@mnemom/mnemom 0.17.7-next.2 → 0.17.7

package/dist/commands/agent.js

@@ -33,10 +33,10 @@ import { basename, join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { statuslineLaunch } from "../lib/statusline.js";
 import { getApiUrl, getGatewayUrl, MNEMOM_DIR } from "../lib/config.js";
-import { apiAcceptsMnemomKey, createOrgApiKey, getAgentByName, listOwnApiKeysForCheck, revokeApiKey, } from "../lib/api.js";
-import { checkMnemomKey, MNEMOM_KEY_ENV, readLocalMnemomKey, readStoredMnemomKey, resolveAgentAuth, resolveLaunchMnemomKey, storePatchForMnemomKey, subscriptionChildEnv, subscriptionShape, } from "../lib/subscription-login.js";
-import { LEDGER_FILE, appendSessionRecord, findResumeCandidate, readSessionRecords, resolveRetentionDays, resumedContextProfile, toLedgerContract, } from "../lib/agent-ledger.js";
-import { getActiveOrg, loadCliConfig } from "../lib/cli-config.js";
+import { createApiKey, getAgentByName } from "../lib/api.js";
+import { MNEMOM_KEY_STORE_FIELD, resolveAgentAuth, resolveSubscriptionMnemomKey, subscriptionChildEnv, subscriptionShape, } from "../lib/subscription-login.js";
+import { LEDGER_FILE, appendSessionRecord, findResumeCandidate, readSessionRecords, resolveRetentionDays, toLedgerContract, } from "../lib/agent-ledger.js";
+import { loadCliConfig } from "../lib/cli-config.js";
 import { configKeySpec, loadLauncherConfig, writeLauncherConfig } from "../lib/launcher-config.js";
 import { experimentalNotice } from "../lib/experimental.js";
 import { fmt } from "../lib/format.js";
@@ -45,42 +45,22 @@ import { authConfigured, chooseAuth, detectClaudeLogin, readClaudeLoginState, }
 import { requireConsoleKey, readConsoleKey } from "../lib/console-key.js";
 import { goalAlignmentLine, resolveSessionSetup } from "./agent-session.js";
 import { AgentIdentityMismatchError, defaultAgentSlug, ensureGovernedAgent, ensureSessionAndBalance, isQuietPreambleExit, resolveDefaultSlug, resolvePreflightedAccount, } from "./agent-setup.js";
-import { assembleContract, buildGoalModeHeader, buildCustomHeaders, buildHandoffMcpConfigJson, buildSessionConfig, buildSessionConfigB64, assertCompactAtCompatible, assertOffProfileCompatible, compactAtWindowWarning, describeCompactAt, launchWindow, resolveCompactAt, applyGatewayHintHeaders, resolveCompactionIntercept, resolveContextHandoff, resolveContextProfile, resolveHandoffGatewayHost, HANDOFF_RC_KEY_ENV_NAME, HANDOFF_RC_MNEMOM_KEY_ENV_NAME, isProdGateway, launchPreferenceExplicit, launchPreflighted, remoteControlAllowed, applyToolSearchDefault, DISABLE_1M_ENV, readCcSettings, resolveWindowModel, resolveAnthropicDoor, resolveLaunchModel, resolveConversationId, resolveGatewayHost, singleCellError, resolveLaunchShape, resolveRemoteControlShape, passthroughName, sanitizeAgentName, sessionDisplayName, SESSION_NAME_ENV, SESSION_CONFIG_HEADER, } from "../lib/agent.js";
-import { LAUNCHER_STORE_PATH, mergeStore, readStore } from "../lib/launcher-store.js";
+import { assembleContract, buildGoalModeHeader, buildCustomHeaders, buildHandoffMcpConfigJson, buildSessionConfig, buildSessionConfigB64, assertCompactAtCompatible, compactAtWindowWarning, describeCompactAt, launchWindow, resolveCompactAt, applyGatewayHintHeaders, resolveCompactionIntercept, resolveContextHandoff, resolveContextProfile, resolveHandoffGatewayHost, HANDOFF_RC_KEY_ENV_NAME, isProdGateway, launchPreferenceExplicit, launchPreflighted, remoteControlAllowed, applyToolSearchDefault, DISABLE_1M_ENV, readCcSettings, resolveWindowModel, resolveAnthropicDoor, resolveLaunchModel, resolveConversationId, resolveGatewayHost, singleCellError, resolveLaunchShape, resolveRemoteControlShape, passthroughName, sanitizeAgentName, sessionDisplayName, SESSION_NAME_ENV, SESSION_CONFIG_HEADER, } from "../lib/agent.js";
+import { LAUNCHER_STORE_PATH, mergeStore } from "../lib/launcher-store.js";
 import { slackChannelArgs } from "../lib/slack-launch.js";
 /** The CLI's own provider-key store (zero 1Password): ~/.mnemom/launcher.json, 0600. */
 const CODE_STORE = LAUNCHER_STORE_PATH;
 const say = (line = "") => console.error(line);
 /** The one-line launch note when the compaction intercept is ON. */
 const COMPACTION_INTERCEPT_NOTE = "mnemom agent: compaction intercept ON (experimental) — requested from the gateway (GATEWAY_USAGE_REAL_SIZE, GATEWAY_COMPACTION_INTERCEPT); a gateway without the companion support drops both keys and the session runs as before.";
-const OFF_DROPS_COMPACTION_NOTE = "mnemom agent: compaction intercept off for this session — context profile off leaves compaction to the coding agent, so the standing compaction_intercept / compact_at setting is not sent.";
 /**
- * The compaction notes for a resolved launch. Context profile `off` sends the intercept off and
- * no target (`buildSessionConfig`), so a standing intercept or target is reported as dropped
- * rather than as ON.
