@mnemom/mnemom 0.17.9-next.0 → 0.17.10

package/dist/commands/agent.js

@@ -33,7 +33,7 @@ import { basename, join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { statuslineLaunch } from "../lib/statusline.js";
 import { getApiUrl, getGatewayUrl, MNEMOM_DIR } from "../lib/config.js";
-import { createApiKey, getAgentByName } from "../lib/api.js";
+import { createApiKey } from "../lib/api.js";
 import { MNEMOM_KEY_STORE_FIELD, resolveAgentAuth, resolveSubscriptionMnemomKey, subscriptionChildEnv, subscriptionShape, } from "../lib/subscription-login.js";
 import { LEDGER_FILE, appendSessionRecord, findResumeCandidate, readSessionRecords, resolveRetentionDays, resumedContextProfile, toLedgerContract, } from "../lib/agent-ledger.js";
 import { loadCliConfig } from "../lib/cli-config.js";
@@ -44,7 +44,7 @@ import { askInput, askSelect, askYesNo, isInteractive } from "../lib/prompt.js";
 import { authConfigured, chooseAuth, detectClaudeLogin, readClaudeLoginState, } from "../lib/login-detect.js";
 import { requireConsoleKey, readConsoleKey } from "../lib/console-key.js";
 import { goalAlignmentLine, resolveSessionSetup } from "./agent-session.js";
-import { AgentIdentityMismatchError, defaultAgentSlug, ensureGovernedAgent, ensureSessionAndBalance, isQuietPreambleExit, resolveDefaultSlug, resolvePreflightedAccount, } from "./agent-setup.js";
+import { defaultAgentSlug, ensureClaimedServedAgent, ensureSessionAndBalance, isQuietPreambleExit, resolveDefaultSlug, resolvePreflightedAccount, } from "./agent-setup.js";
 import { assembleContract, buildGoalModeHeader, buildCustomHeaders, buildHandoffMcpConfigJson, buildSessionConfig, buildSessionConfigB64, assertCompactAtCompatible, assertOffProfileCompatible, compactAtWindowWarning, describeCompactAt, launchWindow, resolveCompactAt, applyGatewayHintHeaders, resolveCompactionIntercept, resolveContextHandoff, resolveContextProfile, resolveHandoffGatewayHost, HANDOFF_RC_KEY_ENV_NAME, isProdGateway, launchPreferenceExplicit, launchPreflighted, remoteControlAllowed, applyToolSearchDefault, DISABLE_1M_ENV, readCcSettings, resolveWindowModel, resolveAnthropicDoor, resolveLaunchModel, resolveConversationId, resolveGatewayHost, singleCellError, resolveLaunchShape, resolveRemoteControlShape, passthroughName, sanitizeAgentName, sessionDisplayName, SESSION_NAME_ENV, SESSION_CONFIG_HEADER, } from "../lib/agent.js";
 import { LAUNCHER_STORE_PATH, mergeStore } from "../lib/launcher-store.js";
 import { slackChannelArgs } from "../lib/slack-launch.js";
@@ -292,6 +292,7 @@ export async function agentCommand(scenarioArg, options = {}) {
         if (auth === "subscription") {
             say("mnemom agent: auth = subscription — Claude Code would use your claude.ai login (Team/Enterprise plans only) with a Mnemom API key; no Anthropic key.");
         }
+        say(`mnemom agent: the real launch first confirms the agent the gateway serves for '${agent}' is claimed — claiming it into the org the launch bills if it is not — and never runs on an unclaimed agent.`);
         if (auth === "console") {
             say("mnemom agent: auth = console — the launch would use the API key your Claude Code Anthropic Console login created.");
         }
@@ -388,40 +389,20 @@ export async function agentCommand(scenarioArg, options = {}) {
         if (refreshed)
             agent = refreshed;
     }
-    // ── zero-friction governed agent: make sure `agent` exists + is claimed in the
-    // customer's org (with the nudge/nudge coding posture) before we launch. AUTO
-    // provisions-with-confirm when interactive; warns and continues otherwise.
-    // Skipped entirely by `--no-setup`. A provisioning failure never blocks the
-    // launch — it degrades to the unclaimed (fail-open) identity with a warning.
-    // The agent id the gateway serves, when setup asked it (undefined = never asked, so the ledger
-    // falls back to the org's name lookup).
-    let servedAgentId;
-    if (options.setup !== false && !anthropicKey) {
-        // Subscription login: the gateway creates the agent in the Mnemom key's org on the first
-        // turn, so there is nothing to birth or claim here.
-        say(`mnemom agent: subscription login — '${agent}' is created in your org on the first turn (identity: your Mnemom API key).`);
