@mnemom/mnemom 0.17.35 → 0.17.37

package/dist/commands/agent-run.d.ts

@@ -24,6 +24,8 @@ export interface RunDeps {
     env: NodeJS.ProcessEnv;
     fetch: FetchFn;
     apiUrl: string;
+    /** The gateway the model proxy forwards to. */
+    gatewayUrl: string;
     /** stdout: one outcome line per job. */
     emit(line: string): void;
     /** stderr. */
@@ -36,6 +38,8 @@ export interface RunDeps {
 }
 /** The refusal of a runner with no ANTHROPIC_API_KEY (34.30.1); a config error, exit 2. */
 export declare const RUNNER_MODEL_KEY_MISSING = "runner_model_key_missing";
+/** The refusal of a non-production API paired with the production gateway; a config error, exit 2. */
+export declare const RUNNER_GATEWAY_RING_MISMATCH = "runner_gateway_ring_mismatch";
 /** Resolves the process exit code; never throws for a usage, config or Mnemom error. */
 export declare function agentRunCommand(flags: RunFlags, deps: RunDeps): Promise<number>;
 export declare const GITHUB_API: string;

package/dist/commands/agent-run.js

@@ -20,7 +20,7 @@ import { randomUUID } from "node:crypto";
 import { mkdtemp, readFile, rm } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
-import { getApiUrl, getGatewayUrl } from "../lib/config.js";
+import { gatewayRingMismatch, getApiUrl, getGatewayUrl } from "../lib/config.js";
 import { runnerApi } from "../lib/runner/executor-client.js";
 import { resolveClaudeBin } from "../lib/claude-bin.js";
 import { executorIdFromState } from "../lib/runner/executor-state.js";
@@ -35,6 +35,8 @@ import { resolveGithubToken } from "./agent-fuel.js";
 import { executorStatePath } from "../vendor/durable-contract/index.js";
 /** The refusal of a runner with no ANTHROPIC_API_KEY (34.30.1); a config error, exit 2. */
 export const RUNNER_MODEL_KEY_MISSING = "runner_model_key_missing";
+/** The refusal of a non-production API paired with the production gateway; a config error, exit 2. */
+export const RUNNER_GATEWAY_RING_MISMATCH = "runner_gateway_ring_mismatch";
 /** Resolves the process exit code; never throws for a usage, config or Mnemom error. */
 export async function agentRunCommand(flags, deps) {
     const resolved = resolveRunPlan(flags, deps.env);
@@ -45,6 +47,11 @@ export async function agentRunCommand(flags, deps) {
     const plan = resolved.plan;
     for (const w of plan.warnings)
         deps.err(w);
+    if (gatewayRingMismatch(deps.apiUrl, deps.gatewayUrl)) {
+        deps.err(`mnemom agent run: refused (${RUNNER_GATEWAY_RING_MISMATCH}): the API is ${deps.apiUrl} but the gateway is the production one, ${deps.gatewayUrl}; nothing was claimed`);
+        deps.err("  fix: set MNEMOM_GATEWAY_URL to the same cell's gateway as MNEMOM_API_URL");
+        return USAGE_EXIT_CODE;
+    }
     const modelKey = deps.env.ANTHROPIC_API_KEY?.trim();
     if (!modelKey) {
         deps.err(`mnemom agent run: refused (${RUNNER_MODEL_KEY_MISSING}): this runner has no ANTHROPIC_API_KEY for its phases' model calls; nothing was claimed`);
@@ -247,6 +254,7 @@ export function runAgentRun(flags) {
         env: process.env,
         fetch,
         apiUrl: getApiUrl(),
+        gatewayUrl: getGatewayUrl(),
         emit: (line) => process.stdout.write(`${line}\n`),
         err: (line) => process.stderr.write(`${line}\n`),
         stop: stop.signal,

package/dist/commands/agent-share-render.js

@@ -20,7 +20,7 @@ async function loadVerifier(load) {
     catch (error) {
         const e = error;
         if (e.code === "ERR_MODULE_NOT_FOUND" || e.code === "MODULE_NOT_FOUND") {
-            throw new Error("the aip verifier (@mnemom/aip-verifier) is not installed: run `npm install https://github.com/mnemom/aip/releases/download/aip-verifier-v0.6.0/mnemom-aip-verifier-0.6.0.tgz`", { cause: error });
+            throw new Error("the aip verifier (@mnemom/aip-verifier) is not installed: it ships bundled inside @mnemom/mnemom, so reinstall with `npm install -g @mnemom/mnemom`", { cause: error });
         }
         throw new Error(`the aip verifier (@mnemom/aip-verifier) failed to load: ${e.message ?? error}`, { cause: error });
     }

