@mnemom/mnemom 0.17.34-next.4 → 0.17.35

package/dist/commands/agent-config.js

@@ -224,6 +224,9 @@ function deleteKey(cfg, key) {
         case "slack_allow":
             delete cfg.slackAllow;
             break;
+        case "slack_owner":
+            delete cfg.slackOwner;
+            break;
         case "slack_aliases":
             delete cfg.slackAliases;
             break;

package/dist/commands/agent-goal.d.ts

@@ -17,6 +17,7 @@
  * index.ts wires in. Key material is never printed.
  */
 import { type SessionRecord } from "../lib/agent-ledger.js";
+import { type LauncherConfig } from "../lib/launcher-config.js";
 import { type FetchLike, type GoalControlCreds, type GoalShowResponse } from "../lib/goal-api.js";
 export interface GoalCommandDeps {
     /** The ledger, newest first. */
@@ -30,10 +31,14 @@ export interface GoalCommandDeps {
     err: (line: string) => void;
 }
 /**
- * The Anthropic key the launch would resolve (env, then ~/.mnemom/launcher.json), never prompted
- * for. Lazy import: commands/agent.ts is the launcher and carries a heavy import graph.
+ * The credential the launch would resolve, never prompted for. The auth mode resolves as the
+ * launch does (MNEMOM_AGENT_AUTH, else launcher.toml `auth` folded in under env, else api-key;
+ * host/seat-credential.ts does the same). api-key: the Anthropic key (env, then
+ * ~/.mnemom/launcher.json) plus the Mnemom key sent beside it. subscription: the launch had no
+ * Anthropic key and anchored on its Mnemom key, which the gateway control route accepts as the
+ * session credential. Lazy import: commands/agent.ts is the launcher and carries a heavy import graph.
  */
-export declare function resolveLaunchCreds(): Promise<GoalControlCreds>;
+export declare function resolveLaunchCreds(env?: NodeJS.ProcessEnv, loadConfig?: () => LauncherConfig): Promise<GoalControlCreds>;
 export declare const liveGoalDeps: GoalCommandDeps;
 export interface GoalShowOptions {
     thread?: string;

package/dist/commands/agent-goal.js

@@ -18,22 +18,36 @@
  */
 import { readSessionRecords } from "../lib/agent-ledger.js";
 import { MNEMOM_DIR } from "../lib/config.js";
+import { applyConfigToEnv, loadLauncherConfig, } from "../lib/launcher-config.js";
 import { fmt, formatRelativeAge } from "../lib/format.js";
 import { GoalControlError, goalControlFetch, isValidGoalThread, } from "../lib/goal-api.js";
 import { askYesNo, isInteractive } from "../lib/prompt.js";
 import { localGoalFlag, resolveSessionRef } from "./agent-sessions.js";
 /**
- * The Anthropic key the launch would resolve (env, then ~/.mnemom/launcher.json), never prompted
- * for. Lazy import: commands/agent.ts is the launcher and carries a heavy import graph.
+ * The credential the launch would resolve, never prompted for. The auth mode resolves as the
+ * launch does (MNEMOM_AGENT_AUTH, else launcher.toml `auth` folded in under env, else api-key;
+ * host/seat-credential.ts does the same). api-key: the Anthropic key (env, then
+ * ~/.mnemom/launcher.json) plus the Mnemom key sent beside it. subscription: the launch had no
+ * Anthropic key and anchored on its Mnemom key, which the gateway control route accepts as the
+ * session credential. Lazy import: commands/agent.ts is the launcher and carries a heavy import graph.
  */
-export async function resolveLaunchCreds() {
+export async function resolveLaunchCreds(env = process.env, loadConfig = loadLauncherConfig) {
     const { defaultMnemomKeyDeps, resolveAnthropicKey } = await import("./agent.js");
-    const { readMnemomKey } = await import("../lib/subscription-login.js");
+    const { readMnemomKey, resolveAgentAuth } = await import("../lib/subscription-login.js");
+    const folded = { ...env };
+    applyConfigToEnv(loadConfig(), folded);
+    // The Mnemom key the launch sent (env, else the store; never minted here) — a pinned session's
+    // control calls need it, and every call is then asked as the launch was.
+    const mnemomKey = readMnemomKey(defaultMnemomKeyDeps());
+    if (resolveAgentAuth(undefined, folded) === "subscription") {
+        if (!mnemomKey) {
+            throw new Error("auth = subscription and no Mnemom key in env (MNEMOM_AGENT_MNEMOM_KEY) or ~/.mnemom/launcher.json — " +
+                "the goal commands authenticate with the Mnemom key the session launched with");
+        }
+        return { mnemomKey };
+    }
     try {
-        const anthropicKey = await resolveAnthropicKey(process.env, { allowPrompt: false });
-        // The Mnemom key the launch sent beside it (env, else the store; never minted here) — a
-        // pinned session's control calls need it, and every call is then asked as the launch was.
-        const mnemomKey = readMnemomKey(defaultMnemomKeyDeps());
+        const anthropicKey = await resolveAnthropicKey(folded, { allowPrompt: false });
         return mnemomKey ? { anthropicKey, mnemomKey } : { anthropicKey };
     }
     catch {