- */
-function sayCompaction(profile, compactionIntercept, compactAt, window) {
-    const off = profile === "off";
-    sayCompactAt(off ? null : compactAt, window);
-    if (off && (compactionIntercept || compactAt !== null))
-        say(OFF_DROPS_COMPACTION_NOTE);
-    else if (compactionIntercept)
-        say(COMPACTION_INTERCEPT_NOTE);
-}
-/**
- * The one-line launch note for the context profile: `null` (none chosen — nothing is sent) names
- * the cell default. `off` keeps the wording `--no-context` has always printed.
+ * The one-line launch note for a non-default context profile (`balanced`, the default, is
+ * silent — nothing is sent). `off` keeps the wording `--no-context` has always printed.
  */
 function sayContextProfile(profile) {
-    if (profile === null) {
-        say("mnemom agent: context: cell default");
-    }
-    else if (profile === "off") {
+    if (profile === "off") {
         say("mnemom agent: context folding OFF for this session (--no-context or context = false).");
     }
-    else if (profile === "balanced") {
-        say("mnemom agent: context profile balanced — the gateway keeps more of the earlier work verbatim and folds later.");
-    }
     else if (profile === "aggressive") {
         say("mnemom agent: context profile aggressive — the gateway folds earlier and keeps a tighter working set.");
     }
@@ -194,12 +174,11 @@ export async function agentCommand(scenarioArg, options = {}) {
     const cellNote = isProdGateway(env) ? "us-2/prod" : `custom (${gatewayHost})`;
     const yolo = options.yolo !== false; // default ON
     const contextHint = options.contextHint !== false; // default ON
-    // Context profile: none (null — the cell's own default, no fold key sent) unless
-    // --context-profile / MNEMOM_AGENT_CONTEXT_PROFILE (the `context_profile` setting) chooses
-    // one; --no-context (or `context = false` in launcher.toml → MNEMOM_AGENT_CONTEXT) is `off`. A
-    // chosen profile rides in the per-session config header; `undefined` sessionConfigB64 ⇒
-    // nothing sent. A resume re-resolves it below, once the resumed session is known.
-    let contextProfile = resolveContextProfile({
+    // Context profile: `balanced` (the gateway's own defaults) unless --context-profile /
+    // MNEMOM_AGENT_CONTEXT_PROFILE (the `context_profile` setting) says otherwise; --no-context
+    // (or `context = false` in launcher.toml → MNEMOM_AGENT_CONTEXT) is `off`. Anything but
+    // balanced rides in the per-session config header; `undefined` sessionConfigB64 ⇒ nothing sent.
+    const contextProfile = resolveContextProfile({
         contextProfile: options.contextProfile,
         context: options.context,
         env,
@@ -223,13 +202,6 @@ export async function agentCommand(scenarioArg, options = {}) {
     // cannot arm without the intercept it just turned off. Refuse rather than silently pick
     // a side.
     assertCompactAtCompatible({ compactionIntercept: options.compactionIntercept, compactAt });
-    // Context profile off sends the intercept off: an explicit --compaction-intercept or
-    // --compact-at <N> in the same launch contradicts it. A resume re-checks below.
