@mnemom/mnemom 0.17.7-next.1 → 0.17.7

package/dist/lib/agent.d.ts

@@ -294,26 +294,22 @@ export declare const CONTEXT_TAIL_BUDGET_KEY = "CONTEXT_RUNTIME_TAIL_BUDGET_TOKE
 export declare const CONTEXT_READ_CACHE_KEY = "CONTEXT_RUNTIME_READ_CACHE_TOKENS";
 export declare const CONTEXT_HEAD_RECLAIM_KEY = "CONTEXT_RUNTIME_HEAD_BREAKPOINT_RECLAIM";
 /**
- * The gateway key that turns the size-banded fold policy on or off (allow-listed per session).
- * Only the literal `banded` enables it; any other value — the profiles send `off` — disables it,
- * and a session's value replaces the cell's own. The band thresholds and budgets stay at the
- * gateway's own defaults.
+ * The gateway key the `adaptive` context profile sets (allow-listed per session): turns on the
+ * size-banded fold policy. Only the literal `banded` enables it; the band thresholds and budgets
+ * stay at the gateway's own defaults.
  */
 export declare const CONTEXT_SIZE_POLICY_KEY = "CONTEXT_RUNTIME_SIZE_POLICY";
 /**
  * The named presets for how the gateway folds a session's context (`--context-profile`,
- * launcher.toml `context_profile`, `MNEMOM_AGENT_CONTEXT_PROFILE`). Choosing NONE sends no fold
- * key at all and the cell's own default decides (see `resolveContextProfile`). A chosen profile
- * is complete on its own, so a change to a cell's default can never change what it means:
+ * launcher.toml `context_profile`, `MNEMOM_AGENT_CONTEXT_PROFILE`):
  *   - `off`        → `CONTEXT_RUNTIME_ENABLED: "false"` — compaction is left to the coding agent
  *                    (the same bytes `--no-context` has always sent).
- *   - `balanced`   → `CONTEXT_RUNTIME_SIZE_POLICY: "off"` — the cell's own fold budgets, never
- *                    the size bands, even on a cell whose default is adaptive.
- *   - `aggressive` → a smaller tail budget + read cache and head-breakpoint reclaim on, size
- *                    policy off: folds earlier and keeps a tighter working set at every size.
+ *   - `balanced`   → NO fold keys: the gateway's own defaults stand. The default.
+ *   - `aggressive` → a smaller tail budget + read cache and head-breakpoint reclaim on: folds
+ *                    earlier and keeps a tighter working set.
  *   - `adaptive`   → `CONTEXT_RUNTIME_SIZE_POLICY: "banded"` — the gateway picks the fold by the
  *                    conversation's original size: no fold below 200k tokens, the aggressive
- *                    budgets from 200k to 1M, balanced above.
+ *                    budgets from 200k to 1M, balanced above. Opt-in; never the default.
  */
 export declare const CONTEXT_PROFILES: readonly ["off", "balanced", "aggressive", "adaptive"];
 export type ContextProfile = (typeof CONTEXT_PROFILES)[number];
@@ -475,10 +471,8 @@ export declare function launchPreferenceExplicit(opts: {
  * Has an orchestrator already run the session + µ-balance preflight for this
  * launch? `MNEMOM_AGENT_PREFLIGHTED=1` is for orchestrators (the ADW fleet) that
  * checked sign-in and balance themselves before spawning many launches; it skips
- * the per-launch session prompt and balance round trips. The launch org still
- * resolves as on a normal launch (active org, else personal org — the launch's
- * Mnemom key is minted for it), and the Mnemom Agent entitlement (which also
- * gates Remote Control, fail-closed) is still fetched for it.
+ * the per-launch session/personal-org/balance round trips. The Mnemom Agent
+ * entitlement (which also gates Remote Control, fail-closed) is still fetched.
  * Only the exact value `1` counts — anything else, including `true` or ` 1`, is
  * a normal launch.
  */
@@ -527,11 +521,7 @@ export declare function resolveRemoteControlShape(args: {
 export declare function buildCustomHeaders(opts: {
     /** Absent on a subscription-login launch: Claude Code then sends its own claude.ai login. */
     anthropicKey?: string;
-    /**
-     * The Mnemom key every `mnemom agent` launch sends (lib/subscription-login.ts
-     * resolveLaunchMnemomKey) — the gateway refuses the session without it, and on a subscription
-     * login it is also the governed-identity anchor.