package/dist/commands/scan.d.ts

@@ -11,6 +11,7 @@ import { type AnthropicUsageDeps } from "../lib/scan/spend/anthropic-usage.js";
 import { type RecordDeps, type RecordOutcome } from "../lib/scan/record.js";
 import { type CostSpend } from "../lib/scan/cost-per-pr.js";
 import { type ReportEmailDeps } from "../lib/scan/report-email.js";
+import { type RepoListDeps } from "../lib/scan/repo-picker.js";
 import { type ReportRecipients } from "../lib/scan/share.js";
 export interface ScanCommandOptions {
     repos: string[];
@@ -42,12 +43,20 @@ export interface ScanCommandOptions {
     recordDeps?: RecordDeps;
     /** Test seam: the report-email POST. */
     emailDeps?: ReportEmailDeps;
+    /** Test seam: the org this login was authorized for (none of the stored tokens carry one today). */
+    authorizedOrg?: () => string | undefined;
+    /** Test seam: the `mnemom org use` default. */
+    activeOrg?: () => {
+        org_id: string;
+    } | undefined;
     /** Test seam: the signed-in user's orgs, used to infer --org when it is omitted. */
     listOrgs?: () => Promise<Array<{
         org_id: string;
         name?: string;
         is_personal?: boolean;
     }>>;
+    /** Test seam: the fetch behind the repo picker's list read. */
+    repoListDeps?: RepoListDeps;
     /** Test seams. */
     isTty?: boolean;
     env?: NodeJS.ProcessEnv;
@@ -93,9 +102,10 @@ export declare function resolveMeasuredUsage(o: ScanCommandOptions, period: {
 } | null>;
 /**
  * --org is optional only because it can be inferred: the report is emailed on every scan, so the scan
- * needs an org. Inference uses the signed-in user's own memberships (GET /v1/orgs, personal org
- * excluded): exactly one org is used; none, several, or a failed read stops the scan loudly BEFORE any
- * scan work, naming the fix. It never guesses between orgs and never skips the email.
+ * needs an org. Order: --org; the org the login was authorized for; the `mnemom org use` default; the
+ * signed-in user's single non-personal membership (GET /v1/orgs); a terminal picker over several; else it
+ * stops loudly BEFORE any scan work, naming each org beside its id. It never guesses between orgs and
+ * never skips the email.
  */
 export declare function resolveScanOrg(o: ScanCommandOptions): Promise<string>;
 export declare const INVALID_ORG_MSG = "--org must be an org id like org-1a2b3c4d.";

