@mnemom/mnemom 0.17.38 → 0.17.39-next.0

package/dist/commands/agent-setup.js

@@ -43,7 +43,7 @@ import { getApiUrl, getGatewayUrl, getWebsiteUrl, MNEMOM_DIR } from "../lib/conf
 import { fmt } from "../lib/format.js";
 import { askYesNo, isInteractive } from "../lib/prompt.js";
 import { malformedAgentIdMessage, parseAgentRef, resolveAnthropicDoor, resolveGatewayHost, sanitizeAgentName, singleCellError, } from "../lib/agent.js";
-import { readMnemomKey, resolveAgentAuth, resolveSubscriptionMnemomKey, sayRetiredConsoleNotice, } from "../lib/subscription-login.js";
+import { mnemomKeyRejectedFix, readMnemomKey, resolveAgentAuth, resolveSubscriptionMnemomKey, sayRetiredConsoleNotice, } from "../lib/subscription-login.js";
 import { configKeySpec, loadLauncherConfig, writeLauncherConfig } from "../lib/launcher-config.js";
 import { IdentityRouteMissingError, resolveServedIdentity, resolveServedIdentityDetail, } from "../lib/agent-identity-route.js";
 import { readConfirmedAgent, readServedAgent, servedFingerprint, writeConfirmedAgent, writeServedAgent, } from "../lib/served-agent-cache.js";
@@ -431,7 +431,7 @@ export async function ensureClaimedServedAgent(opts) {
     }
     catch (err) {
         if (err instanceof MnemomKeyRejectedError) {
-            say(fmt.warn("mnemom agent: the gateway rejected your stored Mnemom API key — launching without it (fix: `mnemom agent config` / re-run subscription setup, or unset MNEMOM_AGENT_MNEMOM_KEY)."));
+            say(fmt.warn(`mnemom agent: the gateway rejected your Mnemom API key — launching without it. ${mnemomKeyRejectedFix(getApiUrl(), process.env)}`));
             const retried = await ensureClaimedServedAgent({ ...opts, mnemomKey: undefined });
             return { ...retried, mnemomKeyRejected: true };
         }
@@ -560,6 +560,15 @@ async function resolveServedAgent(opts, fp) {
         if (opts.anthropicKey && opts.mnemomKey && isRejectedMnemomKey(err)) {
             throw new MnemomKeyRejectedError();
         }
+        // A subscription launch whose Mnemom key the gateway rejected (401, e.g. invalid_mnemom_key):
+        // most often a key saved for another cell. Name the cell and the exact fix.
+        if (!opts.anthropicKey &&
+            opts.mnemomKey &&
+            err instanceof MnemomApiError &&
+            err.effectiveStatus === 401) {
+            throw new UnclaimedAgentError(`mnemom agent: the gateway rejected the Mnemom API key this launch sent (${err.code ?? "401"}), so it can't confirm '${slug}' is claimed. ` +
+                mnemomKeyRejectedFix(getApiUrl(), process.env));
+        }
         if (err instanceof IdentityRouteMissingError) {
             throw new UnclaimedAgentError(`mnemom agent: ${err.message}, so it can't confirm '${slug}' is claimed. ` +
                 "Launch with an Anthropic API key instead (`--auth api-key`), or try again once the gateway is updated.");
@@ -736,7 +745,7 @@ function pinRefusal(err, pin, slug) {
     }
     if (code === "mnemom_api_key_required" || status === 401) {
         return (`${head}: a pin needs a valid Mnemom API key (${code ?? "401"}). ` +
-            "Set MNEMOM_AGENT_MNEMOM_KEY, or delete mnemom_api_key from ~/.mnemom/launcher.json so the next pinned launch mints a fresh one.");
+            mnemomKeyRejectedFix(getApiUrl(), process.env));
     }
     return `${head} (${describeApiError(err)}). A pinned launch never falls back to another agent.`;
 }

