@mnemom/mnemom 0.17.34-next.1 → 0.17.34-next.3

package/dist/durable/cwd-rule.js

@@ -51,6 +51,24 @@ export function classifyCwd(cwd, deps, ccSessionId = null) {
         return { ok: false, cwd_kind: "symlink_transcript", params: { realpath: real } };
     return { ok: false, cwd_kind: null, unadoptable: "no_transcript" };
 }
+/**
+ * The daemon's spawn-time cwd check (attestation check `cwd`, C14-R04; mnemom-test #1002): the
+ * committed cwd's realpath must equal `git rev-parse --show-toplevel` there. Null when it holds;
+ * otherwise the S1 CWD_CHECK_CAUSES value: `missing` when there is no committed cwd or it does not
+ * resolve, `not_toplevel` when it resolves but is not a work tree's top level (a subdirectory, or
+ * not in a git work tree at all).
+ */
+export function spawnCwdCause(cwd, deps) {
+    if (cwd === null)
+        return "missing";
+    const real = deps.realpath(cwd);
+    if (real === null)
+        return "missing";
+    const top = deps.gitToplevel(real);
+    if (top === null)
+        return "not_toplevel";
+    return (deps.realpath(top) ?? top) === real ? null : "not_toplevel";
+}
 const CWD_FIX = {
     subdirectory: "cwd_subdirectory",
     not_git: "cwd_not_git",

package/dist/durable/flock.d.ts

@@ -0,0 +1,26 @@
+export type LockResult = {
+    ok: true;
+    fd: number;
+} | {
+    ok: false;
+    reason: "held" | "error";
+    detail: string;
+};
+/** The helper commands, tried in order. Each locks fd 3 and exits 0 (taken), 3 (held), else error. */
+export declare const FLOCK_HELPERS: readonly (readonly string[])[];
+export interface FlockDeps {
+    openSync: (p: string, flags: string, mode: number) => number;
+    closeSync: (fd: number) => void;
+    mkdirSync: (p: string, opts: {
+        recursive: true;
+        mode: number;
+    }) => unknown;
+    run: (argv: readonly string[], fd: number) => number | null;
+    exists: (p: string) => boolean;
+}
+export declare const defaultFlockDeps: FlockDeps;
+/**
+ * Take an exclusive non-blocking flock on `lockPath` (created 0600 in a 0700 directory). On success
+ * the returned fd must stay open for the life of the lock; closing it (or exiting) releases it.
+ */
+export declare function tryLockFile(lockPath: string, deps?: FlockDeps): LockResult;

package/dist/durable/flock.js

@@ -0,0 +1,80 @@
+// flock(2) LOCK_EX|LOCK_NB for the durable seat proxy's per-conversation lock (S1 proxyLockPath,
+// BACKBONE amendment 51, C13-R4).
+//
+// Node has no flock binding, so the lock is taken by a short-lived helper on an fd this process
+// opened and passes down: flock locks belong to the open file description, so the lock stays held
+// by this process's fd after the helper exits, is visible to `lsof -p <this pid>`, and is released
+// when this process exits for any reason (kill -9 included). The helper is the system perl
+// (Fcntl), present on every macOS; python3 is the fallback.
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+/** The helper commands, tried in order. Each locks fd 3 and exits 0 (taken), 3 (held), else error. */
+export const FLOCK_HELPERS = [
+    [
+        "/usr/bin/perl",
+        "-MFcntl=:flock",
+        "-e",
+        'open(my $fh, "+<&=", 3) or exit 9; flock($fh, LOCK_EX|LOCK_NB) ? exit 0 : exit 3',
+    ],
+    [
+        "/usr/bin/python3",
+        "-I",
+        "-c",
+        "import fcntl,sys\ntry:\n fcntl.flock(3, fcntl.LOCK_EX|fcntl.LOCK_NB)\nexcept BlockingIOError:\n sys.exit(3)\nexcept Exception:\n sys.exit(9)",
+    ],
+];
+export const defaultFlockDeps = {
+    openSync: (p, flags, mode) => fs.openSync(p, flags, mode),
+    closeSync: (fd) => fs.closeSync(fd),
+    mkdirSync: (p, opts) => fs.mkdirSync(p, opts),
+    run: (argv, fd) => spawnSync(argv[0], argv.slice(1), {
+        stdio: ["ignore", "ignore", "ignore", fd],
+        timeout: 10_000,
+    }).status,
+    exists: (p) => fs.existsSync(p),
+};
+/**
+ * Take an exclusive non-blocking flock on `lockPath` (created 0600 in a 0700 directory). On success
+ * the returned fd must stay open for the life of the lock; closing it (or exiting) releases it.
+ */
+export function tryLockFile(lockPath, deps = defaultFlockDeps) {
+    let fd;
+    try {
+        deps.mkdirSync(path.dirname(lockPath), { recursive: true, mode: 0o700 });
+        fd = deps.openSync(lockPath, "a", 0o600);
+    }
+    catch (e) {
+        return { ok: false, reason: "error", detail: e.message };
+    }
+    // The fd is handed back only when the lock is taken; every other way out (held, no helper, a
+    // helper or the existence probe throwing) closes it here.
+    let taken = false;
+    try {
+        for (const helper of FLOCK_HELPERS) {
+            if (!deps.exists(helper[0]))
+                continue;
+            const status = deps.run(helper, fd);
+            if (status === 0) {
+                taken = true;
+                return { ok: true, fd };
+            }
+            if (status === 3)
+                return { ok: false, reason: "held", detail: "lock held" };
+        }
+        return { ok: false, reason: "error", detail: "no flock helper could take the lock" };
+    }
+    catch (e) {
+        return { ok: false, reason: "error", detail: e.message };
+    }
+    finally {
+        if (!taken) {
+            try {
+                deps.closeSync(fd);
+            }
+            catch {
+                /* already closed */
+            }
+        }
+    }
+}