-    assertOffProfileCompatible({
-        profile: contextProfile,
-        compactionIntercept: options.compactionIntercept,
-        compactAt: options.compactAt,
-    });
     const experimental = options.experimental ?? [];
     const sessionConfig = buildSessionConfig({
         profile: contextProfile,
@@ -237,7 +209,7 @@ export async function agentCommand(scenarioArg, options = {}) {
         compactionIntercept,
         compactAt,
     });
-    let sessionConfigB64 = buildSessionConfigB64({
+    const sessionConfigB64 = buildSessionConfigB64({
         profile: contextProfile,
         contextHandoff,
         compactionIntercept,
@@ -301,10 +273,12 @@ export async function agentCommand(scenarioArg, options = {}) {
             say("mnemom agent: the plan shows Remote Control because this machine can run it; the real launch uses it only if your account is entitled (internal Mnemom accounts), else terminal-only.");
         }
         sayContextProfile(contextProfile);
-        sayCompaction(contextProfile, compactionIntercept, compactAt, launchWindow(windowModelFor(options, cli)));
+        sayCompactAt(compactAt, launchWindow(windowModelFor(options, cli)));
         if (contextHandoff) {
             say("mnemom agent: context handoff ON (experimental) — the `handoff` MCP tool would be registered.");
         }
+        if (compactionIntercept)
+            say(COMPACTION_INTERCEPT_NOTE);
         return;
     }
     // Real launch: make sure we actually have a CLI to run. If we couldn't find it,
@@ -328,9 +302,8 @@ export async function agentCommand(scenarioArg, options = {}) {
     // lives in (default: the user's personal org). No µ ⇒ blocked with a
     // portal-style top-up message. Skipped only on --dry-run (handled above).
     // MNEMOM_AGENT_PREFLIGHTED=1 (orchestrators such as the ADW fleet that already
-    // ran their own session + balance preflight) skips those round trips; the launch
-    // org resolves the same way and its entitlement is still fetched — see
-    // resolvePreflightedAccount.
+    // ran their own session + balance preflight) skips those round trips; the
+    // entitlement is still fetched — see resolvePreflightedAccount.
     let account;
     try {
         account = launchPreflighted(env)
@@ -370,19 +343,14 @@ export async function agentCommand(scenarioArg, options = {}) {
         rcCapable: rc.ok,
         say,
     });
-    // Subscription login: Remote Control only for RC-entitled (internal) accounts.
+    // Subscription login: Remote Control only for RC-entitled (internal) accounts, and the governed identity anchors on a
+    // Mnemom API key (minted once and stored if there is none). Resolved after sign-in so
+    // minting can use the session.
+    let mnemomKey;
     if (auth === "subscription") {
         shape = subscriptionShape(shape, shapeExplicit, rcAllowed, say);
+        mnemomKey = await resolveSubscriptionMnemomKey(defaultMnemomKeyDeps());
     }
-    // Every launch — api-key, console and subscription, every shape — sends a Mnemom API key
-    // (x-mnemom-api-key): the gateway refuses `mnemom agent` traffic without a verified one.
-    // Resolved after sign-in so minting and the one-time liveness check can use the session: the
-    // key stored for the active org, checked once (a revoked/rotated one is re-minted), else a
-    // fresh key minted for the launch's org (account.orgId: the active org, else the personal
-    // org — the org the agent is claimed into, which the gateway's org check requires of the key)
-    // and stored. No key ⇒ this throws and the launch does not start (a session the gateway
-    // would refuse is worse than an actionable error).
-    const mnemomKey = await resolveLaunchMnemomKey(defaultMnemomKeyDeps(CODE_STORE, account.orgId));
     // Now that a session exists, a defaulted slug uses the real login handle from
     // /v1/auth/me (the stored token has no email, so the pre-sign-in value was the
     // "agent-user" fallback). Only when the caller didn't name an agent. Under an
@@ -413,7 +381,6 @@ export async function agentCommand(scenarioArg, options = {}) {
             const ensured = await ensureGovernedAgent({
                 slug: agent,
                 anthropicKey,
-                mnemomKey,
                 setup: options.setup,
                 gatewayHost,
             });
@@ -457,38 +424,6 @@ export async function agentCommand(scenarioArg, options = {}) {
             passthrough: [...(options.passthrough ?? []), "--resume", continuation.resumeCcSessionId],
         };
     }
-    // A launch that resumes a Claude Code session (the continuation above, or the caller's own
-    // `-- --resume <id>`) keeps the profile that session ran under, unless this launch chose one
-    // with a flag. Read from the ledger only — nothing here writes a default anywhere.
