options.remoteControl, server: options.server }, env);
     // How Claude Code authenticates: an Anthropic key (default) or the user's claude.ai
     // subscription login (Team/Enterprise; lib/subscription-login.ts).
@@ -260,7 +280,7 @@ export async function agentCommand(scenarioArg, options = {}) {
     const cellNote = isProdGateway(env) ? "us-2/prod" : `custom (${gatewayHost})`;
     // ── the bundled Claude Code plugin (lib/claude-plugin) ── resolved up front so the dry-run plan
     // and the launch log print the same line. Only Claude Code proper takes `--plugin-dir`.
-    const pluginWanted = pluginEnabled(options.plugin, env);
+    const pluginWanted = pluginEnabled(options.plugin, env, options.durable !== undefined);
     const bundledPluginDir = pluginWanted ? resolvePluginDir() : null;
     const pluginFor = (cliName) => cliName !== "claude" && pluginWanted
         ? { dir: null, line: `off (${cliName} is not Claude Code)` }
@@ -519,20 +539,83 @@ export async function agentCommand(scenarioArg, options = {}) {
     // so the goal the gateway inferred there is still the one it steers by. Resolved here, after
     // sign-in and the agent refresh, because a resume needs the org, agent and gateway host to
     // match the earlier launch.
-    const continuation = await resolveLaunchContinuation({
-        session: scenario,
-        orgId: account.orgId,
-        agent,
-        gatewayHost,
-        explicit: options.conversationId,
-        implicit: goalAlignmentMode(envelope, goalMode) === "implicit",
-        passthrough: options.passthrough ?? [],
-        interactive: isInteractive(),
-        records: () => readSessionRecords({ dir: MNEMOM_DIR }),
-        askYesNo: (q, d) => askYesNo(q, d),
-        ccSessionExists: (id) => ccSessionTranscriptExists(id, process.env),
-    });
+    // ── durable (gate on only) ── the server registry decides continue / new / attach before the
+    // local ledger does (C01-R01); a registry-backed plan replaces the ledger continuation.
+    let durablePlan = null;
+    // The launcher key of a durable plan: durablePlan is only ever set under options.durable.
+    let durableKey = "off";
+    if (options.durable && scenario && durableLaunch) {
+        durableKey = options.durable.launcherKey;
+        const plan = await planDurableLaunch({
+            name: scenario,
+            newFlag: options.durable.newSession,
+            launcherKey: options.durable.launcherKey,
+            passthrough: options.passthrough ?? [],
+            goalGiven: Boolean(options.goal?.trim()),
+            explicitAgentId: pin ? servedAgentId : null,
+            interactive: isInteractive(),
+            home: await liveHomeFacts(),
+            rows: durableRows,
+            explicitConversationId: options.conversationId ?? null,
+        }, livePlanDeps(servedAgentId, (id) => ccSessionTranscriptExists(id, process.env), (q, d) => askYesNo(q, d)));
+        if (plan.kind === "attach") {
+            process.exitCode = await attachToSeat(plan.row, scenario, [], liveSeatDeps(options.durable.launcherKey));
+            return;
+        }
+        if (plan.kind === "spawn")
+            durablePlan = plan;
+    }
+    const continuation = durablePlan
+        ? {
+            conversationId: durablePlan.conversationId,
+            resumeCcSessionId: durablePlan.resumeCcSessionId,
+        }
+        : await resolveLaunchContinuation({
+            session: scenario,
+            orgId: account.orgId,
+            agent,
+            gatewayHost,
+            explicit: options.conversationId,
+            implicit: goalAlignmentMode(envelope, goalMode) === "implicit",
+            passthrough: options.passthrough ?? [],
+            interactive: isInteractive(),
+            records: () => readSessionRecords({ dir: MNEMOM_DIR }),
+            askYesNo: (q, d) => askYesNo(q, d),
+            ccSessionExists: (id) => ccSessionTranscriptExists(id, process.env),
+        });
     const conversationId = continuation.conversationId;
+    // The registered row of a durable launch: its child's SIGKILL may be a handover (C02-R26 step 7).
+    let durableRow = null;
+    // A lock on a new CC session waits for its first turn (dogfood B5): claude spawns attended first.
