@mnemom/mnemom 0.17.6-next.1 → 0.17.6-next.3

package/dist/lib/first-run/screen.d.ts

@@ -1,5 +1,5 @@
 /**
- * The first-run screen: one plain terminal screen (at most 16 lines of at most 78
+ * The first-run screen: one plain terminal screen (at most 22 lines of at most 78
  * columns, ASCII) built from the backtest numbers. Pure — no I/O — so every layout is
  * unit-tested. Every number on it is recorded in the audit with its raw value and
  * method.
@@ -25,7 +25,7 @@
  *   - No live counter is promised: `mnemom agent` has no status bar today.
  */
 export declare const WIDTH = 78;
-export declare const MAX_LINES = 16;
+export declare const MAX_LINES = 22;
 /** Less history than this (API prices, in the window) is too little to backtest. */
 export declare const MIN_HISTORY_USD = 5;
 /** Variation A iff the shown saving is at least this many dollars and this many percent. */
@@ -33,12 +33,12 @@ export declare const STRONG_MIN_USD = 5;
 export declare const STRONG_MIN_PCT = 5;
 export declare const DAYS = 30;
 /**
- * The forward line: the best finished chain45 run with its error margin (operator
- * 2026-10-01, until something better): S43 C2 total bill -19.5% [-23.9, -14.9], Opus 5.5,
- * n=23, 95% CI rounded to 15-25. The d240p1 ~45% figure is NOT used (its re-bill
- * undercounts output).
+ * The forward line: chain45 S46 C2n (context runtime, aggressive profile) total bill vs
+ * stock, -20.9% [-25.6, -15.9], Opus 5.5, n=13 (r15 readout; operator 2026-10-02: quote
+ * S46, not S43), 95% CI rounded to fives, 15-25. The d240p1 ~45% figure is NOT used
+ * (its re-bill undercounts output).
  */
-export declare const FORWARD_LINE = "Long sessions are where Mnemom saves the most: about 15 to 25% in our tests.";
+export declare const FORWARD_LINE = "Long sessions are where Mnemom saves the most: about 15 to 25% in our datasets.";
 /** Prices, promotions and plan allocations move; the saving is in usage (operator 2026-10-01). */
 export declare const PRICE_LINE = "Prices and plan limits change. Mnemom cuts what you use, so you stay ahead.";
 /** What `mnemom agent` does today: routes through the gateway, records, keeps context lean. */
@@ -52,8 +52,8 @@ export declare function sig3(x: number): number;
  * screen. The implied saving is the shown saving, which never exceeds the raw saving.
  */
 export declare function pair(total: number, saved: number): [number, number, number];
-/** part / whole as a percentage rounded DOWN to a multiple of 5. */
-export declare function pct5(part: number, whole: number): number;
+/** part / whole as a whole-number percentage, decimals dropped (rounded DOWN). */
+export declare function pctDown(part: number, whole: number): number;
 export declare function day(t: number): string;
 export declare function usd(n: number): string;
 export declare function clean(s: string): string;

package/dist/lib/first-run/screen.js

@@ -1,5 +1,5 @@
 /**
- * The first-run screen: one plain terminal screen (at most 16 lines of at most 78
+ * The first-run screen: one plain terminal screen (at most 22 lines of at most 78
  * columns, ASCII) built from the backtest numbers. Pure — no I/O — so every layout is
  * unit-tested. Every number on it is recorded in the audit with its raw value and
  * method.
@@ -26,7 +26,7 @@
  */
 import { ESTIMATOR_METHOD } from "./backtest.js";
 export const WIDTH = 78;
-export const MAX_LINES = 16;
+export const MAX_LINES = 22;
 /** Less history than this (API prices, in the window) is too little to backtest. */
 export const MIN_HISTORY_USD = 5;
 /** Variation A iff the shown saving is at least this many dollars and this many percent. */
@@ -34,14 +34,14 @@ export const STRONG_MIN_USD = 5;
 export const STRONG_MIN_PCT = 5;
 export const DAYS = 30;
 /**
- * The forward line: the best finished chain45 run with its error margin (operator
- * 2026-10-01, until something better): S43 C2 total bill -19.5% [-23.9, -14.9], Opus 5.5,
- * n=23, 95% CI rounded to 15-25. The d240p1 ~45% figure is NOT used (its re-bill
- * undercounts output).
