@mnemom/mnemom 0.17.34 → 0.17.35

package/dist/vendor/shared/durable-contract/routes.d.ts

@@ -12,7 +12,7 @@
  *
  * Owner session verbs (ruling 33.22; design-v3 section 3.5, BACKBONE A2): scoped on the
  * conversation id under /v1/agent/sessions/; the `?agent_id=` query is not part of the match. Not
- * frozen: move, inbox, triggers and profiles (not in A2), the pre-existing GET /{cid} and POST
+ * frozen: move, triggers and profiles (not in A2), the pre-existing GET /{cid} and POST
  * /{cid}/contract, and create and list (their methods are not spelled in the sources).
  *
  * Doors amendment (ruling 34.03): exec_ready_list (the pool discovery read) and exec_oidc_exchange
@@ -23,10 +23,24 @@
  * Internal): int_charter is the api route the gateway's durable seal calls on a cold charter LRU.
  * The api serves it (A2: only the api holds the charter DEK); the gateway sends
  * CHARTER_BY_HASH_BODY_KEYS with INTERNAL_KEY_HEADER and reads CHARTER_BY_HASH_RESPONSE.
+ *
+ * Inbox (S1 amendment 60, signed off by Wassim 2026-11-02): the owner's send, list and allowlist routes
+ * under /v1/agent/sessions/{cid}/inbox, and the executor's summary, take and ack routes under
+ * /v1/executor/sessions/{id}/inbox. Bodies and answers are inbox.ts's closed shapes. A route takes
+ * one id, so the allowlist's agent_id and the acked inbox_id ride in the body.
+ *
+ * Questions (S1 amendment 61, signed off by Wassim 2026-11-02): the executor's ask, poll and release
+ * routes under /v1/executor/sessions/{id}/questions, the owner's list and answer routes under
+ * /v1/agent/sessions/{cid}/questions. Bodies and answers are question.ts's closed shapes; the
+ * approval_id rides in the body.
  */
 export type RouteMethod = "GET" | "POST" | "DELETE";
 /** github_oidc (ruling 34.03 (1)): a GitHub Actions workflow OIDC token, in the body, exchanged for a one-lease key. */
-export type RouteAuth = "owner_jwt" | "owner" | "poll_secret" | "executor_key" | "internal" | "github_oidc";
+/**
+ * inbox_sender (S1 amendment 60): an `owner` credential, or an agent-bound credential (the agent's
+ * mnm_ds_ lease key or its session key) whose agent is on the recipient agent's inbox allowlist.
+ */
+export type RouteAuth = "owner_jwt" | "owner" | "poll_secret" | "executor_key" | "internal" | "github_oidc" | "inbox_sender";
 export interface FixedRoute {
     readonly method: RouteMethod;
     readonly auth: RouteAuth;
@@ -61,6 +75,20 @@ export declare const ROUTES: Readonly<{
     exec_ready_list: FixedRoute;
     /** Body {oidc_token}; answers a one-lease org-scope executor key or an OIDC_EXCHANGE_REFUSALS refusal. */
     exec_oidc_exchange: FixedRoute;
+    /** Content-free summary {admitted, delivered, oldest_admitted_at} (inboxSummaryResponseOk); marks nothing. */
+    exec_inbox: ScopedRoute;
+    /** Body {epoch, nonce, limit?}: marks up to limit messages delivered at the live epoch, journals inbox.delivered, answers their delivery text. */
+    exec_inbox_take: ScopedRoute;
+    /** Body {epoch, nonce, inbox_id, sha}: acks a message delivered at this epoch, journals inbox.acked. */
+    exec_inbox_ack: ScopedRoute;
+    /** Body {epoch, nonce, inbox_id, sha, reason}: hands a delivered message back undone (admitted again, or dead at the limit), journals inbox.reverted. */
+    exec_inbox_release: ScopedRoute;
+    /** Body {epoch, nonce, tool_use_id, questions}: opens the session's question approval (or returns it when the open one has this question_sha), journals question.asked. */
+    exec_question: ScopedRoute;
+    /** Body {epoch, nonce, approval_id}: the question's state; an answer is handed over once (marked taken). */
+    exec_question_poll: ScopedRoute;
+    /** Body {epoch, nonce, approval_id}: the seat stopped waiting; the answer (now or later) goes to the inbox. */
+    exec_question_release: ScopedRoute;
     own_lock: ScopedRoute;
     own_unlock: ScopedRoute;
     own_pause: ScopedRoute;
@@ -70,6 +98,20 @@ export declare const ROUTES: Readonly<{
     own_amend: ScopedRoute;
     own_fail: ScopedRoute;
     own_events: ScopedRoute;
+    /** Body {text, idempotency_key} (inboxSendBodyOk); answer INBOX_SEND_RESPONSE or an INBOX_REJECT_CODES refusal. */
+    own_inbox_send: ScopedRoute;
+    /** {messages: [INBOX_LIST_ITEM, ...]}, newest first, content-free. */
+    own_inbox_list: ScopedRoute;
+    /** {recipient_agent_id, senders: [INBOX_SENDER_ITEM, ...]}: the session's agent's live allowlist. */
+    own_inbox_senders: ScopedRoute;
+    /** Body {agent_id, label?}: allowlists one of the owner's own agents in the same org. */
+    own_inbox_sender_add: ScopedRoute;
+    /** Body {agent_id}: revokes it (the row keeps revoked_at and revoked_by). */
+    own_inbox_sender_remove: ScopedRoute;
+    /** {questions: [QUESTION_LIST_ITEM, ...]}, newest first; the owner reads the question text. */
+    own_questions: ScopedRoute;
+    /** Body {approval_id, via, answers | dismiss: true}: answers or dismisses, journals question.answered. */
+    own_answer: ScopedRoute;
     int_events: FixedRoute;
     int_arm: FixedRoute;
     int_sweep: FixedRoute;