package/dist/commands/scan.js

@@ -12,10 +12,12 @@ import { isSpendTiersEnabled, NOT_ENABLED_MSG, parseMonthlySpendUsd, selectSpend
 import { ADMIN_KEY_ENV, AnthropicUsageError, fetchMeasuredUsage, isAdminKeyShape, usageFailureText, } from "../lib/scan/spend/anthropic-usage.js";
 import { getAuthInfo } from "../lib/auth.js";
 import { listMyOrgs } from "../lib/api.js";
+import { getActiveOrg } from "../lib/cli-config.js";
 import { fetchRecordTotals, isOrgId, } from "../lib/scan/record.js";
 import { modelledSpend } from "../lib/scan/cost-per-pr.js";
 import { RECORD_NO_ORG_NOTE, renderRecordSection } from "../lib/scan/report.js";
 import { buildEmailBody, buildEmailReport, DRY_RUN_MSG, UNAVAILABLE_MSG, failureMessage, ReportEmailError, sendReportEmail, } from "../lib/scan/report-email.js";
+import { pickRepos, REPO_PICKER_NO_TERMINAL_HINT, } from "../lib/scan/repo-picker.js";
 import { buildSharePayload, parseShareLevel, promptShareLevel, } from "../lib/scan/share.js";
 /** Parses repeated/comma-separated `--repo owner/name`. Returns null on any invalid slug. */
 export function parseRepoFlags(raw) {
@@ -126,9 +128,10 @@ export async function resolveMeasuredUsage(o, period) {
 }
 /**
  * --org is optional only because it can be inferred: the report is emailed on every scan, so the scan
- * needs an org. Inference uses the signed-in user's own memberships (GET /v1/orgs, personal org
- * excluded): exactly one org is used; none, several, or a failed read stops the scan loudly BEFORE any
- * scan work, naming the fix. It never guesses between orgs and never skips the email.
+ * needs an org. Order: --org; the org the login was authorized for; the `mnemom org use` default; the
+ * signed-in user's single non-personal membership (GET /v1/orgs); a terminal picker over several; else it
+ * stops loudly BEFORE any scan work, naming each org beside its id. It never guesses between orgs and
+ * never skips the email.
  */
 export async function resolveScanOrg(o) {
     if (o.org !== undefined) {
@@ -136,6 +139,18 @@ export async function resolveScanOrg(o) {
             throw new Error(INVALID_ORG_MSG);
         return o.org;
     }
+    // 2. The org this login was authorized for, when the token or session carries one.
+    const authorized = o.authorizedOrg?.();
+    if (authorized !== undefined) {
+        if (!isOrgId(authorized))
+            throw new Error(INVALID_ORG_MSG);
+        return authorized;
+    }
+    // 3. The default set with `mnemom org use <slug>` (a malformed stored id is ignored, not trusted).
+    const active = (o.activeOrg ?? getActiveOrg)()?.org_id;
+    if (active !== undefined && isOrgId(active))
+        return active;
+    // 4-6. Memberships: a single one, else a terminal picker, else fail closed.
     let orgs;
     try {
         orgs = (await (o.listOrgs ?? listMyOrgs)()).filter((x) => !x.is_personal);
@@ -147,8 +162,20 @@ export async function resolveScanOrg(o) {
         return orgs[0].org_id;
     if (orgs.length === 0)
         throw new Error("You belong to no organization, so the report has nowhere to be emailed from. Pass --org <org_id>.");
-    throw new Error(`You belong to ${orgs.length} organizations; pass --org <org_id> (${orgs.map((x) => x.org_id).join(", ")}).`);
+    // Several orgs: ids alone mean nothing, so show each name beside its id. A terminal picks one; anything
+    // else fails closed (never a guess) with the same labels in the message.
+    const labels = orgs.map(orgLabel);
+    if (o.isTty ?? process.stdin.isTTY) {
+        const chosen = await askSelect("Which organization should the report be emailed for?", labels);
+        const hit = orgs.find((x, i) => labels[i] === chosen);
+        if (hit && isOrgId(hit.org_id))
+            return hit.org_id;
+        throw new Error("No organization selected. Pass --org <org_id>.");
+    }
+    throw new Error(`You belong to ${orgs.length} organizations; pass --org <org_id> (${labels.join(", ")}).`);
 }
+/** "Name (org-id)", or just the id when the org has no usable name. */
+const orgLabel = (x) => typeof x.name === "string" && x.name.trim() !== "" ? `${x.name.trim()} (${x.org_id})` : x.org_id;
 export const INVALID_ORG_MSG = "--org must be an org id like org-1a2b3c4d.";
 /**
  * The Record read for the preview: null when the flag gate is off (no read, no output, as before).
@@ -168,23 +195,34 @@ export async function scanCommand(o) {
     if (o.share !== undefined && parseShareLevel(o.share) === null) {
         throw new Error("--share must be one of: summary, full, none");
     }
-    if (o.repos.length === 0)
-        throw new Error("--repo owner/name is required (repeatable)");
+    const noRepoFlag = o.repos.length === 0;
+    // No --repo: on a terminal pick from the repos this GitHub login can read; otherwise the error stays, with a hint.
+    if (noRepoFlag && !(o.isTty ?? process.stdin.isTTY))
+        throw new Error(`--repo owner/name is required (repeatable). ${REPO_PICKER_NO_TERMINAL_HINT}`);
     // The report is emailed on every scan, so resolve the org before any scan work; failure is loud.
     const emailOrg = await resolveScanOrg(o);
     if (o.ctoEmail !== undefined && !isEmail(o.ctoEmail))
         throw new Error("--cto-email must be a valid email address");
+    const getCredential = async () => {
+        const c = o.credential ?? (await resolveCredential().catch(() => null));
+        if (!c)
+            throw new Error(failureText("credential"));
+        return c;
+    };
+    // Asked before the spend prompts so the repo comes first; the credential is reused for the scan.
+    const pickedCredential = noRepoFlag ? await getCredential() : null;
+    const repos = pickedCredential
+        ? await pickRepos(pickedCredential, { isTty: true, deps: o.repoListDeps })
+        : o.repos;
     const selfReported = await resolveSelfReportedSpend(o);
     const now = o.now ?? Date.now;
     const end = new Date(now()).toISOString().slice(0, 10);
     const period = o.period ?? { start: end, end };
     const measured = await resolveMeasuredUsage(o, period);
-    const credential = o.credential ?? (await resolveCredential().catch(() => null));
-    if (!credential)
-        throw new Error(failureText("credential"));
+    const credential = pickedCredential ?? (await getCredential());
     // Before the local scan: a refused credential fails closed without spending the GitHub reads.
     const record = await resolveRecordOutcome(o);
-    const outcome = await runLocalScan({ credential, now, ...o.deps }, { repos: o.repos, period });
+    const outcome = await runLocalScan({ credential, now, ...o.deps }, { repos, period });
     if (outcome.status === "withheld")
         throw new Error(`Scan withheld: ${failureText(outcome.reason)}`);
     const { result } = outcome;