+ * The forward line: chain45 S46 C2n (context runtime, aggressive profile) total bill vs
+ * stock, -20.9% [-25.6, -15.9], Opus 5.5, n=13 (r15 readout; operator 2026-10-02: quote
+ * S46, not S43), 95% CI rounded to fives, 15-25. The d240p1 ~45% figure is NOT used
+ * (its re-bill undercounts output).
  */
-export const FORWARD_LINE = "Long sessions are where Mnemom saves the most: about 15 to 25% in our tests.";
-const FORWARD_SOURCE = "operator 2026-10-01: S43 C2 total bill -19.5% [-23.9, -14.9] (Opus 5.5, n=23), 95% CI " +
-    "rounded to 15 to 25; measured vs stock at the 1M default";
+export const FORWARD_LINE = "Long sessions are where Mnemom saves the most: about 15 to 25% in our datasets.";
+const FORWARD_SOURCE = "operator 2026-10-02: S46 C2n total bill -20.9% [-25.6, -15.9] (Opus 5.5, n=13), 95% CI " +
+    "rounded to fives, 15 to 25; measured vs stock";
 /** Prices, promotions and plan allocations move; the saving is in usage (operator 2026-10-01). */
 export const PRICE_LINE = "Prices and plan limits change. Mnemom cuts what you use, so you stay ahead.";
 /** What `mnemom agent` does today: routes through the gateway, records, keeps context lean. */
@@ -73,11 +73,11 @@ export function pair(total, saved) {
     const tot = sig3(total);
     return [tot, Math.min(sv, tot), Math.max(tot - sv, 0)];
 }
-/** part / whole as a percentage rounded DOWN to a multiple of 5. */
-export function pct5(part, whole) {
+/** part / whole as a whole-number percentage, decimals dropped (rounded DOWN). */
+export function pctDown(part, whole) {
     if (whole <= 0 || part <= 0)
         return 0;
-    return Math.floor((100 * part) / whole / 5 + 1e-9) * 5;
+    return Math.floor((100 * part) / whole + 1e-9);
 }
 const MONTHS = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"];
 export function day(t) {
@@ -126,17 +126,17 @@ const SAVED_METHOD = `backtest.estimate(): ${ESTIMATOR_METHOD}; 2 sig figs DOWN`
 function subLines(sub, A) {
     if (!sub)
         return [];
-    const p = pct5(sub.saved, sub.actual);
+    const p = pctDown(sub.saved, sub.actual);
     const raw = sub.actual > 0 ? (100 * sub.saved) / sub.actual : 0;
     if (p < 5) {
-        A("sub_line_omitted", { shown: true, raw, method: "usage cut rounds DOWN below 5%" });
+        A("sub_line_omitted", { shown: true, raw, method: "usage cut below 5% (decimals dropped)" });
         return [];
     }
     A("sub_usage_pct", {
         shown: p,
         raw,
         method: "saving / API-price cost over the subscription sessions in the window (all sessions if " +
-            "none is tagged); cost-weighted, rounded DOWN to 5s",
+            "none is tagged); cost-weighted, decimals dropped",
     });
     return wrap(`On your subscription that is about ${p}% less usage: fewer limit hits, and less ` +
         "overage if you use extra usage.");
@@ -151,7 +151,7 @@ export function buildScreen(inp) {
     const actual = ses.reduce((t, r) => t + r.actual, 0);
     const saved = ses.reduce((t, r) => t + r.saved, 0);
     const [a, s, e] = pair(actual, saved);
-    const p = pct5(saved, actual);
+    const p = pctDown(saved, actual);
     const enough = actual >= MIN_HISTORY_USD;
     const variation = enough && s >= STRONG_MIN_USD && p >= STRONG_MIN_PCT ? "A" : enough ? "B" : "C";
     A("variation", { shown: variation, raw: { actual, saved }, method: "see screen.ts header" });
@@ -162,7 +162,11 @@ export function buildScreen(inp) {
     L.push("");
     if (variation === "A") {
         A("spent_usd", { shown: a, raw: actual, method: SPENT_METHOD });
