@mnemom/mnemom 0.17.7-next.1 → 0.17.7

package/README.md

@@ -87,27 +87,20 @@ or `launch` in `launcher.toml`) also skips the Remote Control capability probe
 #### Context profile: how the gateway folds a session's context
 
 `--context-profile <off|balanced|aggressive|adaptive>` picks how the Mnemom gateway folds a
-session's context. **Unset is the default:** the launch sends no fold setting at all and the
-gateway cell's own default decides (the launch note reads `context: cell default`). A profile
-you choose is sent in full, so it means the same thing on every cell whatever that cell's
-default is. Each profile serves a different set of use cases:
-
-- **`balanced`** keeps more of the earlier work verbatim and folds later — for long sessions
-  that revisit earlier files and decisions. It sends `CONTEXT_RUNTIME_SIZE_POLICY=off`, so the
-  cell's own fold budgets apply at every size, even on a cell whose default is `adaptive`.
+session's context. Each profile serves a different set of use cases:
+
+- **`balanced`** (the default) keeps more of the earlier work verbatim and folds later —
+  for long sessions that revisit earlier files and decisions.
 - **`aggressive`** folds earlier and keeps a tighter working set — for cost-sensitive
-  sessions and short, focused tasks. It sends its three budget keys plus
-  `CONTEXT_RUNTIME_SIZE_POLICY=off`.
-- **`adaptive`** lets the gateway size the fold to the conversation's original context: no
-  fold below 200k tokens (folding a small conversation costs more than it saves), the
-  `aggressive` budgets from 200k to 1M, and `balanced` above 1M. It sends
+  sessions and short, focused tasks.
+- **`adaptive`** (opt-in) lets the gateway size the fold to the conversation's original
+  context: no fold below 200k tokens (folding a small conversation costs more than it
+  saves), the `aggressive` budgets from 200k to 1M, and `balanced` above 1M. It sends
   `CONTEXT_RUNTIME_SIZE_POLICY=banded` in the per-session config; the band thresholds are the
   gateway's defaults.
 - **`off`** leaves compaction to the coding agent.
 
-Choose it for one launch, as a standing default, or in the environment (flag > env >
-`launcher.toml`). Only `mnemom agent config set` (or editing `launcher.toml`) saves a default;
-a flag applies to that launch alone and is never written anywhere later launches read:
+Set it per launch, as a standing default, or in the environment (flag > env > `launcher.toml`):
 
 ```bash
 mnemom agent my-task --context-profile aggressive   # this launch only
@@ -116,16 +109,11 @@ export MNEMOM_AGENT_CONTEXT_PROFILE=aggressive      # for every launch in this s
 mnemom agent my-task --context-profile adaptive     # size-banded folding, this launch only
 ```
 
-A launch that resumes a Claude Code session (`-- --resume <id>`, or the implicit-goal relaunch)
-keeps the profile that session ran under, ahead of the standing default; a `--context-profile`
-flag on the resuming launch still wins.
-
 `--no-context` (or `context = false` in `launcher.toml`) is the same as `off`. Pass one or the
 other: `--no-context` together with `--context-profile balanced`, `aggressive` or `adaptive` is refused. A
 `--context-profile` flag overrides a standing `context = false` in `launcher.toml`. `--dry-run`
-prints the resolved profile (`cell default` when none is chosen) and, when the launch sends the
-per-session config header, the decoded key/value list; `mnemom agent show` and the session
-ledger record a chosen profile.
+prints the resolved profile and, when the launch sends the per-session config header, the
+decoded key/value list; `mnemom agent show` and the session ledger record the profile.
 