package/dist/durable/launch-spec.d.ts

@@ -83,6 +83,11 @@ export interface LauncherArgvSplit {
     launcherArgv: string[];
     passthrough: string[];
     yoloInjected: boolean;
+    /**
+     * The launcher's interactive Remote Control prefix (`--remote-control <name> [--name <name>]`,
+     * agent.ts launch): named as a dropped --remote-control, its session name never a positional.
+     */
+    rcInjected: boolean;
     /** The --session-id the launcher pinned, if any. */
     sessionId: string | null;
     /**
@@ -100,7 +105,8 @@ export interface LauncherArgvSplit {
 }
 /**
  * Split an original claude argv (after argv[0]) the way `mnemom agent` built it (buildCliArgs):
- * [--model v] [--effort v] [yolo] [--session-id id] [--plugin-dir dir] <passthrough>
+ * [--remote-control n [--name n]] [--model v] [--effort v] [yolo] [--session-id id]
+ * [--plugin-dir dir] <passthrough>
  * [--strict-mcp-config] [--mcp-config <v>]. `passthroughHint` (the tokens after the parent
  * launcher's `--`, read from its own argv) pins the split exactly when it occurs where the
  * layout allows; an empty hint (the parent was read and had no `--`) makes the shape read exact;
@@ -132,6 +138,8 @@ export declare function launchSpecChangeFixLines(ctx: {
     flags: string;
     launcherKey: LauncherKey;
     soleLockedSession: boolean;
+    /** Whether the name holds a registry row; absent: it does (every launch path). */
+    nameHeld?: boolean;
 }): [string, ...string[]];
 /** The adopt Note for an adopted row (C14-R12, R21): S1 grammar, unchanged builder names. */
 export declare function adoptNote(dropped: readonly string[]): string;

package/dist/durable/launch-spec.js

@@ -159,15 +159,21 @@ function isSubsequenceAt(hay, needle, at) {
 }
 /**
  * Split an original claude argv (after argv[0]) the way `mnemom agent` built it (buildCliArgs):
- * [--model v] [--effort v] [yolo] [--session-id id] [--plugin-dir dir] <passthrough>
+ * [--remote-control n [--name n]] [--model v] [--effort v] [yolo] [--session-id id]
+ * [--plugin-dir dir] <passthrough>
  * [--strict-mcp-config] [--mcp-config <v>]. `passthroughHint` (the tokens after the parent
  * launcher's `--`, read from its own argv) pins the split exactly when it occurs where the
  * layout allows; an empty hint (the parent was read and had no `--`) makes the shape read exact;
  * without a hint (null or absent) the prefix and suffix are read by shape and reported ambiguous.
  */
 export function splitLauncherArgv(argv, passthroughHint) {
-    // Prefix: launcher-injected flags in their fixed order.
+    // The RC launch puts its own `--remote-control <name> --name <name>` first.
     let i = 0;
+    const rcName = argv[1];
+    const rcInjected = argv[0] === REMOTE_CONTROL_FLAG && rcName !== undefined && readToken(rcName).flag === null;
+    if (rcInjected)
+        i = argv[2] === "--name" && argv[3] === rcName ? 4 : 2;
+    // Prefix: launcher-injected flags in their fixed order.
     const prefix = {};
     for (const [flag, arity] of LAUNCHER_PREFIX) {
         if (argv[i] !== flag)
@@ -230,6 +236,7 @@ export function splitLauncherArgv(argv, passthroughHint) {
         launcherArgv,
         passthrough,
         yoloInjected: prefix[YOLO_FLAG] === true,
+        rcInjected,
         sessionId: typeof prefix["--session-id"] === "string" ? prefix["--session-id"] : null,
         exact,
         ambiguous,
@@ -245,7 +252,7 @@ export function runningSourceInput(originalArgv, cwd, opts = {}) {
         userArgv: [...split.ambiguous, ...split.passthrough],
         yoloInjected: split.yoloInjected,
         // Names are deduplicated, so a --remote-control the user also passed is named once.
-        remoteControl: opts.remoteControl === true,
+        remoteControl: opts.remoteControl === true || split.rcInjected,
         cwd,
     };
 }
@@ -263,7 +270,7 @@ export async function compareWithCommitted(built, committed) {
 export function launchSpecChangeFixLines(ctx) {
     const render = {
         launcherKey: ctx.launcherKey,
-        nameHeld: true,
+        nameHeld: ctx.nameHeld ?? true,
         params: { name: ctx.name, flags: ctx.flags },
     };
     const lines = [renderFixLine("launch_spec_change", render)];

