@mnemom/mnemom 0.17.34-next.1 → 0.17.34-next.2

package/dist/commands/durable-verbs.js

@@ -0,0 +1,393 @@
+/**
+ * The flat durable owner verbs (BACKBONE C1; S1 owner-verbs.ts, ROUTES.own_*; C11, C16):
+ *
+ *   mnemom agent pause|resume|done|kill <name> [--json]
+ *   mnemom agent amend <name> [--budget <n>] [--turns <n>] [--json]
+ *   mnemom agent sessions unlock <name>
+ *   mnemom agent containment pause|resume <agent>
+ *
+ * The API decides (S1 owner-verb table, first match wins); the CLI resolves the name through the
+ * registry, sends the verb, and renders the answer: a refusal with its S1 fix line and machine
+ * code, a 200 no-op with its state, a 202 device step (user_code + verification_uri_complete,
+ * polled at the server interval with the 202's device_code and client_id; never a token printed
+ * or kept), or the applied change. `done`/`kill` on a tracked session also stop the local tracked
+ * claude after the 200 (final F04; SIGTERM, SIGKILL after TRACKED_STOP_GRACE_S).
+ *
+ * Every dependency is injected (`DurableVerbDeps`), so each branch is unit-tested.
+ */
+import { PER_SESSION_BUDGET_LIMIT_USD, TRACKED_STOP_GRACE_S, } from "../vendor/shared/durable-contract/constants.js";
+import { renderFixLine, } from "../vendor/shared/durable-contract/fixlines.js";
+import { errorCodeOf, errorDetailsOf, errorMessageOf, RegistryAnswerError, RegistryUnavailable, } from "../lib/durable/api.js";
+import { DurableRefusal, printDurableRefusal } from "../lib/durable/refusal.js";
+import { isLocked, liveRow, stateLabel } from "../lib/durable/view.js";
+import { CODE } from "../lib/durable/codes.js";
+const VERB_ROUTE = {
+    pause: "own_pause",
+    resume: "own_resume",
+    done: "own_complete",
+    kill: "own_kill",
+    amend: "own_amend",
+    unlock: "own_unlock",
+};
+const APPLIED_TEXT = {
+    pause: "paused",
+    resume: "resumed; the host daemon picks it up",
+    done: "done",
+    kill: "killed",
+    amend: "amended",
+    unlock: "unlocked",
+};
+/** The session a verb acts on: the non-terminal row holding the name, else the newest row. */
+export async function resolveTarget(api, name) {
+    let rows;
+    try {
+        rows = await api.listSessions({ name });
+    }
+    catch (e) {
+        if (e instanceof RegistryAnswerError)
+            throw refusalFromAnswer(e.answer, name, "off");
+        throw e;
+    }
+    const row = liveRow(rows) ?? rows[0] ?? null;
+    if (row === null) {
+        throw new DurableRefusal({
+            code: "agent_not_found",
+            message: `no session named ${name}`,
+            fix: null,
+        });
+    }
+    return row;
+}
+/**
+ * A refusal from an API answer: the API's message and code, its rendered fix (details.fix, as the
+ * API already applied the fix-line rule), else the CLI's catalogue fallback for that code.
+ */
+export function refusalFromAnswer(a, name, launcherKey, row) {
+    const code = errorCodeOf(a.body) ?? `http_${a.status}`;
+    const details = errorDetailsOf(a.body);
+    const apiFix = typeof details.fix === "string" && details.fix !== "" ? details.fix : null;
+    const fix = apiFix ?? fallbackFix(code, details, name, launcherKey, row);
+    const apiMessage = errorMessageOf(a.body);
+    // The refusal line always names the session the verb was for (C02-R05: the user sees what failed).
+    const message = apiMessage === null
+        ? `${name}: refused (${a.status})`
+        : apiMessage.includes(name)
+            ? apiMessage
+            : `${name}: ${apiMessage}`;
+    return new DurableRefusal({ code, message: sanitizeLine(message), fix, apiBody: a.body });
+}
+/** A one-line message: no control characters reach the terminal. */
+function sanitizeLine(s) {
+    return (s
+        // eslint-disable-next-line no-control-regex
+        .replace(/[\u0000-\u001f\u007f]+/g, " ")
+        .replace(/ {2,}/g, " ")
+        .trim());
+}
+function render(key, params, launcherKey, held) {
+    return renderFixLine(key, { launcherKey, nameHeld: held, params });
+}
+/** The catalogue fix the CLI prints when the API body carries none. */
+export function fallbackFix(code, details, name, launcherKey, row) {
+    const agent = row?.agent_name ?? row?.agent_id ?? "<agent>";
+    switch (code) {
+        case CODE.durable_session_ended:
+            return details.state_reason === "agent_killed"
+                ? render("agent_killed", { name }, launcherKey, false)