-     */
+    /** The governed-identity anchor on a subscription-login launch (lib/subscription-login.ts). */
     mnemomKey?: string;
     agent: string;
     conversationId: string;
@@ -560,42 +550,36 @@ export declare function resolveContextFold(opts: {
  */
 export declare function parseContextProfile(raw: string, source: string): ContextProfile;
 /**
- * Which context profile this launch runs under, or `null` when none was chosen anywhere — then
- * no fold key is sent and the cell's own default decides. Precedence, highest wins:
+ * Which context profile this launch runs under. Precedence, highest wins:
  *   1. `--no-context` — always `off`. Combined with an explicit `--context-profile
  *      balanced|aggressive|adaptive` it is a CONFLICT and the launch refuses (never a silent override);
  *      `--context-profile off` agrees with it.
  *   2. an explicit `--context-profile <profile>` flag (`--context` alongside it is fine — the
  *      profile wins);
- *   3. `resumed`: the profile the session this launch resumes ran under (from the session
- *      ledger), so a resume keeps that session's own choice over the saved default;
- *   4. `MNEMOM_AGENT_CONTEXT_PROFILE` (which `applyConfigToEnv` sets from the `context_profile`
+ *   3. `MNEMOM_AGENT_CONTEXT_PROFILE` (which `applyConfigToEnv` sets from the `context_profile`
  *      config key) — an invalid value is an error, never a silent default;
- *   5. the folding boolean when NO profile is set anywhere: `context = false` in launcher.toml
+ *   4. the folding boolean when NO profile is set anywhere: `context = false` in launcher.toml
  *      (→ `MNEMOM_AGENT_CONTEXT`, see `resolveContextFold`) means `off`;
- *   6. `null` — unset, the cell default.
+ *   5. `balanced` (the default).
  */
 export declare function resolveContextProfile(opts: {
     contextProfile?: ContextProfile;
     context?: boolean;
-    resumed?: ContextProfile | null;
     env?: NodeJS.ProcessEnv;
-}): ContextProfile | null;
+}): ContextProfile;
 /**
  * The decoded per-session env overlay for this launch — the `config` object of the
  * `x-mnemom-session-config` payload, in wire order: the profile's keys first
- * (`CONTEXT_RUNTIME_ENABLED` for `off`; the three fold-tuning keys + size policy off for
- * `aggressive`; size policy off for `balanced`; size policy banded for `adaptive`; nothing when
- * no profile was chosen), then `CONTEXT_HANDOFF_ENABLED: "true"` when context handoff is ON, then
+ * (`CONTEXT_RUNTIME_ENABLED` for `off`; the three fold-tuning keys for `aggressive`;
+ * `CONTEXT_RUNTIME_SIZE_POLICY` for `adaptive`; nothing for `balanced`), then `CONTEXT_HANDOFF_ENABLED: "true"` when context handoff is ON, then
  * `GATEWAY_USAGE_REAL_SIZE: "on"` + `GATEWAY_COMPACTION_INTERCEPT: "on"` when EITHER the
  * `compaction_intercept` setting is ON OR `--compact-at` arms a target below 1M (the target
  * cannot be honored without the intercept), then `GATEWAY_COMPACTION_UPLOAD_TARGET_TOKENS: "<N>"`
- * when a target is set. Empty with no profile chosen and everything off — the common case, where
- * no header is sent at all. Exported so `--dry-run` can list exactly what the header carries.
+ * when a target is set. Empty for `balanced` with everything off — the common case, where no
+ * header is sent at all. Exported so `--dry-run` can list exactly what the header carries.
  */
 export declare function buildSessionConfig(opts: {
-    /** `resolveContextProfile` output: `null` ⇒ no profile chosen, no fold key sent. */
-    profile: ContextProfile | null;
+    profile: ContextProfile;
     contextHandoff: boolean;
     compactionIntercept?: boolean;
     /** `resolveCompactAt` output: `null` (or absent) ⇒ no target, send nothing new. */
@@ -607,7 +591,7 @@ export declare function buildSessionConfig(opts: {
  * gateway's allow-list never sees them as env keys; it ignores unknown envelope fields.