package/dist/host/commands.js

@@ -8,6 +8,7 @@ import * as os from "node:os";
 import { CLI_VERSION } from "../version.js";
 import { getApiUrl } from "../lib/config.js";
 import { getAccessToken } from "../lib/auth.js";
+import { getActiveOrg } from "../lib/cli-config.js";
 import { resolveBootId, defaultBootIdDeps } from "./bootid.js";
 import { realLaunchctl } from "./launchd.js";
 import { ownerApi, parseExecutorList } from "./owner.js";
@@ -37,6 +38,7 @@ function verbIo(json) {
         bootId: () => resolveBootId({ ...defaultBootIdDeps(), env }).bootId,
         programArguments: () => [...cliExec(), "agent", "host", "run"],
         claudeBin: () => resolveClaudeBin(env),
+        activeOrg: () => getActiveOrg()?.org_id ?? null,
     };
 }
 async function guarded(json, fn) {
@@ -66,7 +68,8 @@ export function registerHostCommands(agent, hidden) {
     host
         .command("enroll")
         .description("Enroll this machine as an executor (device step); `install` does this when needed")
-        .action(async () => guarded(false, hostEnroll));
+        .option("--org <org_id>", "Join this organization (you must be a member); defaults to the active org, else your personal org")
+        .action(async (o) => guarded(false, (io) => hostEnroll(io, { org: o.org })));
     host
         .command("renew")
         .description("Renew this machine's executor grant (device step)")

package/dist/host/owner.d.ts

@@ -11,6 +11,8 @@ export interface OwnerApi {
         runtime: string;
         contract_version: string;
         machine_label?: string;
+        /** Ruling 34.03.4: the org this host joins; the api checks membership. */
+        org_id?: string;
     }): Promise<OwnerHttp>;
     enrollPoll(pollSecret: string, approvalId: string | null): Promise<OwnerHttp>;
     list(): Promise<OwnerHttp>;

package/dist/host/verbs.d.ts

@@ -20,6 +20,8 @@ export interface VerbIo {
     readonly pollSleep?: (ms: number) => Promise<void>;
     /** Takes the enrollment lock; acquireHostLock (macOS flock) when absent. */
     readonly acquireLock?: (lockFile: string) => LockResult;
+    /** The CLI's active org id (`mnemom org use`), or null with none set; never read when absent. */
+    readonly activeOrg?: () => string | null;
 }
 /** Fresh-invocation gate for every host verb (C12-R25): exit 2 with the gated text, nothing else. */
 export declare function freshGate(io: VerbIo): number | null;
@@ -40,13 +42,26 @@ export declare function executorLiveness(io: VerbIo, executorId: string): Promis
 export declare function printRiskLine(io: VerbIo): void;
 /** "<org name> (<org_id>)", or the bare id when the api sent no name. */
 export declare function joinTarget(orgId: string, orgName: string | null): string;
+/**
+ * The org a start names (ruling 34.03.4): `--org`, else the active org, else none, so the api
+ * keeps its fallback (the token's org, else the personal org).
+ */
+export declare function enrollOrg(io: VerbIo, opts: {
+    org?: string;
+}): {
+    orgId: string;
+    from: "flag" | "active";
+} | null;
 /** The device step: start, show the code, poll, write the state file. Returns an exit code. */
 export declare function enrollDevice(io: VerbIo, opts?: {
     label?: string;
+    org?: string;
 }): Promise<number>;
 /** Write the plist and (re)load the job. */
 export declare function writeAndLoad(io: VerbIo): Promise<number>;
 export declare function hostInstall(io: VerbIo): Promise<number>;
-export declare function hostEnroll(io: VerbIo): Promise<number>;
+export declare function hostEnroll(io: VerbIo, opts?: {
+    org?: string;
+}): Promise<number>;
 export declare function hostRenew(io: VerbIo): Promise<number>;
 export declare function hostUninstall(io: VerbIo): Promise<number>;