package/dist/vendor/shared/durable-contract/routes.js

@@ -13,7 +13,7 @@
  *
  * Owner session verbs (ruling 33.22; design-v3 section 3.5, BACKBONE A2): scoped on the
  * conversation id under /v1/agent/sessions/; the `?agent_id=` query is not part of the match. Not
- * frozen: move, inbox, triggers and profiles (not in A2), the pre-existing GET /{cid} and POST
+ * frozen: move, triggers and profiles (not in A2), the pre-existing GET /{cid} and POST
  * /{cid}/contract, and create and list (their methods are not spelled in the sources).
  *
  * Doors amendment (ruling 34.03): exec_ready_list (the pool discovery read) and exec_oidc_exchange
@@ -24,6 +24,16 @@
  * Internal): int_charter is the api route the gateway's durable seal calls on a cold charter LRU.
  * The api serves it (A2: only the api holds the charter DEK); the gateway sends
  * CHARTER_BY_HASH_BODY_KEYS with INTERNAL_KEY_HEADER and reads CHARTER_BY_HASH_RESPONSE.
+ *
+ * Inbox (S1 amendment 60, signed off by Wassim 2026-11-02): the owner's send, list and allowlist routes
+ * under /v1/agent/sessions/{cid}/inbox, and the executor's summary, take and ack routes under
+ * /v1/executor/sessions/{id}/inbox. Bodies and answers are inbox.ts's closed shapes. A route takes
+ * one id, so the allowlist's agent_id and the acked inbox_id ride in the body.
+ *
+ * Questions (S1 amendment 61, signed off by Wassim 2026-11-02): the executor's ask, poll and release
+ * routes under /v1/executor/sessions/{id}/questions, the owner's list and answer routes under
+ * /v1/agent/sessions/{cid}/questions. Bodies and answers are question.ts's closed shapes; the
+ * approval_id rides in the body.
  */
 import { ARM_ROUTE } from "./arm.js";
 import { fieldOk } from "./admission.js";
@@ -64,6 +74,22 @@ export const ROUTES = Object.freeze({
     exec_ready_list: fixed("GET", "executor_key", "/v1/executor/ready"),
     /** Body {oidc_token}; answers a one-lease org-scope executor key or an OIDC_EXCHANGE_REFUSALS refusal. */
     exec_oidc_exchange: fixed("POST", "github_oidc", "/v1/executor/oidc/exchange"),
+    // ---- inbox, executor side (S1 amendment 60) ----
+    /** Content-free summary {admitted, delivered, oldest_admitted_at} (inboxSummaryResponseOk); marks nothing. */
+    exec_inbox: scoped("GET", "executor_key", EXEC_SESSION_PRE, "/inbox"),
+    /** Body {epoch, nonce, limit?}: marks up to limit messages delivered at the live epoch, journals inbox.delivered, answers their delivery text. */
+    exec_inbox_take: scoped("POST", "executor_key", EXEC_SESSION_PRE, "/inbox/take"),
+    /** Body {epoch, nonce, inbox_id, sha}: acks a message delivered at this epoch, journals inbox.acked. */
+    exec_inbox_ack: scoped("POST", "executor_key", EXEC_SESSION_PRE, "/inbox/ack"),
+    /** Body {epoch, nonce, inbox_id, sha, reason}: hands a delivered message back undone (admitted again, or dead at the limit), journals inbox.reverted. */
+    exec_inbox_release: scoped("POST", "executor_key", EXEC_SESSION_PRE, "/inbox/release"),
+    // ---- questions, executor side (S1 amendment 61) ----
+    /** Body {epoch, nonce, tool_use_id, questions}: opens the session's question approval (or returns it when the open one has this question_sha), journals question.asked. */
+    exec_question: scoped("POST", "executor_key", EXEC_SESSION_PRE, "/questions"),
+    /** Body {epoch, nonce, approval_id}: the question's state; an answer is handed over once (marked taken). */
+    exec_question_poll: scoped("POST", "executor_key", EXEC_SESSION_PRE, "/questions/poll"),
+    /** Body {epoch, nonce, approval_id}: the seat stopped waiting; the answer (now or later) goes to the inbox. */
+    exec_question_release: scoped("POST", "executor_key", EXEC_SESSION_PRE, "/questions/release"),
     // ---- owner session verbs (ruling 33.22) ----
     own_lock: scoped("POST", "owner", OWNER_SESSION_PRE, "/lock"),
     own_unlock: scoped("POST", "owner", OWNER_SESSION_PRE, "/unlock"),
@@ -74,6 +100,22 @@ export const ROUTES = Object.freeze({
     own_amend: scoped("POST", "owner", OWNER_SESSION_PRE, "/amend"),
     own_fail: scoped("POST", "owner", OWNER_SESSION_PRE, "/fail"),
     own_events: scoped("GET", "owner", OWNER_SESSION_PRE, "/events"),
+    // ---- inbox, owner side (S1 amendment 60) ----
+    /** Body {text, idempotency_key} (inboxSendBodyOk); answer INBOX_SEND_RESPONSE or an INBOX_REJECT_CODES refusal. */
+    own_inbox_send: scoped("POST", "inbox_sender", OWNER_SESSION_PRE, "/inbox"),
+    /** {messages: [INBOX_LIST_ITEM, ...]}, newest first, content-free. */
+    own_inbox_list: scoped("GET", "owner", OWNER_SESSION_PRE, "/inbox"),
+    /** {recipient_agent_id, senders: [INBOX_SENDER_ITEM, ...]}: the session's agent's live allowlist. */
+    own_inbox_senders: scoped("GET", "owner", OWNER_SESSION_PRE, "/inbox/senders"),
+    /** Body {agent_id, label?}: allowlists one of the owner's own agents in the same org. */
+    own_inbox_sender_add: scoped("POST", "owner", OWNER_SESSION_PRE, "/inbox/senders"),
+    /** Body {agent_id}: revokes it (the row keeps revoked_at and revoked_by). */
+    own_inbox_sender_remove: scoped("DELETE", "owner", OWNER_SESSION_PRE, "/inbox/senders"),
+    // ---- questions, owner side (S1 amendment 61) ----
+    /** {questions: [QUESTION_LIST_ITEM, ...]}, newest first; the owner reads the question text. */
+    own_questions: scoped("GET", "owner", OWNER_SESSION_PRE, "/questions"),
+    /** Body {approval_id, via, answers | dismiss: true}: answers or dismisses, journals question.answered. */
+    own_answer: scoped("POST", "owner", OWNER_SESSION_PRE, "/questions/answer"),
     // ---- gateway internal ----
     int_events: fixed("POST", "internal", GATEWAY_EVENTS_ROUTE),
     int_arm: fixed("GET", "internal", ARM_ROUTE),

