@mnemom/mnemom 0.17.7-next.1 → 0.17.7

package/dist/lib/subscription-login.d.ts

@@ -1,40 +1,15 @@
 /**
- * `mnemom agent` launch auth: the `auth` setting (api-key | console | subscription) and the
- * Mnemom API key EVERY launch sends.
- *
- * The Mnemom key (`x-mnemom-api-key`) rides on every governed request a launch makes, for every
- * auth mode and launch shape: the gateway refuses `mnemom agent` traffic that carries no
- * verified Mnemom key. This module resolves it — env, then the key stored for the active org in
- * the 0600 store, then a freshly minted gateway-only key — checks it once (a revoked or rotated
- * stored key is replaced), and a launch that cannot resolve one refuses to start.
- *
- * Which org a key belongs to: the key is minted FOR the launch's org — the active org, else the
- * caller's personal org, i.e. the org the launcher claims the agent into — as an org-owned key
- * with scopes exactly ["gateway"] (POST /v1/orgs/:id/api-keys; any owner/admin/member may mint
- * one), so the gateway's agent-traffic org check (#2289: the agent's org must be the key's org)
- * passes. There is no personal-key fallback: a personal key has no org, so the gateway would
- * refuse every governed turn with it. When the mint is refused (an API that predates member org
- * keys, or a viewer/auditor role) the launch stops with guidance — ask an org owner/admin for a
- * gateway-scoped org key, or set MNEMOM_AGENT_MNEMOM_KEY to one. Each saved key records the org
- * it was minted for; a launch in another org mints and saves a key for that org.
- *
- * When the launcher replaces a key it minted and saved (proven dead, minted for another org, or
- * the legacy single-field key), it revokes the old one best-effort. An env-provided key is never
- * replaced and never revoked.
- *
- * Birth org: the launcher's gateway probe/birth call carries the key AND a no-op
- * `x-mnemom-session-config`, which makes it Mnemom agent traffic: the gateway verifies the key
- * and births a new agent in the key's org. The launcher's claim step then records the claim in
- * that same org.
- *
- * With a Claude subscription login (`auth = subscription`) — Team and Enterprise plans only;
- * the gateway checks the plan with Anthropic and refuses anything else
- * (gateway/src/subscription-auth.ts) — Claude Code authenticates to the gateway with its own
- * claude.ai OAuth login: the launch sets ANTHROPIC_BASE_URL and leaves ANTHROPIC_API_KEY /
- * ANTHROPIC_AUTH_TOKEN unset, so Claude Code sends `Authorization: Bearer <its login>`. No
- * Anthropic key is involved; the gateway anchors the governed identity on the Mnemom key and
- * creates the agent in that key's org on the first turn, so there is no CLI-side birth or
- * claim.
+ * `mnemom agent` with a Claude subscription login (`auth = subscription`) — Team and
+ * Enterprise plans only; the gateway checks the plan with Anthropic and refuses anything
+ * else (gateway/src/subscription-auth.ts).
+ *
+ * Claude Code then authenticates to the gateway with its own claude.ai OAuth login: the
+ * launch sets ANTHROPIC_BASE_URL and leaves ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN unset,
+ * so Claude Code sends `Authorization: Bearer <its login>`. No Anthropic key is involved.
+ * The gateway anchors the governed identity on a Mnemom API key instead
+ * (`x-mnemom-api-key`), which this module resolves — env, then the 0600 store, then a
+ * freshly minted gateway-only key — and the agent is created in that key's org on the
+ * first turn, so there is no CLI-side birth or claim.
  *
  * Remote Control is internal-only (see subscriptionShape); the context-handoff tool
  * authenticates with an Anthropic key, so it is off on a subscription launch.
@@ -47,133 +22,26 @@ export type AgentAuth = "api-key" | "subscription" | "console";
 export declare const AGENT_AUTHS: readonly AgentAuth[];
 /** Env override for the setting (the launcher.toml `auth` key folds into it). */
 export declare const AGENT_AUTH_ENV = "MNEMOM_AGENT_AUTH";
-/** Env override for the Mnemom key every launch sends. */
+/** Env override for the Mnemom key a subscription launch sends. */
 export declare const MNEMOM_KEY_ENV = "MNEMOM_AGENT_MNEMOM_KEY";
-/**
- * Legacy field in ~/.mnemom/launcher.json (0600): the single minted key, from before keys were
- * stored per org. Read as the no-org slot; retired when that slot is written.
- */
+/** Field in ~/.mnemom/launcher.json (0600) holding the minted key. */
 export declare const MNEMOM_KEY_STORE_FIELD = "mnemom_api_key";
-/**
- * Field in ~/.mnemom/launcher.json (0600): `{ <active org id | "_none">: { key, key_id, org_id } }`
- * — one slot per `mnemom org use` setting; `org_id` is the org the key was minted for.