package/dist/commands/agent-run.d.ts

@@ -9,6 +9,11 @@
  *
  * The GitHub token (GH_TOKEN, GITHUB_TOKEN, else `gh auth token`) is the runner's own: it reaches
  * git only through GIT_CONFIG_* env (never argv) and the phases never see it (phaseEnv).
+ *
+ * So is the Anthropic key (ruling 34.30.1): the phases' model calls are billed to the runner's own
+ * ANTHROPIC_API_KEY, which only the model proxy holds and sets on each upstream request. A runner
+ * without one refuses at start, before any credential exchange or claim. The key is read once per
+ * process: after rotating it, restart a `--watch` runner.
  */
 import { type FetchFn, type RunnerApi } from "../lib/runner/executor-client.js";
 import { type GithubBases } from "../lib/runner/github-base.js";
@@ -27,8 +32,10 @@ export interface RunDeps {
     stop: AbortSignal;
     /** The text of this host's executor-state.json, or null when there is none. */
     readExecutorState?(): Promise<string | null>;
-    jobDeps(api: RunnerApi, executorId: string | null, github: GithubBases): JobDeps;
+    jobDeps(api: RunnerApi, executorId: string | null, github: GithubBases, modelKey: string): JobDeps;
 }
+/** The refusal of a runner with no ANTHROPIC_API_KEY (34.30.1); a config error, exit 2. */
+export declare const RUNNER_MODEL_KEY_MISSING = "runner_model_key_missing";
 /** Resolves the process exit code; never throws for a usage, config or Mnemom error. */
 export declare function agentRunCommand(flags: RunFlags, deps: RunDeps): Promise<number>;
 export declare const GITHUB_API: string;
@@ -45,7 +52,7 @@ export declare function cleanupWorkspace(ws: Workspace): Promise<void>;
 /** Commits on the job branch that no origin ref has: the clone's base is origin's default branch. */
 export declare function commitsAhead(git: Git, ws: Workspace): Promise<number>;
 /** Push the job branch and open its PR against the repo's default branch; resolves its URL. */
-export declare function openPr(git: Git, fetch: FetchFn, token: string | null, repo: string, ws: Workspace, title: string, apiBase?: string): Promise<string>;
+export declare function openPr(git: Git, fetch: FetchFn, token: string | null, repo: string, ws: Workspace, title: string, body: string, apiBase?: string): Promise<string>;
 /** merge_on_green: GitHub's auto-merge on the PR (squash). */
 export declare function enableAutoMerge(fetch: FetchFn, token: string | null, prUrl: string, bases?: GithubBases): Promise<void>;
 /** Run one phase's process in the job's working copy; stdout goes to our stderr, never stdout. */
@@ -55,6 +62,7 @@ export declare function liveJobDeps(api: RunnerApi, opts: {
     env: NodeJS.ProcessEnv;
     executorId: string | null;
     github: GithubBases;
+    modelKey: string;
 }): JobDeps;
 /** The process wiring: signals, stdout and stderr. Resolves the exit code. */
 export declare function runAgentRun(flags: RunFlags): Promise<number>;