-        A("saved_pct", { shown: p, raw: (100 * saved) / actual, method: "rounded DOWN to 5s" });
+        A("saved_pct", {
+            shown: p,
+            raw: (100 * saved) / actual,
+            method: "decimals dropped (rounded DOWN)",
+        });
         const viaRaw = ses.reduce((t, r) => t + (r.viaMnemom ? r.saved : 0), 0);
         const via = sig2(viaRaw);
         const rest = sig2(saved - viaRaw);
@@ -170,12 +174,14 @@ export function buildScreen(inp) {
             A("saved_usd", { shown: s, raw: saved, method: SAVED_METHOD });
             A("with_mnemom_usd", { shown: e, raw: actual - saved, method: "spent shown - saved shown" });
             L.push(...wrap(`At API prices that usage cost about ${usd(a)}. With Mnemom: about ${usd(e)}.`));
+            L.push("");
             L.push(...wrap(`That's about ${usd(s)} less (${p}%), and you don't change how you work.`));
         }
         else {
             const m = `${SAVED_METHOD}; sessions the launch ledger shows ran through Mnemom`;
             A("saved_via_mnemom_usd", { shown: via, raw: viaRaw, method: m });
             L.push(...wrap(`At API prices that usage comes to about ${usd(a)} without Mnemom.`));
+            L.push("");
             if (rest < 1) {
                 L.push(...wrap(`Mnemom saved you about ${usd(via)} of it (${p}%), and you didn't change how you work.`));
             }
@@ -202,11 +208,14 @@ export function buildScreen(inp) {
             raw: big.actual - big.saved,
             method: "its cost shown - its saving (2 sig figs DOWN)",
         });
+        L.push("");
         const where = big.label ? `${big.label} on ${day(big.end)}` : `on ${day(big.end)}`;
         L.push(...wrap(big.viaMnemom
             ? `Your biggest session, ${where}: ${usd(ba)} without Mnemom, about ${usd(be)} with it.`
             : `Your biggest session, ${where}: ${usd(ba)}, with Mnemom about ${usd(be)}.`));
-        L.push(...subLines(inp.sub, A));
+        const subL = subLines(inp.sub, A);
+        if (subL.length)
+            L.push("", ...subL);
     }
     else {
         if (variation === "B") {
@@ -219,10 +228,12 @@ export function buildScreen(inp) {
             L.push(...wrap(`Your sessions used about ${usd(a)} at API prices. They stayed small, so Mnemom ` +
                 "wouldn't have changed that much."));
         }
-        L.push(FORWARD_LINE);
+        if (variation === "B")
+            L.push("");
+        L.push(...wrap(FORWARD_LINE));
         A("forward_range_pct", {
             shown: "15 to 25",
-            raw: [-23.9, -19.5, -14.9],
+            raw: [-25.6, -20.9, -15.9],
             method: FORWARD_SOURCE,
         });
     }

package/dist/lib/launcher-config.d.ts

@@ -58,7 +58,8 @@ export interface LauncherConfig {
     /**
      * How the gateway folds each session's context (`balanced` when unset): `off` leaves
      * compaction to the coding agent, `balanced` keeps more earlier work verbatim, `aggressive`
-     * folds earlier with a tighter working set. `--context-profile` overrides it per launch.
+     * folds earlier with a tighter working set, `adaptive` sizes the fold to the conversation
+     * (none below 200k tokens, aggressive up to 1M, balanced above). `--context-profile` overrides it per launch.
      */
     contextProfile?: ContextProfile;
     /**

package/dist/lib/subscription-login.d.ts

@@ -1,15 +1,40 @@
 /**
- * `mnemom agent` with a Claude subscription login (`auth = subscription`) — Team and
- * Enterprise plans only; the gateway checks the plan with Anthropic and refuses anything
- * else (gateway/src/subscription-auth.ts).