+                : render("session_ended", { name }, launcherKey, false);
+        case CODE.durable_agent_contained:
+            return render("agent_contained", { agent }, launcherKey, true);
+        case CODE.durable_not_owner:
+            return typeof details.owner === "string"
+                ? render("not_owner_info", { owner: details.owner }, launcherKey, true)
+                : null;
+        case CODE.durable_session_login_required:
+            return render("device_step_login", {}, launcherKey, true);
+        case CODE.durable_unsupported:
+            if (details.feature === "launch_spec_change") {
+                // The flags come from the answer; without them there is no line to print.
+                const flags = Array.isArray(details.flags)
+                    ? details.flags.filter((f) => typeof f === "string").join(" ")
+                    : typeof details.flags === "string"
+                        ? details.flags
+                        : "";
+                return flags.trim() === ""
+                    ? null
+                    : render("launch_spec_change", { name, flags: flags.trim() }, launcherKey, true);
+            }
+            if (details.feature === "above_limit_raise")
+                return render("above_limit_raise", { name, limit: String(PER_SESSION_BUDGET_LIMIT_USD) }, launcherKey, true);
+            return null;
+        default:
+            return null;
+    }
+}
+function isRecord(v) {
+    return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+export function deviceStepOf(body) {
+    if (!isRecord(body))
+        return null;
+    const b = (isRecord(body.device_step) ? body.device_step : body);
+    const s = (k) => (typeof b[k] === "string" && b[k] !== "" ? b[k] : null);
+    const user = s("user_code");
+    const uri = s("verification_uri_complete");
+    const dc = s("device_code");
+    const cid = s("client_id");
+    if (!user || !uri || !dc || !cid)
+        return null;
+    const interval = typeof b.interval === "number" && b.interval > 0 ? b.interval : 5;
+    return {
+        user_code: user,
+        verification_uri_complete: uri,
+        device_code: dc,
+        interval,
+        client_id: cid,
+        ...(s("approval_id") ? { approval_id: s("approval_id") } : {}),
+    };
+}
+/** How long the CLI keeps polling a device step before giving up (the approval TTL). */
+export const DEVICE_STEP_POLL_MAX_MS = 15 * 60 * 1000;
+/**
+ * Print the device step and poll until it resolves. 0 when applied; throws a DurableRefusal when
+ * denied, expired or refused. Never prints the device_code or any token.
+ */
+export async function runDeviceStep(step, note, deps) {
+    deps.err(`Approve this change: open ${step.verification_uri_complete}`);
+    deps.err(`and confirm the code ${step.user_code}.`);
+    if (note)
+        deps.err(note);
+    let interval = step.interval * 1000;
+    const deadline = deps.now() + DEVICE_STEP_POLL_MAX_MS;
+    for (;;) {
+        await deps.sleep(interval);
+        const a = await deps.api.devicePoll(step.device_code, step.client_id);
+        const code = errorCodeOf(a.body);
+        if (a.status < 300 && code === null) {
+            deps.err("approved and applied");
+            return 0;
+        }
+        if (code === "authorization_pending" || code === "slow_down") {
+            if (code === "slow_down")
+                interval += 5000;
+            if (deps.now() + interval > deadline) {
+                throw new DurableRefusal({
+                    code: "expired_token",
+                    message: "the approval expired",
+                    fix: null,
+                });
+            }
+            continue;
+        }
+        const why = code === "access_denied"
+            ? "the approval was denied"
+            : code === "expired_token"
+                ? "the approval expired"
+                : (errorMessageOf(a.body) ?? "the approval was refused");
+        throw new DurableRefusal({ code: code ?? `http_${a.status}`, message: why, fix: null });
+    }
+}
+/** Run one verb end to end and return its exit status (refusals rendered here). */
+export async function runVerb(verb, name, body, opts, deps) {
+    const launcherKey = deps.launcherKey();
+    try {
+        const row = await resolveTarget(deps.api, name);
+        const a = await deps.api.ownerVerb(VERB_ROUTE[verb], row.conversation_id, row.agent_id, body);
+        if (a.status === 202) {