 #### Context handoff (experimental, off by default)
 

package/dist/commands/agent-doctor.d.ts

@@ -2,13 +2,11 @@
  * `mnemom agent doctor` — a read-only preflight for `mnemom agent`. It checks the
  * things a governed launch needs and prints a checklist with clear, actionable
  * remediation, so a customer can see at a glance why a launch would fail before
- * it does. Writes nothing and prints no secret VALUE (the Mnemom key is sent to the
- * Mnemom API to check it, exactly as a launch does). Exits non-zero when the machine is
- * not launch-ready (no coding agent CLI, or no Anthropic key), so it can gate a script.
+ * it does. Writes nothing and reads no secret VALUE (only whether a key is
+ * resolvable). Exits non-zero when the machine is not launch-ready (no coding
+ * agent CLI, or no Anthropic key), so it can gate a script.
  *
- * Checks: settings file, coding-agent CLI, Anthropic key source, Mnemom API key source and
- * whether it is still active (every launch sends one; none yet is informational — the launch
- * mints it; a saved key proven dead is a warning — the launch re-mints it), gateway health
+ * Checks: settings file, coding-agent CLI, Anthropic key source, gateway health
  * (200 + the x-mnemom-verdict header that proves the governance pipeline is
  * live), Remote-Control capability (node + openssl + the --remote-control flag),
  * claude.ai login (informational — Remote Control needs it), and CLI auto-update status.
@@ -19,21 +17,6 @@ export interface DoctorOptions {
 }
 /** Run the preflight and print the checklist. Sets process.exitCode on failure. */
 export declare function agentDoctorCommand(options?: DoctorOptions): Promise<void>;
-/**
- * The Mnemom API key row: where the key a launch would send comes from, and whether it passes
- * the launch's own one-time check (commands/agent.ts verifyLocalMnemomKey). A key counts as dead
- * only when proven (lib/subscription-login.ts checkMnemomKey), so only a saved key this CLI
- * minted can be:
- *   valid                 → ok
- *   saved key, invalid    → warn (the next launch mints a new one and revokes the old)
- *   anything else         → info (not verified: a launch sends it as is)
- *   none                  → info (the next launch mints one for the launch's org)
- */
-export declare function mnemomKeyRow(): Promise<{
-    mark: Mark;
-    text: string;
-    hint?: string;
-}>;
 export interface CodeAccessProbe {
     mark: Mark;
     text: string;