-    const resumeId = shape === "server" ? null : passthroughResumeId(options.passthrough ?? []);
-    if (resumeId && options.contextProfile === undefined && options.context !== false) {
-        let resumed;
-        try {
-            resumed = resumedContextProfile(readSessionRecords({ dir: MNEMOM_DIR }), {
-                ccSessionId: resumeId,
-                orgId: account.orgId,
-                gatewayHost,
-            });
-        }
-        catch {
-            resumed = null; // best-effort: an unreadable ledger keeps the launch's own resolution
-        }
-        if (resumed !== null && resumed !== contextProfile) {
-            contextProfile = resolveContextProfile({ context: options.context, resumed, env });
-            assertOffProfileCompatible({
-                profile: contextProfile,
-                compactionIntercept: options.compactionIntercept,
-                compactAt: options.compactAt,
-            });
-            sessionConfigB64 = buildSessionConfigB64({
-                profile: contextProfile,
-                contextHandoff,
-                compactionIntercept,
-                compactAt,
-                experimental,
-            });
-        }
-    }
     // ── local session ledger (~/.mnemom/sessions.jsonl) ── one line per real
     // launch so `mnemom agent sessions` / `show` can find this conversation later.
     // Written after provisioning so a freshly claimed agent's id resolves. Holds
@@ -520,14 +455,16 @@ export async function agentCommand(scenarioArg, options = {}) {
         goalMode,
         ccSessionId: cc.id,
         contextProfile,
-        compactAt: contextProfile === "off" ? null : compactAt,
+        compactAt,
     });
     logLaunch({ shape, door, agent, conversationId, cellNote, envelope, goalMode, cli });
     if (expNotice)
         say(expNotice);
     say(goalAlignmentLine(goalAlignmentMode(envelope, goalMode)));
     sayContextProfile(contextProfile);
-    sayCompaction(contextProfile, compactionIntercept, compactAt, launchWindow(win));
+    sayCompactAt(compactAt, launchWindow(win));
+    if (compactionIntercept)
+        say(COMPACTION_INTERCEPT_NOTE);
     // ── handoff MCP tool (MNE-7564) ── OFF by default: absent/false ⇒ handoffMcpConfigPath stays
     // undefined and buildCliArgs/spawnRcCli are byte-identical to a build without this flag. ON:
     // the config is written to a 0600 temp file and referenced by PATH only — never inlined into
@@ -543,22 +480,15 @@ export async function agentCommand(scenarioArg, options = {}) {
             // back out at request time. Remote Control (both shapes) strips every ANTHROPIC_* auth
             // var from the child's env, so `spawnRcCli` below instead sets a dedicated, non-ANTHROPIC
             // var (HANDOFF_RC_KEY_ENV_NAME) on that same child env — still nothing in this file.
-            // The Mnemom key the gateway requires rides the same way: its `x-mnemom-api-key:` line
-            // in ANTHROPIC_CUSTOM_HEADERS (terminal), or HANDOFF_RC_MNEMOM_KEY_ENV_NAME (RC).
-            const terminal = shape === "terminal";
-            const anthropicKeySource = terminal
+            const anthropicKeySource = shape === "terminal"
                 ? { envName: "ANTHROPIC_CUSTOM_HEADERS" }
                 : { envName: HANDOFF_RC_KEY_ENV_NAME };
-            const mnemomKeySource = terminal
-                ? { envName: "ANTHROPIC_CUSTOM_HEADERS" }
-                : { envName: HANDOFF_RC_MNEMOM_KEY_ENV_NAME };
             handoffMcpConfigPath = writeHandoffMcpConfigFile(buildHandoffMcpConfigJson({
                 // The SAME origin the session's own model traffic goes to — not resolveGatewayHost,
                 // which would ignore a MNEMOM_AGENT_ANTHROPIC_GATEWAY override (a test-cell launch
                 // must never send its handoff calls to prod, or vice versa).
                 gatewayHost: resolveHandoffGatewayHost(door),
                 anthropicKeySource,
-                mnemomKeySource,
                 agent,
                 conversationId,
                 sessionConfigB64,
@@ -759,9 +689,7 @@ export async function recordSessionLaunch(ctx) {
         cli: ctx.cli.name,
         contract: toLedgerContract(ctx.envelope?.contract ?? null),
         goal_mode: goalAlignmentMode(ctx.envelope, ctx.goalMode),
-        ...(ctx.contextProfile !== null
-            ? { context_profile: ctx.contextProfile, context_profile_v: 2 }
-            : {}),
+        context_profile: ctx.contextProfile,
         compact_at: ctx.compactAt,
         cc_session_id: ctx.ccSessionId ?? null,
         ...(ctx.options.experimental?.length ? { experimental: [...ctx.options.experimental] } : {}),
@@ -778,55 +706,25 @@ export async function recordSessionLaunch(ctx) {
 // ───────────────────────────────────────────────────────────────────────────
 // Credential resolution (zero 1Password)
 // ───────────────────────────────────────────────────────────────────────────
-/** Per-call timeout of the launch's Mnemom-key check: a slow API must not hold up a launch. */
-export const MNEMOM_KEY_CHECK_TIMEOUT_MS = 2500;
-/**
- * Mint the launch's key: an ORG-owned key for `orgId` (the launch's org) with scopes exactly
- * ["gateway"], which any owner/admin/member may mint — so the gateway's agent-traffic org check
- * (agent org = key org) passes for the agent the launcher claims into that org. Never a personal
- * key: it has no org, and the gateway would refuse every governed turn with it. A refusal (403:
- * an API that predates member org keys, or a viewer/auditor role) is thrown as is; the launch
- * stops with guidance (lib/subscription-login.ts mintAndStore).