  */
 export declare function buildSessionConfigPayload(opts: {
-    profile: ContextProfile | null;
+    profile: ContextProfile;
     contextHandoff: boolean;
     compactionIntercept?: boolean;
     compactAt?: number | null;
@@ -619,12 +603,11 @@ export declare function buildSessionConfigPayload(opts: {
 } | undefined;
 /**
  * The `x-mnemom-session-config` value for this launch, or `undefined` when there is
- * nothing to override (the cell's own defaults stand — no profile chosen with everything else
- * off, byte-identical to a launch before profiles existed). Independent overlays:
+ * nothing to override (the gateway's own defaults stand — `balanced` with everything else off,
+ * byte-identical to a launch before profiles existed). Independent overlays:
  *   - the context profile (`buildSessionConfig`): `off` → `CONTEXT_RUNTIME_ENABLED: "false"`,
- *     `aggressive` → the three fold-tuning keys + `CONTEXT_RUNTIME_SIZE_POLICY: "off"`,
- *     `balanced` → `CONTEXT_RUNTIME_SIZE_POLICY: "off"`, `adaptive` →
- *     `CONTEXT_RUNTIME_SIZE_POLICY: "banded"`, none chosen → nothing;
+ *     `aggressive` → the three fold-tuning keys, `adaptive` → `CONTEXT_RUNTIME_SIZE_POLICY:
+ *     "banded"`, `balanced` → nothing;
  *   - `compactionIntercept: true` → `GATEWAY_USAGE_REAL_SIZE` + `GATEWAY_COMPACTION_INTERCEPT`
  *     `"on"` (the `compaction_intercept` setting);
  *   - `compactAt: <N>` (`--compact-at`, below 1M) → the SAME two intercept keys plus
@@ -637,20 +620,12 @@ export declare function buildSessionConfigPayload(opts: {
  * base64url so it survives the gateway's inbound strip.
  */
 export declare function buildSessionConfigB64(opts: {
-    profile: ContextProfile | null;
+    profile: ContextProfile;
     contextHandoff: boolean;
     compactionIntercept?: boolean;
     compactAt?: number | null;
     experimental?: readonly string[];
 }): string | undefined;
-/**
- * A no-op `x-mnemom-session-config` value: `{ v: 1, config: {} }` overrides nothing (the gateway
- * applies an empty set, exactly its own defaults). buildSessionConfigB64 returns `undefined` for
- * the defaults — no header at all; this is for a call that must be Mnemom agent traffic (the
- * gateway's agent-traffic gate keys on the header's presence) without changing any setting: the
- * launcher's birth probe (commands/wrap.ts birthThroughGateway).
- */
-export declare const NOOP_SESSION_CONFIG_B64: string;
 /**
  * Is the `handoff` MCP tool + `CONTEXT_HANDOFF_ENABLED` session-config header ON for
  * this launch? OFF by default (operator directive, curation 2026-09-25): an absent flag
@@ -686,12 +661,6 @@ export declare const HANDOFF_MCP_SERVER_NAME = "mnemom-handoff";
  * it the same way it inherits `ANTHROPIC_CUSTOM_HEADERS` under the terminal shape.
  */
 export declare const HANDOFF_RC_KEY_ENV_NAME = "MNEMOM_HANDOFF_KEY";
-/**
- * Beside `HANDOFF_RC_KEY_ENV_NAME`: the non-`ANTHROPIC_*` var `spawnRcCli` sets to the launch's
- * Mnemom key when context handoff is on, so the handoff call carries the `x-mnemom-api-key` the
- * gateway requires on every `mnemom agent` request.
- */
-export declare const HANDOFF_RC_MNEMOM_KEY_ENV_NAME = "MNEMOM_HANDOFF_MNEMOM_KEY";
 /**
  * How the `handoff` MCP server (cli/src/mcp/handoff-server.mjs) recovers the Anthropic key
  * WITHOUT it ever being written into the `--mcp-config` file on disk: `envName` is the NAME of a
@@ -723,12 +692,6 @@ export interface HandoffMcpParams {
     /** The gateway ORIGIN (e.g. https://gateway.mnemom.ai) — see `resolveHandoffGatewayHost`. */
     gatewayHost: string;
     anthropicKeySource: HandoffAnthropicKeySource;
-    /**
-     * Where the server reads the Mnemom key (`x-mnemom-api-key`) from — same contract as
-     * `anthropicKeySource`: `ANTHROPIC_CUSTOM_HEADERS` (its `x-mnemom-api-key:` line) on a terminal
-     * launch, `HANDOFF_RC_MNEMOM_KEY_ENV_NAME` under Remote Control. Absent ⇒ no Mnemom key header.