package/dist/host/verbs.js

@@ -23,6 +23,7 @@ import { renderPlist } from "./plist.js";
 import { loadJob, unloadJob } from "./launchd.js";
 import { classifyPoll, parseEnrollStart, parseExecutorList, EXECUTOR_CONTRACT, } from "./owner.js";
 import { readRuntime } from "./runtime.js";
+import { CODE } from "./s1-names.js";
 import { RENEW_FIX, GRANT_EXPIRED_LINE } from "./grant.js";
 export const INSTALL_FIX = "`mnemom agent host install`";
 export const UNINSTALL_SESSION_LINE = (name) => `${name}: they stop restarting until ${INSTALL_FIX}`;
@@ -63,6 +64,22 @@ export function printRiskLine(io) {
 export function joinTarget(orgId, orgName) {
     return orgName ? `${orgName} (${orgId})` : orgId;
 }
+/**
+ * The org a start names (ruling 34.03.4): `--org`, else the active org, else none, so the api
+ * keeps its fallback (the token's org, else the personal org).
+ */
+export function enrollOrg(io, opts) {
+    if (opts.org)
+        return { orgId: opts.org, from: "flag" };
+    const active = io.activeOrg?.() ?? null;
+    return active ? { orgId: active, from: "active" } : null;
+}
+/** The api's refusal code from an error body, or null. */
+function errorCode(body) {
+    const e = body && typeof body === "object" ? body.error : undefined;
+    const code = e && typeof e === "object" ? e.code : undefined;
+    return typeof code === "string" ? code : null;
+}
 /** The device step: start, show the code, poll, write the state file. Returns an exit code. */
 export async function enrollDevice(io, opts = {}) {
     const { paths } = ctx(io);
@@ -71,16 +88,41 @@ export async function enrollDevice(io, opts = {}) {
         io.err(`mnemom agent host: an enrollment is already in progress here (${lock.reason}): wait for it, then ${INSTALL_FIX}`);
         return 1;
     }
+    let org = enrollOrg(io, opts);
     try {
-        const st = await io.owner.enrollStart({
+        const startWith = (o) => io.owner.enrollStart({
             kind: "host",
             runtime: "node",
             contract_version: EXECUTOR_CONTRACT,
             ...(opts.label ? { machine_label: opts.label } : {}),
+            ...(o ? { org_id: o.orgId } : {}),
         });
+        let st = await startWith(org);
+        // An api from before 34.03.4 refuses org_id on a host start with its plain 400 invalid_scope
+        // (34.03.2 (1); mnemom-api enroll.ts "org_id is only accepted with scope org"; recorded beside
+        // exec_enroll in S1 codes.ts). An org taken from the active org then falls back to the start this
+        // CLI made before; an explicit --org cannot.
+        if (org && st.status === 400 && errorCode(st.body) === "invalid_scope") {
+            if (org.from === "flag") {
+                io.err(`mnemom agent host: this Mnemom server cannot enroll a machine into ${org.orgId} yet.`);
+                io.err("fix: `mnemom agent host enroll` without --org (joins your personal org)");
+                return 1;
+            }
+            io.err(`mnemom agent host: this Mnemom server cannot enroll a machine into your active org ${org.orgId} yet; it joins your personal org.`);
+            org = null;
+            st = await startWith(null);
+        }
         const start = st.status === 202 || st.status === 200 || st.status === 201
             ? parseEnrollStart(st.body)
             : null;
+        if (!start && org && errorCode(st.body) === CODE.durable_approval_not_eligible) {
+            // 34.03.4: only a member of the org may enroll a machine into it.
+            io.err(`mnemom agent host: you are not a member of ${org.orgId}, so this machine cannot join it.`);
+            io.err(org.from === "flag"
+                ? "fix: `mnemom org list` shows the organizations you belong to"
+                : "fix: `mnemom org use --clear`, then `mnemom agent host enroll` (joins your personal org)");
+            return 1;
+        }
         if (!start) {
             const code = st.body && typeof st.body === "object"
                 ? JSON.stringify(st.body).slice(0, 300)
@@ -211,8 +253,8 @@ export async function hostInstall(io) {
         io.out(reload ? "Host daemon reloaded on this machine's enrollment." : "Host daemon installed.");
     return 0;
 }
-export async function hostEnroll(io) {
-    return enrollDevice(io);
+export async function hostEnroll(io, opts = {}) {
+    return enrollDevice(io, opts);
 }
 export async function hostRenew(io) {
     const { paths } = ctx(io);

package/dist/index.js

@@ -2384,7 +2384,7 @@ program
 program
     .command("scan")
     .description("Read-only local scan of GitHub PR metadata; the report is emailed to you every time (counts only, no repo names) and Mnemom keeps nothing at share level none")
-    .option("--repo <owner/name...>", "Repo to scan (repeatable or comma-separated)")
+    .option("--repo <owner/name...>", "Repo to scan (repeatable or comma-separated; omit on a terminal to pick from your repos)")
     .option("--start <YYYY-MM-DD>", "Period start (default: today)")
     .option("--end <YYYY-MM-DD>", "Period end (default: today)")
     .option("--share <level>", "summary | full | none (default: full when asked; none when not interactive)")
@@ -2395,7 +2395,8 @@ program
     .option("--org <org_id>", "Your org id; the report is emailed to you for this org (default: your only organization, else the scan stops and asks). Also selects the Record totals preview (needs MNEMOM_ORG_SCAN_MODE=true)")
     .action(async (options) => {
     try {
-        const repos = parseRepoFlags(options.repo);
+        // Omitted --repo is allowed here: scanCommand picks from your repos on a terminal, else stops with a hint.
+        const repos = options.repo === undefined ? [] : parseRepoFlags(options.repo);
         if (!repos)
             throw new Error("--repo owner/name is required (repeatable)");
         const today = new Date().toISOString().slice(0, 10);