- */
-export async function mintLaunchMnemomKey(orgId) {
-    const k = await createOrgApiKey(orgId, `mnemom-agent ${hostname()}`, ["gateway"]);
-    return { key: k.key, keyId: k.key_id };
-}
-/**
- * The real I/O behind every launch's Mnemom key (lib/subscription-login.ts). `launchOrgId` is
- * the org the launch runs in (ensureSessionAndBalance's `orgId`: the active org, else the
- * caller's personal org); omitted or empty, it is the active org.
- */
-export function defaultMnemomKeyDeps(storePath = CODE_STORE, launchOrgId) {
-    const activeOrgId = getActiveOrg()?.org_id || null;
+/** The real I/O behind a subscription launch's Mnemom key (lib/subscription-login.ts). */
+export function defaultMnemomKeyDeps(storePath = CODE_STORE) {
     return {
         env: process.env,
-        activeOrgId,
-        launchOrgId: launchOrgId || activeOrgId,
-        readStored: (orgId) => readStoredMnemomKey(readStore(storePath), orgId),
-        mint: mintLaunchMnemomKey,
-        store: (orgId, key) => mergeStore(storePatchForMnemomKey(readStore(storePath), orgId, key), storePath),
-        check: (key, keyId) => checkMnemomKey(key, keyId, {
-            apiAccepts: (k) => apiAcceptsMnemomKey(k, MNEMOM_KEY_CHECK_TIMEOUT_MS),
-            listOwnKeys: () => listOwnApiKeysForCheck(MNEMOM_KEY_CHECK_TIMEOUT_MS),
-        }),
-        // DELETE /v1/api-keys/:key_id revokes only keys the signed-in user created (org keys
-        // included), so a replaced key minted by someone else is never touched.
-        revoke: (keyId) => revokeApiKey(keyId, { timeoutMs: MNEMOM_KEY_CHECK_TIMEOUT_MS }),
+        readStored: () => {
+            try {
+                const data = JSON.parse(readFileSync(storePath, "utf8"));
+                const v = data[MNEMOM_KEY_STORE_FIELD];
+                return typeof v === "string" ? stripCrlf(v) : undefined;
+            }
+            catch {
+                return undefined;
+            }
+        },
+        mint: async () => (await createApiKey(`mnemom-agent ${hostname()}`, ["gateway"])).key,
+        store: (key) => mergeStore({ [MNEMOM_KEY_STORE_FIELD]: key }, storePath),
         say,
     };
 }
-/**
- * The Mnemom key already on this machine (MNEMOM_AGENT_MNEMOM_KEY, then ~/.mnemom/launcher.json),
- * never minted: `mnemom agent doctor` reports its source, the goal commands send it.
- */
-export function localLaunchMnemomKey(storePath = CODE_STORE) {
-    return readLocalMnemomKey(defaultMnemomKeyDeps(storePath));
-}
-/** The launch's one-time check of that key (`mnemom agent doctor` reports it). Never throws. */
-export function verifyLocalMnemomKey(local) {
-    return defaultMnemomKeyDeps().check(local.key, local.keyId);
-}
 /** The real machine behind lib/console-key.ts: the macOS keychain via `security`, no shell. */
 export function defaultConsoleKeyDeps(env) {
     return {
@@ -1102,8 +1000,6 @@ function launchTerminal(ctx) {
     if (ctx.anthropicKey) {
         childEnv = { ...process.env };
         delete childEnv.ANTHROPIC_API_KEY;
-        // The Mnemom key already rides in the headers; the child has no other use for it.
-        Reflect.deleteProperty(childEnv, MNEMOM_KEY_ENV);
         childEnv.ANTHROPIC_BASE_URL = ctx.door;
         childEnv.ANTHROPIC_AUTH_TOKEN = "mnemom-gateway";
         childEnv.ANTHROPIC_CUSTOM_HEADERS = headers;
@@ -1288,10 +1184,9 @@ function launchRemoteControl(ctx) {
         }
     };
     process.on("exit", onExit);
-    // Secrets on stdin — three lines (anthropic, mnemom, openai). Every launch sends the Mnemom
-    // key (the proxy adds it as x-mnemom-api-key on every gateway request); an api-key launch
-    // also sends the Anthropic key, a subscription launch leaves that line empty (the user's
-    // OAuth bearer is what pays). openai is always empty on this Anthropic-only door.