-     */
-    mnemomKeySource?: HandoffAnthropicKeySource;
     agent: string;
     conversationId: string;
     /** `buildSessionConfigB64` output — forwarded so the route resolves the SAME per-session flag. */

package/dist/lib/agent.js

@@ -452,37 +452,32 @@ export const CONTEXT_TAIL_BUDGET_KEY = "CONTEXT_RUNTIME_TAIL_BUDGET_TOKENS";
 export const CONTEXT_READ_CACHE_KEY = "CONTEXT_RUNTIME_READ_CACHE_TOKENS";
 export const CONTEXT_HEAD_RECLAIM_KEY = "CONTEXT_RUNTIME_HEAD_BREAKPOINT_RECLAIM";
 /**
- * The gateway key that turns the size-banded fold policy on or off (allow-listed per session).
- * Only the literal `banded` enables it; any other value — the profiles send `off` — disables it,
- * and a session's value replaces the cell's own. The band thresholds and budgets stay at the
- * gateway's own defaults.
+ * The gateway key the `adaptive` context profile sets (allow-listed per session): turns on the
+ * size-banded fold policy. Only the literal `banded` enables it; the band thresholds and budgets
+ * stay at the gateway's own defaults.
  */
 export const CONTEXT_SIZE_POLICY_KEY = "CONTEXT_RUNTIME_SIZE_POLICY";
 /**
  * The named presets for how the gateway folds a session's context (`--context-profile`,
- * launcher.toml `context_profile`, `MNEMOM_AGENT_CONTEXT_PROFILE`). Choosing NONE sends no fold
- * key at all and the cell's own default decides (see `resolveContextProfile`). A chosen profile
- * is complete on its own, so a change to a cell's default can never change what it means:
+ * launcher.toml `context_profile`, `MNEMOM_AGENT_CONTEXT_PROFILE`):
  *   - `off`        → `CONTEXT_RUNTIME_ENABLED: "false"` — compaction is left to the coding agent
  *                    (the same bytes `--no-context` has always sent).
- *   - `balanced`   → `CONTEXT_RUNTIME_SIZE_POLICY: "off"` — the cell's own fold budgets, never
- *                    the size bands, even on a cell whose default is adaptive.
- *   - `aggressive` → a smaller tail budget + read cache and head-breakpoint reclaim on, size
- *                    policy off: folds earlier and keeps a tighter working set at every size.
+ *   - `balanced`   → NO fold keys: the gateway's own defaults stand. The default.
+ *   - `aggressive` → a smaller tail budget + read cache and head-breakpoint reclaim on: folds
+ *                    earlier and keeps a tighter working set.
  *   - `adaptive`   → `CONTEXT_RUNTIME_SIZE_POLICY: "banded"` — the gateway picks the fold by the
  *                    conversation's original size: no fold below 200k tokens, the aggressive
- *                    budgets from 200k to 1M, balanced above.
+ *                    budgets from 200k to 1M, balanced above. Opt-in; never the default.
  */
 export const CONTEXT_PROFILES = ["off", "balanced", "aggressive", "adaptive"];
 /** The per-session env overlay each profile expands to (key order is the wire order). */
 const CONTEXT_PROFILE_CONFIG = {
     off: [[CONTEXT_RUNTIME_KEY, "false"]],
-    balanced: [[CONTEXT_SIZE_POLICY_KEY, "off"]],
+    balanced: [],
     aggressive: [
         [CONTEXT_TAIL_BUDGET_KEY, "60000"],
         [CONTEXT_READ_CACHE_KEY, "8000"],
         [CONTEXT_HEAD_RECLAIM_KEY, "true"],
-        [CONTEXT_SIZE_POLICY_KEY, "off"],
     ],
     adaptive: [[CONTEXT_SIZE_POLICY_KEY, "banded"]],
 };
@@ -813,10 +808,8 @@ export function launchPreferenceExplicit(opts, env = process.env) {
  * Has an orchestrator already run the session + µ-balance preflight for this
  * launch? `MNEMOM_AGENT_PREFLIGHTED=1` is for orchestrators (the ADW fleet) that
  * checked sign-in and balance themselves before spawning many launches; it skips
- * the per-launch session prompt and balance round trips. The launch org still
- * resolves as on a normal launch (active org, else personal org — the launch's
- * Mnemom key is minted for it), and the Mnemom Agent entitlement (which also
- * gates Remote Control, fail-closed) is still fetched for it.