package/dist/vendor/shared/durable-contract/turn.d.ts

@@ -13,7 +13,10 @@ export type TurnOrigin = (typeof TURN_ORIGINS)[number];
 export declare const TURN_SOURCES: readonly ["typed", "queued", "system", "sdk"];
 export type TurnSource = (typeof TURN_SOURCES)[number];
 export declare const CHAIN_KEY = "chain";
-/** Reserved entry key; no M1 emitter (P0a-B). Any entry carrying it is unattended. */
+/**
+ * Entry key `inbox=<sha256 hex>`: the turn answers that inbox message. Any entry carrying it is
+ * unattended. Its emitter is the seat proxy (amendment 60); admission reads the newest entry's value.
+ */
 export declare const INBOX_KEY = "inbox";
 export declare const TURN_HASH_RE: RegExp;
 export interface TurnEntryFacts {
@@ -23,6 +26,8 @@ export interface TurnEntryFacts {
     producer?: string;
     /** True when the entry carried `inbox=<sha256 hex>`. */
     inbox: boolean;
+    /** The entry's `inbox=<sha256 hex>` value when it carried a well-formed one (amendment 60). */
+    inboxSha?: string;
 }
 /** Sources that keep a human entry attended: absent, typed, queued (queued attended is a recorded departure). */
 export declare const ATTENDED_SOURCES: readonly (TurnSource | undefined)[];
@@ -44,6 +49,15 @@ export declare const ATTENDED_TASK_PRODUCER = "session-task";
  * `schemaKnown=false` (schema=unknown with a well-formed chain, F07) is unattended.
  */
 export declare function candidatePosture(entries: readonly TurnEntryFacts[], schemaKnown?: boolean): "attended" | "unattended";
+/**
+ * Amendment 60 (e): the inbox message the newest entry answers, or null. The newest entry's own
+ * `inbox=<sha>`; else, when the newest entry is a session-task notification (a background command or
+ * agent this session started, the amendment 56 continuation shape), the sha of the turn that started
+ * it: walking back over session-task entries, the first other entry's `inbox=<sha>`, if it has one.
+ * So a background task an inbox turn launched finishes inside that turn's admission, and nothing
+ * else does: a human, scheduled, peer or channel entry in between ends the walk with null.
+ */
+export declare function inboxShaOf(entries: readonly TurnEntryFacts[]): string | null;
 /** chain = sha256 hex of the root promptId (UTF-8). */
 export declare function chainIdOf(rootPromptId: string): Promise<string>;
 /** Request classes (day-1 spike vocabulary) and whether each waits for its transcript entry. */