package/dist/lib/config.d.ts

@@ -42,6 +42,13 @@ export declare function setRing(ring: CellRing | undefined): void;
 export declare function getRing(): CellRing | undefined;
 /** Override the active API base for this process (clears on undefined/empty). */
 export declare function setApiUrlOverride(url: string | undefined): void;
+/**
+ * True when the API is not production but the gateway is the production one. A lease key minted
+ * by a non-production cell's API means nothing to the production gateway, which answers every
+ * model call 401 and still receives the key (door2-path run 41783208169), so `agent run` refuses
+ * this pairing. A base that does not parse decides nothing. Pure.
+ */
+export declare function gatewayRingMismatch(apiUrl: string, gatewayUrl: string): boolean;
 export declare function getApiUrl(): string;
 export declare function getGatewayUrl(): string;
 export declare function getWebsiteUrl(): string;

package/dist/lib/config.js

@@ -113,6 +113,27 @@ function ringUrls() {
     const ring = getRing();
     return ring ? RING_URLS[ring] : undefined;
 }
+function originOf(url) {
+    try {
+        return new URL(url).origin.toLowerCase();
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * True when the API is not production but the gateway is the production one. A lease key minted
+ * by a non-production cell's API means nothing to the production gateway, which answers every
+ * model call 401 and still receives the key (door2-path run 41783208169), so `agent run` refuses
+ * this pairing. A base that does not parse decides nothing. Pure.
+ */
+export function gatewayRingMismatch(apiUrl, gatewayUrl) {
+    const api = originOf(apiUrl);
+    const gateway = originOf(gatewayUrl);
+    if (api === null || gateway === null)
+        return false;
+    return api !== originOf(API_URLS.production) && gateway === originOf(GATEWAY_URLS.production);
+}
 export function getApiUrl() {
     return (apiUrlOverride ?? envBase("MNEMOM_API_URL") ?? ringUrls()?.api ?? API_URLS[getEnvironment()]);
 }

package/dist/lib/scan/pr-source.js

@@ -31,6 +31,8 @@ const ALLOWED_PATHS = [
     new RegExp(`^/repos/${SLUG}/pulls\\?state=closed&sort=updated&direction=desc&per_page=\\d{1,3}&page=\\d{1,4}$`),
     new RegExp(`^/repos/${SLUG}/pulls/\\d{1,9}$`),
     new RegExp(`^/repos/${SLUG}/commits/[0-9a-f]{40}/check-runs\\?per_page=100$`),
+    // The repo picker's one list read (MNE-9643): the repos this login can read, newest push first.
+    /^\/user\/repos\?sort=pushed&direction=desc&per_page=\d{1,3}$/,
 ];
 export function isAllowedScanPath(path) {
     return ALLOWED_PATHS.some((re) => re.test(path));

package/dist/lib/scan/repo-picker.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Repo picker for `mnemom scan` when --repo is omitted on a terminal (MNE-9643). Read-only: one GET of
+ * the repos the signed-in GitHub account can read, through the same credential seam the scan uses.
+ * Only `full_name` is kept; descriptions, owners' logins beyond the slug, URLs and the token never leave
+ * this module. Failures throw fixed text (never a GitHub body, header or URL). Prompt style and fail-closed
+ * handling follow promptShareLevel in ./share.ts: no terminal, no answer, or a bad answer selects nothing.
+ */
+import { askMultiSelect } from "../prompt.js";
+import { type GitHubCredential } from "./credential.js";
+/** Most repos listed: the most recently pushed, so the list stays pickable. `--repo` names any other. */
+export declare const REPO_PICKER_LIMIT = 30;
+/** The only path the picker may read. */
+export declare const REPO_LIST_PATH = "/user/repos?sort=pushed&direction=desc&per_page=30";
+export declare const REPO_PICKER_NO_TERMINAL_HINT = "Pass --repo owner/name (repeatable), or run in a terminal to pick from your repos.";
+export declare const REPO_LIST_FAILED_MSG = "Could not list your GitHub repos. Pass --repo owner/name, or check `gh auth status`.";
+export declare const NO_REPOS_MSG = "No GitHub repos are readable by this account. Pass --repo owner/name.";
+export declare const NO_REPO_SELECTED_MSG = "No repo selected. Pass --repo owner/name, or choose at least one number from the list.";
+export interface RepoListDeps {
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+}
+/** GET-only read of the repos the credential can see. Returns valid slugs only, newest push first. */
+export declare function listReadableRepos(credential: GitHubCredential, deps?: RepoListDeps): Promise<string[]>;
+/**
+ * Lists the readable repos and asks which to scan (comma-separated numbers, as the other multi-select
+ * prompts do). Throws fixed text when there is no terminal, nothing is listed, or nothing valid is chosen.
+ */
+export declare function pickRepos(credential: GitHubCredential, o: {
+    isTty: boolean;
+    deps?: RepoListDeps;
+    ask?: typeof askMultiSelect;
+}): Promise<string[]>;