+ * the per-launch session/personal-org/balance round trips. The Mnemom Agent
+ * entitlement (which also gates Remote Control, fail-closed) is still fetched.
  * Only the exact value `1` counts — anything else, including `true` or ` 1`, is
  * a normal launch.
  */
@@ -917,20 +910,17 @@ export function parseContextProfile(raw, source) {
     throw new Error(`${source} must be one of ${CONTEXT_PROFILES.join(", ")} (got '${raw}').`);
 }
 /**
- * Which context profile this launch runs under, or `null` when none was chosen anywhere — then
- * no fold key is sent and the cell's own default decides. Precedence, highest wins:
+ * Which context profile this launch runs under. Precedence, highest wins:
  *   1. `--no-context` — always `off`. Combined with an explicit `--context-profile
  *      balanced|aggressive|adaptive` it is a CONFLICT and the launch refuses (never a silent override);
  *      `--context-profile off` agrees with it.
  *   2. an explicit `--context-profile <profile>` flag (`--context` alongside it is fine — the
  *      profile wins);
- *   3. `resumed`: the profile the session this launch resumes ran under (from the session
- *      ledger), so a resume keeps that session's own choice over the saved default;
- *   4. `MNEMOM_AGENT_CONTEXT_PROFILE` (which `applyConfigToEnv` sets from the `context_profile`
+ *   3. `MNEMOM_AGENT_CONTEXT_PROFILE` (which `applyConfigToEnv` sets from the `context_profile`
  *      config key) — an invalid value is an error, never a silent default;
- *   5. the folding boolean when NO profile is set anywhere: `context = false` in launcher.toml
+ *   4. the folding boolean when NO profile is set anywhere: `context = false` in launcher.toml
  *      (→ `MNEMOM_AGENT_CONTEXT`, see `resolveContextFold`) means `off`;
- *   6. `null` — unset, the cell default.
+ *   5. `balanced` (the default).
  */
 export function resolveContextProfile(opts) {
     if (opts.context === false) {
@@ -941,33 +931,28 @@ export function resolveContextProfile(opts) {
     }
     if (opts.contextProfile !== undefined)
         return opts.contextProfile;
-    if (opts.resumed)
-        return opts.resumed;
     const raw = (opts.env?.MNEMOM_AGENT_CONTEXT_PROFILE ?? "").trim();
     if (raw !== "")
         return parseContextProfile(raw, "MNEMOM_AGENT_CONTEXT_PROFILE");
     if (!resolveContextFold({ context: opts.context, env: opts.env }))
         return "off";
-    return null;
+    return "balanced";
 }
 /**
  * The decoded per-session env overlay for this launch — the `config` object of the
  * `x-mnemom-session-config` payload, in wire order: the profile's keys first
- * (`CONTEXT_RUNTIME_ENABLED` for `off`; the three fold-tuning keys + size policy off for
- * `aggressive`; size policy off for `balanced`; size policy banded for `adaptive`; nothing when
- * no profile was chosen), then `CONTEXT_HANDOFF_ENABLED: "true"` when context handoff is ON, then
+ * (`CONTEXT_RUNTIME_ENABLED` for `off`; the three fold-tuning keys for `aggressive`;
+ * `CONTEXT_RUNTIME_SIZE_POLICY` for `adaptive`; nothing for `balanced`), then `CONTEXT_HANDOFF_ENABLED: "true"` when context handoff is ON, then
  * `GATEWAY_USAGE_REAL_SIZE: "on"` + `GATEWAY_COMPACTION_INTERCEPT: "on"` when EITHER the
  * `compaction_intercept` setting is ON OR `--compact-at` arms a target below 1M (the target
  * cannot be honored without the intercept), then `GATEWAY_COMPACTION_UPLOAD_TARGET_TOKENS: "<N>"`
- * when a target is set. Empty with no profile chosen and everything off — the common case, where
- * no header is sent at all. Exported so `--dry-run` can list exactly what the header carries.
+ * when a target is set. Empty for `balanced` with everything off — the common case, where no
+ * header is sent at all. Exported so `--dry-run` can list exactly what the header carries.