package/dist/vendor/shared/durable-contract/turn.js

@@ -13,7 +13,10 @@ import { sha256Hex } from "./canonical.js";
 export const TURN_ORIGINS = ["human", "channel", "scheduled", "peer", "task", "meta"];
 export const TURN_SOURCES = ["typed", "queued", "system", "sdk"];
 export const CHAIN_KEY = "chain";
-/** Reserved entry key; no M1 emitter (P0a-B). Any entry carrying it is unattended. */
+/**
+ * Entry key `inbox=<sha256 hex>`: the turn answers that inbox message. Any entry carrying it is
+ * unattended. Its emitter is the seat proxy (amendment 60); admission reads the newest entry's value.
+ */
 export const INBOX_KEY = "inbox";
 export const TURN_HASH_RE = /^[0-9a-f]{64}$/;
 /** Sources that keep a human entry attended: absent, typed, queued (queued attended is a recorded departure). */
@@ -51,6 +54,35 @@ export function candidatePosture(entries, schemaKnown = true) {
         entries.slice(0, -1).some(attendedHuman);
     return continuation ? "attended" : "unattended";
 }
+const sessionTaskContinuation = (e) => e.origin === "task" &&
+    e.source === "system" &&
+    e.producer === ATTENDED_TASK_PRODUCER &&
+    !e.inbox;
+/**
+ * Amendment 60 (e): the inbox message the newest entry answers, or null. The newest entry's own
+ * `inbox=<sha>`; else, when the newest entry is a session-task notification (a background command or
+ * agent this session started, the amendment 56 continuation shape), the sha of the turn that started
+ * it: walking back over session-task entries, the first other entry's `inbox=<sha>`, if it has one.
+ * So a background task an inbox turn launched finishes inside that turn's admission, and nothing
+ * else does: a human, scheduled, peer or channel entry in between ends the walk with null.
+ */
+export function inboxShaOf(entries) {
+    const newest = entries[entries.length - 1];
+    if (newest === undefined)
+        return null;
+    const own = (e) => e.inbox && typeof e.inboxSha === "string" && TURN_HASH_RE.test(e.inboxSha) ? e.inboxSha : null;
+    if (newest.inbox)
+        return own(newest);
+    if (!sessionTaskContinuation(newest))
+        return null;
+    for (let i = entries.length - 2; i >= 0; i--) {
+        const e = entries[i];
+        if (sessionTaskContinuation(e))
+            continue;
+        return own(e);
+    }
+    return null;
+}
 /** chain = sha256 hex of the root promptId (UTF-8). */
 export async function chainIdOf(rootPromptId) {
     if (typeof rootPromptId !== "string" || rootPromptId.length === 0)