- */
-export declare const MNEMOM_KEYS_BY_ORG_FIELD = "mnemom_api_keys";
 export declare function coerceAgentAuth(raw: string): AgentAuth;
 /** `--auth` flag > MNEMOM_AGENT_AUTH (launcher.toml folds in here) > api-key. */
 export declare function resolveAgentAuth(flag: string | undefined, env: Record<string, string | undefined>): AgentAuth;
-/** A key in the 0600 store: the secret, and its API key_id when this CLI minted it. */
-export interface StoredMnemomKey {
-    key: string;
-    /** Absent on a key saved before key ids were stored. */
-    keyId?: string;
-    /** The launch org this key was minted for. Absent on a key saved before orgs were stored. */
-    orgId?: string;
-}
-/**
- * Is a Mnemom key live? `invalid` only when it is PROVEN dead (checkMnemomKey); anything unproven
- * (offline, slow, no session, a gateway-only key the API cannot introspect) is `unknown` — a
- * launch then proceeds with the key, and the gateway refuses a dead one with a clear message.
- */
-export type MnemomKeyCheck = "valid" | "invalid" | "unknown";
 export interface MnemomKeyDeps {
     env: Record<string, string | undefined>;
-    /**
-     * The active org (`mnemom org use`), or null when none is set. The store holds one key per
-     * org: a minted key belongs to the org that was active when it was minted.
-     */
-    activeOrgId: string | null;
-    /**
-     * The org this launch runs in — the active org, else the caller's personal org (the org the
-     * launcher claims the agent into) — or null when unknown. Keys are minted for it; with none
-     * known, a launch that needs a new key refuses (it has no org to mint one for).
-     */
-    launchOrgId: string | null;
-    readStored(orgId: string | null): StoredMnemomKey | undefined;
-    /**
-     * Mint an org-owned key with scopes ["gateway"] for `orgId`. Throws when the API refuses (a
-     * refusal carries `status`/`effectiveStatus` 403). Any `orgId` on the result is ignored: the
-     * store records the org the key was minted FOR.
-     */
-    mint(orgId: string): Promise<StoredMnemomKey>;
-    store(orgId: string | null, key: StoredMnemomKey): void;
-    /** checkMnemomKey over the real API, with short timeouts. Never throws. */
-    check(key: string, keyId: string | undefined): Promise<MnemomKeyCheck>;
-    /** Revoke a key this CLI minted, by key_id (needs a session). May throw; callers ignore it. */
-    revoke(keyId: string): Promise<void>;
+    readStored(): string | undefined;
+    /** Mint a gateway-only personal key for this machine; returns the secret. */
+    mint(): Promise<string>;
+    store(key: string): void;
     say(line: string): void;
 }
-/** A Mnemom key that is already on this machine, and where it came from. */
-export interface LocalMnemomKey {
-    key: string;
-    source: "env" | "store";
-    /** The stored key's API key_id, when known. */
-    keyId?: string;
-    /** The org the stored key was minted for, when known. */
-    orgId?: string;
-}
-/**
- * The Mnemom key already on this machine — MNEMOM_AGENT_MNEMOM_KEY, else the key stored for the
- * active org — or null. Never mints. Shared by the launch (which mints on null), `mnemom agent
- * doctor` (which reports the source) and the goal commands (which send the key the launch sent).
- */
-export declare function readLocalMnemomKey(deps: Pick<MnemomKeyDeps, "env" | "readStored" | "activeOrgId">): LocalMnemomKey | null;
-/** The I/O behind checkMnemomKey (lib/api.ts apiAcceptsMnemomKey / listOwnApiKeysForCheck). */
-export interface MnemomKeyCheckIo {
-    /** true = the API accepted the key on its own (whoami 200); false = it refused it (401/403). */
-    apiAccepts(key: string): Promise<boolean>;
-    /** The signed-in account's active keys (incl. org keys it minted), or null with no session. */
-    listOwnKeys(): Promise<Array<{
-        key_id: string;
-    }> | null>;
-}
-/**
- * Is `key` a live Mnemom key? A key counts as dead (`invalid`) only when that is PROVEN;
- * anything unproven proceeds, and the gateway refuses a dead key with a clear message.
- *
- *   - A key whose key_id we know (this CLI minted and saved it): the signed-in account's active
- *     keys — which include the org keys it minted — either list that key_id (`valid`) or do not:
- *     the key was revoked or rotated (`invalid`). No usable session ⇒ `unknown`.
- *   - Any other key (MNEMOM_AGENT_MNEMOM_KEY, a legacy saved key): whoami with the key itself.
