@mnemom/mnemom 0.17.36 → 0.17.37

package/dist/host/commands.js

@@ -8,6 +8,7 @@ import * as os from "node:os";
 import { CLI_VERSION } from "../version.js";
 import { getApiUrl } from "../lib/config.js";
 import { getAccessToken } from "../lib/auth.js";
+import { getActiveOrg } from "../lib/cli-config.js";
 import { resolveBootId, defaultBootIdDeps } from "./bootid.js";
 import { realLaunchctl } from "./launchd.js";
 import { ownerApi, parseExecutorList } from "./owner.js";
@@ -37,6 +38,7 @@ function verbIo(json) {
         bootId: () => resolveBootId({ ...defaultBootIdDeps(), env }).bootId,
         programArguments: () => [...cliExec(), "agent", "host", "run"],
         claudeBin: () => resolveClaudeBin(env),
+        activeOrg: () => getActiveOrg()?.org_id ?? null,
     };
 }
 async function guarded(json, fn) {
@@ -66,7 +68,8 @@ export function registerHostCommands(agent, hidden) {
     host
         .command("enroll")
         .description("Enroll this machine as an executor (device step); `install` does this when needed")
-        .action(async () => guarded(false, hostEnroll));
+        .option("--org <org_id>", "Join this organization (you must be a member); defaults to the active org, else your personal org")
+        .action(async (o) => guarded(false, (io) => hostEnroll(io, { org: o.org })));
     host
         .command("renew")
         .description("Renew this machine's executor grant (device step)")

package/dist/host/owner.d.ts

@@ -11,6 +11,8 @@ export interface OwnerApi {
         runtime: string;
         contract_version: string;
         machine_label?: string;
+        /** Ruling 34.03.4: the org this host joins; the api checks membership. */
+        org_id?: string;
     }): Promise<OwnerHttp>;
     enrollPoll(pollSecret: string, approvalId: string | null): Promise<OwnerHttp>;
     list(): Promise<OwnerHttp>;

package/dist/host/verbs.d.ts

@@ -20,6 +20,8 @@ export interface VerbIo {
     readonly pollSleep?: (ms: number) => Promise<void>;
     /** Takes the enrollment lock; acquireHostLock (macOS flock) when absent. */
     readonly acquireLock?: (lockFile: string) => LockResult;
+    /** The CLI's active org id (`mnemom org use`), or null with none set; never read when absent. */
+    readonly activeOrg?: () => string | null;
 }
 /** Fresh-invocation gate for every host verb (C12-R25): exit 2 with the gated text, nothing else. */
 export declare function freshGate(io: VerbIo): number | null;
@@ -40,13 +42,26 @@ export declare function executorLiveness(io: VerbIo, executorId: string): Promis
 export declare function printRiskLine(io: VerbIo): void;
 /** "<org name> (<org_id>)", or the bare id when the api sent no name. */
 export declare function joinTarget(orgId: string, orgName: string | null): string;
+/**
+ * The org a start names (ruling 34.03.4): `--org`, else the active org, else none, so the api
+ * keeps its fallback (the token's org, else the personal org).
+ */
+export declare function enrollOrg(io: VerbIo, opts: {
+    org?: string;
+}): {
+    orgId: string;
+    from: "flag" | "active";
+} | null;
 /** The device step: start, show the code, poll, write the state file. Returns an exit code. */
 export declare function enrollDevice(io: VerbIo, opts?: {
     label?: string;
+    org?: string;
 }): Promise<number>;
 /** Write the plist and (re)load the job. */
 export declare function writeAndLoad(io: VerbIo): Promise<number>;
 export declare function hostInstall(io: VerbIo): Promise<number>;
-export declare function hostEnroll(io: VerbIo): Promise<number>;
+export declare function hostEnroll(io: VerbIo, opts?: {
+    org?: string;
+}): Promise<number>;
 export declare function hostRenew(io: VerbIo): Promise<number>;
 export declare function hostUninstall(io: VerbIo): Promise<number>;