package/dist/commands/agent-run.js

@@ -9,6 +9,11 @@
  *
  * The GitHub token (GH_TOKEN, GITHUB_TOKEN, else `gh auth token`) is the runner's own: it reaches
  * git only through GIT_CONFIG_* env (never argv) and the phases never see it (phaseEnv).
+ *
+ * So is the Anthropic key (ruling 34.30.1): the phases' model calls are billed to the runner's own
+ * ANTHROPIC_API_KEY, which only the model proxy holds and sets on each upstream request. A runner
+ * without one refuses at start, before any credential exchange or claim. The key is read once per
+ * process: after rotating it, restart a `--watch` runner.
  */
 import { spawn, execFile } from "node:child_process";
 import { randomUUID } from "node:crypto";
@@ -28,6 +33,8 @@ import { resolveRunPlan } from "../lib/runner/options.js";
 import { startModelProxy } from "../lib/runner/proxy.js";
 import { resolveGithubToken } from "./agent-fuel.js";
 import { executorStatePath } from "../vendor/durable-contract/index.js";
+/** The refusal of a runner with no ANTHROPIC_API_KEY (34.30.1); a config error, exit 2. */
+export const RUNNER_MODEL_KEY_MISSING = "runner_model_key_missing";
 /** Resolves the process exit code; never throws for a usage, config or Mnemom error. */
 export async function agentRunCommand(flags, deps) {
     const resolved = resolveRunPlan(flags, deps.env);
@@ -38,6 +45,12 @@ export async function agentRunCommand(flags, deps) {
     const plan = resolved.plan;
     for (const w of plan.warnings)
         deps.err(w);
+    const modelKey = deps.env.ANTHROPIC_API_KEY?.trim();
+    if (!modelKey) {
+        deps.err(`mnemom agent run: refused (${RUNNER_MODEL_KEY_MISSING}): this runner has no ANTHROPIC_API_KEY for its phases' model calls; nothing was claimed`);
+        deps.err("  fix: set ANTHROPIC_API_KEY on this machine or as a CI secret");
+        return USAGE_EXIT_CODE;
+    }
     const gh = resolveGithubBases(deps.env);
     if (gh.warning)
         deps.err(gh.warning);
@@ -70,7 +83,7 @@ export async function agentRunCommand(flags, deps) {
     }
     const api = runnerApi({ apiUrl: deps.apiUrl, executorKey, fetch: deps.fetch });
     const loop = { failMode: plan.failMode, stop: deps.stop, emit: deps.emit };
-    const job = deps.jobDeps(api, executorId, gh.bases);
+    const job = deps.jobDeps(api, executorId, gh.bases, modelKey);
     return plan.form === "once" ? runOnce(job, loop) : runWatch(job, loop);
 }
 // ── GitHub and git, for the live driver ──────────────────────────────────────
@@ -146,14 +159,14 @@ export async function commitsAhead(git, ws) {
     return n;
 }
 /** Push the job branch and open its PR against the repo's default branch; resolves its URL. */
-export async function openPr(git, fetch, token, repo, ws, title, apiBase = GITHUB_BASES.api) {
+export async function openPr(git, fetch, token, repo, ws, title, body, apiBase = GITHUB_BASES.api) {
     await git(ws.dir, ["push", "--quiet", "origin", `HEAD:refs/heads/${ws.branch}`]);
     const meta = await github(fetch, token, "GET", `/repos/${repo}`, undefined, apiBase);
     const base = meta.json.default_branch;
     if (meta.status !== 200 || typeof base !== "string") {
         throw new Error(`reading ${repo} answered ${meta.status}`);
     }
-    const pr = await github(fetch, token, "POST", `/repos/${repo}/pulls`, { title, head: ws.branch, base }, apiBase);
+    const pr = await github(fetch, token, "POST", `/repos/${repo}/pulls`, { title, body, head: ws.branch, base }, apiBase);
     const url = pr.json.html_url;
     if (pr.status !== 201 || typeof url !== "string") {
         throw new Error(`opening the PR answered ${pr.status}`);
@@ -214,10 +227,10 @@ export function liveJobDeps(api, opts) {
         sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
         log: (line) => process.stderr.write(`mnemom agent run: ${line}\n`),
         gatewayUrl: `${getGatewayUrl()}/anthropic`,
-        startProxy: (state) => startModelProxy(`${getGatewayUrl()}/anthropic`, state),
+        startProxy: (state) => startModelProxy(`${getGatewayUrl()}/anthropic`, state, opts.modelKey),
         prepareWorkspace: (repo, sessionId) => prepareWorkspace(git, `${gh.web}/${repo}.git`, sessionId),
         runPhase: (inv, ws, modelUrl, signal) => runPhaseProcess(inv, ws, modelUrl, signal, opts.env),
-        openPr: (repo, ws, title) => openPr(git, opts.fetch, token, repo, ws, title, gh.api),
+        openPr: (repo, ws, title, body) => openPr(git, opts.fetch, token, repo, ws, title, body, gh.api),
         commitsAhead: (ws) => commitsAhead(git, ws),
         enableAutoMerge: (prUrl) => enableAutoMerge(opts.fetch, token, prUrl, gh),
         cleanup: cleanupWorkspace,
@@ -238,7 +251,7 @@ export function runAgentRun(flags) {
         err: (line) => process.stderr.write(`${line}\n`),
         stop: stop.signal,
         readExecutorState: () => readFile(executorStatePath(homedir()), "utf8").catch(() => null),
-        jobDeps: (api, executorId, github) => liveJobDeps(api, { fetch, env: process.env, executorId, github }),
+        jobDeps: (api, executorId, github, modelKey) => liveJobDeps(api, { fetch, env: process.env, executorId, github, modelKey }),
     }).finally(() => {
         process.off("SIGTERM", onSignal);
         process.off("SIGINT", onSignal);