- *     200 ⇒ `valid`. A refusal proves nothing — the API refuses every key without an `api:*`
- *     scope (ADR-049), so a live gateway-only key is refused exactly like a dead one ⇒ `unknown`.
- *     Key prefixes are never matched: an 8-character prefix collides across keys.
- *
- * Any error or timeout ⇒ `unknown`.
- */
-export declare function checkMnemomKey(key: string, keyId: string | undefined, io: MnemomKeyCheckIo): Promise<MnemomKeyCheck>;
-/**
- * The Mnemom key every launch sends — api-key, console and subscription alike: the local key
- * (readLocalMnemomKey); else mint one (scopes ["gateway"], org-owned, for the launch's org) and
- * store it. The key is never printed.
- *
- *   - MNEMOM_AGENT_MNEMOM_KEY is used as given: not checked here (nothing could prove it dead —
- *     see checkMnemomKey), never replaced, never revoked. The gateway refuses a dead one.
- *   - A saved key minted for another org than the launch's (or saved before orgs were recorded,
- *     e.g. the legacy single-field key) is replaced by one for the launch's org, unchecked.
- *   - A saved key checked once (`deps.check`) and proven dead is replaced by a fresh one.
- *   - Replacing a saved key this CLI minted revokes the old one, best-effort.
- *
- * THROWS when no key can be had (no launch org, or the mint is refused or fails): the gateway
- * would refuse the session, so the launch must not start.
- */
-export declare function resolveLaunchMnemomKey(deps: MnemomKeyDeps): Promise<string>;
-/** Did the API refuse the mint (403: an API that predates member org keys, or a viewer/auditor)? */
-export declare function isMintRefusal(err: unknown): boolean;
-/** Store slot for a key minted with no active org (for the caller's personal org). */
-export declare const NO_ORG_SLOT = "_none";
-/**
- * The key stored for `orgId` in the store document: `mnemom_api_keys[<org id | _none>]`. The
- * pre-per-org field `mnemom_api_key` (a bare string, minted personal) still serves the no-org
- * slot until that slot is written. CR/LF stripped; anything malformed reads as no key.
- */
-export declare function readStoredMnemomKey(data: Record<string, unknown>, orgId: string | null): StoredMnemomKey | undefined;
 /**
- * The mergeStore patch that saves `key` for `orgId` — replacing that org's key, keeping every
- * other org's. Writing the no-org slot retires the legacy `mnemom_api_key` field (a null value
- * removes it), so a stale legacy key can never shadow the new one.
+ * The Mnemom key a subscription launch sends: MNEMOM_AGENT_MNEMOM_KEY, else the stored
+ * key, else mint one (gateway scope only) and store it. The key is never printed.
  */
-export declare function storePatchForMnemomKey(data: Record<string, unknown>, orgId: string | null, key: StoredMnemomKey): Record<string, unknown>;
+export declare function resolveSubscriptionMnemomKey(deps: MnemomKeyDeps): Promise<string>;
 /**
  * Remote Control on a subscription login is open to accounts entitled to Remote Control
  * (internal Mnemom accounts): the RC proxy then forwards the user's own OAuth bearer to the

package/dist/lib/subscription-login.js

@@ -1,40 +1,15 @@
 /**
- * `mnemom agent` launch auth: the `auth` setting (api-key | console | subscription) and the
- * Mnemom API key EVERY launch sends.
+ * `mnemom agent` with a Claude subscription login (`auth = subscription`) — Team and
+ * Enterprise plans only; the gateway checks the plan with Anthropic and refuses anything
+ * else (gateway/src/subscription-auth.ts).
  *
- * The Mnemom key (`x-mnemom-api-key`) rides on every governed request a launch makes, for every
- * auth mode and launch shape: the gateway refuses `mnemom agent` traffic that carries no
- * verified Mnemom key. This module resolves it — env, then the key stored for the active org in
- * the 0600 store, then a freshly minted gateway-only key — checks it once (a revoked or rotated
- * stored key is replaced), and a launch that cannot resolve one refuses to start.
- *
- * Which org a key belongs to: the key is minted FOR the launch's org — the active org, else the
- * caller's personal org, i.e. the org the launcher claims the agent into — as an org-owned key
- * with scopes exactly ["gateway"] (POST /v1/orgs/:id/api-keys; any owner/admin/member may mint
- * one), so the gateway's agent-traffic org check (#2289: the agent's org must be the key's org)
- * passes. There is no personal-key fallback: a personal key has no org, so the gateway would
- * refuse every governed turn with it. When the mint is refused (an API that predates member org
- * keys, or a viewer/auditor role) the launch stops with guidance — ask an org owner/admin for a
- * gateway-scoped org key, or set MNEMOM_AGENT_MNEMOM_KEY to one. Each saved key records the org
- * it was minted for; a launch in another org mints and saves a key for that org.