+            const step = deviceStepOf(a.body);
+            if (step === null) {
+                throw new DurableRefusal({
+                    code: "device_step_malformed",
+                    message: "the API answered 202 without a usable device step",
+                    fix: null,
+                });
+            }
+            const contained = row.state === "paused" && row.state_reason === "agent_contained";
+            const note = contained
+                ? "an org admin other than you must approve this unpause (a solo org approves it itself)"
+                : null;
+            const rc = await runDeviceStep(step, note, deps);
+            if (opts.json)
+                deps.out(JSON.stringify({ name, verb, applied: true }));
+            return rc;
+        }
+        if (a.status >= 200 && a.status < 300) {
+            if (verb === "done" || verb === "kill") {
+                // An ending verb fails closed: only an answer that says the session ended (or a re-read
+                // that shows it) counts, and only then is a tracked claude stopped. Never SIGKILL on an
+                // ambiguous 2xx (a null body, a proxy-swallowed body, schema drift).
+                if (!(isRecord(a.body) && a.body.changed === false)) {
+                    await confirmEnded(verb, row, a, deps.api, name);
+                }
+            }
+            const changed = !(isRecord(a.body) && a.body.changed === false);
+            // --json: stdout carries the one JSON document; the human lines go to stderr.
+            const say = opts.json ? deps.err : deps.out;
+            if (!changed) {
+                say(`${name}: no change (${stateLabel(row)})`);
+                if (verb === "resume")
+                    say(`fix: ${render("resume_live", { name }, launcherKey, true)}`);
+            }
+            else {
+                say(`${name}: ${APPLIED_TEXT[verb]}`);
+                if ((verb === "done" || verb === "kill") && !isLocked(row) && deps.stopTrackedClaude) {
+                    await deps.stopTrackedClaude(row, TRACKED_STOP_GRACE_S);
+                }
+            }
+            if (opts.json)
+                deps.out(JSON.stringify(a.body ?? { changed }));
+            return 0;
+        }
+        throw refusalFromAnswer(a, name, launcherKey, row);
+    }
+    catch (e) {
+        return handleVerbError(e, opts.json === true, deps);
+    }
+}
+/** The state an applied done / kill writes (S1 owner-verbs: complete -> completed, kill -> killed). */
+const ENDED_STATE = { done: "completed", kill: "killed" };
+/**
+ * Confirm an applied done / kill: the answer's own `{changed: true, state}` when it names the ended
+ * state, else one re-read of the session by conversation id. Throws a refusal (nothing stopped
+ * locally) when neither shows the session ended.
+ */
+export async function confirmEnded(verb, row, a, api, name) {
+    const want = ENDED_STATE[verb];
+    if (isRecord(a.body) && a.body.changed === true && a.body.state === want)
+        return;
+    const seen = await api.listSessions({ name }).then((rows) => rows.find((r) => r.conversation_id === row.conversation_id) ?? null, () => null);
+    if (seen !== null && seen.state === want)
+        return;
+    throw new DurableRefusal({
+        code: "verb_unconfirmed",
+        message: `${name}: the API answered ${a.status} but did not confirm the session ${want === "completed" ? "completed" : "was killed"}; nothing was stopped locally`,
+        fix: null,
+    });
+}
+export function handleVerbError(e, json, deps) {
+    if (e instanceof DurableRefusal)
+        return printDurableRefusal(e, json, deps);
+    if (e instanceof RegistryUnavailable) {
+        return printDurableRefusal(new DurableRefusal({
+            code: "session_registry_unavailable",
+            message: `the session registry is unreachable (${e.message}); nothing was changed`,
+            fix: null,
+        }), json, deps);
+    }
+    throw e;
+}
+/** Parse a positive amount (amend --budget); `integer` for a count (amend --turns). */
+export function parsePositive(flag, raw, integer = false) {
+    if (raw === undefined)
+        return undefined;
+    const n = Number(raw);
+    if (!Number.isFinite(n) || n <= 0 || (integer && !Number.isInteger(n))) {
+        throw new DurableRefusal({
+            code: "invalid_argument",
+            message: `${flag} must be a positive ${integer ? "whole number" : "number"} (got '${raw}')`,