package/dist/durable/seat-proxy-entry.d.ts

@@ -0,0 +1,11 @@
+import { type ExperimentalPrefs } from "../lib/experimental.js";
+/** True when argv (after the node + script pair) names the seat proxy. */
+export declare function isSeatProxyArgv(argv: readonly string[]): boolean;
+export interface SeatProxyEntryDeps {
+    stored: () => ExperimentalPrefs | undefined;
+    stderr: (line: string) => void;
+    exit: (code: number) => void;
+    run: (argv: readonly string[]) => Promise<unknown>;
+}
+/** Gate, then run the proxy with the arguments after `seat-proxy`. */
+export declare function runSeatProxyEntry(argv: readonly string[], deps: SeatProxyEntryDeps): void;

package/dist/durable/seat-proxy-entry.js

@@ -0,0 +1,25 @@
+// Entry dispatch for the hidden `mnemom agent host seat-proxy` (C3). It bypasses commander (the
+// `agent` launcher's options would reject the proxy's flags, as with `agent slack`), the update
+// hook and the experimental migration, so the proxy's stdout carries only its READY line.
+//
+// Gate (BACKBONE Flags/CLI): the durable experimental feature, read from config.json only, like the
+// host daemon that spawns the proxy (resolveExperimental with an empty env; MNEMOM_EXPERIMENTAL is
+// never read here). Off: exit 2 with the gate message, no HTTP, no file under HOME, no process.
+import { gatedMessage, resolveExperimental } from "../lib/experimental.js";
+/** True when argv (after the node + script pair) names the seat proxy. */
+export function isSeatProxyArgv(argv) {
+    return argv[0] === "agent" && argv[1] === "host" && argv[2] === "seat-proxy";
+}
+/** Gate, then run the proxy with the arguments after `seat-proxy`. */
+export function runSeatProxyEntry(argv, deps) {
+    const on = resolveExperimental({ stored: deps.stored(), env: {} }).enabled.includes("durable");
+    if (!on) {
+        deps.stderr(`${gatedMessage("`mnemom agent host`", "durable")}\n`);
+        deps.exit(2);
+        return;
+    }
+    deps.run(argv.slice(3)).catch(() => {
+        deps.stderr("mnemom agent host seat-proxy: internal error\n");
+        deps.exit(1);
+    });
+}