- *
- * When the launcher replaces a key it minted and saved (proven dead, minted for another org, or
- * the legacy single-field key), it revokes the old one best-effort. An env-provided key is never
- * replaced and never revoked.
- *
- * Birth org: the launcher's gateway probe/birth call carries the key AND a no-op
- * `x-mnemom-session-config`, which makes it Mnemom agent traffic: the gateway verifies the key
- * and births a new agent in the key's org. The launcher's claim step then records the claim in
- * that same org.
- *
- * With a Claude subscription login (`auth = subscription`) — Team and Enterprise plans only;
- * the gateway checks the plan with Anthropic and refuses anything else
- * (gateway/src/subscription-auth.ts) — Claude Code authenticates to the gateway with its own
- * claude.ai OAuth login: the launch sets ANTHROPIC_BASE_URL and leaves ANTHROPIC_API_KEY /
- * ANTHROPIC_AUTH_TOKEN unset, so Claude Code sends `Authorization: Bearer <its login>`. No
- * Anthropic key is involved; the gateway anchors the governed identity on the Mnemom key and
- * creates the agent in that key's org on the first turn, so there is no CLI-side birth or
- * claim.
+ * Claude Code then authenticates to the gateway with its own claude.ai OAuth login: the
+ * launch sets ANTHROPIC_BASE_URL and leaves ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN unset,
+ * so Claude Code sends `Authorization: Bearer <its login>`. No Anthropic key is involved.
+ * The gateway anchors the governed identity on a Mnemom API key instead
+ * (`x-mnemom-api-key`), which this module resolves — env, then the 0600 store, then a
+ * freshly minted gateway-only key — and the agent is created in that key's org on the
+ * first turn, so there is no CLI-side birth or claim.
  *
  * Remote Control is internal-only (see subscriptionShape); the context-handoff tool
  * authenticates with an Anthropic key, so it is off on a subscription launch.
@@ -44,18 +19,10 @@
 export const AGENT_AUTHS = ["api-key", "subscription", "console"];
 /** Env override for the setting (the launcher.toml `auth` key folds into it). */
 export const AGENT_AUTH_ENV = "MNEMOM_AGENT_AUTH";
-/** Env override for the Mnemom key every launch sends. */
+/** Env override for the Mnemom key a subscription launch sends. */
 export const MNEMOM_KEY_ENV = "MNEMOM_AGENT_MNEMOM_KEY";
-/**
- * Legacy field in ~/.mnemom/launcher.json (0600): the single minted key, from before keys were
- * stored per org. Read as the no-org slot; retired when that slot is written.
- */
+/** Field in ~/.mnemom/launcher.json (0600) holding the minted key. */
 export const MNEMOM_KEY_STORE_FIELD = "mnemom_api_key";
-/**
- * Field in ~/.mnemom/launcher.json (0600): `{ <active org id | "_none">: { key, key_id, org_id } }`
- * — one slot per `mnemom org use` setting; `org_id` is the org the key was minted for.
- */
-export const MNEMOM_KEYS_BY_ORG_FIELD = "mnemom_api_keys";
 /**
  * The key is spliced into the newline-joined ANTHROPIC_CUSTOM_HEADERS block, so an embedded
  * CR/LF (a multi-line paste, a bad env value) would inject extra header lines.
@@ -77,188 +44,35 @@ export function resolveAgentAuth(flag, env) {
     return fromEnv ? coerceAgentAuth(fromEnv) : "api-key";
 }
 /**
- * The Mnemom key already on this machine — MNEMOM_AGENT_MNEMOM_KEY, else the key stored for the
- * active org — or null. Never mints. Shared by the launch (which mints on null), `mnemom agent
- * doctor` (which reports the source) and the goal commands (which send the key the launch sent).
+ * The Mnemom key a subscription launch sends: MNEMOM_AGENT_MNEMOM_KEY, else the stored
+ * key, else mint one (gateway scope only) and store it. The key is never printed.
  */
-export function readLocalMnemomKey(deps) {
+export async function resolveSubscriptionMnemomKey(deps) {
     const fromEnv = headerSafe(deps.env[MNEMOM_KEY_ENV] ?? "");
     if (fromEnv)
-        return { key: fromEnv, source: "env" };
-    const stored = deps.readStored(deps.activeOrgId);
-    const key = headerSafe(stored?.key ?? "");
-    if (!key)
-        return null;
-    const local = { key, source: "store" };
-    if (stored?.keyId)
-        local.keyId = stored.keyId;
-    if (stored?.orgId)
-        local.orgId = stored.orgId;
-    return local;
-}
-/**
- * Is `key` a live Mnemom key? A key counts as dead (`invalid`) only when that is PROVEN;
- * anything unproven proceeds, and the gateway refuses a dead key with a clear message.