-    }
-    else if (options.setup !== false && anthropicKey) {
-        servedAgentId = null; // asked below; stays null if setup can't tell
-        try {
-            const ensured = await ensureGovernedAgent({
-                slug: agent,
-                anthropicKey,
-                setup: options.setup,
-                gatewayHost,
-            });
-            servedAgentId = ensured.agentId ?? null;
-        }
-        catch (err) {
-            // An identity mismatch is the one setup failure that must NOT degrade: the
-            // launch would run as an agent other than the one --setup just tried to
-            // govern. Refuse, with both ids in the message (MNE-7650).
-            if (err instanceof AgentIdentityMismatchError)
-                throw err;
-            const msg = err instanceof Error ? err.message : String(err);
-            say(fmt.warn(`mnemom agent: agent setup did not complete (${msg}) — launching with the unclaimed identity.`));
-        }
-    }
+    // ── never an unclaimed agent ── the gateway serves hash(credential, name); the coding CLI
+    // starts only once THAT agent is claimed. An unclaimed one is claimed here into the org this
+    // launch bills (account.orgId — the active/default org is never changed); anything else
+    // refuses the launch. No prompt and no unclaimed fallback, interactive or not, preflighted or
+    // not. `--no-setup` only skips the default-card writes.
+    const { agentId: servedAgentId } = await ensureClaimedServedAgent({
+        slug: agent,
+        anthropicKey,
+        mnemomKey,
+        gatewayHost,
+        orgId: account.orgId,
+        orgLabel: account.orgLabel,
+        setup: options.setup,
+    });
     // ── conversation id ── an implicit relaunch continues its earlier conversation (IG5 #1, D1)
     // so the goal the gateway inferred there is still the one it steers by. Resolved here, after
     // sign-in and the agent refresh, because a resume needs the org, agent and gateway host to
@@ -499,7 +480,7 @@ export async function agentCommand(scenarioArg, options = {}) {
     if (win?.reason === "one-m") {
         say(`mnemom agent: model ${win.from} → ${win.model} (1M context window; set ${DISABLE_1M_ENV}=1, or pass the model as \`-- --model <id>\`, to keep the standard window).`);
     }
-    await recordSessionLaunch({
+    recordSessionLaunch({
         session: scenario,
         conversationId,
         agent,
@@ -706,30 +687,19 @@ export async function resolveLaunchContinuation(input) {
     return { conversationId: resolveConversationId(conv), resumeCcSessionId };
 }
 /**
- * Record this launch in ~/.mnemom/sessions.jsonl. The agent record id is
- * resolved best-effort (a lookup failure or an unknown slug records null); a
- * ledger write failure warns to stderr and the launch proceeds regardless.
+ * Record this launch in ~/.mnemom/sessions.jsonl, with the claimed agent id the
+ * gateway serves; a ledger write failure warns to stderr and the launch proceeds
+ * regardless.
  */
-export async function recordSessionLaunch(ctx) {
-    // Never re-derive a known id from the name: the name can match an org agent the gateway does
-    // not serve for this key (MNE-7650), which is exactly what the ledger must not record.
-    let agentId;
-    if (ctx.agentId !== undefined) {
-        agentId = ctx.agentId;
-    }
-    else {
-        try {
-            agentId = (await getAgentByName(ctx.agent))?.id ?? null;
-        }
-        catch {
-            agentId = null; // unresolvable right now — the ledger still records the launch
-        }
-    }
+export function recordSessionLaunch(ctx) {
+    // The SERVED id, never one re-derived from the name: the name can match an org agent the
+    // gateway does not serve for this key (MNE-7650), which is exactly what the ledger must not
+    // record.
     const result = appendSessionRecord({
         session: ctx.session,
         conversation_id: ctx.conversationId,
         agent_slug: ctx.agent,
-        agent_id: agentId,
+        agent_id: ctx.agentId,
         org_id: ctx.account.orgId,
         org_label: ctx.account.orgLabel,
         gateway_host: ctx.gatewayHost,