package/dist/host/verbs.js

@@ -23,6 +23,7 @@ import { renderPlist } from "./plist.js";
 import { loadJob, unloadJob } from "./launchd.js";
 import { classifyPoll, parseEnrollStart, parseExecutorList, EXECUTOR_CONTRACT, } from "./owner.js";
 import { readRuntime } from "./runtime.js";
+import { CODE } from "./s1-names.js";
 import { RENEW_FIX, GRANT_EXPIRED_LINE } from "./grant.js";
 export const INSTALL_FIX = "`mnemom agent host install`";
 export const UNINSTALL_SESSION_LINE = (name) => `${name}: they stop restarting until ${INSTALL_FIX}`;
@@ -63,6 +64,22 @@ export function printRiskLine(io) {
 export function joinTarget(orgId, orgName) {
     return orgName ? `${orgName} (${orgId})` : orgId;
 }
+/**
+ * The org a start names (ruling 34.03.4): `--org`, else the active org, else none, so the api
+ * keeps its fallback (the token's org, else the personal org).
+ */
+export function enrollOrg(io, opts) {
+    if (opts.org)
+        return { orgId: opts.org, from: "flag" };
+    const active = io.activeOrg?.() ?? null;
+    return active ? { orgId: active, from: "active" } : null;
+}
+/** The api's refusal code from an error body, or null. */
+function errorCode(body) {
+    const e = body && typeof body === "object" ? body.error : undefined;
+    const code = e && typeof e === "object" ? e.code : undefined;
+    return typeof code === "string" ? code : null;
+}
 /** The device step: start, show the code, poll, write the state file. Returns an exit code. */
 export async function enrollDevice(io, opts = {}) {
     const { paths } = ctx(io);
@@ -71,16 +88,41 @@ export async function enrollDevice(io, opts = {}) {
         io.err(`mnemom agent host: an enrollment is already in progress here (${lock.reason}): wait for it, then ${INSTALL_FIX}`);
         return 1;
     }
+    let org = enrollOrg(io, opts);
     try {
-        const st = await io.owner.enrollStart({
+        const startWith = (o) => io.owner.enrollStart({
             kind: "host",
             runtime: "node",
             contract_version: EXECUTOR_CONTRACT,
             ...(opts.label ? { machine_label: opts.label } : {}),
+            ...(o ? { org_id: o.orgId } : {}),
         });
+        let st = await startWith(org);
+        // An api from before 34.03.4 refuses org_id on a host start with its plain 400 invalid_scope
+        // (34.03.2 (1); mnemom-api enroll.ts "org_id is only accepted with scope org"; recorded beside
+        // exec_enroll in S1 codes.ts). An org taken from the active org then falls back to the start this
+        // CLI made before; an explicit --org cannot.
+        if (org && st.status === 400 && errorCode(st.body) === "invalid_scope") {
+            if (org.from === "flag") {
+                io.err(`mnemom agent host: this Mnemom server cannot enroll a machine into ${org.orgId} yet.`);
+                io.err("fix: `mnemom agent host enroll` without --org (joins your personal org)");
+                return 1;
+            }
+            io.err(`mnemom agent host: this Mnemom server cannot enroll a machine into your active org ${org.orgId} yet; it joins your personal org.`);
+            org = null;
+            st = await startWith(null);
+        }
         const start = st.status === 202 || st.status === 200 || st.status === 201
             ? parseEnrollStart(st.body)
             : null;
+        if (!start && org && errorCode(st.body) === CODE.durable_approval_not_eligible) {
+            // 34.03.4: only a member of the org may enroll a machine into it.
+            io.err(`mnemom agent host: you are not a member of ${org.orgId}, so this machine cannot join it.`);
+            io.err(org.from === "flag"
+                ? "fix: `mnemom org list` shows the organizations you belong to"
+                : "fix: `mnemom org use --clear`, then `mnemom agent host enroll` (joins your personal org)");
+            return 1;
+        }
         if (!start) {
             const code = st.body && typeof st.body === "object"
                 ? JSON.stringify(st.body).slice(0, 300)
@@ -211,8 +253,8 @@ export async function hostInstall(io) {
         io.out(reload ? "Host daemon reloaded on this machine's enrollment." : "Host daemon installed.");
     return 0;
 }
-export async function hostEnroll(io) {
-    return enrollDevice(io);
+export async function hostEnroll(io, opts = {}) {
+    return enrollDevice(io, opts);
 }
 export async function hostRenew(io) {
     const { paths } = ctx(io);