- *
- *   - A key whose key_id we know (this CLI minted and saved it): the signed-in account's active
- *     keys — which include the org keys it minted — either list that key_id (`valid`) or do not:
- *     the key was revoked or rotated (`invalid`). No usable session ⇒ `unknown`.
- *   - Any other key (MNEMOM_AGENT_MNEMOM_KEY, a legacy saved key): whoami with the key itself.
- *     200 ⇒ `valid`. A refusal proves nothing — the API refuses every key without an `api:*`
- *     scope (ADR-049), so a live gateway-only key is refused exactly like a dead one ⇒ `unknown`.
- *     Key prefixes are never matched: an 8-character prefix collides across keys.
- *
- * Any error or timeout ⇒ `unknown`.
- */
-export async function checkMnemomKey(key, keyId, io) {
-    try {
-        if (!keyId)
-            return (await io.apiAccepts(key)) ? "valid" : "unknown";
-        const own = await io.listOwnKeys();
-        if (own === null)
-            return "unknown";
-        return own.some((k) => k.key_id === keyId) ? "valid" : "invalid";
-    }
-    catch {
-        return "unknown";
-    }
-}
-/**
- * The Mnemom key every launch sends — api-key, console and subscription alike: the local key
- * (readLocalMnemomKey); else mint one (scopes ["gateway"], org-owned, for the launch's org) and
- * store it. The key is never printed.
- *
- *   - MNEMOM_AGENT_MNEMOM_KEY is used as given: not checked here (nothing could prove it dead —
- *     see checkMnemomKey), never replaced, never revoked. The gateway refuses a dead one.
- *   - A saved key minted for another org than the launch's (or saved before orgs were recorded,
- *     e.g. the legacy single-field key) is replaced by one for the launch's org, unchecked.
- *   - A saved key checked once (`deps.check`) and proven dead is replaced by a fresh one.
- *   - Replacing a saved key this CLI minted revokes the old one, best-effort.
- *
- * THROWS when no key can be had (no launch org, or the mint is refused or fails): the gateway
- * would refuse the session, so the launch must not start.
- */
-export async function resolveLaunchMnemomKey(deps) {
-    const local = readLocalMnemomKey(deps);
-    if (!local)
-        return mintAndStore(deps, null);
-    if (local.source === "env")
-        return local.key;
-    if (deps.launchOrgId && local.orgId !== deps.launchOrgId) {
-        deps.say("mnemom agent: the saved Mnemom API key was minted for another org — minting one for this launch's org.");
-        return mintAndStore(deps, local);
-    }
-    if ((await deps.check(local.key, local.keyId)) !== "invalid")
-        return local.key;
-    deps.say("mnemom agent: the saved Mnemom API key is no longer active (revoked or rotated) — minting a new one.");
-    return mintAndStore(deps, local);
-}
-/** Did the API refuse the mint (403: an API that predates member org keys, or a viewer/auditor)? */
-export function isMintRefusal(err) {
-    if (!err || typeof err !== "object")
-        return false;
-    const { status, effectiveStatus } = err;
-    return (effectiveStatus ?? status) === 403;
-}
-const ORG_KEY_GUIDANCE = `  Ask an org owner or admin for an org API key with the \`gateway\` scope for this org, and set ${MNEMOM_KEY_ENV} to it.`;
-/**
- * Mint and save a key for the launch's org, then revoke `replaced` — the saved key it supersedes
- * — best-effort: only once the new key is saved (the store never points at a revoked key) and
- * only when its key_id is known (a legacy saved key has none; it is left as is).