- *
- * Claude Code then authenticates to the gateway with its own claude.ai OAuth login: the
- * launch sets ANTHROPIC_BASE_URL and leaves ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN unset,
- * so Claude Code sends `Authorization: Bearer <its login>`. No Anthropic key is involved.
- * The gateway anchors the governed identity on a Mnemom API key instead
- * (`x-mnemom-api-key`), which this module resolves — env, then the 0600 store, then a
- * freshly minted gateway-only key — and the agent is created in that key's org on the
- * first turn, so there is no CLI-side birth or claim.
+ * `mnemom agent` launch auth: the `auth` setting (api-key | console | subscription) and the
+ * Mnemom API key EVERY launch sends.
+ *
+ * The Mnemom key (`x-mnemom-api-key`) rides on every governed request a launch makes, for every
+ * auth mode and launch shape: the gateway refuses `mnemom agent` traffic that carries no
+ * verified Mnemom key. This module resolves it — env, then the key stored for the active org in
+ * the 0600 store, then a freshly minted gateway-only key — checks it once (a revoked or rotated
+ * stored key is replaced), and a launch that cannot resolve one refuses to start.
+ *
+ * Which org a key belongs to: the key is minted FOR the launch's org — the active org, else the
+ * caller's personal org, i.e. the org the launcher claims the agent into — as an org-owned key
+ * with scopes exactly ["gateway"] (POST /v1/orgs/:id/api-keys; any owner/admin/member may mint
+ * one), so the gateway's agent-traffic org check (#2289: the agent's org must be the key's org)
+ * passes. There is no personal-key fallback: a personal key has no org, so the gateway would
+ * refuse every governed turn with it. When the mint is refused (an API that predates member org
+ * keys, or a viewer/auditor role) the launch stops with guidance — ask an org owner/admin for a
+ * gateway-scoped org key, or set MNEMOM_AGENT_MNEMOM_KEY to one. Each saved key records the org
+ * it was minted for; a launch in another org mints and saves a key for that org.
+ *
+ * When the launcher replaces a key it minted and saved (proven dead, minted for another org, or
+ * the legacy single-field key), it revokes the old one best-effort. An env-provided key is never
+ * replaced and never revoked.
+ *
+ * Birth org: the launcher's gateway probe/birth call carries the key AND a no-op
+ * `x-mnemom-session-config`, which makes it Mnemom agent traffic: the gateway verifies the key
+ * and births a new agent in the key's org. The launcher's claim step then records the claim in
+ * that same org.
+ *
+ * With a Claude subscription login (`auth = subscription`) — Team and Enterprise plans only;
+ * the gateway checks the plan with Anthropic and refuses anything else
+ * (gateway/src/subscription-auth.ts) — Claude Code authenticates to the gateway with its own
+ * claude.ai OAuth login: the launch sets ANTHROPIC_BASE_URL and leaves ANTHROPIC_API_KEY /
+ * ANTHROPIC_AUTH_TOKEN unset, so Claude Code sends `Authorization: Bearer <its login>`. No
+ * Anthropic key is involved; the gateway anchors the governed identity on the Mnemom key and
+ * creates the agent in that key's org on the first turn, so there is no CLI-side birth or
+ * claim.
  *
  * Remote Control is internal-only (see subscriptionShape); the context-handoff tool
  * authenticates with an Anthropic key, so it is off on a subscription launch.
@@ -22,26 +47,133 @@ export type AgentAuth = "api-key" | "subscription" | "console";
 export declare const AGENT_AUTHS: readonly AgentAuth[];
 /** Env override for the setting (the launcher.toml `auth` key folds into it). */
 export declare const AGENT_AUTH_ENV = "MNEMOM_AGENT_AUTH";
-/** Env override for the Mnemom key a subscription launch sends. */
+/** Env override for the Mnemom key every launch sends. */
 export declare const MNEMOM_KEY_ENV = "MNEMOM_AGENT_MNEMOM_KEY";
-/** Field in ~/.mnemom/launcher.json (0600) holding the minted key. */
+/**
+ * Legacy field in ~/.mnemom/launcher.json (0600): the single minted key, from before keys were
+ * stored per org. Read as the no-org slot; retired when that slot is written.