package/dist/commands/agent-doctor.js

@@ -2,20 +2,18 @@
  * `mnemom agent doctor` — a read-only preflight for `mnemom agent`. It checks the
  * things a governed launch needs and prints a checklist with clear, actionable
  * remediation, so a customer can see at a glance why a launch would fail before
- * it does. Writes nothing and prints no secret VALUE (the Mnemom key is sent to the
- * Mnemom API to check it, exactly as a launch does). Exits non-zero when the machine is
- * not launch-ready (no coding agent CLI, or no Anthropic key), so it can gate a script.
+ * it does. Writes nothing and reads no secret VALUE (only whether a key is
+ * resolvable). Exits non-zero when the machine is not launch-ready (no coding
+ * agent CLI, or no Anthropic key), so it can gate a script.
  *
- * Checks: settings file, coding-agent CLI, Anthropic key source, Mnemom API key source and
- * whether it is still active (every launch sends one; none yet is informational — the launch
- * mints it; a saved key proven dead is a warning — the launch re-mints it), gateway health
+ * Checks: settings file, coding-agent CLI, Anthropic key source, gateway health
  * (200 + the x-mnemom-verdict header that proves the governance pipeline is
  * live), Remote-Control capability (node + openssl + the --remote-control flag),
  * claude.ai login (informational — Remote Control needs it), and CLI auto-update status.
  */
 import { spawnSync } from "node:child_process";
 import { existsSync } from "node:fs";
-import { anthropicKeySource, checkRcCapability, defaultConsoleKeyDeps, localLaunchMnemomKey, verifyLocalMnemomKey, resolveCliBin, } from "./agent.js";
+import { anthropicKeySource, checkRcCapability, defaultConsoleKeyDeps, resolveCliBin, } from "./agent.js";
 import { readConsoleKey } from "../lib/console-key.js";
 import { resolveAgentAuth } from "../lib/subscription-login.js";
 import { isProdGateway, resolveAnthropicDoor, resolveGatewayHost, singleCellError, } from "../lib/agent.js";
@@ -75,9 +73,6 @@ export async function agentDoctorCommand(options = {}) {
         else
             add("miss", "Anthropic key: none found", "export MNEMOM_AGENT_ANTHROPIC_KEY=sk-ant-… (or ANTHROPIC_API_KEY), or run `mnemom agent` once and accept the save prompt");
     }
-    // ── Mnemom API key: every launch sends one, whatever the auth mode ──
-    const keyRow = await mnemomKeyRow();
-    add(keyRow.mark, keyRow.text, keyRow.hint);
     // ── one cell: the launch door must be the CLI's own cell ──
     const cellError = singleCellError({
         door: resolveAnthropicDoor(env),
@@ -181,47 +176,6 @@ function claudeLoggedIn(bin) {
         return null;
     }
 }
-const MNEMOM_KEY_MINT_HINT = "minting needs a signed-in session (`mnemom login`) and an org role that may mint a gateway key (owner, admin or member); or ask an org owner/admin for an org API key with the `gateway` scope and set MNEMOM_AGENT_MNEMOM_KEY";
-/**
- * The Mnemom API key row: where the key a launch would send comes from, and whether it passes
- * the launch's own one-time check (commands/agent.ts verifyLocalMnemomKey). A key counts as dead
- * only when proven (lib/subscription-login.ts checkMnemomKey), so only a saved key this CLI
- * minted can be:
- *   valid                 → ok
- *   saved key, invalid    → warn (the next launch mints a new one and revokes the old)
- *   anything else         → info (not verified: a launch sends it as is)
- *   none                  → info (the next launch mints one for the launch's org)
- */
-export async function mnemomKeyRow() {
-    const local = localLaunchMnemomKey();
-    const org = getActiveOrg();
-    const orgLabel = org ? `org ${org.slug}` : "no active org";
-    if (!local) {
-        return {
-            mark: "info",
-            text: `Mnemom API key: none yet for ${orgLabel} — the next launch mints a gateway-only org key and saves it`,
-            hint: MNEMOM_KEY_MINT_HINT,
-        };
-    }
-    const where = local.source === "env"
-        ? "MNEMOM_AGENT_MNEMOM_KEY (environment)"
-        : `~/.mnemom/launcher.json (saved for ${orgLabel})`;
-    const verdict = await verifyLocalMnemomKey(local);
-    if (verdict === "valid")
-        return { mark: "ok", text: `Mnemom API key: ${where} — verified` };
-    if (verdict === "invalid" && local.source === "store") {
-        return {
-            mark: "warn",
-            text: `Mnemom API key: the key saved for ${orgLabel} is no longer active (revoked or rotated) — the next launch mints a new one`,
-            hint: MNEMOM_KEY_MINT_HINT,
-        };
-    }
-    return {
-        mark: "info",
-        text: `Mnemom API key: ${where} — not verified (API unreachable, not signed in, or a gateway-only key the API cannot look up); a launch sends it as is`,
-        hint: "sign in (`mnemom login`) so the doctor and each launch can check a saved key; the gateway refuses a dead key with a clear message",
-    };
-}
 /**
  * The invited-cohort gate, as the doctor reports it. Signed out → info (we can't
  * check without a session); enabled → ok with the reason; a determined

package/dist/commands/agent-goal.d.ts

@@ -31,7 +31,7 @@ export interface GoalCommandDeps {
 }
 /**
  * The Anthropic key the launch would resolve (env, then ~/.mnemom/launcher.json), never prompted
- * for, plus the Mnemom key the launch sent (null when this machine has none). Lazy import: commands/agent.ts is the launcher and carries a heavy import graph.
+ * for. Lazy import: commands/agent.ts is the launcher and carries a heavy import graph.
  */
 export declare function resolveLaunchCreds(): Promise<GoalControlCreds>;
 export declare const liveGoalDeps: GoalCommandDeps;

package/dist/commands/agent-goal.js

@@ -24,20 +24,17 @@ import { askYesNo, isInteractive } from "../lib/prompt.js";
 import { localGoalFlag, resolveSessionRef } from "./agent-sessions.js";
 /**
  * The Anthropic key the launch would resolve (env, then ~/.mnemom/launcher.json), never prompted
- * for, plus the Mnemom key the launch sent (null when this machine has none). Lazy import: commands/agent.ts is the launcher and carries a heavy import graph.
+ * for. Lazy import: commands/agent.ts is the launcher and carries a heavy import graph.
  */
 export async function resolveLaunchCreds() {
-    const agentMod = await import("./agent.js");
-    let anthropicKey;
+    const { resolveAnthropicKey } = await import("./agent.js");
     try {
-        anthropicKey = await agentMod.resolveAnthropicKey(process.env, { allowPrompt: false });
+        return { anthropicKey: await resolveAnthropicKey(process.env, { allowPrompt: false }) };
     }
     catch {
         throw new Error("no Anthropic key in env (MNEMOM_AGENT_ANTHROPIC_KEY / ANTHROPIC_API_KEY) or ~/.mnemom/launcher.json — " +
             "the goal commands authenticate with the same key the session launched with");
     }
-    // The Mnemom key the launch sent too (env, then the store — never minted here).
-    return { anthropicKey, mnemomKey: agentMod.localLaunchMnemomKey()?.key ?? null };
 }
 export const liveGoalDeps = {
     readRecords: () => readSessionRecords({ dir: MNEMOM_DIR }).reverse(),