- */
-async function mintAndStore(deps, replaced) {
-    const orgId = deps.launchOrgId;
-    if (!orgId) {
-        throw new Error("mnemom agent: every launch needs a Mnemom API key for the org it runs in, and this launch's org is unknown.\n" +
-            `  Pick one with \`mnemom org use <org>\`, or:\n${ORG_KEY_GUIDANCE}`);
-    }
+        return fromEnv;
+    const stored = headerSafe(deps.readStored() ?? "");
+    if (stored)
+        return stored;
     let minted;
     try {
-        minted = await deps.mint(orgId);
+        minted = headerSafe(await deps.mint());
     }
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
-        const why = isMintRefusal(err)
-            ? `the Mnemom API refused to mint one for this org (${msg}) — your org role may not allow it (viewer or auditor), or the API predates member org keys`
-            : `minting one for this org failed (${msg})`;
-        throw new Error(`mnemom agent: every launch needs a Mnemom API key (the gateway refuses governed traffic without one) and ${why}.\n${ORG_KEY_GUIDANCE}`, { cause: err });
+        throw new Error(`mnemom agent: subscription login needs a Mnemom API key and minting one failed (${msg}).\n` +
+            `  Create one with \`mnemom api-key create --name mnemom-agent --scopes gateway\` and set ${MNEMOM_KEY_ENV}.`, { cause: err });
     }
-    const key = headerSafe(minted.key ?? "");
-    if (!key)
+    if (!minted)
         throw new Error("mnemom agent: the API returned an empty Mnemom key.");
-    const saved = { key, orgId };
-    if (minted.keyId)
-        saved.keyId = minted.keyId;
     try {
-        deps.store(deps.activeOrgId, saved);
+        deps.store(minted);
+        deps.say("mnemom agent: minted a gateway-only Mnemom API key for subscription login (saved to ~/.mnemom/launcher.json, 0600).");
     }
     catch {
         deps.say("mnemom agent: minted a gateway-only Mnemom API key for this launch but could not save it — the next launch mints another.");
-        return key;
-    }
-    deps.say("mnemom agent: minted a gateway-only Mnemom API key for this org (saved to ~/.mnemom/launcher.json, 0600).");
-    if (replaced?.keyId) {
-        try {
-            await deps.revoke(replaced.keyId);
-        }
-        catch {
-            // Best-effort: the old key may already be revoked, or not this account's to revoke.
-        }
     }
-    return key;
-}
-// ── The 0600 store's shape (~/.mnemom/launcher.json) ─────────────────────────
-/** Store slot for a key minted with no active org (for the caller's personal org). */
-export const NO_ORG_SLOT = "_none";
-function slotOf(orgId) {
-    return orgId || NO_ORG_SLOT;
-}
-/**
- * The key stored for `orgId` in the store document: `mnemom_api_keys[<org id | _none>]`. The
- * pre-per-org field `mnemom_api_key` (a bare string, minted personal) still serves the no-org
- * slot until that slot is written. CR/LF stripped; anything malformed reads as no key.
- */
-export function readStoredMnemomKey(data, orgId) {
-    const byOrg = data[MNEMOM_KEYS_BY_ORG_FIELD];
-    const entry = byOrg && typeof byOrg === "object" && !Array.isArray(byOrg)
-        ? byOrg[slotOf(orgId)]
-        : undefined;
-    if (entry && typeof entry === "object") {
-        const { key, key_id, org_id } = entry;
-        if (typeof key !== "string")
-            return undefined;
-        const stored = { key: headerSafe(key) };
-        if (typeof key_id === "string" && key_id)
-            stored.keyId = key_id;
-        if (typeof org_id === "string" && org_id)
-            stored.orgId = org_id;
-        return stored;
-    }
-    const legacy = data[MNEMOM_KEY_STORE_FIELD];
-    if (orgId === null && typeof legacy === "string")
-        return { key: headerSafe(legacy) };
-    return undefined;
-}
-/**
- * The mergeStore patch that saves `key` for `orgId` — replacing that org's key, keeping every
- * other org's. Writing the no-org slot retires the legacy `mnemom_api_key` field (a null value
- * removes it), so a stale legacy key can never shadow the new one.
- */
-export function storePatchForMnemomKey(data, orgId, key) {
-    const prev = data[MNEMOM_KEYS_BY_ORG_FIELD];
-    const byOrg = prev && typeof prev === "object" && !Array.isArray(prev)
-        ? { ...prev }
-        : {};
-    const entry = { key: key.key };
-    if (key.keyId)
-        entry.key_id = key.keyId;
-    if (key.orgId)
-        entry.org_id = key.orgId;
-    byOrg[slotOf(orgId)] = entry;
-    const patch = { [MNEMOM_KEYS_BY_ORG_FIELD]: byOrg };
-    if (orgId === null)
-        patch[MNEMOM_KEY_STORE_FIELD] = null;
-    return patch;
+    return minted;
 }
 /**
  * Remote Control on a subscription login is open to accounts entitled to Remote Control
@@ -285,9 +99,8 @@ export function subscriptionChildEnv(base, door, headers) {
     const env = { ...base };
     delete env.ANTHROPIC_API_KEY;
     delete env.ANTHROPIC_AUTH_TOKEN;
-    // The key already rides in the headers; the child process has no other use for it. Same
-    // strip, same constant, as the api-key/console arm of launchTerminal and the RC child.
-    Reflect.deleteProperty(env, MNEMOM_KEY_ENV);
+    // The key already rides in the headers; the child process has no other use for it.