package/dist/lib/scan/repo-picker.js

@@ -0,0 +1,80 @@
+/**
+ * Repo picker for `mnemom scan` when --repo is omitted on a terminal (MNE-9643). Read-only: one GET of
+ * the repos the signed-in GitHub account can read, through the same credential seam the scan uses.
+ * Only `full_name` is kept; descriptions, owners' logins beyond the slug, URLs and the token never leave
+ * this module. Failures throw fixed text (never a GitHub body, header or URL). Prompt style and fail-closed
+ * handling follow promptShareLevel in ./share.ts: no terminal, no answer, or a bad answer selects nothing.
+ */
+import { askMultiSelect } from "../prompt.js";
+import { GITHUB_API, isAllowedScanPath } from "./pr-source.js";
+import { assertReadOnlyCredential, isValidRepoSlug } from "./credential.js";
+/** Most repos listed: the most recently pushed, so the list stays pickable. `--repo` names any other. */
+export const REPO_PICKER_LIMIT = 30;
+/** The only path the picker may read. */
+export const REPO_LIST_PATH = `/user/repos?sort=pushed&direction=desc&per_page=${REPO_PICKER_LIMIT}`;
+export const REPO_PICKER_NO_TERMINAL_HINT = "Pass --repo owner/name (repeatable), or run in a terminal to pick from your repos.";
+export const REPO_LIST_FAILED_MSG = "Could not list your GitHub repos. Pass --repo owner/name, or check `gh auth status`.";
+export const NO_REPOS_MSG = "No GitHub repos are readable by this account. Pass --repo owner/name.";
+export const NO_REPO_SELECTED_MSG = "No repo selected. Pass --repo owner/name, or choose at least one number from the list.";
+/** GET-only read of the repos the credential can see. Returns valid slugs only, newest push first. */
+export async function listReadableRepos(credential, deps = {}) {
+    if (!isAllowedScanPath(REPO_LIST_PATH))
+        throw new Error(REPO_LIST_FAILED_MSG);
+    // Same order as runLocalScan: a credential GitHub granted more than read is refused before any read.
+    await assertReadOnlyCredential(credential).catch(() => {
+        throw new Error(REPO_LIST_FAILED_MSG);
+    });
+    const doFetch = deps.fetchImpl ?? fetch;
+    let res;
+    try {
+        // User-level read: there is no single repo to scope to (the gh-login credential ignores the argument).
+        const bearer = await credential.tokenFor("");
+        res = await doFetch(`${GITHUB_API}${REPO_LIST_PATH}`, {
+            method: "GET",
+            headers: {
+                accept: "application/vnd.github+json",
+                "x-github-api-version": "2022-11-28",
+                "user-agent": "mnemom-cli-scan/1",
+                authorization: `Bearer ${bearer}`,
+            },
+            redirect: "error",
+            signal: AbortSignal.timeout(deps.timeoutMs ?? 10_000),
+        });
+    }
+    catch {
+        throw new Error(REPO_LIST_FAILED_MSG);
+    }
+    if (!res.ok) {
+        await res.body?.cancel().catch(() => { });
+        throw new Error(REPO_LIST_FAILED_MSG);
+    }
+    let json;
+    try {
+        json = await res.json();
+    }
+    catch {
+        throw new Error(REPO_LIST_FAILED_MSG);
+    }
+    if (!Array.isArray(json))
+        throw new Error(REPO_LIST_FAILED_MSG);
+    const slugs = json
+        .map((r) => (r && typeof r === "object" ? r.full_name : undefined))
+        .filter(isValidRepoSlug);
+    return [...new Set(slugs)].slice(0, REPO_PICKER_LIMIT);
+}
+/**
+ * Lists the readable repos and asks which to scan (comma-separated numbers, as the other multi-select
+ * prompts do). Throws fixed text when there is no terminal, nothing is listed, or nothing valid is chosen.
+ */
+export async function pickRepos(credential, o) {
+    if (!o.isTty)
+        throw new Error(`--repo owner/name is required (repeatable). ${REPO_PICKER_NO_TERMINAL_HINT}`);
+    const repos = await listReadableRepos(credential, o.deps);
+    if (repos.length === 0)
+        throw new Error(NO_REPOS_MSG);
+    const chosen = await (o.ask ?? askMultiSelect)("Which repos should be scanned (read-only)?", repos);
+    const picked = chosen.filter((c) => repos.includes(c));
+    if (picked.length === 0)
+        throw new Error(NO_REPO_SELECTED_MSG);
+    return picked;
+}