+    // Secrets on stdin — three lines (anthropic, mnemom, openai). An api-key launch sends the
+    // Anthropic key only; a subscription launch sends the Mnemom key only (the identity anchor —
+    // the user's OAuth bearer is what pays). openai is always empty on this Anthropic-only door.
     // A proxy that exits before reading them turns this write into an EPIPE; that is
     // not a failure of its own — the exited-before-READY check below refuses the
     // launch. Any other stdin error fails closed like a spawn error.
@@ -1302,7 +1197,7 @@ function launchRemoteControl(ctx) {
         onExit();
         process.exit(1);
     });
-    proxy.stdin?.end(`${ctx.anthropicKey ?? ""}\n${ctx.mnemomKey}\n\n`);
+    proxy.stdin?.end(`${ctx.anthropicKey ?? ""}\n${ctx.anthropicKey ? "" : (ctx.mnemomKey ?? "")}\n\n`);
     let stdoutBuf = "";
     const start = Date.now();
     const tryStart = () => {
@@ -1370,9 +1265,6 @@ function spawnRcCli(ctx) {
         "no_proxy",
         "HTTP_PROXY",
         "http_proxy",
-        // The Mnemom key rides to the gateway via the proxy (stdin) and, with handoff on, in
-        // HANDOFF_RC_MNEMOM_KEY_ENV_NAME below; the CLI itself has no use for the launch's env var.
-        MNEMOM_KEY_ENV,
     ]);
     const childEnv = {};
     for (const [k, v] of Object.entries(process.env)) {
@@ -1400,10 +1292,8 @@ function spawnRcCli(ctx) {
     // ride through here ungated), so this rides through untouched. Only set when the tool is
     // actually registered — never on a plain RC launch.
     // (Never on a subscription launch — handoff is turned off there, so there is no key to set.)
-    // The Mnemom key the gateway requires rides beside it in its own non-ANTHROPIC var.
     if (ctx.handoffMcpConfigPath && ctx.anthropicKey) {
         childEnv[HANDOFF_RC_KEY_ENV_NAME] = ctx.anthropicKey;
-        childEnv[HANDOFF_RC_MNEMOM_KEY_ENV_NAME] = ctx.mnemomKey;
     }
     let args;
     if (ctx.shape === "server") {
@@ -1676,7 +1566,7 @@ export function printPlan(ctx) {
     L.push(`  agent:         ${ctx.agent}`);
     L.push(`  conversation:  ${ctx.conversationId}`);
     L.push(`  yolo:          ${ctx.yolo ? "on (--dangerously-skip-permissions)" : "off"}`);
-    L.push(`  context:       ${ctx.contextProfile ?? "cell default"}`);
+    L.push(`  context:       ${ctx.contextProfile}`);
     L.push(`  compaction:    ${describeCompactAt(ctx.compactAt)}`);
     const overlay = Object.entries(ctx.sessionConfig);
     if (overlay.length > 0) {

package/dist/commands/wrap.d.ts

@@ -26,13 +26,5 @@ export interface WrapOptions {
 export declare function wrapCommand(options?: WrapOptions): Promise<void>;
 export declare function birthThroughGateway(gatewayUrl: string, provider: Provider, agentName: string, providerKey: string, opts?: {
     timeoutMs?: number;
-    /**
-     * The caller's Mnemom API key, sent as `x-mnemom-api-key` together with a no-op
-     * `x-mnemom-session-config` (NOOP_SESSION_CONFIG_B64). The session config makes the call
-     * Mnemom agent traffic, so the gateway verifies the key and births a NEW agent in the key's
-     * org; the caller's claim step then records the claim in that same org. `mnemom agent`
-     * always sends its launch key; `mnemom wrap` sends neither header (plain traffic, as before).