+    delete env.MNEMOM_AGENT_MNEMOM_KEY;
     env.ANTHROPIC_BASE_URL = door;
     env.ANTHROPIC_CUSTOM_HEADERS = headers;
     return env;

package/dist/mcp/handoff-server.mjs

@@ -25,11 +25,8 @@
 // request time instead. A terminal launch names `ANTHROPIC_CUSTOM_HEADERS` (parsed for its
 // `x-api-key:` line); Remote Control names a dedicated `MNEMOM_HANDOFF_KEY` its launcher sets
 // directly, since RC's child env strips every ANTHROPIC_* var (see `HandoffAnthropicKeySource`
-// in cli/src/lib/agent.ts for the full rationale). The Mnemom key (`x-mnemom-api-key`, required by
-// the gateway on every `mnemom agent` request) rides the same way, named by
-// `MNEMOM_HANDOFF_MNEMOM_KEY_ENV_NAME`: the `x-mnemom-api-key:` line of `ANTHROPIC_CUSTOM_HEADERS`
-// on a terminal launch, `MNEMOM_HANDOFF_MNEMOM_KEY` under Remote Control. This process never logs
-// any of these vars' names or values.
+// in cli/src/lib/agent.ts for the full rationale). This process never logs either var's name or
+// value.
 
 import { createInterface } from "node:readline";
 import { pathToFileURL } from "node:url";
@@ -70,33 +67,29 @@ const REQUIRED_ENV = [
 ];
 
 /**
- * Recover a key from an env var NAME this process itself inherited from its parent (never a
- * value written into the `--mcp-config` file). `ANTHROPIC_CUSTOM_HEADERS` is a multi-line header
- * BLOCK (`buildCustomHeaders`, cli/src/lib/agent.ts) carrying `x-api-key: <key>` and
- * `x-mnemom-api-key: <key>` lines — extract just the line `header` asks for. Any other name is
- * treated as carrying the key value directly.
+ * Recover the Anthropic key from an env var NAME this process itself inherited from its parent
+ * (never a value written into the `--mcp-config` file). `ANTHROPIC_CUSTOM_HEADERS` is a
+ * multi-line header BLOCK (`buildCustomHeaders`, cli/src/lib/agent.ts) whose first line is
+ * `x-api-key: <key>` — extract just that. Any other name is treated as carrying the key value
+ * directly.
  * @param {string} name
  * @param {NodeJS.ProcessEnv} env
- * @param {RegExp} header the header line to read out of a header block
  * @returns {string} the key, or "" if the named var is absent/unusable.
  */
-function resolveKeyFromEnvName(name, env, header) {
+function resolveKeyFromEnvName(name, env) {
   const value = env[name] ?? "";
   if (name === "ANTHROPIC_CUSTOM_HEADERS") {
-    const m = value.match(header);
+    const m = value.match(/^x-api-key:\s*(.+)$/im);
     return m ? m[1].trim() : "";
   }
   return value.trim();
 }
 
-const ANTHROPIC_KEY_LINE = /^x-api-key:\s*(.+)$/im;
-const MNEMOM_KEY_LINE = /^x-mnemom-api-key:\s*(.+)$/im;
-
 /**
  * Read the tool's config from env. Throws (message never contains the key value) when a
  * required var is missing, or when the named key-source var resolves to no usable key.
  * @param {NodeJS.ProcessEnv} env
- * @returns {{gatewayHost: string, anthropicKey: string, mnemomKey?: string, agent: string, conversationId: string, sessionConfigB64?: string}}
+ * @returns {{gatewayHost: string, anthropicKey: string, agent: string, conversationId: string, sessionConfigB64?: string}}
  */
 export function configFromEnv(env) {
   const missing = REQUIRED_ENV.filter((k) => !(env[k] ?? "").trim());
@@ -104,30 +97,16 @@ export function configFromEnv(env) {
     throw new Error(`mnemom-handoff: missing required env var(s): ${missing.join(", ")}`);
   }
   const keyEnvName = env.MNEMOM_HANDOFF_ANTHROPIC_KEY_ENV_NAME.trim();
-  const anthropicKey = resolveKeyFromEnvName(keyEnvName, env, ANTHROPIC_KEY_LINE);
+  const anthropicKey = resolveKeyFromEnvName(keyEnvName, env);
   if (!anthropicKey) {
     throw new Error(
       `mnemom-handoff: MNEMOM_HANDOFF_ANTHROPIC_KEY_ENV_NAME names '${keyEnvName}', but this ` +
         "process's own inherited environment has no usable value for it.",
     );
   }
-  // The Mnemom key the gateway requires on every `mnemom agent` request. A launcher that names
-  // no source sends none; a named source that resolves to nothing is a config error.