package/dist/commands/agent-slack.js

@@ -26,6 +26,7 @@ import { mergeStore, readStore } from "../lib/launcher-store.js";
 import { askInput, isInteractive } from "../lib/prompt.js";
 import { explainSlackError, looksLikeAppToken, looksLikeBotToken, deleteMessage, postMessage, resolveSlackToken, sessionPosterName, slackAppManifest, slackCall, SLACK_APP_TOKEN_STORE_KEY, SLACK_TOKEN_STORE_KEY, } from "../lib/slack.js";
 import { routerStatus, runRouter } from "../lib/slack-router.js";
+import { DurableSlack, slackDurableConfig } from "../lib/slack-durable.js";
 import { normHandle } from "../lib/slack-route.js";
 import { findOwnPost, freshInbox, listAliases, liveSessions, readInboxFrom, readOffset, recordPost, removeAlias, setAlias, writeOffset, } from "../lib/slack-state.js";
 const out = (line = "") => console.log(line);
@@ -96,6 +97,9 @@ async function login() {
         const me = (await askInput("Your Slack member ID — only allowlisted members can reach a session (U…): ")).trim();
         if (me) {
             configKeySpec("slack_allow")?.set(cfg, me);
+            // The member id asked for is the person's own: it is also the owner's (durable inbox).
+            if (!cfg.slackOwner?.length)
+                configKeySpec("slack_owner")?.set(cfg, me);
             writeLauncherConfig(cfg);
         }
     }
@@ -129,6 +133,8 @@ async function status() {
     out(`sticky threads: ${cfg.slackStickyThreads ? "on" : "off"}`);
     const allow = cfg.slackAllow ?? [];
     out(`allowed senders: ${allow.length ? allow.join(", ") : "none — no message will reach a session"}`);
+    const owner = cfg.slackOwner ?? [];
+    out(`owner:          ${owner.length ? owner.join(", ") : "not set — `mnemom agent config set slack_owner <your member id>` (durable inbox)"}`);
 }
 export const POST_USAGE = `Usage: mnemom agent slack post [options] [--] <text…|->
 