package/dist/commands/agent-setup.d.ts

@@ -68,15 +68,6 @@ export interface EnsureAgentOptions {
     slug: string;
     /** The customer's Anthropic key (for the birth call + hash-proof). Never logged. */
     anthropicKey: string;
-    /**
-     * The launch's Mnemom API key, sent on the gateway probe/birth call (x-mnemom-api-key, with a
-     * no-op x-mnemom-session-config — see birthThroughGateway). That makes the call Mnemom agent
-     * traffic: the gateway verifies the key and births a new agent in the key's org — the active
-     * org, else the personal org, i.e. the launch org the key was minted for. The claim below
-     * records the claim in that same org, which the gateway's agent-traffic org check requires of
-     * every governed turn. Never logged.
-     */
-    mnemomKey?: string;
     /** undefined = auto, true = force (--setup), false handled by the caller (skip). */
     setup?: boolean;
     /** Gateway host the launch targets (birth goes to the same cell). */
@@ -166,13 +157,11 @@ export declare function ensureSessionAndBalance(opts: {
 }>;
 /**
  * The account for a launch an orchestrator already preflighted
- * (`MNEMOM_AGENT_PREFLIGHTED=1`, see launchPreflighted): no session prompt and no
- * µ-balance read. The launch org resolves exactly as on a normal launch — the
- * active org, else the caller's personal org — because the launch's Mnemom key is
- * minted for it and the agent is claimed into it (the gateway requires the agent's
- * org to be the key's org). The entitlement is still fetched for that org — it is
- * the access gate and decides Remote Control fail-closed, which a caller's
- * preflight can't vouch for.
+ * (`MNEMOM_AGENT_PREFLIGHTED=1`, see launchPreflighted): no session prompt, no
+ * personal-org lookup, no µ-balance read. The entitlement is still fetched — it
+ * is the access gate and decides Remote Control fail-closed, which a caller's
+ * preflight can't vouch for. With no active org the api resolves the caller's
+ * primary org, and the ledger records the org id the entitlement names.
  */
 export declare function resolvePreflightedAccount(): Promise<{
     orgId: string;