package/dist/durable/seat-proxy.d.ts

@@ -0,0 +1,107 @@
+import http from "node:http";
+import type { Duplex } from "node:stream";
+import { TurnOrigins } from "../turn-origin.mjs";
+import { type LockResult } from "./flock.js";
+import { type SeatIdentity, type HelloRelay } from "./seat-socket.js";
+export declare const EXIT_CONFIG = 2;
+export declare const EXIT_LOCK_HELD = 3;
+export declare const EXIT_KEY_DEAD = 4;
+/**
+ * The drop reasons and exit reasons this proxy logs (the C13 test hooks name them). These are local
+ * literals, not S1 values: S1 freezes no drop-reason or exit-reason enum (gap
+ * c3-seat-proxy-enums-not-in-s1), so other pieces cannot import them yet.
+ */
+export type DropReason = "arm_missing" | "arm_unparseable" | "unattended_hold_off" | "unattended_fence_off" | "turn_wait_timeout" | "pre_first_prompt" | "no_session";
+export type ExitReason = "fenced_exit" | "revoked_exit" | "ended_exit";
+/** The most a dead-key-status (401/409/410) body is buffered to; a longer one is dropped, never truncated. */
+export declare const DEAD_BODY_CAP: number;
+/** The largest request body forwarded (the Messages API request limit); a larger one gets a local 413. */
+export declare const REQUEST_BODY_CAP: number;
+/**
+ * Client headers that never pass: hop-by-hop, proxy-authorization and every x-mnemom-* (the proxy
+ * sets the Mnemom ones from the lease). The provider credential (authorization, x-api-key) passes:
+ * the seat carries it exactly as `mnemom agent` does (dogfood B6 ruling, superseding C13-R2/R8).
+ */
+export declare function isStrippedClientHeader(name: string): boolean;
+export interface SeatProxyArgs {
+    conversation: string;
+    agentId: string;
+    door: URL;
+    cwd: string;
+    seat: SeatIdentity | null;
+    helloRelay: string | null;
+}
+/**
+ * Parse and validate the argv after `seat-proxy`. Errors name the option, never echo a value.
+ * `isDir` and `env` are injected so the check is pure.
+ */
+export declare function parseSeatProxyArgs(argv: readonly string[], env: Record<string, string | undefined>, isDir: (p: string) => boolean): {
+    ok: true;
+    args: SeatProxyArgs;
+} | {
+    ok: false;
+    error: string;
+};
+/** The first stdin line (CR stripped), or "" on EOF / timeout. Only the first line is ever read. */
+export declare function readKeyLine(stream: NodeJS.ReadableStream, timeoutMs?: number): Promise<string>;
+/** The arm verdict for one door response: forward, or the drop reason. */
+export declare function armVerdict(pathname: string, rawHeaders: readonly string[]): {
+    forward: true;
+} | {
+    forward: false;
+    reason: DropReason;
+};
+/** The dead-key signal in a door response (C13-R7), read from the JSON body's error.type. */
+export declare function deadKeyReason(status: number, body: string): ExitReason | null;
+/** Whether a request path is origin-form and free of dot segments (raw or percent-encoded). */
+export declare function isCleanOriginForm(url: string): boolean;
+export type Route = "messages" | "count_tokens" | "hello" | "telemetry" | "refused";
+/** Where a request goes: the two model POSTs are forwarded; startup paths are answered locally. */
+export declare function routeOf(method: string, pathname: string): Route;
+export interface SeatProxyDeps {
+    log: (line: string) => void;
+    exit: (code: number) => void;
+    turns: TurnOrigins;
+    requestId?: () => string;
+    /** Overrides REQUEST_BODY_CAP (tests). */
+    requestBodyCap?: number;
+    /** Overrides DEAD_BODY_CAP (tests). */
+    deadBodyCap?: number;
+}
+export interface SeatProxyState {
+    dead: ExitReason | null;
+}
+/** The request handler of a seat proxy for `cfg` with lease key `key`. */
+export declare function createSeatProxyHandler(cfg: SeatProxyArgs, key: string, deps: SeatProxyDeps, state?: SeatProxyState): (req: http.IncomingMessage, res: http.ServerResponse) => void;
+export interface SeatProxyMainDeps {
+    env: Record<string, string | undefined>;
+    stdin: NodeJS.ReadableStream;
+    stdout: (line: string) => void;
+    stderr: (line: string) => void;
+    exit: (code: number) => void;
+    home: string;
+    isDir: (p: string) => boolean;
+    lock: (lockPath: string) => LockResult;
+    relayFor: (socketPath: string) => HelloRelay;
+    keyTimeoutMs?: number;
+    /** Loopback listen addresses (tests override them to exercise a failed bind). */
+    hostV4?: string;
+    hostV6?: string;
+}
+export declare function defaultMainDeps(): SeatProxyMainDeps;
+/**
+ * The 'connect' listener for a seat proxy's loopback servers: a CONNECT (a tunnel request, never
+ * origin-form) is refused with a 400 and the socket closed. Without a listener Node would drop the
+ * socket silently; this makes the refusal explicit and logged.
+ */
+export declare function refuseConnect(log: (line: string) => void): (req: http.IncomingMessage, socket: Duplex) => void;
+export interface RunningSeatProxy {
+    port: number;
+    socketPath: string;
+    close: () => Promise<void>;
+}
+/**
+ * `mnemom agent host seat-proxy …`: validate, read the key, take the conversation lock, listen,
+ * print READY. Resolves with the running proxy, or with an exit code it already passed to `exit`.
+ */
+export declare function seatProxyMain(argv: readonly string[], deps?: SeatProxyMainDeps): Promise<RunningSeatProxy | number>;