@@ -305,6 +311,7 @@ async function router() {
     if (!app)
         throw new Error("mnemom agent slack router: no app-level token — run `mnemom agent slack login`.");
     const cfg = loadLauncherConfig();
+    const durable = await routerDurable();
     await runRouter({
         botToken: botToken(),
         appToken: app,
@@ -312,6 +319,31 @@ async function router() {
         // Both off unless the operator turned them on: off, routing is unchanged.
         aliases: cfg.slackAliases === true,
         stickyThreads: cfg.slackStickyThreads === true,
+        ...(durable ? { durable } : {}),
+    });
+}
+/**
+ * S1 amendment 60: with durable on, messages routed to a locked durable session go to its durable
+ * inbox (lib/slack-durable.ts). Off: undefined, and the router is unchanged.
+ */
+async function routerDurable() {
+    const { loadExperimentalState } = await import("../lib/cli-config.js");
+    const { durableOn } = await import("../lib/durable/gate.js");
+    if (!durableOn(loadExperimentalState().enabled))
+        return undefined;
+    const { liveDurableApi } = await import("../lib/durable/live.js");
+    const api = liveDurableApi();
+    const conf = slackDurableConfig(process.env, loadLauncherConfig().slackOwner ?? []);
+    console.error(`[slack-router] durable inbox on: ${conf.ownerSlackIds.length} owner id(s), ${Object.keys(conf.agentSenders).length} agent sender(s)`);
+    if (conf.ownerSlackIds.length === 0)
+        console.error("[slack-router] no owner Slack id: your own messages to a locked durable session will not be sent. Fix: mnemom agent config set slack_owner <your member id>");
+    return new DurableSlack({
+        listSessions: (f) => api.listSessions(f),
+        send: (cid, agentId, body, credential) => api.inbox("own_inbox_send", cid, agentId, body, credential),
+        env: process.env,
+        ...conf,
+        cli: ["mnemom"],
+        now: () => Date.now(),
     });
 }
 async function listen() {

package/dist/commands/durable-inbox.d.ts

@@ -0,0 +1,51 @@
+/**
+ * The durable inbox verbs (S1 amendment 60, signed off by Wassim 2026-11-02; ROUTES.own_inbox_*):
+ *
+ *   mnemom agent sessions send <name> [text|-] [--idempotency-key k] [--json]
+ *   mnemom agent sessions send <name> [text|-] --sender-key-env VAR --conversation <cid> --agent-id <id>
+ *   mnemom agent sessions senders list|add|remove <name> [<agent>] [--label l] [--json]
+ *
+ * `send` is the owner door into a locked session: the api admits the message, the host daemon
+ * delivers it into the seat as the next prompt once the seat is idle, and the turn answering it is
+ * admitted unattended (A60 (e)). An allowlisted agent (chief) sends with its own agent-bound key,
+ * read from the environment variable --sender-key-env names (never from argv, so it never shows in
+ * `ps`); the api then records the message as from that agent on behalf of the owner. That agent cannot
+ * list the owner's sessions, so it addresses the session by --conversation and --agent-id.
+ *
+ * The body is exactly {text, idempotency_key}: the sender is never named by the caller. Every
+ * dependency is injected (`InboxVerbDeps`), so each branch is unit-tested.
+ */
+import type { ApiAnswer, DurableCredential } from "../lib/durable/api.js";
+import { type DurableVerbDeps, type VerbApi } from "./durable-verbs.js";
+export type InboxRoute = "own_inbox_send" | "own_inbox_list" | "own_inbox_senders" | "own_inbox_sender_add" | "own_inbox_sender_remove";
+/** The slice of DurableApi the inbox verbs use (a fake in tests). */
+export interface InboxApi extends Pick<VerbApi, "listSessions" | "agentsByName"> {
+    inbox(route: InboxRoute, cid: string, agentId: string, body?: unknown, credential?: DurableCredential): Promise<ApiAnswer>;
+}
+export interface InboxVerbDeps extends Omit<DurableVerbDeps, "api"> {
+    api: InboxApi;
+    /** The environment (the sender key is read from it by name). */
+    env: Readonly<Record<string, string | undefined>>;
+    /** All of stdin, for `send <name> -` (and `send <name>` with no text). */
+    readStdin: () => Promise<string>;
+    newId?: () => string;
+}
+export interface SendOpts {
+    idempotencyKey?: string;
+    senderKeyEnv?: string;
+    conversation?: string;
+    agentId?: string;
+    json?: boolean;
+}
+/** The default idempotency key of one CLI send: a retry of the same command is a new message. */
+export declare const cliIdempotencyKey: (id: string) => string;
+/** The sender agent's key from the named environment variable; a usage refusal when unusable. */
+export declare function senderCredential(envName: string | undefined, env: Readonly<Record<string, string | undefined>>): DurableCredential | undefined;
+export declare function sendCommand(name: string, text: string | undefined, opts: SendOpts, deps: InboxVerbDeps): Promise<number>;
+/** An agent id from a name or id: one agent of that name in the caller's orgs, else the word as an id. */
+export declare function resolveAgentId(api: InboxApi, ref: string): Promise<string>;
+export type SendersVerb = "list" | "add" | "remove";
+export declare function sendersCommand(verb: SendersVerb, name: string, agent: string | undefined, opts: {
+    label?: string;
+    json?: boolean;
+}, deps: InboxVerbDeps): Promise<number>;