+    let lockAfterFirstTurn = false;
+    if (durablePlan) {
+        options = {
+            ...options,
+            passthrough: durablePlan.newCcSessionId
+                ? [...durablePlan.passthrough, "--session-id", durablePlan.newCcSessionId]
+                : durablePlan.passthrough,
+        };
+        // Register (new) and, under `always` / ask-yes, lock instead of spawning (C02-R23 c, e). A lock
+        // refusal prints the refusal and its fix, then falls through to the tracked spawn below. A new
+        // CC session has no transcript to resume yet: it spawns, and locks after its first turn (B5).
+        // B5a (as amended): a new CC session on a durable-only agent is created locked in one request
+        // and attached; it never registers tracked or runs an attended first turn.
+        if (durablePlan.durableOnly && locksAfterFirstTurn(durablePlan)) {
+            process.exitCode = await createLockedInsteadOfSpawn(durablePlan, scenario, servedAgentId, durableKey, { model: options.model, effort: options.effort, trimMcp: options.trimMcp });
+            return;
+        }
+        const row = await registerDurableSession(durablePlan, scenario, servedAgentId);
+        clearLaunching(scenario, liveLaunchingDeps(MNEMOM_DIR));
+        durableRow = firstTurnRow(row, durablePlan);
+        lockAfterFirstTurn = locksAfterFirstTurn(durablePlan);
+        if (durablePlan.lock && !lockAfterFirstTurn) {
+            const locked = await lockInsteadOfSpawn(row, scenario, durableKey, durablePlan.durableOnly);
+            if (locked !== null) {
+                process.exitCode = locked;
+                return;
+            }
+        }
+    }
     // A relaunch that continues an earlier conversation resumes that Claude Code session, so the
     // same CC session id keeps owning the conversation's main goal on the gateway (a fresh
     // --session-id would land on a new, empty m.<sha16> thread). The server shape hosts many
@@ -704,6 +787,7 @@ export async function agentCommand(scenarioArg, options = {}) {
                 goalMode,
                 scenario,
                 launcherVersion: CLI_VERSION,
+                ...(options.durable ? { durable: true } : {}),
                 // The mod re-runs this CLI (`agent show --json`, `agent goal show --json`) for the live
                 // goal state; execArgv keeps a `tsx`/`--import` dev launch runnable the same way.
                 launcherExec: process.argv[1]
@@ -803,6 +887,16 @@ export async function agentCommand(scenarioArg, options = {}) {
             }),
             knownCcSessionId: cc.id ?? continuedCcSessionId,
             plugin,
+            ...(durableRow && options.durable
+                ? {
+                    durableHandover: {
+                        row: durableRow,
+                        name: scenario,
+                        launcherKey: options.durable.launcherKey,
+                        lockAfterFirstTurn,
+                    },
+                }
+                : {}),
             receipt: experimental.includes("record")
                 ? { orgId: recordOrgId, agentId: servedAgentId }
                 : undefined,
@@ -1313,30 +1407,14 @@ function launchTerminal(ctx) {
         handoffMcpConfigPath: ctx.handoffMcpConfigPath,
         pluginDir: ctx.plugin?.dir,
     });
-    // Claude Code logged in via claude.ai (OAuth) PREEMPTS ANTHROPIC_API_KEY, so
-    // it is force-unset; the real key rides in ANTHROPIC_CUSTOM_HEADERS and
-    // ANTHROPIC_AUTH_TOKEN is a fixed non-secret placeholder.
-    //
-    // A subscription launch (no Anthropic key) sets NO auth token: Claude Code then sends its
-    // own claude.ai login to the gateway (lib/subscription-login.ts).
-    let childEnv;
+    // The api-key arm (key in ANTHROPIC_CUSTOM_HEADERS, placeholder auth token, ANTHROPIC_API_KEY
+    // unset) or the subscription arm (Claude Code's own claude.ai login), shared with durable seats
+    // (lib/subscription-login.ts launchChildEnv). MNE-8245 defense-in-depth: the owner's own Mnemom
+    // credential must never ride through to the session just because it happened to sit in the
+    // CLI's OWN process env — the session's only Mnemom credential is the minted key already
+    // spliced into `headers` above (ctx.mnemomKey).