package/dist/vendor/shared/durable-contract/vectors.d.ts

@@ -189,3 +189,48 @@ export declare const SEAL_VECTORS: {
         readonly hash: "5a3bb041c155d67e50d18ee9afb0e6903f7a64988c881ab6373d3447fd5906f5";
     };
 };
+/**
+ * S1 amendment 60: inboxSha golden vectors (sha256 of the canonical identity with `v: 1`), computed
+ * independently with node:crypto over a hand-sorted JSON preimage. `text` is the delivery text the
+ * api renders for the message (inboxDeliveryText), with the sender label shown.
+ */
+export declare const INBOX_SHA_VECTORS: readonly [{
+    readonly identity: {
+        readonly session_id: "11111111-2222-4333-8444-555555555555";
+        readonly sender_kind: "owner";
+        readonly sender_agent_id: null;
+        readonly on_behalf_of: null;
+        readonly in_reply_to: null;
+        readonly body: "Please rebase PR 3220 and rerun the contract tests.";
+    };
+    readonly sender_label: null;
+    readonly preimage: "{\"body\":\"Please rebase PR 3220 and rerun the contract tests.\",\"in_reply_to\":null,\"on_behalf_of\":null,\"sender_agent_id\":null,\"sender_kind\":\"owner\",\"session_id\":\"11111111-2222-4333-8444-555555555555\",\"v\":1}";
+    readonly sha: "87fc04e971ee9fde7c3db3536772f4a7402c30a911111eff9fb37cbd3927c72f";
+    readonly text: "[mnemom inbox 87fc04e971ee9fde7c3db3536772f4a7402c30a911111eff9fb37cbd3927c72f] from the owner\n\nPlease rebase PR 3220 and rerun the contract tests.";
+}, {
+    readonly identity: {
+        readonly session_id: "11111111-2222-4333-8444-555555555555";
+        readonly sender_kind: "agent";
+        readonly sender_agent_id: "mnm-chief01";
+        readonly on_behalf_of: "user_owner_1";
+        readonly in_reply_to: null;
+        readonly body: "Wassim asks: status on the inbox migration?";
+    };
+    readonly sender_label: "chief";
+    readonly preimage: "{\"body\":\"Wassim asks: status on the inbox migration?\",\"in_reply_to\":null,\"on_behalf_of\":\"user_owner_1\",\"sender_agent_id\":\"mnm-chief01\",\"sender_kind\":\"agent\",\"session_id\":\"11111111-2222-4333-8444-555555555555\",\"v\":1}";
+    readonly sha: "8a955bd0811770262fa0d400472472b9cd8bc1cff8a41abb2955a2c1582eea54";
+    readonly text: "[mnemom inbox 8a955bd0811770262fa0d400472472b9cd8bc1cff8a41abb2955a2c1582eea54] from agent chief on behalf of the owner\n\nWassim asks: status on the inbox migration?";
+}, {
+    readonly identity: {
+        readonly session_id: "11111111-2222-4333-8444-555555555555";
+        readonly sender_kind: "owner";
+        readonly sender_agent_id: null;
+        readonly on_behalf_of: null;
+        readonly in_reply_to: "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee";
+        readonly body: "Yes, ship it as a draft. — W ✓";
+    };
+    readonly sender_label: null;
+    readonly preimage: "{\"body\":\"Yes, ship it as a draft. — W ✓\",\"in_reply_to\":\"aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee\",\"on_behalf_of\":null,\"sender_agent_id\":null,\"sender_kind\":\"owner\",\"session_id\":\"11111111-2222-4333-8444-555555555555\",\"v\":1}";
+    readonly sha: "f79c83ca6fd83b8b918fe6464479c79ba4abea1ec30f43fd62b9b6d5950cc218";
+    readonly text: "[mnemom inbox f79c83ca6fd83b8b918fe6464479c79ba4abea1ec30f43fd62b9b6d5950cc218] from the owner (answer to question aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee)\n\nYes, ship it as a draft. — W ✓";
+}];

package/dist/vendor/shared/durable-contract/vectors.js

@@ -206,3 +206,52 @@ export const SEAL_VECTORS = {
         "hash": "5a3bb041c155d67e50d18ee9afb0e6903f7a64988c881ab6373d3447fd5906f5"
     }
 };
+/**
+ * S1 amendment 60: inboxSha golden vectors (sha256 of the canonical identity with `v: 1`), computed
+ * independently with node:crypto over a hand-sorted JSON preimage. `text` is the delivery text the
+ * api renders for the message (inboxDeliveryText), with the sender label shown.
+ */
+export const INBOX_SHA_VECTORS = [
+    {
+        identity: {
+            session_id: "11111111-2222-4333-8444-555555555555",
+            sender_kind: "owner",
+            sender_agent_id: null,
+            on_behalf_of: null,
+            in_reply_to: null,
+            body: "Please rebase PR 3220 and rerun the contract tests.",
+        },
+        sender_label: null,
+        preimage: '{"body":"Please rebase PR 3220 and rerun the contract tests.","in_reply_to":null,"on_behalf_of":null,"sender_agent_id":null,"sender_kind":"owner","session_id":"11111111-2222-4333-8444-555555555555","v":1}',
+        sha: "87fc04e971ee9fde7c3db3536772f4a7402c30a911111eff9fb37cbd3927c72f",
+        text: "[mnemom inbox 87fc04e971ee9fde7c3db3536772f4a7402c30a911111eff9fb37cbd3927c72f] from the owner\n\nPlease rebase PR 3220 and rerun the contract tests.",
+    },
+    {
+        identity: {
+            session_id: "11111111-2222-4333-8444-555555555555",
+            sender_kind: "agent",
+            sender_agent_id: "mnm-chief01",
+            on_behalf_of: "user_owner_1",
+            in_reply_to: null,
+            body: "Wassim asks: status on the inbox migration?",
+        },
+        sender_label: "chief",
+        preimage: '{"body":"Wassim asks: status on the inbox migration?","in_reply_to":null,"on_behalf_of":"user_owner_1","sender_agent_id":"mnm-chief01","sender_kind":"agent","session_id":"11111111-2222-4333-8444-555555555555","v":1}',
+        sha: "8a955bd0811770262fa0d400472472b9cd8bc1cff8a41abb2955a2c1582eea54",
+        text: "[mnemom inbox 8a955bd0811770262fa0d400472472b9cd8bc1cff8a41abb2955a2c1582eea54] from agent chief on behalf of the owner\n\nWassim asks: status on the inbox migration?",
+    },
+    {
+        identity: {
+            session_id: "11111111-2222-4333-8444-555555555555",
+            sender_kind: "owner",
+            sender_agent_id: null,
+            on_behalf_of: null,
+            in_reply_to: "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
+            body: "Yes, ship it as a draft. — W ✓",
+        },
+        sender_label: null,
+        preimage: '{"body":"Yes, ship it as a draft. — W ✓","in_reply_to":"aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee","on_behalf_of":null,"sender_agent_id":null,"sender_kind":"owner","session_id":"11111111-2222-4333-8444-555555555555","v":1}',
+        sha: "f79c83ca6fd83b8b918fe6464479c79ba4abea1ec30f43fd62b9b6d5950cc218",
+        text: "[mnemom inbox f79c83ca6fd83b8b918fe6464479c79ba4abea1ec30f43fd62b9b6d5950cc218] from the owner (answer to question aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee)\n\nYes, ship it as a draft. — W ✓",
+    },
+];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemom/mnemom",
-  "version": "0.17.34",
+  "version": "0.17.35",
   "description": "Transparent AI agent tracing",
   "type": "module",
   "bin": {