package/dist/commands/durable-inbox.js

@@ -0,0 +1,134 @@
+/**
+ * The durable inbox verbs (S1 amendment 60, signed off by Wassim 2026-11-02; ROUTES.own_inbox_*):
+ *
+ *   mnemom agent sessions send <name> [text|-] [--idempotency-key k] [--json]
+ *   mnemom agent sessions send <name> [text|-] --sender-key-env VAR --conversation <cid> --agent-id <id>
+ *   mnemom agent sessions senders list|add|remove <name> [<agent>] [--label l] [--json]
+ *
+ * `send` is the owner door into a locked session: the api admits the message, the host daemon
+ * delivers it into the seat as the next prompt once the seat is idle, and the turn answering it is
+ * admitted unattended (A60 (e)). An allowlisted agent (chief) sends with its own agent-bound key,
+ * read from the environment variable --sender-key-env names (never from argv, so it never shows in
+ * `ps`); the api then records the message as from that agent on behalf of the owner. That agent cannot
+ * list the owner's sessions, so it addresses the session by --conversation and --agent-id.
+ *
+ * The body is exactly {text, idempotency_key}: the sender is never named by the caller. Every
+ * dependency is injected (`InboxVerbDeps`), so each branch is unit-tested.
+ */
+import { randomUUID } from "node:crypto";
+import { INBOX_AGENT_ID_RE, INBOX_IDEMPOTENCY_KEY_RE, INBOX_SENDER_LABEL_RE, inboxBodyOk, inboxSendResponseOk, inboxSenderChangeResponseOk, inboxSendersResponseOk, } from "../vendor/shared/durable-contract/inbox.js";
+import { DurableRefusal } from "../lib/durable/refusal.js";
+import { handleVerbError, refusalFromAnswer, resolveTarget, } from "./durable-verbs.js";
+const usage = (message) => new DurableRefusal({ code: "invalid_argument", message, fix: null, exit: 2 });
+/** The default idempotency key of one CLI send: a retry of the same command is a new message. */
+export const cliIdempotencyKey = (id) => `cli:${id}`;
+/** The session a send goes to: by name through the registry, or by --conversation/--agent-id. */
+async function sendTarget(name, opts, api) {
+    if (opts.conversation !== undefined || opts.agentId !== undefined) {
+        if (!opts.conversation || !opts.agentId)
+            throw usage("--conversation and --agent-id go together");
+        if (!INBOX_AGENT_ID_RE.test(opts.agentId))
+            throw usage(`--agent-id is not an agent id (got '${opts.agentId}')`);
+        return { cid: opts.conversation, agentId: opts.agentId };
+    }
+    if (opts.senderKeyEnv !== undefined)
+        throw usage("--sender-key-env sends as another agent, which cannot look the session up: give --conversation and --agent-id too");
+    const row = await resolveTarget(api, name);
+    return { cid: row.conversation_id, agentId: row.agent_id };
+}
+/** The sender agent's key from the named environment variable; a usage refusal when unusable. */
+export function senderCredential(envName, env) {
+    if (envName === undefined)
+        return undefined;
+    if (!/^[A-Z_][A-Z0-9_]*$/.test(envName))
+        throw usage(`--sender-key-env takes an environment variable name (got '${envName}')`);
+    const key = env[envName]?.trim();
+    if (!key)
+        throw usage(`--sender-key-env ${envName}: that variable is not set`);
+    return { type: "api-key", key };
+}
+export async function sendCommand(name, text, opts, deps) {
+    const json = opts.json === true;
+    try {
+        const body = text === undefined || text === "-" ? await deps.readStdin() : text;
+        if (!inboxBodyOk(body))
+            throw usage("the message must be 1..16384 UTF-8 bytes with no control character but tab and newline (give it as an argument or on stdin)");
+        const key = opts.idempotencyKey ?? cliIdempotencyKey((deps.newId ?? randomUUID)());
+        if (!INBOX_IDEMPOTENCY_KEY_RE.test(key))
+            throw usage(`--idempotency-key must be 1..200 letters, digits or _ . : - (got '${key.slice(0, 40)}')`);