+            fix: null,
+            exit: 2,
+        });
+    }
+    return n;
+}
+export async function amendCommand(name, opts, deps) {
+    let budget;
+    let turns;
+    try {
+        budget = parsePositive("--budget", opts.budget);
+        turns = parsePositive("--turns", opts.turns, true);
+    }
+    catch (e) {
+        return handleVerbError(e, opts.json === true, deps);
+    }
+    if (budget === undefined && turns === undefined) {
+        deps.err("mnemom agent amend: give --budget <n> and/or --turns <n>");
+        return 2;
+    }
+    const body = {};
+    if (budget !== undefined)
+        body.budget_usd = budget;
+    if (turns !== undefined)
+        body.max_turns = turns;
+    return runVerb("amend", name, body, opts, deps);
+}
+export async function unlockCommand(name, deps) {
+    return runVerb("unlock", name, {}, {}, deps);
+}
+/**
+ * `mnemom agent containment pause|resume <agent>` (BACKBONE C1, amendment 35; C16-R30): a thin
+ * verb over POST /v1/orgs/{org}/agents/{id}/pause|resume. The org comes from the agent record,
+ * never the active org. It needs a session login: on an API-key-only credential, or the api's
+ * 403 org_scope_requires_session, it exits non-zero with the containment_login line and never
+ * sends the API key or prints the raw 403.
+ */
+export async function containmentCommand(verb, agentRef, deps) {
+    const launcherKey = deps.launcherKey();
+    const loginRefusal = () => new DurableRefusal({
+        // Never the raw 403 code (C11-R26): the machine code is the S1 fix key.
+        code: "containment_login",
+        message: `mnemom agent containment ${verb}: org containment acts as a signed-in org admin`,
+        fix: render("containment_login", {}, launcherKey, false),
+    });
+    try {
+        if ((await deps.api.credentialType()) !== "jwt")
+            throw loginRefusal();
+        const { orgId, agentId } = await resolveContainmentAgent(agentRef, deps, launcherKey);
+        const a = await deps.api.containment(orgId, agentId, verb);
+        if (a.status === 403 && errorCodeOf(a.body) === "org_scope_requires_session")
+            throw loginRefusal();
+        if (a.status >= 200 && a.status < 300) {
+            deps.out(`agent ${agentRef}: ${verb === "pause" ? "paused (contained)" : "active again"}`);
+            return 0;
+        }
+        throw refusalFromAnswer(a, agentRef, launcherKey);
+    }
+    catch (e) {
+        return handleVerbError(e, false, deps);
+    }
+}
+/** An agent id as the CLI recognises one (lib/api.ts resolveAgentId). */
+export const AGENT_ID_RE = /^(smolt-[0-9a-f]{8}|mnm-[0-9a-f-]{36})$/;
+/**
+ * The containment target and its org, from the agent record (never the active org): an id is read
+ * with GET /v1/agents/{id}; a name is looked up in the caller's org fleets and must match exactly one.
+ */
+export async function resolveContainmentAgent(agentRef, deps, launcherKey) {
+    if (AGENT_ID_RE.test(agentRef)) {
+        const ag = await deps.api.getAgent(agentRef);
+        if (ag.status !== 200 || !isRecord(ag.body))
+            throw refusalFromAnswer(ag, agentRef, launcherKey);
+        const rec = (isRecord(ag.body.agent) ? ag.body.agent : ag.body);
+        const orgId = typeof rec.org_id === "string" ? rec.org_id : null;
+        if (orgId === null) {
+            throw new DurableRefusal({
+                code: "agent_not_found",
+                message: `agent ${agentRef} has no org on record`,
+                fix: null,
+            });
+        }
+        return { orgId, agentId: typeof rec.id === "string" ? rec.id : agentRef };
+    }
+    const found = await deps.api.agentsByName(agentRef);
+    if (found.length === 0) {
+        throw new DurableRefusal({
+            code: "agent_not_found",
+            message: `no agent named ${agentRef} in your orgs`,
+            fix: null,
+        });
+    }
+    if (found.length > 1) {
+        throw new DurableRefusal({
+            code: "agent_ambiguous",
+            message: `${found.length} agents are named ${agentRef} in your orgs (${found.map((a) => a.id).join(", ")}); name one by its id`,
+            fix: null,
+        });
+    }
+    const [only] = found;
+    return { orgId: only.org_id, agentId: only.id };
+}
+/** The thin verbs (pause/resume/done/kill) with no body. */
+export async function ownerVerbCommand(verb, name, opts, deps) {
+    return runVerb(verb, name, {}, opts, deps);
+}