package/dist/commands/agent.d.ts

@@ -265,7 +265,7 @@ export declare function recordSessionLaunch(ctx: {
     compactAt: number | null;
 }): void;
 /** The real I/O behind a subscription launch's Mnemom key (lib/subscription-login.ts). */
-export declare function defaultMnemomKeyDeps(storePath?: string): MnemomKeyDeps;
+export declare function defaultMnemomKeyDeps(storePath?: string, apiUrl?: string): MnemomKeyDeps;
 /**
  * Resolve the Anthropic key with NO 1Password dependency (built for external
  * customer adoption), in order:

package/dist/commands/agent.js

@@ -41,7 +41,7 @@ import { createApiKey } from "../lib/api.js";
 import { recordOrgFor } from "../lib/record-org.js";
 import { httpDoorAllowed } from "../durable/test-mode.mjs";
 import { defaultSessionKeyDeps, mintSessionGatewayKey, revokeSessionGatewayKey, startSessionKeyRenewal, } from "../lib/session-key.js";
-import { MNEMOM_KEY_STORE_FIELD, resolveAgentAuth, sayRetiredConsoleNotice, readMnemomKey, resolveSubscriptionMnemomKey, launchChildEnv, subscriptionShape, } from "../lib/subscription-login.js";
+import { mnemomKeyStorePatch, storedMnemomKeyForCell, resolveAgentAuth, sayRetiredConsoleNotice, readMnemomKey, resolveSubscriptionMnemomKey, launchChildEnv, subscriptionShape, } from "../lib/subscription-login.js";
 import { clearLaunching, liveLaunchingDeps, markLaunching } from "../lib/durable/launching.js";
 import { LEDGER_FILE, appendSessionRecord, findResumeCandidate, readSessionRecords, resolveRetentionDays, resumedContextProfile, toLedgerContract, } from "../lib/agent-ledger.js";
 import { isLoggedIn } from "../lib/auth.js";
@@ -55,7 +55,7 @@ import { authConfigured, chooseAuth, detectClaudeLogin, readClaudeLoginState, }
 import { goalAlignmentLine, resolveSessionSetup } from "./agent-session.js";
 import { defaultAgentSlug, ensureClaimedServedAgent, ensureSessionAndBalance, isQuietPreambleExit, readComposedProtection, resolveDefaultSlug, resolvePinnedAgent, resolvePreflightedAccount, } from "./agent-setup.js";
 import { assembleContract, buildGoalModeHeader, buildCustomHeaders, buildHandoffMcpConfigJson, buildSessionConfig, buildSessionConfigB64, assertCompactAtCompatible, assertOffProfileCompatible, compactAtWindowWarning, describeCompactAt, launchWindow, resolveCompactAt, applyGatewayHintHeaders, resolveCompactionIntercept, resolveContextHandoff, resolveContextProfile, resolveHandoffGatewayHost, resolveUsageSavings, HANDOFF_RC_KEY_ENV_NAME, HANDOFF_RC_MNEMOM_KEY_ENV_NAME, malformedAgentIdMessage, parseAgentRef, isProdGateway, launchPreferenceExplicit, launchPreflighted, remoteControlAllowed, applyToolSearchDefault, DISABLE_1M_ENV, readCcSettings, passthroughModel, resolveWindowModel, resolveAnthropicDoor, resolveLaunchModel, resolveConversationId, resolveGatewayHost, singleCellError, resolveLaunchShape, resolveRemoteControlShape, liftPassthroughName, passthroughName, sanitizeAgentName, resumeCommand, sessionDisplayName, SESSION_NAME_ENV, SESSION_CONFIG_HEADER, stripOwnerCredentialEnv, } from "../lib/agent.js";
-import { LAUNCHER_STORE_PATH, mergeStore } from "../lib/launcher-store.js";
+import { LAUNCHER_STORE_PATH, mergeStore, readStore } from "../lib/launcher-store.js";
 import { slackChannelArgs } from "../lib/slack-launch.js";
 import { appendPluginDirsEnv, applyPluginEnv, pluginEnabled, pluginPlanLine, resolvePluginDir, } from "../lib/claude-plugin.js";
 import { CLI_VERSION } from "../version.js";
@@ -1146,21 +1146,17 @@ export function recordSessionLaunch(ctx) {
 // Credential resolution (zero 1Password)
 // ───────────────────────────────────────────────────────────────────────────
 /** The real I/O behind a subscription launch's Mnemom key (lib/subscription-login.ts). */
-export function defaultMnemomKeyDeps(storePath = CODE_STORE) {
+export function defaultMnemomKeyDeps(storePath = CODE_STORE, apiUrl = getApiUrl()) {
     return {
         env: process.env,
+        // The key is per cell (keyed by the API origin): a key minted on one cell is rejected by
+        // another cell's gateway (401), so it is never read for, or sent to, a different cell.
         readStored: () => {
-            try {
-                const data = JSON.parse(readFileSync(storePath, "utf8"));
-                const v = data[MNEMOM_KEY_STORE_FIELD];
-                return typeof v === "string" ? stripCrlf(v) : undefined;
-            }
-            catch {
-                return undefined;
-            }
+            const v = storedMnemomKeyForCell(readStore(storePath), apiUrl);
+            return v === undefined ? undefined : stripCrlf(v);
         },
         mint: async () => (await createApiKey(`mnemom-agent ${hostname()}`, ["gateway"])).key,
-        store: (key) => mergeStore({ [MNEMOM_KEY_STORE_FIELD]: key }, storePath),
+        store: (key) => mergeStore(mnemomKeyStorePatch(readStore(storePath), apiUrl, key), storePath),
         say,
     };
 }