package/dist/commands/card.js

@@ -884,8 +884,8 @@ export async function cardEditCommand(agentName, options = {}) {
         cardYaml = yaml.dump({
             card_version: "unified/2026-04-26",
             agent_id: agentId,
-            autonomy_mode: "observe",
-            integrity_mode: "observe",
+            autonomy_mode: "off",
+            integrity_mode: "off",
             principal: { type: "agent", identifier: agentId, relationship: "delegated_authority" },
             values: { declared: ["transparency", "safety", "honesty"] },
             autonomy: {

package/dist/commands/onboard.js

@@ -352,7 +352,8 @@ async function earnRating(agentId, steps, say) {
 }
 // ── starter alignment card ──────────────────────────────────────────────────────
 /**
- * A starter alignment card in `observe` mode — the honest, minimal declaration
+ * A starter alignment card, `off` by default (alignment analysis is billed; the
+ * user turns it on) — the honest, minimal declaration
  * of intent for a freshly-onboarded agent. Mirrors the shape `wrap` seeds so the
  * two skill-runners produce a consistent first card.
  */
@@ -360,8 +361,8 @@ function buildStarterAlignmentCard(agentId) {
     return {
         card_version: "unified/2026-04-26",
         agent_id: agentId,
-        autonomy_mode: "observe",
-        integrity_mode: "observe",
+        autonomy_mode: "off",
+        integrity_mode: "off",
         principal: { type: "agent", identifier: agentId, relationship: "delegated_authority" },
         values: { declared: ["transparency", "safety", "honesty"] },
         autonomy: {

package/dist/commands/protection.js

@@ -729,7 +729,7 @@ export async function protectionEditCommand(agentName, options = {}) {
         yaml.dump({
             card_version: "protection/2026-04-26",
             agent_id: agentId,
-            mode: "observe",
+            mode: "off",
             thresholds: { warn: 0.3, quarantine: 0.6, block: 0.9 },
             screen_surfaces: {
                 incoming: true,

package/dist/commands/try-me.d.ts

@@ -48,5 +48,18 @@ export interface TryMeOptions {
  * are surfaced as human guidance.
  */
 export declare function tryMeCommand(token: string, options?: TryMeOptions): Promise<void>;
+/**
+ * Classify a 401/403 card-write failure BY ITS ERROR CODE, never by status alone.
+ *
+ * - `grant-pending`: a PROTECTION 403 whose code says the one-time CISO grant
+ *   hasn't landed in the browser yet. This is expected and is polled for the
+ *   window; it must NOT trigger a re-login.
+ * - `refused`: any OTHER protection 403 (e.g. `feature_gated`, a billing
+ *   refusal). Waiting cannot fix it, so it fails fast with the server's reason
+ *   instead of polling for a grant the human already approved.
+ * - `auth`: a 401 anywhere, or an alignment 403 — the caller isn't authorized.
+ *   After a short propagation grace this means the session is stale/mismatched.
+ */
+export declare function classifyAuthError(kind: "alignment" | "protection", status: number | undefined, code?: string): "grant-pending" | "refused" | "auth";
 /** Render the resolved plan as human-readable text (no side effects). */
 export declare function renderPlan(manifest: BriefingManifest): string;