  */
 export function buildSessionConfig(opts) {
     const config = {};
-    if (opts.profile !== null) {
-        for (const [k, v] of CONTEXT_PROFILE_CONFIG[opts.profile])
-            config[k] = v;
-    }
+    for (const [k, v] of CONTEXT_PROFILE_CONFIG[opts.profile])
+        config[k] = v;
     if (opts.contextHandoff)
         config[CONTEXT_HANDOFF_KEY] = "true";
     const hasCompactionTarget = opts.compactAt !== undefined && opts.compactAt !== null;
@@ -999,12 +984,11 @@ export function buildSessionConfigPayload(opts) {
 }
 /**
  * The `x-mnemom-session-config` value for this launch, or `undefined` when there is
- * nothing to override (the cell's own defaults stand — no profile chosen with everything else
- * off, byte-identical to a launch before profiles existed). Independent overlays:
+ * nothing to override (the gateway's own defaults stand — `balanced` with everything else off,
+ * byte-identical to a launch before profiles existed). Independent overlays:
  *   - the context profile (`buildSessionConfig`): `off` → `CONTEXT_RUNTIME_ENABLED: "false"`,
- *     `aggressive` → the three fold-tuning keys + `CONTEXT_RUNTIME_SIZE_POLICY: "off"`,
- *     `balanced` → `CONTEXT_RUNTIME_SIZE_POLICY: "off"`, `adaptive` →
- *     `CONTEXT_RUNTIME_SIZE_POLICY: "banded"`, none chosen → nothing;
+ *     `aggressive` → the three fold-tuning keys, `adaptive` → `CONTEXT_RUNTIME_SIZE_POLICY:
+ *     "banded"`, `balanced` → nothing;
  *   - `compactionIntercept: true` → `GATEWAY_USAGE_REAL_SIZE` + `GATEWAY_COMPACTION_INTERCEPT`
  *     `"on"` (the `compaction_intercept` setting);
  *   - `compactAt: <N>` (`--compact-at`, below 1M) → the SAME two intercept keys plus
@@ -1022,14 +1006,6 @@ export function buildSessionConfigB64(opts) {
         return undefined;
     return Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
 }
-/**
- * A no-op `x-mnemom-session-config` value: `{ v: 1, config: {} }` overrides nothing (the gateway
- * applies an empty set, exactly its own defaults). buildSessionConfigB64 returns `undefined` for
- * the defaults — no header at all; this is for a call that must be Mnemom agent traffic (the
- * gateway's agent-traffic gate keys on the header's presence) without changing any setting: the
- * launcher's birth probe (commands/wrap.ts birthThroughGateway).
- */
-export const NOOP_SESSION_CONFIG_B64 = Buffer.from(JSON.stringify({ v: 1, config: {} }), "utf8").toString("base64url");
 /**
  * Is the `handoff` MCP tool + `CONTEXT_HANDOFF_ENABLED` session-config header ON for
  * this launch? OFF by default (operator directive, curation 2026-09-25): an absent flag
@@ -1073,12 +1049,6 @@ export const HANDOFF_MCP_SERVER_NAME = "mnemom-handoff";
  * it the same way it inherits `ANTHROPIC_CUSTOM_HEADERS` under the terminal shape.
  */
 export const HANDOFF_RC_KEY_ENV_NAME = "MNEMOM_HANDOFF_KEY";
-/**
- * Beside `HANDOFF_RC_KEY_ENV_NAME`: the non-`ANTHROPIC_*` var `spawnRcCli` sets to the launch's
- * Mnemom key when context handoff is on, so the handoff call carries the `x-mnemom-api-key` the
- * gateway requires on every `mnemom agent` request.
- */
-export const HANDOFF_RC_MNEMOM_KEY_ENV_NAME = "MNEMOM_HANDOFF_MNEMOM_KEY";
 /** The `--mcp-config` document registering exactly the `handoff` tool. Pure — no I/O. */
 export function buildHandoffMcpConfig(p) {
     const env = {
@@ -1087,8 +1057,6 @@ export function buildHandoffMcpConfig(p) {
         MNEMOM_HANDOFF_AGENT: p.agent,
         MNEMOM_HANDOFF_CONVERSATION_ID: p.conversationId,
     };
-    if (p.mnemomKeySource)
-        env.MNEMOM_HANDOFF_MNEMOM_KEY_ENV_NAME = p.mnemomKeySource.envName;
     if (p.sessionConfigB64)
         env.MNEMOM_HANDOFF_SESSION_CONFIG = p.sessionConfigB64;
     return {

package/dist/lib/api.d.ts

@@ -1069,27 +1069,6 @@ export declare function listApiKeys(): Promise<ApiKeyListItem[]>;
  * for non-staff, admin:org for users not in any org-admin role).