package/dist/durable/flock.d.ts

@@ -0,0 +1,26 @@
+export type LockResult = {
+    ok: true;
+    fd: number;
+} | {
+    ok: false;
+    reason: "held" | "error";
+    detail: string;
+};
+/** The helper commands, tried in order. Each locks fd 3 and exits 0 (taken), 3 (held), else error. */
+export declare const FLOCK_HELPERS: readonly (readonly string[])[];
+export interface FlockDeps {
+    openSync: (p: string, flags: string, mode: number) => number;
+    closeSync: (fd: number) => void;
+    mkdirSync: (p: string, opts: {
+        recursive: true;
+        mode: number;
+    }) => unknown;
+    run: (argv: readonly string[], fd: number) => number | null;
+    exists: (p: string) => boolean;
+}
+export declare const defaultFlockDeps: FlockDeps;
+/**
+ * Take an exclusive non-blocking flock on `lockPath` (created 0600 in a 0700 directory). On success
+ * the returned fd must stay open for the life of the lock; closing it (or exiting) releases it.
+ */
+export declare function tryLockFile(lockPath: string, deps?: FlockDeps): LockResult;

package/dist/durable/flock.js

@@ -0,0 +1,80 @@
+// flock(2) LOCK_EX|LOCK_NB for the durable seat proxy's per-conversation lock (S1 proxyLockPath,
+// BACKBONE amendment 51, C13-R4).
+//
+// Node has no flock binding, so the lock is taken by a short-lived helper on an fd this process
+// opened and passes down: flock locks belong to the open file description, so the lock stays held
+// by this process's fd after the helper exits, is visible to `lsof -p <this pid>`, and is released
+// when this process exits for any reason (kill -9 included). The helper is the system perl
+// (Fcntl), present on every macOS; python3 is the fallback.
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+/** The helper commands, tried in order. Each locks fd 3 and exits 0 (taken), 3 (held), else error. */
+export const FLOCK_HELPERS = [
+    [
+        "/usr/bin/perl",
+        "-MFcntl=:flock",
+        "-e",
+        'open(my $fh, "+<&=", 3) or exit 9; flock($fh, LOCK_EX|LOCK_NB) ? exit 0 : exit 3',
+    ],
+    [
+        "/usr/bin/python3",
+        "-I",
+        "-c",
+        "import fcntl,sys\ntry:\n fcntl.flock(3, fcntl.LOCK_EX|fcntl.LOCK_NB)\nexcept BlockingIOError:\n sys.exit(3)\nexcept Exception:\n sys.exit(9)",
+    ],
+];
+export const defaultFlockDeps = {
+    openSync: (p, flags, mode) => fs.openSync(p, flags, mode),
+    closeSync: (fd) => fs.closeSync(fd),
+    mkdirSync: (p, opts) => fs.mkdirSync(p, opts),
+    run: (argv, fd) => spawnSync(argv[0], argv.slice(1), {
+        stdio: ["ignore", "ignore", "ignore", fd],
+        timeout: 10_000,
+    }).status,
+    exists: (p) => fs.existsSync(p),
+};
+/**