package/dist/commands/try-me.js

@@ -23,12 +23,12 @@
  * sign-in). That session IS the human's own — it is the headless twin of the
  * host-connector authorization in the MCP flow, not a forged credential.
  */
-import { resolveBriefing, birthAgent, fetchAgentClaimed, buildClaimUrl, buildGrantUrl, buildDojoDeepLink, claimProof, isTokenMode, looksLikeTryMeToken, sleep, } from "../lib/try-me.js";
+import { resolveBriefing, birthAgent, fetchAgentClaimed, buildClaimUrl, buildGrantUrl, buildDojoDeepLink, claimProof, describeOutOfMu, isTokenMode, looksLikeTryMeToken, sleep, } from "../lib/try-me.js";
 import { putAlignmentCard, putProtectionCard, listOrgAgents, MnemomApiError } from "../lib/api.js";
 import { resolveAuth, loginWithBrowser, loginWithDeviceFlow } from "../lib/auth.js";
 import { openBrowser } from "../lib/oauth.js";
 import { askSelect, askInput, askYesNo, isInteractive } from "../lib/prompt.js";
-import { getApiUrl, setApiUrlOverride } from "../lib/config.js";
+import { getApiUrl, getWebsiteUrl, setApiUrlOverride } from "../lib/config.js";
 import { fmt } from "../lib/format.js";
 import { getAgentName, mergeAgentConfig } from "../lib/agent-config.js";
 const POLL_INTERVAL_MS = 3000;
@@ -352,21 +352,44 @@ async function ensureSession(ctx, opts = {}) {
  */
 const AUTH_PROPAGATION_GRACE_MS = 20_000;
 /**
- * Classify a retriable (401/403) card-write failure.
+ * The 403 codes that mean "the one-time protection grant hasn't landed yet":
+ * mnemom-api's `agent_scope_forbidden` (a protection write with no live one-time
+ * capability) and the RFC 6750 `insufficient_scope` the manifest names.
+ */
+const GRANT_PENDING_CODES = new Set(["agent_scope_forbidden", "insufficient_scope"]);
+/**
+ * Classify a 401/403 card-write failure BY ITS ERROR CODE, never by status alone.
  *
- * - `grant-pending`: a PROTECTION 403 — the one-time CISO grant hasn't landed in
- *   the browser yet (the manifest's `insufficient_scope`). This is expected and
- *   is polled for the full window; it must NOT trigger a re-login. (Alignment is
- *   written first and has no grant, so a stale/wrong-account session is caught
- *   there before protection runs — making a protection 403 reliably the grant.)
+ * - `grant-pending`: a PROTECTION 403 whose code says the one-time CISO grant
+ *   hasn't landed in the browser yet. This is expected and is polled for the
+ *   window; it must NOT trigger a re-login.
+ * - `refused`: any OTHER protection 403 (e.g. `feature_gated`, a billing
+ *   refusal). Waiting cannot fix it, so it fails fast with the server's reason
+ *   instead of polling for a grant the human already approved.
  * - `auth`: a 401 anywhere, or an alignment 403 — the caller isn't authorized.
  *   After a short propagation grace this means the session is stale/mismatched.
  */
-function classifyAuthError(kind, status) {
-    if (status === 403 && kind === "protection")
-        return "grant-pending";
+export function classifyAuthError(kind, status, code) {
+    if (status === 403 && kind === "protection") {
+        return code !== undefined && GRANT_PENDING_CODES.has(code) ? "grant-pending" : "refused";
+    }
     return "auth";
 }
+/**
+ * The error for a card write that waiting or re-authenticating cannot fix: the
+ * server's own reason (and code), with a recharge link when it is about µ.
+ */
+function cardWriteRefusal(kind, agentId, err) {
+    const outOfMu = describeOutOfMu({ status: err.effectiveStatus, code: err.code, message: err.message, details: err.details }, getWebsiteUrl());
+    if (outOfMu) {
+        return new Error(`Couldn't set the ${kind} card. ${outOfMu} (--resume ${agentId})`, {
+            cause: err,
+        });
+    }
+    return new Error(`The server refused the ${kind} card for ${agentId}: ${err.message}` +
+        (err.code ? ` (${err.code})` : "") +
+        `. Fix that, then re-run with --resume ${agentId}.`, { cause: err });
+}
 /**
  * Write a card, tolerating the two legitimate transient unauthorized states and
  * escalating a persistent one instead of hanging:
@@ -397,10 +420,18 @@ async function writeCardWithRetry(kind, card, timeoutSeconds, ctx) {
             return;
         }
         catch (err) {
-            const status = err instanceof MnemomApiError ? err.effectiveStatus : undefined;
+            if (!(err instanceof MnemomApiError))
+                throw err; // not a server answer — surface it
+            const status = err.effectiveStatus;
+            // Out of µ / no billing account: a recharge prompt, not the raw error.
+            if (status === 402)
+                throw cardWriteRefusal(kind, agentId, err);
             if (status !== 401 && status !== 403)
                 throw err; // a real error — surface it
-            const kindOfFailure = classifyAuthError(kind, status);
+            const kindOfFailure = classifyAuthError(kind, status, err.code);
+            // Not a grant that hasn't landed: waiting won't help — say why, now.
+            if (kindOfFailure === "refused")
+                throw cardWriteRefusal(kind, agentId, err);
             // A stale/mismatched session: once the short propagation grace is spent,
             // re-authenticate as the agent's owner and retry the write exactly once.
             if (kindOfFailure === "auth" && Date.now() >= authGraceDeadline) {