package/dist/commands/agent-setup.js

@@ -34,8 +34,7 @@ import { configKeySpec, loadLauncherConfig, writeLauncherConfig } from "../lib/l
 import { readServedAgent, servedFingerprint, writeServedAgent } from "../lib/served-agent-cache.js";
 import { deriveHashProof } from "./agents.js";
 import { birthThroughGateway } from "./wrap.js";
-import { defaultMnemomKeyDeps, resolveAnthropicKey } from "./agent.js";
-import { resolveLaunchMnemomKey } from "../lib/subscription-login.js";
+import { resolveAnthropicKey } from "./agent.js";
 import { assertCodeEnabled, CodeNotEnabledError } from "./agent-invite.js";
 const say = (line = "") => console.error(line);
 /**
@@ -146,7 +145,6 @@ export async function ensureGovernedAgent(opts) {
                     cached ??
                         (await birthThroughGateway(gatewayUrl, "anthropic", slug, opts.anthropicKey, {
                             timeoutMs: opts.setup === true ? undefined : SERVED_PROBE_TIMEOUT_MS,
-                            mnemomKey: opts.mnemomKey,
                         }));
             }
             catch (err) {
@@ -208,9 +206,7 @@ export async function ensureGovernedAgent(opts) {
     }
     // 5. Birth → claim → publish observe-only cards. (Key never logged.)
     const gatewayUrl = opts.gatewayHost.replace(/\/+$/, "");
-    const agentId = await birthThroughGateway(gatewayUrl, "anthropic", slug, opts.anthropicKey, {
-        mnemomKey: opts.mnemomKey,
-    });
+    const agentId = await birthThroughGateway(gatewayUrl, "anthropic", slug, opts.anthropicKey);
     const hashProof = deriveHashProof(opts.anthropicKey, slug);
     await claimAgent(agentId, { hashProof, orgId: org?.org_id });
     say(fmt.success(`mnemom agent: claimed '${slug}' (${agentId}) in ${orgLabel}.`));
@@ -326,9 +322,8 @@ export async function agentSetupCommand(opts = {}) {
     if (cellError)
         throw new Error(cellError.replace("mnemom agent:", "mnemom agent setup:"));
     // Sign in (offer sign-up) and enforce the MU balance before any account write.
-    let launchOrgId;
     try {
-        launchOrgId = (await ensureSessionAndBalance({})).orgId;
+        await ensureSessionAndBalance({});
     }
     catch (err) {
         if (isQuietPreambleExit(err))
@@ -343,16 +338,7 @@ export async function agentSetupCommand(opts = {}) {
         : await resolveDefaultSlug({ strict: true });
     if (!slug)
         throw new Error("mnemom agent setup: agent slug sanitised to empty — pass --agent <slug>.");
-    // The birth call carries the same Mnemom key every launch sends, minted for the org the agent
-    // is claimed into (see EnsureAgentOptions.mnemomKey).
-    const mnemomKey = await resolveLaunchMnemomKey(defaultMnemomKeyDeps(undefined, launchOrgId));
-    const result = await ensureGovernedAgent({
-        slug,
-        anthropicKey,
-        mnemomKey,
-        setup: true,
-        gatewayHost,
-    });
+    const result = await ensureGovernedAgent({ slug, anthropicKey, setup: true, gatewayHost });
     if (!result.provisioned) {
         say(fmt.dim(`  '${slug}' is ready (already claimed) or setup was skipped.`));
     }
@@ -522,20 +508,17 @@ export async function ensureSessionAndBalance(opts) {
 }
 /**
  * The account for a launch an orchestrator already preflighted
- * (`MNEMOM_AGENT_PREFLIGHTED=1`, see launchPreflighted): no session prompt and no
- * µ-balance read. The launch org resolves exactly as on a normal launch — the
- * active org, else the caller's personal org — because the launch's Mnemom key is
- * minted for it and the agent is claimed into it (the gateway requires the agent's
- * org to be the key's org). The entitlement is still fetched for that org — it is
- * the access gate and decides Remote Control fail-closed, which a caller's
- * preflight can't vouch for.
+ * (`MNEMOM_AGENT_PREFLIGHTED=1`, see launchPreflighted): no session prompt, no
+ * personal-org lookup, no µ-balance read. The entitlement is still fetched — it
+ * is the access gate and decides Remote Control fail-closed, which a caller's
+ * preflight can't vouch for. With no active org the api resolves the caller's
+ * primary org, and the ledger records the org id the entitlement names.
  */
 export async function resolvePreflightedAccount() {
     const active = getActiveOrg();
-    const orgId = active?.org_id ?? (await getMyPersonalOrg()).org_id;
-    const orgLabel = active ? `${active.name} (${active.slug})` : "your personal org";
-    const entitlement = await assertCodeEnabled(orgId, orgLabel);
-    return { orgId, orgLabel, entitlement };
+    const orgLabel = active ? `${active.name} (${active.slug})` : "your primary org";
+    const entitlement = await assertCodeEnabled(active?.org_id ?? "", orgLabel);
+    return { orgId: active?.org_id ?? entitlement?.org_id ?? "", orgLabel, entitlement };
 }
 // ── The default coding posture (cards observe-only; goal contracts nudge) ────
 function buildCodeAlignmentCard(agentId) {