+ * Take an exclusive non-blocking flock on `lockPath` (created 0600 in a 0700 directory). On success
+ * the returned fd must stay open for the life of the lock; closing it (or exiting) releases it.
+ */
+export function tryLockFile(lockPath, deps = defaultFlockDeps) {
+    let fd;
+    try {
+        deps.mkdirSync(path.dirname(lockPath), { recursive: true, mode: 0o700 });
+        fd = deps.openSync(lockPath, "a", 0o600);
+    }
+    catch (e) {
+        return { ok: false, reason: "error", detail: e.message };
+    }
+    // The fd is handed back only when the lock is taken; every other way out (held, no helper, a
+    // helper or the existence probe throwing) closes it here.
+    let taken = false;
+    try {
+        for (const helper of FLOCK_HELPERS) {
+            if (!deps.exists(helper[0]))
+                continue;
+            const status = deps.run(helper, fd);
+            if (status === 0) {
+                taken = true;
+                return { ok: true, fd };
+            }
+            if (status === 3)
+                return { ok: false, reason: "held", detail: "lock held" };
+        }
+        return { ok: false, reason: "error", detail: "no flock helper could take the lock" };
+    }
+    catch (e) {
+        return { ok: false, reason: "error", detail: e.message };
+    }
+    finally {
+        if (!taken) {
+            try {
+                deps.closeSync(fd);
+            }
+            catch {
+                /* already closed */
+            }
+        }
+    }
+}

package/dist/durable/launch-spec.d.ts

@@ -83,6 +83,11 @@ export interface LauncherArgvSplit {
     launcherArgv: string[];
     passthrough: string[];
     yoloInjected: boolean;
+    /**
+     * The launcher's interactive Remote Control prefix (`--remote-control <name> [--name <name>]`,
+     * agent.ts launch): named as a dropped --remote-control, its session name never a positional.
+     */
+    rcInjected: boolean;
     /** The --session-id the launcher pinned, if any. */
     sessionId: string | null;
     /**
@@ -100,7 +105,8 @@ export interface LauncherArgvSplit {
 }
 /**
  * Split an original claude argv (after argv[0]) the way `mnemom agent` built it (buildCliArgs):
- * [--model v] [--effort v] [yolo] [--session-id id] [--plugin-dir dir] <passthrough>
+ * [--remote-control n [--name n]] [--model v] [--effort v] [yolo] [--session-id id]
+ * [--plugin-dir dir] <passthrough>
  * [--strict-mcp-config] [--mcp-config <v>]. `passthroughHint` (the tokens after the parent
  * launcher's `--`, read from its own argv) pins the split exactly when it occurs where the
  * layout allows; an empty hint (the parent was read and had no `--`) makes the shape read exact;