package/dist/commands/wrap.js

@@ -256,8 +256,8 @@ function buildStarterAlignmentCard(agentId) {
     return {
         card_version: "unified/2026-04-26",
         agent_id: agentId,
-        autonomy_mode: "observe",
-        integrity_mode: "observe",
+        autonomy_mode: "off",
+        integrity_mode: "off",
         principal: { type: "agent", identifier: agentId, relationship: "delegated_authority" },
         values: { declared: ["transparency", "safety", "honesty"] },
         autonomy: {
@@ -272,7 +272,7 @@ function buildStarterProtectionCard(agentId) {
     return {
         card_version: "protection/2026-04-26",
         agent_id: agentId,
-        mode: "observe",
+        mode: "off",
         thresholds: { warn: 0.3, quarantine: 0.6, block: 0.9 },
         screen_surfaces: {
             incoming: true,

package/dist/index.js

@@ -168,8 +168,8 @@ const agentCmd = program
 ]))
     .option("--trim-mcp", "Launch the CLI with no MCP servers (--strict-mcp-config + empty --mcp-config)")
     .option("--invite <token>", "Redeem a Mnemom Agent invitation (pinv_…): unlocks Mnemom Agent for you + credits your starter µ; launches too when a session name is given")
-    .option("--setup", "Provision + claim the governed agent before launch (non-interactive opt-in)")
-    .option("--no-setup", "Skip governed-agent provisioning entirely for this launch")
+    .option("--setup", "Re-check the served agent and refresh its default cards before launch")
+    .option("--no-setup", "Skip the default-card writes (the agent is still confirmed and claimed)")
     .option("--no-yolo", "Do NOT pass --dangerously-skip-permissions (yolo is on by default)")
     .option("--no-context-hint", "Do NOT seed Claude Code's context-hint feature flag before launch")
     .addOption(new Option("--slack", "EXPERIMENTAL (`mnemom experimental enable slack`): attach the Slack channel — messages addressed to this session arrive in it, and it can reply (see `mnemom agent slack`)").hideHelp(hiddenUnless("slack")))