+        const credential = senderCredential(opts.senderKeyEnv, deps.env);
+        const t = await sendTarget(name, opts, deps.api);
+        const a = await deps.api.inbox("own_inbox_send", t.cid, t.agentId, { text: body, idempotency_key: key }, credential);
+        if (a.status !== 200 || !inboxSendResponseOk(a.body))
+            throw refusalFromAnswer(a, name, deps.launcherKey());
+        const r = a.body;
+        const say = json ? deps.err : deps.out;
+        const how = r.deduped
+            ? "already sent (same idempotency key)"
+            : r.coalesced
+                ? "already waiting (same message still open)"
+                : "queued";
+        say(`${name}: ${how}; inbox ${r.inbox_id} (${r.sha.slice(0, 12)}), ${r.status}${r.sender_kind === "agent" ? ", sent as an allowlisted agent on behalf of the owner" : ""}`);
+        if (json)
+            deps.out(JSON.stringify(a.body));
+        return 0;
+    }
+    catch (e) {
+        return handleVerbError(e, json, deps);
+    }
+}
+/** An agent id from a name or id: one agent of that name in the caller's orgs, else the word as an id. */
+export async function resolveAgentId(api, ref) {
+    const byName = await api.agentsByName(ref).catch(() => []);
+    if (byName.length > 1)
+        throw usage(`more than one agent is named ${ref}: give its id (mnemom agent list)`);
+    const id = byName[0]?.id ?? ref;
+    if (!INBOX_AGENT_ID_RE.test(id))
+        throw usage(`'${ref}' is not an agent name or id`);
+    return id;
+}
+export async function sendersCommand(verb, name, agent, opts, deps) {
+    const json = opts.json === true;
+    const say = json ? deps.err : deps.out;
+    try {
+        if (verb !== "list" && agent === undefined)
+            throw usage(`mnemom agent sessions senders ${verb} <name> <agent>`);
+        if (opts.label !== undefined && (verb !== "add" || !INBOX_SENDER_LABEL_RE.test(opts.label)))
+            throw usage("--label goes with `add`: one line of printable ASCII, no brackets, 1..128");
+        const row = await resolveTarget(deps.api, name);
+        if (verb === "list") {
+            const a = await deps.api.inbox("own_inbox_senders", row.conversation_id, row.agent_id);
+            if (a.status !== 200 || !inboxSendersResponseOk(a.body))
+                throw refusalFromAnswer(a, name, deps.launcherKey(), row);
+            const b = a.body;
+            if (json)
+                deps.out(JSON.stringify(a.body));
+            else if (b.senders.length === 0)
+                say(`${name}: only the owner may send to agent ${b.recipient_agent_id}'s inbox`);
+            else {
+                say(`${name}: agents that may send to agent ${b.recipient_agent_id}'s inbox:`);
+                for (const s of b.senders)
+                    say(`  ${s.sender_agent_id}${s.label ? `  ${s.label}` : ""}  (since ${s.created_at})`);
+            }
+            return 0;
+        }
+        const agentId = await resolveAgentId(deps.api, agent);
+        const route = verb === "add" ? "own_inbox_sender_add" : "own_inbox_sender_remove";
+        const body = verb === "add" && opts.label !== undefined
+            ? { agent_id: agentId, label: opts.label }
+            : { agent_id: agentId };
+        const a = await deps.api.inbox(route, row.conversation_id, row.agent_id, body);
+        if (a.status !== 200 || !inboxSenderChangeResponseOk(a.body))
+            throw refusalFromAnswer(a, name, deps.launcherKey(), row);
+        const changed = a.body.changed;
+        say(verb === "add"
+            ? `${name}: agent ${agentId} ${changed ? "may now send" : "could already send"} to this agent's inbox`
+            : `${name}: agent ${agentId} ${changed ? "may no longer send" : "was not allowed to send"} to this agent's inbox`);
+        if (json)
+            deps.out(JSON.stringify(a.body));
+        return 0;
+    }
+    catch (e) {
+        return handleVerbError(e, json, deps);
+    }
+}