-     */
-    mnemomKey?: string;
 }): Promise<string>;
 export {};

package/dist/commands/wrap.js

@@ -20,9 +20,7 @@ import { mergeAgentConfig } from "../lib/agent-config.js";
 import { askSelect, askInput, isInteractive } from "../lib/prompt.js";
 import { getGatewayUrl } from "../lib/config.js";
 import { fmt } from "../lib/format.js";
-import { NOOP_SESSION_CONFIG_B64, SESSION_CONFIG_HEADER } from "../lib/agent.js";
 const AGENT_HEADER = "x-mnemom-agent";
-const MNEMOM_KEY_HEADER = "x-mnemom-api-key";
 const PROVIDERS = {
     anthropic: {
         label: "Anthropic",
@@ -210,10 +208,6 @@ export async function birthThroughGateway(gatewayUrl, provider, agentName, provi
         [prov.keyHeader]: authValue,
         [AGENT_HEADER]: agentName,
     };
-    if (opts.mnemomKey) {
-        headers[MNEMOM_KEY_HEADER] = opts.mnemomKey;
-        headers[SESSION_CONFIG_HEADER] = NOOP_SESSION_CONFIG_B64;
-    }
     if (provider === "anthropic") {
         headers["anthropic-version"] = "2023-06-01";
     }
@@ -241,24 +235,13 @@ export async function birthThroughGateway(gatewayUrl, provider, agentName, provi
                 messages: [{ role: "user", content: "hello" }],
             });
     }
-    const post = (h) => fetch(url, {
+    const response = await fetch(url, {
         method: "POST",
-        headers: h,
+        headers,
         body,
         signal: opts.timeoutMs ? AbortSignal.timeout(opts.timeoutMs) : undefined,
     });
-    let response = await post(headers);
-    let agentId = response.headers.get(AGENT_HEADER);
-    // An agent an earlier plain call already birthed sits unclaimed in the sandbox org, and the
-    // gateway refuses agent traffic for it with 402 `agent_unclaimed` (and no agent id) — yet that
-    // is exactly the agent `mnemom agent setup` must claim. Ask once more as plain traffic (no
-    // session config): that serves it exactly as before and returns the id for the claim step.
-    if (!agentId && SESSION_CONFIG_HEADER in headers && (await isAgentUnclaimedRefusal(response))) {
-        const plain = { ...headers };
-        Reflect.deleteProperty(plain, SESSION_CONFIG_HEADER);
-        response = await post(plain);
-        agentId = response.headers.get(AGENT_HEADER);
-    }
+    const agentId = response.headers.get(AGENT_HEADER);
     if (!response.ok && !agentId) {
         const text = await response.text().catch(() => "");
         throw new MnemomApiError(response.status, `Gateway returned ${response.status}: ${text.slice(0, 300)}`);
@@ -268,22 +251,6 @@ export async function birthThroughGateway(gatewayUrl, provider, agentName, provi
     }
     return agentId;
 }
-/**
- * Is `response` the gateway's agent-traffic refusal for an agent still unclaimed in the sandbox
- * org — 402 with `error.details.reason === "agent_unclaimed"`? Reads a clone, so the caller can
- * still read the body. Anything unparseable is `false`.
- */
-async function isAgentUnclaimedRefusal(response) {
-    if (response.status !== 402)
-        return false;
-    try {
-        const body = (await response.clone().json());
-        return body?.error?.details?.reason === "agent_unclaimed";
-    }
-    catch {
-        return false;
-    }
-}
 // ── Starter cards ─────────────────────────────────────────────────────────────
 function buildStarterAlignmentCard(agentId) {
     return {

package/dist/index.js

@@ -175,7 +175,7 @@ const agentCmd = program
     .addOption(new Option("--slack", "EXPERIMENTAL (`mnemom experimental enable slack`): attach the Slack channel — messages addressed to this session arrive in it, and it can reply (see `mnemom agent slack`)").hideHelp(hiddenUnless("slack")))
     .option("--context", "Force context folding ON for this launch even when launcher.toml (context = false) or MNEMOM_AGENT_CONTEXT turns it off")
     .option("--no-context", "Disable context folding for this launch (folding is on by default; tells the gateway to skip it for this session)")
-    .addOption(new Option("--context-profile <profile>", 'How the gateway folds this session\'s context. Unset (the default): nothing is sent and the gateway cell\'s own default decides. "balanced" keeps more of the earlier work verbatim and folds later — for long sessions that revisit earlier files and decisions. "aggressive" folds earlier and keeps a tighter working set — for cost-sensitive sessions and short, focused tasks. "adaptive" sizes the fold to the conversation: no fold below 200k tokens, aggressive from 200k to 1M, balanced above. "off" leaves compaction to the coding agent and never intercepts it (fold, compaction intercept and real-size usage all off; refused with --compaction-intercept or --compact-at <n>). Applies to this launch only (a resumed session keeps its own); to change the default for every launch: config key context_profile, env MNEMOM_AGENT_CONTEXT_PROFILE.').argParser((v) => {
+    .addOption(new Option("--context-profile <profile>", 'How the gateway folds this session\'s context. "balanced" (default) keeps more of the earlier work verbatim and folds later — for long sessions that revisit earlier files and decisions. "aggressive" folds earlier and keeps a tighter working set — for cost-sensitive sessions and short, focused tasks. "adaptive" sizes the fold to the conversation: no fold below 200k tokens, aggressive from 200k to 1M, balanced above. "off" leaves compaction to the coding agent. Also: config key context_profile, env MNEMOM_AGENT_CONTEXT_PROFILE.').argParser((v) => {
     // One validator for all three surfaces (flag, MNEMOM_AGENT_CONTEXT_PROFILE,
     // launcher.toml context_profile): trimmed, case-insensitive, same error wording.