package/plugins/integrity-manifest.json

@@ -12,12 +12,16 @@
     },
     {
       "path": "hooks/hooks.json",
-      "sha256": "c9fe91672a14aa8fc74d8fe523e412b7fdbe16a281cdc1d3e51b162fef3a7ed3"
+      "sha256": "fe45556f57011f0f1805fc56d2c86d5e2462cd1ba998ef7b54778b26556cfc4e"
     },
     {
       "path": "hooks/register.tsx",
       "sha256": "98da58c198d4015a5d454110249b1bc5c9fe0a1e2271c310f46c1185935d4436"
     },
+    {
+      "path": "hooks/seat-ask.mjs",
+      "sha256": "dcd0b419fc2a6fb1275aff34abb3d107311cecb4c8d7eac3c49b0c8a600db4a3"
+    },
     {
       "path": "hooks/seat-hello.mjs",
       "sha256": "4d6cd4e2fed2dc701bc6990ed5c43b37fb4aaf202b25012c3a052845d624daee"
@@ -31,5 +35,5 @@
       "sha256": "b877ea4d4d6fe11ae2eb10e035b5f017b225905f7f9ec015b3c3010609cad27b"
     }
   ],
-  "dir_hash": "ad16249ecbdd1e2fc6913529f9aefb357d516da7230f26a4e1c2c0ccf09735c5"
+  "dir_hash": "845a702134fb66daa9cbe8cc9a51f6a06ce08a08392ed5f0cf68ac4af7625398"
 }

package/plugins/mnemom/hooks/hooks.json

@@ -12,6 +12,18 @@
           }
         ]
       }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "AskUserQuestion",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "[ -z \"$MNEMOM_SEAT_SOCKET\" ] || node \"${CLAUDE_PLUGIN_ROOT}/hooks/seat-ask.mjs\"",
+            "timeout": 600
+          }
+        ]
+      }
     ]
   }
 }