  */
 export declare function createApiKey(name: string, scopes: ApiKeyScope[]): Promise<ApiKeyCreated>;
-/**
- * POST /v1/orgs/{org_id}/api-keys — mint an ORG-owned key (its `org_id` is that org, so the
- * gateway births a new agent there). Owners and admins may mint any scopes; a member may mint a
- * key whose scopes are exactly ["gateway"]. A refusal (viewer/auditor, a non-member, or an API
- * that predates member org keys) is thrown as MnemomApiError with its status (403/404).
- */
-export declare function createOrgApiKey(orgId: string, name: string, scopes: ApiKeyScope[]): Promise<ApiKeyCreated>;
-/**
- * GET /v1/api-keys/whoami authenticated by `key` ALONE (`X-Mnemom-Api-Key`, no session): does
- * the API accept this key? true = 200. false = 401/403 — revoked, rotated or unknown, OR a valid
- * `gateway`-only key: the API refuses every key without an `api:*` scope (ADR-049), so false
- * alone never proves a key dead. Throws on anything else (network, timeout, 429, 5xx): the
- * caller reads that as "could not check".
- */
-export declare function apiAcceptsMnemomKey(key: string, timeoutMs: number): Promise<boolean>;
-/**
- * GET /v1/api-keys with a timeout, for checking a key: the signed-in caller's ACTIVE keys (a
- * revoked or rotated key is absent). null when there is no usable session (no credential, or
- * 401/403 after the refresh retry). Throws on anything else (network, timeout, 5xx).
- */
-export declare function listOwnApiKeysForCheck(timeoutMs: number): Promise<ApiKeyListItem[] | null>;
 /**
  * POST /v1/api-keys/{key_id}/rotate — atomic mint-new + revoke-old.
  * Returns the full new secret only on this call. The new key inherits
@@ -1099,13 +1078,9 @@ export declare function listOwnApiKeysForCheck(timeoutMs: number): Promise<ApiKe
 export declare function rotateApiKey(keyId: string): Promise<ApiKeyCreated>;
 /**
  * DELETE /v1/api-keys/{key_id} — soft-revoke. The key row stays for
- * audit; `is_active` flips to false and `revoked_at` is timestamped. Only
- * a key the signed-in user created (an org key they minted included) is
- * found; anything else is a 404. `timeoutMs` bounds the call.
+ * audit; `is_active` flips to false and `revoked_at` is timestamped.
  */
-export declare function revokeApiKey(keyId: string, opts?: {
-    timeoutMs?: number;
-}): Promise<void>;
+export declare function revokeApiKey(keyId: string): Promise<void>;
 export interface LicenseValidationResult {
     valid: boolean;
     license_id?: string;

package/dist/lib/api.js

@@ -1385,65 +1385,6 @@ export async function createApiKey(name, scopes) {
     }
     return (await response.json());
 }
-/**
- * POST /v1/orgs/{org_id}/api-keys — mint an ORG-owned key (its `org_id` is that org, so the
- * gateway births a new agent there). Owners and admins may mint any scopes; a member may mint a
- * key whose scopes are exactly ["gateway"]. A refusal (viewer/auditor, a non-member, or an API
- * that predates member org keys) is thrown as MnemomApiError with its status (403/404).
- */
-export async function createOrgApiKey(orgId, name, scopes) {
-    const url = validateUrl(`${API_BASE}/v1/orgs/${encodeURIComponent(sanitizeForHttp(orgId))}/api-keys`);
-    const response = await fetchWithAuthRetry(url, async () => ({
-        method: "POST",
-        headers: { ...(await authHeaders()), "Content-Type": "application/json" },
-        body: JSON.stringify({ name, scopes }),
-    }));
-    if (!response.ok) {
-        if (response.status === 401)
-            throw new MnemomApiError(401, NOT_AUTHENTICATED_MSG);
-        throw await readApiError(response, "Failed to create org api key");
-    }
-    return (await response.json());
-}
-/**
- * GET /v1/api-keys/whoami authenticated by `key` ALONE (`X-Mnemom-Api-Key`, no session): does
- * the API accept this key? true = 200. false = 401/403 — revoked, rotated or unknown, OR a valid
- * `gateway`-only key: the API refuses every key without an `api:*` scope (ADR-049), so false
- * alone never proves a key dead. Throws on anything else (network, timeout, 429, 5xx): the
- * caller reads that as "could not check".