+    const childEnv = launchChildEnv(process.env, ctx.door, headers, ctx.anthropicKey);
     let feed = null;
-    if (ctx.anthropicKey) {
-        childEnv = { ...process.env };
-        delete childEnv.ANTHROPIC_API_KEY;
-        childEnv.ANTHROPIC_BASE_URL = ctx.door;
-        childEnv.ANTHROPIC_AUTH_TOKEN = "mnemom-gateway";
-        childEnv.ANTHROPIC_CUSTOM_HEADERS = headers;
-    }
-    else {
-        childEnv = subscriptionChildEnv(process.env, ctx.door, headers);
-    }
-    // MNE-8245 defense-in-depth: the owner's own Mnemom credential must never ride
-    // through to the session just because it happened to sit in the CLI's OWN
-    // process env (a shell MNEMOM_API_KEY / MNEMOM_TOKEN export, or a leftover
-    // MNEMOM_AGENT_MNEMOM_KEY) — the session's only Mnemom credential is the
-    // minted key already spliced into `headers` above (ctx.mnemomKey).
-    stripOwnerCredentialEnv(childEnv);
     // Both auth arms point ANTHROPIC_BASE_URL at the gateway door, which makes Claude Code turn
     // tool search off and inline every tool schema on every request — unless told otherwise.
     applyToolSearchDefault(childEnv);
@@ -1346,10 +1424,9 @@ function launchTerminal(ctx) {
     const sessionName = passthroughName(ctx.options.passthrough ?? []) ?? sessionDisplayName(ctx.agent, ctx.scenario);
     childEnv[SESSION_NAME_ENV] = sessionName;
     // Exact compaction signal for the gateway (x-claude-code-request-class: compaction), on every
-    // terminal launch — interactive and `-p` passthrough alike; a user's own value wins. The
-    // user's CLAUDE_AUTOCOMPACT_PCT_OVERRIDE / CLAUDE_CODE_AUTO_COMPACT_WINDOW ride through
-    // untouched in the copied env (USER_AUTOCOMPACT_ENV).
-    applyGatewayHintHeaders(childEnv);
+    // terminal launch — interactive and `-p` passthrough alike; a user's own value wins: set by
+    // launchChildEnv above (shared with durable seats). The user's CLAUDE_AUTOCOMPACT_PCT_OVERRIDE /
+    // CLAUDE_CODE_AUTO_COMPACT_WINDOW ride through untouched in the copied env (USER_AUTOCOMPACT_ENV).
     if (ctx.options.slack)
         args.push(...slackChannelArgs(sessionName));
     // The status-bar segment (lib/statusline.ts). Claude Code only; the user's own
@@ -1394,8 +1471,12 @@ function launchTerminal(ctx) {
     }
     let recordStatePath;
     const run = () => {
+        const savedTty = ctx.durableHandover ? saveTtyMode() : null;
         const launchedSec = Math.floor(Date.now() / 1000);
         const child = spawn(ctx.cli.bin, args, { stdio: "inherit", env: childEnv });
+        const firstTurn = ctx.durableHandover?.lockAfterFirstTurn ? ctx.durableHandover : null;
+        if (firstTurn)
+            void liveLockAfterFirstTurn(firstTurn.row, firstTurn.name, firstTurn.launcherKey, () => child.exitCode === null && child.signalCode === null);
         // W1.8: report the session's commits while it runs; no record state (no proxy) → no reports.
         const commits = ctx.commitReport && ctx.orgId && recordStatePath
             ? startCommitReporter({
@@ -1416,6 +1497,14 @@ function launchTerminal(ctx) {
                 if (ctx.sessionKeyId) {
                     await revokeSessionGatewayKey(defaultSessionKeyDeps(say), ctx.sessionKeyId);
                 }
+                // A lock handover SIGKILLs the frozen claude once the daemon's seat runs the conversation:
+                // attach to it instead of dying with the child (C02-R26 step 7). Never relaunches claude.
+                const h = ctx.durableHandover;
+                if (mayBeHandover(h !== undefined, signal) && h) {
+                    const attached = await liveParentAfterChildEnded(h.row, h.name, h.launcherKey, savedTty);
+                    if (attached !== null)
+                        process.exit(attached);
+                }
                 if (signal) {
                     process.kill(process.pid, signal);
                     return;
@@ -1562,6 +1651,8 @@ export function turnProxyWanted(env) {
     const raw = (env.MNEMOM_AGENT_TURN_HEADER ?? "").trim().toLowerCase();
     return !["0", "off", "false", "no"].includes(raw);
 }
+/** The flag that lets base-url-proxy.mjs use an http door on a loopback literal (C17-R16 T3). */
+export const BU_HTTP_DOOR_ENV = "MNEMOM_AGENT_BU_HTTP_DOOR";
 /**
  * Start base-url-proxy.mjs in front of `door`; calls `done` exactly once with its
  * `http://127.0.0.1:<port>` base URL, or with null (after a one-line warning) when it does not
@@ -1587,6 +1678,13 @@ export function startBaseUrlProxy(door, done, opts = {}) {
     };
     // MNE-8245 defense-in-depth: the proxy reads none of the owner's own Mnemom credential vars.
     stripOwnerCredentialEnv(proxyEnv);
+    // C17-R16 T3: the proxy never reads TEST_MODE itself (one test-mode module per repo), so the seam
+    // decision is made here and handed over as a non-secret flag; an inherited flag never passes.