+ */
 export declare const MNEMOM_KEY_STORE_FIELD = "mnemom_api_key";
+/**
+ * Field in ~/.mnemom/launcher.json (0600): `{ <active org id | "_none">: { key, key_id, org_id } }`
+ * — one slot per `mnemom org use` setting; `org_id` is the org the key was minted for.
+ */
+export declare const MNEMOM_KEYS_BY_ORG_FIELD = "mnemom_api_keys";
 export declare function coerceAgentAuth(raw: string): AgentAuth;
 /** `--auth` flag > MNEMOM_AGENT_AUTH (launcher.toml folds in here) > api-key. */
 export declare function resolveAgentAuth(flag: string | undefined, env: Record<string, string | undefined>): AgentAuth;
+/** A key in the 0600 store: the secret, and its API key_id when this CLI minted it. */
+export interface StoredMnemomKey {
+    key: string;
+    /** Absent on a key saved before key ids were stored. */
+    keyId?: string;
+    /** The launch org this key was minted for. Absent on a key saved before orgs were stored. */
+    orgId?: string;
+}
+/**
+ * Is a Mnemom key live? `invalid` only when it is PROVEN dead (checkMnemomKey); anything unproven
+ * (offline, slow, no session, a gateway-only key the API cannot introspect) is `unknown` — a
+ * launch then proceeds with the key, and the gateway refuses a dead one with a clear message.
+ */
+export type MnemomKeyCheck = "valid" | "invalid" | "unknown";
 export interface MnemomKeyDeps {
     env: Record<string, string | undefined>;
-    readStored(): string | undefined;
-    /** Mint a gateway-only personal key for this machine; returns the secret. */
-    mint(): Promise<string>;
-    store(key: string): void;
+    /**
+     * The active org (`mnemom org use`), or null when none is set. The store holds one key per
+     * org: a minted key belongs to the org that was active when it was minted.
+     */
+    activeOrgId: string | null;
+    /**
+     * The org this launch runs in — the active org, else the caller's personal org (the org the
+     * launcher claims the agent into) — or null when unknown. Keys are minted for it; with none
+     * known, a launch that needs a new key refuses (it has no org to mint one for).
+     */
+    launchOrgId: string | null;
+    readStored(orgId: string | null): StoredMnemomKey | undefined;
+    /**
+     * Mint an org-owned key with scopes ["gateway"] for `orgId`. Throws when the API refuses (a
+     * refusal carries `status`/`effectiveStatus` 403). Any `orgId` on the result is ignored: the
+     * store records the org the key was minted FOR.
+     */
+    mint(orgId: string): Promise<StoredMnemomKey>;
+    store(orgId: string | null, key: StoredMnemomKey): void;
+    /** checkMnemomKey over the real API, with short timeouts. Never throws. */
+    check(key: string, keyId: string | undefined): Promise<MnemomKeyCheck>;
+    /** Revoke a key this CLI minted, by key_id (needs a session). May throw; callers ignore it. */
+    revoke(keyId: string): Promise<void>;
     say(line: string): void;
 }
+/** A Mnemom key that is already on this machine, and where it came from. */
+export interface LocalMnemomKey {
+    key: string;
+    source: "env" | "store";
+    /** The stored key's API key_id, when known. */
+    keyId?: string;
+    /** The org the stored key was minted for, when known. */
+    orgId?: string;
+}
+/**
+ * The Mnemom key already on this machine — MNEMOM_AGENT_MNEMOM_KEY, else the key stored for the
+ * active org — or null. Never mints. Shared by the launch (which mints on null), `mnemom agent
+ * doctor` (which reports the source) and the goal commands (which send the key the launch sent).