package/dist/lib/subscription-login.d.ts

@@ -38,8 +38,31 @@ export declare function sayRetiredConsoleNotice(flag: string | undefined, env: R
 export declare const AGENT_AUTH_ENV = "MNEMOM_AGENT_AUTH";
 /** Env override for the Mnemom key a subscription launch sends. */
 export declare const MNEMOM_KEY_ENV = "MNEMOM_AGENT_MNEMOM_KEY";
-/** Field in ~/.mnemom/launcher.json (0600) holding the minted key. */
+/**
+ * LEGACY field in ~/.mnemom/launcher.json (0600): the single, cell-blind key every launcher
+ * before the per-cell store saved. Every such key was minted against production, so it is read
+ * ONLY when the CLI points at the production API and is never sent to another cell.
+ */
 export declare const MNEMOM_KEY_STORE_FIELD = "mnemom_api_key";
+/** Field in ~/.mnemom/launcher.json (0600): the minted keys per cell, `{ "<api origin>": key }`. */
+export declare const MNEMOM_KEYS_STORE_FIELD = "mnemom_api_keys";
+/** The production API origin: the only cell the legacy flat field may be used for. */
+export declare const PRODUCTION_API_ORIGIN = "https://api.mnemom.ai";
+/**
+ * The cell a Mnemom key belongs to: the API base's origin, lowercased. An unparseable base
+ * gives null, and every caller then fails closed (no stored key is read, none is saved).
+ */
+export declare function mnemomKeyCell(apiUrl: string): string | null;
+/**
+ * The stored Mnemom key for the cell `apiUrl` names, from the launcher.json object `data`:
+ * the per-cell entry, else (production only) the legacy flat field, else undefined. Pure.
+ */
+export declare function storedMnemomKeyForCell(data: Record<string, unknown>, apiUrl: string): string | undefined;
+/**
+ * The launcher.json patch that saves `key` for the cell `apiUrl` names, keeping every other
+ * cell's entry. Throws on an unparseable base, so nothing is saved under a cell we can't name.
+ */
+export declare function mnemomKeyStorePatch(data: Record<string, unknown>, apiUrl: string, key: string): Record<string, unknown>;
 export declare function coerceAgentAuth(raw: string): AgentAuth;
 /**
  * launcher.toml `auth`: the retired `console` is kept as-is (never a load error); it folds into
@@ -48,6 +71,13 @@ export declare function coerceAgentAuth(raw: string): AgentAuth;
 export declare function parseSavedAgentAuth(raw: string): SavedAgentAuth;
 /** `--auth` flag > MNEMOM_AGENT_AUTH (launcher.toml folds in here; a saved retired `console` → api-key) > api-key. */
 export declare function resolveAgentAuth(flag: string | undefined, env: Record<string, string | undefined>): AgentAuth;
+/**
+ * The fix line for a gateway 401 on the Mnemom key this launch sent. The saved key is per cell
+ * (keyed by the API origin), so the line names the cell and the exact remedy: a key set in
+ * MNEMOM_AGENT_MNEMOM_KEY must come from this cell; a saved one is removed from this cell's
+ * entry so the next launch mints one here. Pure.
+ */
+export declare function mnemomKeyRejectedFix(apiUrl: string, env: Record<string, string | undefined>): string;
 export interface MnemomKeyDeps {
     env: Record<string, string | undefined>;
     readStored(): string | undefined;