package/dist/durable/launch-spec.js

@@ -159,15 +159,21 @@ function isSubsequenceAt(hay, needle, at) {
 }
 /**
  * Split an original claude argv (after argv[0]) the way `mnemom agent` built it (buildCliArgs):
- * [--model v] [--effort v] [yolo] [--session-id id] [--plugin-dir dir] <passthrough>
+ * [--remote-control n [--name n]] [--model v] [--effort v] [yolo] [--session-id id]
+ * [--plugin-dir dir] <passthrough>
  * [--strict-mcp-config] [--mcp-config <v>]. `passthroughHint` (the tokens after the parent
  * launcher's `--`, read from its own argv) pins the split exactly when it occurs where the
  * layout allows; an empty hint (the parent was read and had no `--`) makes the shape read exact;
  * without a hint (null or absent) the prefix and suffix are read by shape and reported ambiguous.
  */
 export function splitLauncherArgv(argv, passthroughHint) {
-    // Prefix: launcher-injected flags in their fixed order.
+    // The RC launch puts its own `--remote-control <name> --name <name>` first.
     let i = 0;
+    const rcName = argv[1];
+    const rcInjected = argv[0] === REMOTE_CONTROL_FLAG && rcName !== undefined && readToken(rcName).flag === null;
+    if (rcInjected)
+        i = argv[2] === "--name" && argv[3] === rcName ? 4 : 2;
+    // Prefix: launcher-injected flags in their fixed order.
     const prefix = {};
     for (const [flag, arity] of LAUNCHER_PREFIX) {
         if (argv[i] !== flag)
@@ -230,6 +236,7 @@ export function splitLauncherArgv(argv, passthroughHint) {
         launcherArgv,
         passthrough,
         yoloInjected: prefix[YOLO_FLAG] === true,
+        rcInjected,
         sessionId: typeof prefix["--session-id"] === "string" ? prefix["--session-id"] : null,
         exact,
         ambiguous,
@@ -245,7 +252,7 @@ export function runningSourceInput(originalArgv, cwd, opts = {}) {
         userArgv: [...split.ambiguous, ...split.passthrough],
         yoloInjected: split.yoloInjected,
         // Names are deduplicated, so a --remote-control the user also passed is named once.
-        remoteControl: opts.remoteControl === true,
+        remoteControl: opts.remoteControl === true || split.rcInjected,
         cwd,
     };
 }

package/dist/durable/seat-proxy-entry.d.ts

@@ -0,0 +1,11 @@
+import { type ExperimentalPrefs } from "../lib/experimental.js";
+/** True when argv (after the node + script pair) names the seat proxy. */
+export declare function isSeatProxyArgv(argv: readonly string[]): boolean;
+export interface SeatProxyEntryDeps {
+    stored: () => ExperimentalPrefs | undefined;
+    stderr: (line: string) => void;
+    exit: (code: number) => void;
+    run: (argv: readonly string[]) => Promise<unknown>;
+}
+/** Gate, then run the proxy with the arguments after `seat-proxy`. */
+export declare function runSeatProxyEntry(argv: readonly string[], deps: SeatProxyEntryDeps): void;

package/dist/durable/seat-proxy-entry.js

@@ -0,0 +1,25 @@
+// Entry dispatch for the hidden `mnemom agent host seat-proxy` (C3). It bypasses commander (the
+// `agent` launcher's options would reject the proxy's flags, as with `agent slack`), the update
+// hook and the experimental migration, so the proxy's stdout carries only its READY line.
+//
+// Gate (BACKBONE Flags/CLI): the durable experimental feature, read from config.json only, like the
+// host daemon that spawns the proxy (resolveExperimental with an empty env; MNEMOM_EXPERIMENTAL is
+// never read here). Off: exit 2 with the gate message, no HTTP, no file under HOME, no process.
+import { gatedMessage, resolveExperimental } from "../lib/experimental.js";
+/** True when argv (after the node + script pair) names the seat proxy. */
+export function isSeatProxyArgv(argv) {
+    return argv[0] === "agent" && argv[1] === "host" && argv[2] === "seat-proxy";
+}
+/** Gate, then run the proxy with the arguments after `seat-proxy`. */
+export function runSeatProxyEntry(argv, deps) {
+    const on = resolveExperimental({ stored: deps.stored(), env: {} }).enabled.includes("durable");
+    if (!on) {
+        deps.stderr(`${gatedMessage("`mnemom agent host`", "durable")}\n`);
+        deps.exit(2);
+        return;
+    }
+    deps.run(argv.slice(3)).catch(() => {
+        deps.stderr("mnemom agent host seat-proxy: internal error\n");
+        deps.exit(1);
+    });
+}