package/dist/vendor/durable-contract/index.js

@@ -1196,7 +1196,10 @@ var DURABLE_CODES = {
   // ---- api executor enrollment start, POST ROUTES.exec_enroll (C04-R02, R03; wave-0 fix 3b) ----
   // Names kept verbatim from C04-R03. A machine principal keeps 403 machine_principal_refused
   // (C04-R02); a non-starter approver gets durable_approval_not_eligible (ruling 1.13). Device-poll
-  // errors are not codes here: see ENROLL_POLL_ERRORS.
+  // errors are not codes here: see ENROLL_POLL_ERRORS. Ruling 34.03.4: a host start naming an org_id
+  // the caller is not a member of is also durable_approval_not_eligible (403, no approval row). A
+  // malformed or refused org_id is the api's plain 400 invalid_scope, which is not a durable code;
+  // an api from before 34.03.4 answers it to any org_id on a host start (34.03.2 (1)).
   /** The caller lacks the entitlement durable.locked. */
   not_entitled: { status: 403, surfaces: ["api"], fields: [] },
   /** The declared kind is not in durable.executors (M1 allows 'host' only). */
@@ -1643,8 +1646,8 @@ var M1_CLI_SURFACE = Object.freeze([
   entry(["agent", "done"], ["--json"]),
   // BACKBONE C2 (`mnemom agent host` replaces `mnemom host`, amendment 2; design-v3 row 7).
   entry(["agent", "host"]),
-  // BACKBONE C2 enroll (device step).
-  entry(["agent", "host", "enroll"]),
+  // BACKBONE C2 enroll (device step); --org: ruling 34.03.4 (a host joins an org its user belongs to).
+  entry(["agent", "host", "enroll"], ["--org"]),
   // BACKBONE C2 install/status/uninstall; --json: C04 (`mnemom agent host install --json`),
   // ruling 32.31.
   entry(["agent", "host", "install"], ["--json"]),

package/dist/vendor/shared/durable-contract/cli-surface.js

@@ -36,8 +36,8 @@ export const M1_CLI_SURFACE = Object.freeze([
     entry(["agent", "done"], ["--json"]),
     // BACKBONE C2 (`mnemom agent host` replaces `mnemom host`, amendment 2; design-v3 row 7).
     entry(["agent", "host"]),
-    // BACKBONE C2 enroll (device step).
-    entry(["agent", "host", "enroll"]),
+    // BACKBONE C2 enroll (device step); --org: ruling 34.03.4 (a host joins an org its user belongs to).
+    entry(["agent", "host", "enroll"], ["--org"]),
     // BACKBONE C2 install/status/uninstall; --json: C04 (`mnemom agent host install --json`),
     // ruling 32.31.
     entry(["agent", "host", "install"], ["--json"]),

package/dist/vendor/shared/durable-contract/codes.js

@@ -157,7 +157,10 @@ export const DURABLE_CODES = {
     // ---- api executor enrollment start, POST ROUTES.exec_enroll (C04-R02, R03; wave-0 fix 3b) ----
     // Names kept verbatim from C04-R03. A machine principal keeps 403 machine_principal_refused
     // (C04-R02); a non-starter approver gets durable_approval_not_eligible (ruling 1.13). Device-poll
-    // errors are not codes here: see ENROLL_POLL_ERRORS.
+    // errors are not codes here: see ENROLL_POLL_ERRORS. Ruling 34.03.4: a host start naming an org_id
+    // the caller is not a member of is also durable_approval_not_eligible (403, no approval row). A
+    // malformed or refused org_id is the api's plain 400 invalid_scope, which is not a durable code;
+    // an api from before 34.03.4 answers it to any org_id on a host start (34.03.2 (1)).
     /** The caller lacks the entitlement durable.locked. */
     not_entitled: { status: 403, surfaces: ["api"], fields: [] },
     /** The declared kind is not in durable.executors (M1 allows 'host' only). */