package/dist/commands/durable-questions.d.ts

@@ -0,0 +1,64 @@
+/**
+ * The durable question verbs (S1 amendment 61, signed off by Wassim 2026-11-02; ROUTES.own_questions and
+ * ROUTES.own_answer):
+ *
+ *   mnemom agent sessions questions <name> [--all] [--json]
+ *   mnemom agent sessions answer <name> <qid|latest> [choice...] [--dismiss] [--json]
+ *
+ * A locked seat that calls AskUserQuestion records the question at the api (question.asked) instead
+ * of drawing a dialog nobody sees. `questions` lists them (the open ones by default), with the option
+ * the seat recommends marked; `answer` answers one (question.answered, via coding_agent) or dismisses
+ * it. Each choice is a 1-based option number (comma separated for a multi-select question), an
+ * option label, or free text; with several questions, one choice per question in order. The seat
+ * gets the answer either live (its hook is still waiting) or as its next inbox message.
+ *
+ * Every dependency is injected (`QuestionVerbDeps`), so each branch is unit-tested.
+ */
+import { type QuestionItem, type QuestionState } from "../vendor/shared/durable-contract/question.js";
+import type { ApiAnswer } from "../lib/durable/api.js";
+import { type DurableVerbDeps, type VerbApi } from "./durable-verbs.js";
+export type QuestionRoute = "own_questions" | "own_answer";
+/** The slice of DurableApi the question verbs use (a fake in tests). */
+export interface QuestionApi extends Pick<VerbApi, "listSessions"> {
+    questions(route: QuestionRoute, cid: string, agentId: string, body?: unknown): Promise<ApiAnswer>;
+}
+export interface QuestionVerbDeps extends Omit<DurableVerbDeps, "api"> {
+    api: QuestionApi;
+}
+/** One own_questions item as the CLI reads it (shape checked by questionListResponseOk). */
+export interface QuestionRow {
+    approval_id: string;
+    state: QuestionState;
+    questions: QuestionItem[];
+    recommended: Array<number | null>;
+    answers: Record<string, string> | null;
+    answered_via: string | null;
+    created_at: string;
+    expires_at: string;
+    answered_at: string | null;
+}
+/**
+ * Whether the owner can still answer `q`. The api reports a question the seat released as
+ * `handed_off` whether or not it was answered since (S1 question.ts: answered and handed_off can
+ * both hold), so a handed-off question is still waiting for the owner while it has no answered_at
+ * and has not expired. Its answer then reaches the seat as an inbox message (S1 §61 (c)/(e)).
+ */
+export declare function awaitingAnswer(q: QuestionRow, now: number): boolean;
+/**
+ * Text the seat's model wrote, made safe for the owner's terminal: every C0/C1 control character
+ * (ESC, CSI, OSC, BEL, CR, ...) and DEL is shown escaped (`\x1b`), so a question cannot move the
+ * cursor, rewrite or hide a line, or write the clipboard. S1 question.ts only refuses NUL.
+ */
+export declare function terminalSafe(s: string): string;
+/** The human lines for one question row. */
+export declare function renderQuestion(q: QuestionRow, now?: number): string[];
+export declare function questionsCommand(name: string, opts: {
+    all?: boolean;
+    json?: boolean;
+}, deps: QuestionVerbDeps): Promise<number>;
+/** The answers map for one question row from the owner's choices (one per question, in order). */
+export declare function answersFromChoices(q: QuestionRow, choices: readonly string[]): Record<string, string>;
+export declare function answerCommand(name: string, qid: string, choices: readonly string[], opts: {
+    dismiss?: boolean;
+    json?: boolean;
+}, deps: QuestionVerbDeps): Promise<number>;