     try {

package/dist/lib/agent-ledger.d.ts

@@ -14,7 +14,7 @@
  * `sessions.retention_days` (default 30) are dropped when the next one is
  * recorded. No count cap — a long retention keeps everything in the window.
  */
-import { type ContextProfile, type LaunchShape, type SealedContract } from "./agent.js";
+import type { ContextProfile, LaunchShape, SealedContract } from "./agent.js";
 /** The ledger's file name under MNEMOM_DIR. */
 export declare const LEDGER_FILE = "sessions.jsonl";
 /** Days a launch stays in the ledger when `sessions.retention_days` is unset. */
@@ -77,17 +77,10 @@ export interface SessionRecord {
     cc_session_id?: string | null;
     /**
      * The context profile the launch ran under (`--context-profile` / `context_profile` /
-     * `MNEMOM_AGENT_CONTEXT_PROFILE`, or the resumed session's own). Absent when none was chosen
-     * (the cell default) and on records written before profiles existed (still `v: 1`).
+     * `MNEMOM_AGENT_CONTEXT_PROFILE`, or `balanced` by default). Optional: records written
+     * before profiles existed omit it (still `v: 1`).
      */
     context_profile?: ContextProfile;
-    /**
-     * `2` when `context_profile` was written with complete profiles (`balanced` sends size policy
-     * off, `aggressive` adds it). Absent on older records, where `balanced` was also written for a
-     * launch that chose nothing and sent no fold key — so a resume reads an unmarked `balanced` as
-     * the cell default, which is what that session actually ran under.
-     */
-    context_profile_v?: 2;
     /**
      * The resolved gateway compaction target (`--compact-at` / `compact_at` /
      * `MNEMOM_COMPACT_AT`): `null` means no target (Claude Code's own 1M window; the default,
@@ -175,15 +168,3 @@ export declare function findResumeCandidate(records: readonly SessionRecord[], w
     gatewayHost: string;
     resumeId?: string | null;
 }): ResumeCandidate | null;
-/**
- * The context profile the Claude Code session `ccSessionId` ran under — the newest row with the
- * same org and gateway host that pinned that session — so a launch that resumes it
- * (`--resume <id>`) keeps that session's own profile. `null` when no row matches, the row chose
- * no profile (the cell default), it is an older row's `balanced` (see `context_profile_v`), or its
- * value is not a known profile (the file is hand-editable).
- */
-export declare function resumedContextProfile(records: readonly SessionRecord[], want: {
-    ccSessionId: string | null;
-    orgId: string;
-    gatewayHost: string;
-}): ContextProfile | null;

package/dist/lib/agent-ledger.js

@@ -16,7 +16,6 @@
  */
 import { appendFileSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { CONTEXT_PROFILES, } from "./agent.js";
 /** The ledger's file name under MNEMOM_DIR. */
 export const LEDGER_FILE = "sessions.jsonl";
 /** Days a launch stays in the ledger when `sessions.retention_days` is unset. */
@@ -198,25 +197,3 @@ export function findResumeCandidate(records, want) {
     }
     return latest ? { record: latest, source: "session_name", byCcSession: false } : null;
 }
-/**
- * The context profile the Claude Code session `ccSessionId` ran under — the newest row with the
- * same org and gateway host that pinned that session — so a launch that resumes it
- * (`--resume <id>`) keeps that session's own profile. `null` when no row matches, the row chose
- * no profile (the cell default), it is an older row's `balanced` (see `context_profile_v`), or its
- * value is not a known profile (the file is hand-editable).
- */
-export function resumedContextProfile(records, want) {
-    const id = want.ccSessionId?.trim();
-    if (!id || !want.orgId)
-        return null;
-    for (let i = records.length - 1; i >= 0; i--) {
-        const r = records[i];
-        if (r.cc_session_id !== id || r.org_id !== want.orgId || r.gateway_host !== want.gatewayHost)
-            continue;
-        const p = r.context_profile;
-        if (p === "balanced" && r.context_profile_v !== 2)
-            return null; // an older row: sent nothing
-        return p !== undefined && CONTEXT_PROFILES.includes(p) ? p : null;
-    }
-    return null;
-}