+ */
+export declare function readLocalMnemomKey(deps: Pick<MnemomKeyDeps, "env" | "readStored" | "activeOrgId">): LocalMnemomKey | null;
+/** The I/O behind checkMnemomKey (lib/api.ts apiAcceptsMnemomKey / listOwnApiKeysForCheck). */
+export interface MnemomKeyCheckIo {
+    /** true = the API accepted the key on its own (whoami 200); false = it refused it (401/403). */
+    apiAccepts(key: string): Promise<boolean>;
+    /** The signed-in account's active keys (incl. org keys it minted), or null with no session. */
+    listOwnKeys(): Promise<Array<{
+        key_id: string;
+    }> | null>;
+}
+/**
+ * Is `key` a live Mnemom key? A key counts as dead (`invalid`) only when that is PROVEN;
+ * anything unproven proceeds, and the gateway refuses a dead key with a clear message.
+ *
+ *   - A key whose key_id we know (this CLI minted and saved it): the signed-in account's active
+ *     keys — which include the org keys it minted — either list that key_id (`valid`) or do not:
+ *     the key was revoked or rotated (`invalid`). No usable session ⇒ `unknown`.
+ *   - Any other key (MNEMOM_AGENT_MNEMOM_KEY, a legacy saved key): whoami with the key itself.
+ *     200 ⇒ `valid`. A refusal proves nothing — the API refuses every key without an `api:*`
+ *     scope (ADR-049), so a live gateway-only key is refused exactly like a dead one ⇒ `unknown`.
+ *     Key prefixes are never matched: an 8-character prefix collides across keys.
+ *
+ * Any error or timeout ⇒ `unknown`.
+ */
+export declare function checkMnemomKey(key: string, keyId: string | undefined, io: MnemomKeyCheckIo): Promise<MnemomKeyCheck>;
+/**
+ * The Mnemom key every launch sends — api-key, console and subscription alike: the local key
+ * (readLocalMnemomKey); else mint one (scopes ["gateway"], org-owned, for the launch's org) and
+ * store it. The key is never printed.
+ *
+ *   - MNEMOM_AGENT_MNEMOM_KEY is used as given: not checked here (nothing could prove it dead —
+ *     see checkMnemomKey), never replaced, never revoked. The gateway refuses a dead one.
+ *   - A saved key minted for another org than the launch's (or saved before orgs were recorded,
+ *     e.g. the legacy single-field key) is replaced by one for the launch's org, unchecked.
+ *   - A saved key checked once (`deps.check`) and proven dead is replaced by a fresh one.
+ *   - Replacing a saved key this CLI minted revokes the old one, best-effort.
+ *
+ * THROWS when no key can be had (no launch org, or the mint is refused or fails): the gateway
+ * would refuse the session, so the launch must not start.
+ */
+export declare function resolveLaunchMnemomKey(deps: MnemomKeyDeps): Promise<string>;
+/** Did the API refuse the mint (403: an API that predates member org keys, or a viewer/auditor)? */
+export declare function isMintRefusal(err: unknown): boolean;
+/** Store slot for a key minted with no active org (for the caller's personal org). */
+export declare const NO_ORG_SLOT = "_none";
+/**
+ * The key stored for `orgId` in the store document: `mnemom_api_keys[<org id | _none>]`. The
+ * pre-per-org field `mnemom_api_key` (a bare string, minted personal) still serves the no-org
+ * slot until that slot is written. CR/LF stripped; anything malformed reads as no key.
+ */
+export declare function readStoredMnemomKey(data: Record<string, unknown>, orgId: string | null): StoredMnemomKey | undefined;
 /**
- * The Mnemom key a subscription launch sends: MNEMOM_AGENT_MNEMOM_KEY, else the stored
- * key, else mint one (gateway scope only) and store it. The key is never printed.
+ * The mergeStore patch that saves `key` for `orgId` — replacing that org's key, keeping every
+ * other org's. Writing the no-org slot retires the legacy `mnemom_api_key` field (a null value
+ * removes it), so a stale legacy key can never shadow the new one.
  */
-export declare function resolveSubscriptionMnemomKey(deps: MnemomKeyDeps): Promise<string>;
+export declare function storePatchForMnemomKey(data: Record<string, unknown>, orgId: string | null, key: StoredMnemomKey): Record<string, unknown>;
 /**
  * Remote Control on a subscription login is open to accounts entitled to Remote Control
  * (internal Mnemom accounts): the RC proxy then forwards the user's own OAuth bearer to the