- */
-export async function apiAcceptsMnemomKey(key, timeoutMs) {
-    const url = validateUrl(`${API_BASE}/v1/api-keys/whoami`);
-    const response = await mnemomFetch(url, {
-        headers: { "X-Mnemom-Api-Key": sanitizeForHttp(key), Accept: "application/json" },
-        signal: AbortSignal.timeout(timeoutMs),
-    });
-    if (response.ok)
-        return true;
-    if (response.status === 401 || response.status === 403)
-        return false;
-    throw new MnemomApiError(response.status, `api-key whoami: HTTP ${response.status}`);
-}
-/**
- * GET /v1/api-keys with a timeout, for checking a key: the signed-in caller's ACTIVE keys (a
- * revoked or rotated key is absent). null when there is no usable session (no credential, or
- * 401/403 after the refresh retry). Throws on anything else (network, timeout, 5xx).
- */
-export async function listOwnApiKeysForCheck(timeoutMs) {
-    if ((await resolveAuth()).type === "none")
-        return null;
-    const url = validateUrl(`${API_BASE}/v1/api-keys`);
-    const response = await fetchWithAuthRetry(url, async () => ({
-        headers: { ...(await authHeaders()), Accept: "application/json" },
-        signal: AbortSignal.timeout(timeoutMs),
-    }));
-    if (response.status === 401 || response.status === 403)
-        return null;
-    if (!response.ok) {
-        throw new MnemomApiError(response.status, `list api keys: HTTP ${response.status}`);
-    }
-    return (await response.json()).keys ?? [];
-}
 /**
  * POST /v1/api-keys/{key_id}/rotate — atomic mint-new + revoke-old.
  * Returns the full new secret only on this call. The new key inherits
@@ -1469,16 +1410,13 @@ export async function rotateApiKey(keyId) {
 }
 /**
  * DELETE /v1/api-keys/{key_id} — soft-revoke. The key row stays for
- * audit; `is_active` flips to false and `revoked_at` is timestamped. Only
- * a key the signed-in user created (an org key they minted included) is
- * found; anything else is a 404. `timeoutMs` bounds the call.
+ * audit; `is_active` flips to false and `revoked_at` is timestamped.
  */
-export async function revokeApiKey(keyId, opts = {}) {
+export async function revokeApiKey(keyId) {
     const url = validateUrl(`${API_BASE}/v1/api-keys/${encodeURIComponent(keyId)}`);
     const response = await fetchWithAuthRetry(url, async () => ({
         method: "DELETE",
         headers: await authHeaders(),
-        signal: opts.timeoutMs ? AbortSignal.timeout(opts.timeoutMs) : undefined,
     }));
     if (!response.ok) {
         if (response.status === 401) {

package/dist/lib/launcher-config.d.ts

@@ -56,11 +56,10 @@ export interface LauncherConfig {
      */
     compactionIntercept?: boolean;
     /**
-     * How the gateway folds each session's context (unset: nothing is sent, the gateway cell's
-     * own default decides): `off` leaves compaction to the coding agent, `balanced` keeps more
-     * earlier work verbatim, `aggressive` folds earlier with a tighter working set, `adaptive`
-     * sizes the fold to the conversation (none below 200k tokens, aggressive up to 1M, balanced
-     * above). `--context-profile` overrides it for one launch without saving anything.
+     * How the gateway folds each session's context (`balanced` when unset): `off` leaves
+     * compaction to the coding agent, `balanced` keeps more earlier work verbatim, `aggressive`
+     * folds earlier with a tighter working set, `adaptive` sizes the fold to the conversation
+     * (none below 200k tokens, aggressive up to 1M, balanced above). `--context-profile` overrides it per launch.
      */
     contextProfile?: ContextProfile;
     /**

package/dist/lib/launcher-config.js

@@ -215,7 +215,7 @@ export const CONFIG_KEYS = [
     },
     {
         key: "context_profile",
-        describe: `How the gateway folds each session's context (${CONTEXT_PROFILES.join("|")}; unset = the gateway cell's default)`,
+        describe: `How the gateway folds each session's context (${CONTEXT_PROFILES.join("|")}; balanced by default)`,
         get: (c) => c.contextProfile,
         set: (c, v) => {
             c.contextProfile = parseContextProfile(v, "context_profile");