package/dist/commands/agent.d.ts

@@ -25,7 +25,7 @@
  * line, or the proxy's stdin under RC). It is never logged, printed, or passed as
  * an argv value.
  */
-import { type LocalMnemomKey, type MnemomKeyCheck, type MnemomKeyDeps, type StoredMnemomKey } from "../lib/subscription-login.js";
+import { type MnemomKeyDeps } from "../lib/subscription-login.js";
 import { type SessionRecord } from "../lib/agent-ledger.js";
 import { type ExperimentalId } from "../lib/experimental.js";
 import { type ConsoleKeyDeps } from "../lib/console-key.js";
@@ -66,9 +66,8 @@ export interface AgentOptions {
     context?: boolean;
     /**
      * How the gateway folds this session's context (`--context-profile`): `off`, `balanced`,
-     * `aggressive` or `adaptive`. Undefined ⇒ the resumed session's own profile, else
-     * MNEMOM_AGENT_CONTEXT_PROFILE (the `context_profile` setting), else none — the cell default,
-     * nothing sent. `--no-context` is `off`; combined with balanced|aggressive|adaptive the launch refuses.
+     * `aggressive` or `adaptive`. Undefined ⇒ MNEMOM_AGENT_CONTEXT_PROFILE (the `context_profile` setting), else
+     * `balanced`. `--no-context` is `off`; combined with balanced|aggressive|adaptive the launch refuses.
      */
     contextProfile?: ContextProfile;
     /**
@@ -196,35 +195,13 @@ export declare function recordSessionLaunch(ctx: {
     goalMode: string | null;
     /** The Claude Code session id (pickCcSessionId); null/absent when Claude Code picks it. */
     ccSessionId?: string | null;
-    /** The resolved context profile this launch runs under; `null` = none chosen (cell default). */
-    contextProfile: ContextProfile | null;
+    /** The resolved context profile this launch runs under. */
+    contextProfile: ContextProfile;
     /** The resolved compaction target this launch runs under (`resolveCompactAt`). */
     compactAt: number | null;
 }): Promise<void>;
-/** Per-call timeout of the launch's Mnemom-key check: a slow API must not hold up a launch. */
-export declare const MNEMOM_KEY_CHECK_TIMEOUT_MS = 2500;
-/**
- * Mint the launch's key: an ORG-owned key for `orgId` (the launch's org) with scopes exactly
- * ["gateway"], which any owner/admin/member may mint — so the gateway's agent-traffic org check
- * (agent org = key org) passes for the agent the launcher claims into that org. Never a personal
- * key: it has no org, and the gateway would refuse every governed turn with it. A refusal (403:
- * an API that predates member org keys, or a viewer/auditor role) is thrown as is; the launch
- * stops with guidance (lib/subscription-login.ts mintAndStore).
- */
-export declare function mintLaunchMnemomKey(orgId: string): Promise<StoredMnemomKey>;
-/**
- * The real I/O behind every launch's Mnemom key (lib/subscription-login.ts). `launchOrgId` is
- * the org the launch runs in (ensureSessionAndBalance's `orgId`: the active org, else the
- * caller's personal org); omitted or empty, it is the active org.
- */
-export declare function defaultMnemomKeyDeps(storePath?: string, launchOrgId?: string | null): MnemomKeyDeps;
-/**
- * The Mnemom key already on this machine (MNEMOM_AGENT_MNEMOM_KEY, then ~/.mnemom/launcher.json),
- * never minted: `mnemom agent doctor` reports its source, the goal commands send it.
- */
-export declare function localLaunchMnemomKey(storePath?: string): LocalMnemomKey | null;
-/** The launch's one-time check of that key (`mnemom agent doctor` reports it). Never throws. */
-export declare function verifyLocalMnemomKey(local: LocalMnemomKey): Promise<MnemomKeyCheck>;
+/** The real I/O behind a subscription launch's Mnemom key (lib/subscription-login.ts). */
+export declare function defaultMnemomKeyDeps(storePath?: string): MnemomKeyDeps;
 /** The real machine behind lib/console-key.ts: the macOS keychain via `security`, no shell. */
 export declare function defaultConsoleKeyDeps(env: NodeJS.ProcessEnv): ConsoleKeyDeps;
 /**
@@ -375,8 +352,8 @@ export declare function printPlan(ctx: {
     goalMode: string | null;
     yolo: boolean;
     cli: ResolvedCli;
-    /** The resolved context profile (`resolveContextProfile`); `null` = none chosen (cell default). */
-    contextProfile: ContextProfile | null;
+    /** The resolved context profile (`resolveContextProfile`). */
+    contextProfile: ContextProfile;
     /** The resolved compaction target (`resolveCompactAt`); `null` = no target (default). */
     compactAt: number | null;
     /** The decoded `x-mnemom-session-config` overlay (`buildSessionConfig`); empty ⇒ no header. */