package/dist/lib/agent-identity-route.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Which agent the gateway serves a SUBSCRIPTION-login launch (claude.ai login + a Mnemom API
+ * key) for one agent name — `POST /mnemom/agent/identity` on the gateway.
+ *
+ * An Anthropic-key launch learns its served agent from a 16-token birth completion
+ * (birthThroughGateway). A subscription launch has no Anthropic key to send, so the gateway
+ * exposes this route instead: it resolves the agent exactly as a proxied subscription request
+ * with the same Mnemom key + name would (the key owner's claimed agent of that name, else the
+ * hash(Mnemom key, name) agent, birthed if absent) and makes no upstream call. The key rides
+ * only in the request header and is never logged or echoed.
+ */
+export declare const IDENTITY_ROUTE_PATH = "/mnemom/agent/identity";
+/**
+ * The gateway answered 404: the identity route is not deployed on this cell. A subscription
+ * launch can't confirm its agent is claimed without it, so the launcher refuses.
+ */
+export declare class IdentityRouteMissingError extends Error {
+    readonly gatewayUrl: string;
+    constructor(gatewayUrl: string);
+}
+/**
+ * The mnm- id the gateway serves for (Mnemom key, name). Its response also carries claimed /
+ * org_id / resolved_by / created; the launcher reads the claim state from the api instead, so
+ * only the id is used here.
+ */
+export declare function resolveServedIdentity(gatewayUrl: string, agentName: string, mnemomKey: string, opts?: {
+    timeoutMs?: number;
+}): Promise<string>;

package/dist/lib/agent-identity-route.js

@@ -0,0 +1,57 @@
+/**
+ * Which agent the gateway serves a SUBSCRIPTION-login launch (claude.ai login + a Mnemom API
+ * key) for one agent name — `POST /mnemom/agent/identity` on the gateway.
+ *
+ * An Anthropic-key launch learns its served agent from a 16-token birth completion
+ * (birthThroughGateway). A subscription launch has no Anthropic key to send, so the gateway
+ * exposes this route instead: it resolves the agent exactly as a proxied subscription request
+ * with the same Mnemom key + name would (the key owner's claimed agent of that name, else the
+ * hash(Mnemom key, name) agent, birthed if absent) and makes no upstream call. The key rides
+ * only in the request header and is never logged or echoed.
+ */
+import { MnemomApiError } from "./api.js";
+export const IDENTITY_ROUTE_PATH = "/mnemom/agent/identity";
+/**
+ * The gateway answered 404: the identity route is not deployed on this cell. A subscription
+ * launch can't confirm its agent is claimed without it, so the launcher refuses.
+ */
+export class IdentityRouteMissingError extends Error {
+    gatewayUrl;
+    constructor(gatewayUrl) {
+        super(`this gateway (${gatewayUrl}) can't tell which agent a subscription login runs as yet ` +
+            `(POST ${IDENTITY_ROUTE_PATH} is not deployed there)`);
+        this.gatewayUrl = gatewayUrl;
+        this.name = "IdentityRouteMissingError";
+    }
+}
+/**
+ * The mnm- id the gateway serves for (Mnemom key, name). Its response also carries claimed /
+ * org_id / resolved_by / created; the launcher reads the claim state from the api instead, so
+ * only the id is used here.
+ */
+export async function resolveServedIdentity(gatewayUrl, agentName, mnemomKey, opts = {}) {
+    const response = await fetch(`${gatewayUrl}${IDENTITY_ROUTE_PATH}`, {
+        method: "POST",
+        headers: {
+            Accept: "application/json",
+            "x-mnemom-api-key": mnemomKey,
+            "x-mnemom-agent": agentName,
+        },
+        signal: opts.timeoutMs ? AbortSignal.timeout(opts.timeoutMs) : undefined,
+    });
+    if (response.status === 404)
+        throw new IdentityRouteMissingError(gatewayUrl);
+    if (response.status === 401) {
+        throw new MnemomApiError(401, "the gateway rejected your Mnemom API key");
+    }
+    if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        throw new MnemomApiError(response.status, `Gateway returned ${response.status}: ${text.slice(0, 300)}`);
+    }
+    const body = (await response.json().catch(() => null));
+    const agentId = body?.agent_id;
+    if (typeof agentId !== "string" || !/^mnm-/.test(agentId)) {
+        throw new Error(`Gateway returned no mnm- agent id from ${IDENTITY_ROUTE_PATH}.`);
+    }
+    return agentId;
+}