package/plugins/mnemom/hooks/seat-ask.mjs

@@ -0,0 +1,221 @@
+// The seat question hook (durable S1 amendment 61, signed off by Wassim 2026-11-02): a COMMAND hook on
+// PreToolUse for AskUserQuestion. In a durable seat nobody watches the screen, so a drawn dialog
+// would wait forever. This hook makes the question a journaled durable fact instead:
+//
+//   1. ask:     {op:"question_ask", session_id, spawn_id, epoch, tool_use_id, questions} over the
+//               per-seat socket. The seat proxy relays it to the host daemon, which alone holds the
+//               executor key and calls exec_question; the api journals question.asked.
+//   2. poll:    {op:"question_poll", ..., approval_id} every POLL_INTERVAL_MS until WAIT_MS ends.
+//               answered  -> stdout permissionDecision "allow" with updatedInput {questions, answers}:
+//                            the dialog never draws and the tool result carries the owner's answer.
+//               dismissed -> "deny" with the dismissed reason (the session is not suspended).
+//               expired   -> "deny" with the expired reason.
+//      created:false is this same call asked again (the daemon passes on only an answer whose
+//      question_sha is this ask's), so it is polled like a new one. A 409 durable_question_busy means
+//      an earlier question is still with the owner: this one was not recorded, the hook denies with
+//      PENDING_REASON at once and releases nothing (the earlier question belongs to its own wait).
+//   3. release: when the window ends first, {op:"question_release", ..., approval_id}, then "deny"
+//               with the hand-off reason: the model ends its turn and the owner's answer arrives
+//               later as an amendment 60 inbox message, which the daemon delivers unattended.
+//
+// Without MNEMOM_SEAT_SOCKET (every launch that is not a durable seat) it does nothing. If the ask
+// cannot be made (no socket, the daemon or api refuses), it writes nothing and exits 0, so Claude
+// Code shows its own dialog as it always did: this hook only ever removes the screen dependency, it
+// never blocks a question. It never sees a key: the ids are non-secret.
+//
+// The reason strings are S1 question.ts's QUESTION_HANDOFF_REASON and QUESTION_DISMISSED_REASON
+// (a plugin file cannot import the contract; a CLI test pins them equal).
+import net from "node:net";
+import { createHash } from "node:crypto";
+import { pathToFileURL } from "node:url";
+
+export const SEAT_SOCKET_ENV = "MNEMOM_SEAT_SOCKET";
+export const SEAT_SESSION_ENV = "MNEMOM_SEAT_SESSION_ID";
+export const SEAT_SPAWN_ENV = "MNEMOM_SEAT_SPAWN_ID";
+export const SEAT_EPOCH_ENV = "MNEMOM_SEAT_EPOCH";
+
+/** hooks.json gives this hook 600 s; it stops waiting well before, to release and answer cleanly. */
+export const WAIT_MS = 540_000;
+export const POLL_INTERVAL_MS = 3_000;
+/** One socket round trip (the seat proxy relays it to the daemon and the daemon to the api). */
+export const OP_TIMEOUT_MS = 20_000;
+export const MAX_ANSWER_BYTES = 256 * 1024;
+
+export const HANDOFF_REASON =
+  "This question is now with your owner. End your turn now without guessing; the owner's answer will arrive as your next message.";
+export const DISMISSED_REASON =
+  "Your owner dismissed this question without answering. Decide without it, or ask differently.";
+/**
+ * The session already has a different question with the owner (one per session: asking another is
+ * 409 durable_question_busy). This call's question was not recorded; the model must not take the
+ * earlier question's answer for this one.
+ */
+export const PENDING_REASON =
+  "This question was not sent: an earlier question of yours is still waiting for your owner. End your turn now without guessing; the owner's answer to that earlier question will arrive as your next message. Ask this one again after that if it still matters.";
+export const EXPIRED_REASON =
+  "Your owner did not answer this question before it expired. Decide without it, or ask again later.";
+
+/** S1 codes.ts durable_question_busy: another question of this session's is open. */
+const BUSY_CODE = "durable_question_busy";
+const TOOL_USE_ID_RE = /^[A-Za-z0-9_-]{1,128}$/;
+
+/** The seat ids from the env: `{ skip: true }` outside a seat or with an incomplete seat env. */
+export function seatFromEnv(env) {
+  const socketPath = env[SEAT_SOCKET_ENV];
+  const sessionId = env[SEAT_SESSION_ENV];
+  const spawnId = env[SEAT_SPAWN_ENV];
+  const epoch = env[SEAT_EPOCH_ENV];
+  if (!socketPath || !sessionId || !spawnId || !/^\d{1,9}$/.test(epoch ?? ""))
+    return { skip: true };
+  return { socketPath, session_id: sessionId, spawn_id: spawnId, epoch: Number(epoch) };
+}
+
+/**
+ * The tool call from the hook's stdin JSON, or null when it is not an AskUserQuestion call with
+ * questions. tool_use_id comes from the input; when the engine gives none, a stable id is derived
+ * from the questions (asking again returns the session's open question either way).
+ */
+export function toolCallOf(input) {
+  if (!input || typeof input !== "object") return null;
+  if (input.tool_name !== "AskUserQuestion") return null;
+  const ti = input.tool_input;