package/dist/vendor/durable-contract/index.js

@@ -1196,7 +1196,10 @@ var DURABLE_CODES = {
   // ---- api executor enrollment start, POST ROUTES.exec_enroll (C04-R02, R03; wave-0 fix 3b) ----
   // Names kept verbatim from C04-R03. A machine principal keeps 403 machine_principal_refused
   // (C04-R02); a non-starter approver gets durable_approval_not_eligible (ruling 1.13). Device-poll
-  // errors are not codes here: see ENROLL_POLL_ERRORS.
+  // errors are not codes here: see ENROLL_POLL_ERRORS. Ruling 34.03.4: a host start naming an org_id
+  // the caller is not a member of is also durable_approval_not_eligible (403, no approval row). A
+  // malformed or refused org_id is the api's plain 400 invalid_scope, which is not a durable code;
+  // an api from before 34.03.4 answers it to any org_id on a host start (34.03.2 (1)).
   /** The caller lacks the entitlement durable.locked. */
   not_entitled: { status: 403, surfaces: ["api"], fields: [] },
   /** The declared kind is not in durable.executors (M1 allows 'host' only). */
@@ -1643,8 +1646,8 @@ var M1_CLI_SURFACE = Object.freeze([
   entry(["agent", "done"], ["--json"]),
   // BACKBONE C2 (`mnemom agent host` replaces `mnemom host`, amendment 2; design-v3 row 7).
   entry(["agent", "host"]),
-  // BACKBONE C2 enroll (device step).
-  entry(["agent", "host", "enroll"]),
+  // BACKBONE C2 enroll (device step); --org: ruling 34.03.4 (a host joins an org its user belongs to).
+  entry(["agent", "host", "enroll"], ["--org"]),
   // BACKBONE C2 install/status/uninstall; --json: C04 (`mnemom agent host install --json`),
   // ruling 32.31.
   entry(["agent", "host", "install"], ["--json"]),

package/dist/vendor/shared/durable-contract/cli-surface.js

@@ -36,8 +36,8 @@ export const M1_CLI_SURFACE = Object.freeze([
     entry(["agent", "done"], ["--json"]),
     // BACKBONE C2 (`mnemom agent host` replaces `mnemom host`, amendment 2; design-v3 row 7).
     entry(["agent", "host"]),
-    // BACKBONE C2 enroll (device step).
-    entry(["agent", "host", "enroll"]),
+    // BACKBONE C2 enroll (device step); --org: ruling 34.03.4 (a host joins an org its user belongs to).
+    entry(["agent", "host", "enroll"], ["--org"]),
     // BACKBONE C2 install/status/uninstall; --json: C04 (`mnemom agent host install --json`),
     // ruling 32.31.
     entry(["agent", "host", "install"], ["--json"]),

package/dist/vendor/shared/durable-contract/codes.js

@@ -157,7 +157,10 @@ export const DURABLE_CODES = {
     // ---- api executor enrollment start, POST ROUTES.exec_enroll (C04-R02, R03; wave-0 fix 3b) ----
     // Names kept verbatim from C04-R03. A machine principal keeps 403 machine_principal_refused
     // (C04-R02); a non-starter approver gets durable_approval_not_eligible (ruling 1.13). Device-poll
-    // errors are not codes here: see ENROLL_POLL_ERRORS.
+    // errors are not codes here: see ENROLL_POLL_ERRORS. Ruling 34.03.4: a host start naming an org_id
+    // the caller is not a member of is also durable_approval_not_eligible (403, no approval row). A
+    // malformed or refused org_id is the api's plain 400 invalid_scope, which is not a durable code;
+    // an api from before 34.03.4 answers it to any org_id on a host start (34.03.2 (1)).
     /** The caller lacks the entitlement durable.locked. */
     not_entitled: { status: 403, surfaces: ["api"], fields: [] },
     /** The declared kind is not in durable.executors (M1 allows 'host' only). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemom/mnemom",
-  "version": "0.17.36",
+  "version": "0.17.37",
   "description": "Transparent AI agent tracing",
   "type": "module",
   "bin": {