-  const mnemomKeyEnvName = (env.MNEMOM_HANDOFF_MNEMOM_KEY_ENV_NAME ?? "").trim();
-  let mnemomKey;
-  if (mnemomKeyEnvName) {
-    mnemomKey = resolveKeyFromEnvName(mnemomKeyEnvName, env, MNEMOM_KEY_LINE);
-    if (!mnemomKey) {
-      throw new Error(
-        `mnemom-handoff: MNEMOM_HANDOFF_MNEMOM_KEY_ENV_NAME names '${mnemomKeyEnvName}', but this ` +
-          "process's own inherited environment has no usable Mnemom key in it.",
-      );
-    }
-  }
   return {
     gatewayHost: env.MNEMOM_HANDOFF_GATEWAY_HOST.trim(),
     anthropicKey,
-    mnemomKey,
     agent: env.MNEMOM_HANDOFF_AGENT.trim(),
     conversationId: env.MNEMOM_HANDOFF_CONVERSATION_ID.trim(),
     sessionConfigB64: env.MNEMOM_HANDOFF_SESSION_CONFIG?.trim() || undefined,
@@ -136,7 +115,7 @@ export function configFromEnv(env) {
 
 /**
  * Build the fetch call. Exported so a test can assert the wire shape without mocking fetch.
- * @param {{gatewayHost: string, anthropicKey: string, mnemomKey?: string, agent: string, conversationId: string, sessionConfigB64?: string}} cfg
+ * @param {{gatewayHost: string, anthropicKey: string, agent: string, conversationId: string, sessionConfigB64?: string}} cfg
  * @param {string} note
  */
 export function buildHandoffRequest(cfg, note) {
@@ -145,7 +124,6 @@ export function buildHandoffRequest(cfg, note) {
     "x-api-key": cfg.anthropicKey,
     "x-mnemom-agent": cfg.agent,
   };
-  if (cfg.mnemomKey) headers["x-mnemom-api-key"] = cfg.mnemomKey;
   if (cfg.sessionConfigB64) headers["x-mnemom-session-config"] = cfg.sessionConfigB64;
   return {
     url: `${cfg.gatewayHost.replace(/\/+$/, "")}${HANDOFF_PATH}`,
@@ -172,7 +150,7 @@ function extractGatewayError(body) {
  * Call the route and render the result. NEVER throws: a network failure, a non-2xx status, or
  * an unparseable body all come back as `{ok:false, message}` for the caller to surface as an
  * MCP tool error — the tool must never crash the server or the session over a bad response.
- * @param {{gatewayHost: string, anthropicKey: string, mnemomKey?: string, agent: string, conversationId: string, sessionConfigB64?: string}} cfg
+ * @param {{gatewayHost: string, anthropicKey: string, agent: string, conversationId: string, sessionConfigB64?: string}} cfg
  * @param {string} note
  * @param {typeof fetch} fetchImpl
  */

package/dist/rc-proxy.mjs

@@ -19,7 +19,7 @@
 //     byte-for-byte (telemetry, Datadog, MCP servers…).
 //   * Inside api.anthropic.com, only `POST /v1/messages[?…]` is rewritten to the Mnemom
 //     gateway door: the real Anthropic key rides as `x-api-key` (API-key billing), plus
-//     `x-mnemom-agent`, `x-mnemom-conversation-id`, `x-mnemom-api-key` (stdin line 2), and optionally
+//     `x-mnemom-agent`, `x-mnemom-conversation-id`, and optionally `x-mnemom-api-key`,
 //     `x-mnemom-provider`, `x-mnemom-egress-key`, `x-mnemom-contract` / `x-mnemom-goal-mode` — the exact header set
 //     the non-RC launch sends via ANTHROPIC_CUSTOM_HEADERS. The OAuth `authorization` bearer
 //     is STRIPPED on that leg (it never leaves the machine) and `oauth-*` tokens are removed
@@ -51,11 +51,8 @@
 //         (diagnostic only: it forwards continue-deltas the API rejects).
 //
 // SECRETS
-// Arrive on stdin as three newline-terminated lines: Anthropic key, Mnemom key, OpenAI egress
-// key (may be empty). `mnemom agent` sends the Mnemom key on every launch, in both auth modes —
-// the gateway refuses its traffic without one — and the proxy adds it as `x-mnemom-api-key` on
-// every gateway request whenever line 2 is set (required in subscription mode, where it also
-// anchors the identity). Never argv, never env, never disk, never logged.
+// Arrive on stdin as three newline-terminated lines: Anthropic key, Mnemom key (may be
+// empty), OpenAI egress key (may be empty). Never argv, never env, never disk, never logged.
 // The log (MNEMOM_AGENT_RC_PROXY_LOG, else stderr) carries method/path/status/latency and the
 // gateway's `x-mnemom-agent` / `x-mnemom-goal-verdict` response headers only. Gateway error
 // bodies (status ≥ 400) are logged truncated so a 4xx is diagnosable (compressed ones as

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemom/mnemom",
-  "version": "0.17.7-next.1",
+  "version": "0.17.7",
   "description": "Transparent AI agent tracing",
   "type": "module",
   "bin": {