+  if (!ti || typeof ti !== "object" || !Array.isArray(ti.questions)) return null;
+  let id = typeof input.tool_use_id === "string" ? input.tool_use_id : "";
+  if (!TOOL_USE_ID_RE.test(id))
+    id = `h${createHash("sha256").update(JSON.stringify(ti.questions)).digest("hex").slice(0, 40)}`;
+  return { tool_use_id: id, tool_input: ti, questions: ti.questions };
+}
+
+/**
+ * One JSON line out, the first line back, parsed. Rejects on a socket error, close or timeout, and
+ * on an answer line over MAX_ANSWER_BYTES however the bytes were chunked.
+ */
+export function sendFrame(socketPath, frame, timeoutMs = OP_TIMEOUT_MS) {
+  return new Promise((resolve, reject) => {
+    const sock = net.createConnection({ path: socketPath });
+    let buf = Buffer.alloc(0);
+    const done = (fn, v) => {
+      clearTimeout(timer);
+      sock.destroy();
+      fn(v);
+    };
+    const timer = setTimeout(() => done(reject, new Error("no answer in time")), timeoutMs);
+    sock.on("connect", () => sock.write(`${JSON.stringify(frame)}\n`));
+    sock.on("data", (d) => {
+      buf = Buffer.concat([buf, d]);
+      const i = buf.indexOf(0x0a);
+      // The line's bytes, or all the bytes so far while no newline has come.
+      if ((i < 0 ? buf.length : i) > MAX_ANSWER_BYTES)
+        return done(reject, new Error("answer too long"));
+      if (i < 0) return;
+      try {
+        done(resolve, JSON.parse(buf.subarray(0, i).toString("utf8")));
+      } catch {
+        done(reject, new Error("answer is not JSON"));
+      }
+    });
+    sock.on("error", (e) => done(reject, e));
+    sock.on("close", () => {
+      if (buf.indexOf(0x0a) < 0) done(reject, new Error("closed without an answer"));
+    });
+  });
+}
+
+/** The api body of a relayed answer `{ok, status, body}` when ok, else null. */
+function okBody(reply) {
+  return reply &&
+    typeof reply === "object" &&
+    reply.ok === true &&
+    reply.body &&
+    typeof reply.body === "object"
+    ? reply.body
+    : null;
+}
+
+export function decision(permissionDecision, extra) {
+  return { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision, ...extra } };
+}
+
+/**
+ * The hook. Resolves to the stdout object to print, or null to print nothing (Claude Code then
+ * draws its dialog as usual). Never throws.
+ */
+export async function runSeatAsk(env, input, deps = {}) {
+  const send = deps.send ?? sendFrame;
+  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps.now ?? (() => Date.now());
+  const warn = deps.warn ?? ((l) => process.stderr.write(`${l}\n`));
+  const waitMs = deps.waitMs ?? WAIT_MS;
+  const seat = seatFromEnv(env);
+  if (seat.skip) return null;
+  const call = toolCallOf(input);
+  if (!call) return null;
+  const { socketPath, ...ids } = seat;
+  let reply;
+  try {
+    reply = await send(socketPath, {
+      op: "question_ask",
+      ...ids,
+      tool_use_id: call.tool_use_id,
+      questions: call.questions,
+    });
+  } catch (e) {
+    warn(`mnemom: question not recorded: ${e instanceof Error ? e.message : String(e)}`);
+    return null;
+  }
+  if (reply?.status === 409 && reply.body?.error?.code === BUSY_CODE)
+    return decision("deny", { permissionDecisionReason: PENDING_REASON });
+  const asked = okBody(reply);
+  if (!asked || typeof asked.approval_id !== "string") {
+    warn("mnemom: question not recorded (refused); showing the dialog");
+    return null;
+  }
+  const approval_id = asked.approval_id;
+  const deadline = now() + waitMs;
+  while (now() < deadline) {
+    await sleep(POLL_INTERVAL_MS);
+    let st;
+    try {
+      st = okBody(await send(socketPath, { op: "question_poll", ...ids, approval_id }));
+    } catch {
+      continue; // a transient socket or daemon blip: keep the turn held and try again
+    }
+    if (!st) continue;
+    if (st.state === "answered" && st.answers && typeof st.answers === "object")
+      return decision("allow", {
+        permissionDecisionReason: `answered by the owner (question ${approval_id})`,
+        updatedInput: { ...call.tool_input, answers: st.answers },
+      });
+    if (st.state === "dismissed")
+      return decision("deny", { permissionDecisionReason: DISMISSED_REASON });
+    if (st.state === "expired")
+      return decision("deny", { permissionDecisionReason: EXPIRED_REASON });
+    if (st.state === "handed_off") break;
+  }
+  try {
+    await send(socketPath, { op: "question_release", ...ids, approval_id });
+  } catch (e) {
+    // The question stays open at the api and in own_questions; hand off all the same, the model
+    // must not sit on a dialog nobody can see.
+    warn(`mnemom: question release failed: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  return decision("deny", { permissionDecisionReason: HANDOFF_REASON });
+}
+
+async function readStdin() {
+  let s = "";
+  for await (const c of process.stdin) s += c;
+  return s;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  let input;
+  try {
+    input = JSON.parse(await readStdin());
+  } catch {
+    input = null;
+  }
+  const out = await runSeatAsk(process.env, input);
+  if (out) process.stdout.write(`${JSON.stringify(out)}\n`);
+  process.exitCode = 0;
+}