package/dist/lib/login-detect.d.ts

@@ -8,8 +8,8 @@
  *   - Claude subscription, Pro / Max (individual) → not supported (Team/Enterprise only).
  *   - Anthropic Console login (`/login` → Console account) → `auth = console` (supported): the
  *     API key Claude Code created is read from its keychain (lib/console-key.ts). A
- *     `claude auth login --console` profile creates no key → not supported yet.
- *   - Third-party provider (Bedrock / Vertex / Foundry) → not supported yet (no gateway door).
+ *     `claude auth login --console` profile creates no key → not supported.
+ *   - Third-party provider (Bedrock / Vertex / Foundry) → not supported (no gateway door).
  * An Anthropic API key always works (`auth = api-key`, the default).
  *
  * The signals are Claude Code's own client-side state (~/.claude.json `oauthAccount`, the

package/dist/lib/login-detect.js

@@ -8,8 +8,8 @@
  *   - Claude subscription, Pro / Max (individual) → not supported (Team/Enterprise only).
  *   - Anthropic Console login (`/login` → Console account) → `auth = console` (supported): the
  *     API key Claude Code created is read from its keychain (lib/console-key.ts). A
- *     `claude auth login --console` profile creates no key → not supported yet.
- *   - Third-party provider (Bedrock / Vertex / Foundry) → not supported yet (no gateway door).
+ *     `claude auth login --console` profile creates no key → not supported.
+ *   - Third-party provider (Bedrock / Vertex / Foundry) → not supported (no gateway door).
  * An Anthropic API key always works (`auth = api-key`, the default).
  *
  * The signals are Claude Code's own client-side state (~/.claude.json `oauthAccount`, the
@@ -63,9 +63,9 @@ export function unsupportedReason(login) {
         case "individual":
             return `your Claude ${login.plan} plan is a personal plan — Mnemom supports subscription login on Team and Enterprise plans only`;
         case "console":
-            return "your Anthropic Console login has no API key Claude Code created with /login (a `claude auth login --console` profile is not supported yet)";
+            return "your Anthropic Console login has no API key from Claude Code's /login (Mnemom uses the key /login creates)";
         case "third-party":
-            return `${PROVIDER_NAMES[login.provider]} is not supported yet`;
+            return `Claude Code is set to use ${PROVIDER_NAMES[login.provider]}, and Mnemom supports Anthropic sign-in only (an Anthropic API key, an Anthropic Console login, or a Claude Team or Enterprise plan)`;
     }
 }
 export const MENU_SUBSCRIPTION = "Claude subscription — Team or Enterprise (your claude.ai login)";

package/dist/lib/served-agent-cache.d.ts

@@ -5,6 +5,10 @@
  * once a launch has asked, later launches reuse it instead of paying for another probe
  * completion. Entries are keyed by a one-way fingerprint and never hold the key itself (nor the
  * sha256(key|name) claim proof). `--setup` always re-asks and overwrites.
+ *
+ * A second file records the agent this machine last CONFIRMED claimed for the same fingerprint.
+ * It is what a launch falls back to when Mnemom can't be reached to confirm the claim (an
+ * outage degrades to the last confirmed agent, never to an unclaimed one).
  */
 /**
  * A slow KDF (scrypt), not a fast hash: the fingerprint is derived from a credential and lands on
@@ -16,3 +20,7 @@ export declare function servedFingerprint(anthropicKey: string, slug: string, ga
 export declare function readServedAgent(dir: string, fingerprint: string): string | null;
 /** Best effort: a failed write only means the next launch asks again. */
 export declare function writeServedAgent(dir: string, fingerprint: string, agentId: string): void;
+/** The agent last confirmed claimed for this fingerprint, or null. */
+export declare function readConfirmedAgent(dir: string, fingerprint: string): string | null;
+/** Best effort: a failed write only means an outage can't fall back to this agent. */
+export declare function writeConfirmedAgent(dir: string, fingerprint: string, agentId: string): void;