+    // httpDoorAllowed answers true for any https door, so the flag is set for an http door only.
+    if (/^http:/i.test(door) && httpDoorAllowed(door, process.env))
+        proxyEnv.MNEMOM_AGENT_BU_HTTP_DOOR = "1";
+    else
+        delete proxyEnv.MNEMOM_AGENT_BU_HTTP_DOOR;
     const proxy = spawn(opts.node ?? process.execPath, [script], {
         env: proxyEnv,
         stdio: ["ignore", "pipe", "ignore"],
@@ -1779,8 +1877,9 @@ function launchRemoteControl(ctx) {
     let stdoutBuf = "";
     const start = Date.now();
     const tryStart = () => {
-        // Cleanup already ran (a refusal, or the exit fallback reaped the proxy): stop polling, so a
-        // proxy killed by a signal (exitCode stays null) never reaches the 15s refusal afterwards.
+        // Torn down already (a refusal, the sync exit fallback, or an awaited onExit() from the proxy's
+        // error / stdin paths): stop polling, so a proxy killed by a signal (exitCode stays null) never
+        // reaches the 15s refusal and no later arm can call process.exit(1) a second time.
         if (stopped)
             return;
         const m = stdoutBuf.match(/^READY (\d+) (.+)$/m);

package/dist/commands/durable-doctor.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The durable lines of `mnemom agent doctor` (BACKBONE C1 "doctor (MFA, branch protection)";
+ * C02-R19): for each of the caller's open sessions, the MFA and branch-protection verdicts lock would
+ * compute at that moment, with the same probes and codes. The API computes them (S1 lock.ts steps
+ * `mfa` and `protection`); the doctor only renders. Read-only: one GET per session, never a POST.
+ *
+ * Not frozen by S1 (A2 owns it; gaps/c1-doctor-lock-preflight.md):
+ *   GET /v1/agent/sessions/{cid}/lock?agent_id=&dry_run=true
+ *     200 {mfa, repos: [{repo, verdict | protected | reason, pushable?}]}  (read defensively), or the
+ *     lock refusal envelope of the first failing step (403 durable_lock_mfa_required, 409
+ *     durable_lock_branch_unprotected {refusals}, 503 durable_precondition_unavailable, ...).
+ * A route that is absent (404/405) prints one info line; nothing here is ever a MISS, so the doctor's
+ * exit status keeps meaning "launch-ready".
+ */
+import { type ApiAnswer, type RegistryRow } from "../lib/durable/api.js";
+export interface DoctorApi {
+    listSessions(filter: {
+        name?: string;
+        agentId?: string;
+    }): Promise<RegistryRow[]>;
+    lockPreflight(cid: string, agentId: string): Promise<ApiAnswer>;
+}
+export interface DoctorLine {
+    mark: "ok" | "warn" | "info";
+    text: string;
+    hint?: string;
+}
+export type RepoState = "protected" | "unprotected" | "unsupported_host" | "unknown";
+export type PreflightVerdict = {
+    kind: "verdict";
+    mfa: "ok" | "missing" | "unknown";
+    repos: Array<{
+        repo: string;
+        state: RepoState;
+    }>;
+} | {
+    kind: "absent";
+} | {
+    kind: "unavailable";
+    detail: string;
+} | {
+    kind: "earlier";
+    code: string;
+};
+/** At most this many open sessions are checked (one GET each). */
+export declare const DOCTOR_SESSION_CAP = 5;
+/** Read a preflight answer into the verdict the doctor prints. */
+export declare function preflightVerdict(a: ApiAnswer): PreflightVerdict;
+/** The doctor's durable lines: one block per open session (newest first as listed), capped. */
+export declare function durableDoctorLines(api: DoctorApi): Promise<DoctorLine[]>;