package/dist/lib/subscription-login.js

@@ -39,8 +39,64 @@ export function sayRetiredConsoleNotice(flag, env, say) {
 export const AGENT_AUTH_ENV = "MNEMOM_AGENT_AUTH";
 /** Env override for the Mnemom key a subscription launch sends. */
 export const MNEMOM_KEY_ENV = "MNEMOM_AGENT_MNEMOM_KEY";
-/** Field in ~/.mnemom/launcher.json (0600) holding the minted key. */
+/**
+ * LEGACY field in ~/.mnemom/launcher.json (0600): the single, cell-blind key every launcher
+ * before the per-cell store saved. Every such key was minted against production, so it is read
+ * ONLY when the CLI points at the production API and is never sent to another cell.
+ */
 export const MNEMOM_KEY_STORE_FIELD = "mnemom_api_key";
+/** Field in ~/.mnemom/launcher.json (0600): the minted keys per cell, `{ "<api origin>": key }`. */
+export const MNEMOM_KEYS_STORE_FIELD = "mnemom_api_keys";
+/** The production API origin: the only cell the legacy flat field may be used for. */
+export const PRODUCTION_API_ORIGIN = "https://api.mnemom.ai";
+/**
+ * The cell a Mnemom key belongs to: the API base's origin, lowercased. An unparseable base
+ * gives null, and every caller then fails closed (no stored key is read, none is saved).
+ */
+export function mnemomKeyCell(apiUrl) {
+    try {
+        const origin = new URL(apiUrl).origin.toLowerCase();
+        return origin && origin !== "null" ? origin : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The stored Mnemom key for the cell `apiUrl` names, from the launcher.json object `data`:
+ * the per-cell entry, else (production only) the legacy flat field, else undefined. Pure.
+ */
+export function storedMnemomKeyForCell(data, apiUrl) {
+    const cell = mnemomKeyCell(apiUrl);
+    if (cell === null)
+        return undefined;
+    const map = data[MNEMOM_KEYS_STORE_FIELD];
+    if (map && typeof map === "object" && !Array.isArray(map)) {
+        const v = map[cell];
+        if (typeof v === "string" && v.trim())
+            return v;
+    }
+    if (cell === PRODUCTION_API_ORIGIN) {
+        const legacy = data[MNEMOM_KEY_STORE_FIELD];
+        if (typeof legacy === "string")
+            return legacy;
+    }
+    return undefined;
+}
+/**
+ * The launcher.json patch that saves `key` for the cell `apiUrl` names, keeping every other
+ * cell's entry. Throws on an unparseable base, so nothing is saved under a cell we can't name.
+ */
+export function mnemomKeyStorePatch(data, apiUrl, key) {
+    const cell = mnemomKeyCell(apiUrl);
+    if (cell === null)
+        throw new Error(`cannot tell which cell the API base '${apiUrl}' is`);
+    const current = data[MNEMOM_KEYS_STORE_FIELD];
+    const kept = current && typeof current === "object" && !Array.isArray(current)
+        ? current
+        : {};
+    return { [MNEMOM_KEYS_STORE_FIELD]: { ...kept, [cell]: key } };
+}
 /**
  * The key is spliced into the newline-joined ANTHROPIC_CUSTOM_HEADERS block, so an embedded
  * CR/LF (a multi-line paste, a bad env value) would inject extra header lines.
@@ -72,6 +128,30 @@ export function resolveAgentAuth(flag, env) {
     const fromEnv = (env[AGENT_AUTH_ENV] ?? "").trim();
     return fromEnv ? coerceAgentAuth(fromEnv) : "api-key";
 }
+/**
+ * The fix line for a gateway 401 on the Mnemom key this launch sent. The saved key is per cell
+ * (keyed by the API origin), so the line names the cell and the exact remedy: a key set in
+ * MNEMOM_AGENT_MNEMOM_KEY must come from this cell; a saved one is removed from this cell's
+ * entry so the next launch mints one here. Pure.
+ */
+export function mnemomKeyRejectedFix(apiUrl, env) {
+    const cell = mnemomKeyCell(apiUrl);
+    const where = cell ?? `the API base '${apiUrl}'`;
+    const create = "`mnemom api-key create --name mnemom-agent --scopes gateway` while the CLI points at it";
+    if (headerSafe(env[MNEMOM_KEY_ENV] ?? "")) {
+        return (`The Mnemom API key in ${MNEMOM_KEY_ENV} is not valid on this cell (${where}); a key from another cell is rejected here. ` +
+            `Set ${MNEMOM_KEY_ENV} to a key from this cell (${create}), or unset it so the launcher uses or mints this cell's own key.`);
+    }
+    if (cell === null) {
+        return (`The Mnemom API key is not valid on ${where}, and the launcher can't tell which cell that is. ` +
+            `Set ${MNEMOM_KEY_ENV} to a key from that cell (${create}).`);
+    }
+    const legacy = cell === PRODUCTION_API_ORIGIN
+        ? ` (and the older top-level "${MNEMOM_KEY_STORE_FIELD}" field)`
+        : "";
+    return (`The saved Mnemom API key is per cell, and this cell (${cell}) rejected the one saved for it. ` +
+        `Set ${MNEMOM_KEY_ENV} to a key from this cell (${create}), or remove the "${cell}" entry under "${MNEMOM_KEYS_STORE_FIELD}"${legacy} in ~/.mnemom/launcher.json so the next launch mints one.`);
+}
 /**
  * The Mnemom key this machine already has — MNEMOM_AGENT_MNEMOM_KEY, else the stored key — or
  * undefined. NEVER mints. An unpinned api-key launch sends it (`x-mnemom-api-key`) alongside its
@@ -108,7 +188,7 @@ export async function resolveSubscriptionMnemomKey(deps, purpose = "subscription
         throw new Error("mnemom agent: the API returned an empty Mnemom key.");
     try {
         deps.store(minted);
-        deps.say(`mnemom agent: minted a gateway-only Mnemom API key for ${purpose} (saved to ~/.mnemom/launcher.json, 0600).`);
+        deps.say(`mnemom agent: minted a gateway-only Mnemom API key for ${purpose} (saved for this cell to ~/.mnemom/launcher.json, 0600).`);
     }
     catch {
         deps.say("mnemom agent: minted a gateway-only Mnemom API key for this launch but could not save it — the next launch mints another.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemom/mnemom",
-  "version": "0.17.38",
+  "version": "0.17.39-next.0",
   "description": "Transparent AI agent tracing",
   "type": "module",
   "bin": {