package/dist/lib/served-agent-cache.js

@@ -5,11 +5,16 @@
  * once a launch has asked, later launches reuse it instead of paying for another probe
  * completion. Entries are keyed by a one-way fingerprint and never hold the key itself (nor the
  * sha256(key|name) claim proof). `--setup` always re-asks and overwrites.
+ *
+ * A second file records the agent this machine last CONFIRMED claimed for the same fingerprint.
+ * It is what a launch falls back to when Mnemom can't be reached to confirm the claim (an
+ * outage degrades to the last confirmed agent, never to an unclaimed one).
  */
 import { scryptSync } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
 const FILE = "served-agents.json";
+const CONFIRMED_FILE = "confirmed-agents.json";
 /**
  * A slow KDF (scrypt), not a fast hash: the fingerprint is derived from a credential and lands on
  * disk, so recovering the key from it must cost what guessing a password would. Name and
@@ -18,9 +23,9 @@ const FILE = "served-agents.json";
 export function servedFingerprint(anthropicKey, slug, gateway) {
     return scryptSync(anthropicKey, `mnemom-served-agent-v1\n${slug}\n${gateway}`, 32).toString("hex");
 }
-function readAll(dir) {
+function readAll(dir, file = FILE) {
     try {
-        const parsed = JSON.parse(fs.readFileSync(path.join(dir, FILE), "utf8"));
+        const parsed = JSON.parse(fs.readFileSync(path.join(dir, file), "utf8"));
         return parsed && typeof parsed === "object" && !Array.isArray(parsed)
             ? parsed
             : {};
@@ -31,18 +36,30 @@ function readAll(dir) {
 }
 /** The cached served id, or null (missing, unreadable, or not an mnm- id). */
 export function readServedAgent(dir, fingerprint) {
-    const id = readAll(dir)[fingerprint];
-    return typeof id === "string" && /^mnm-/.test(id) ? id : null;
+    return readId(dir, FILE, fingerprint);
 }
 /** Best effort: a failed write only means the next launch asks again. */
 export function writeServedAgent(dir, fingerprint, agentId) {
+    writeId(dir, FILE, fingerprint, agentId);
+}
+/** The agent last confirmed claimed for this fingerprint, or null. */
+export function readConfirmedAgent(dir, fingerprint) {
+    return readId(dir, CONFIRMED_FILE, fingerprint);
+}
+/** Best effort: a failed write only means an outage can't fall back to this agent. */
+export function writeConfirmedAgent(dir, fingerprint, agentId) {
+    writeId(dir, CONFIRMED_FILE, fingerprint, agentId);
+}
+function readId(dir, file, fingerprint) {
+    const id = readAll(dir, file)[fingerprint];
+    return typeof id === "string" && /^mnm-/.test(id) ? id : null;
+}
+function writeId(dir, file, fingerprint, agentId) {
     try {
         fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-        const tmp = path.join(dir, `${FILE}.${process.pid}.tmp`);
-        fs.writeFileSync(tmp, JSON.stringify({ ...readAll(dir), [fingerprint]: agentId }, null, 2), {
-            mode: 0o600,
-        });
-        fs.renameSync(tmp, path.join(dir, FILE));
+        const tmp = path.join(dir, `${file}.${process.pid}.tmp`);
+        fs.writeFileSync(tmp, JSON.stringify({ ...readAll(dir, file), [fingerprint]: agentId }, null, 2), { mode: 0o600 });
+        fs.renameSync(tmp, path.join(dir, file));
     }
     catch {
         /* best effort */

package/dist/lib/try-me.d.ts

@@ -162,6 +162,24 @@ export interface BirthResult {
 export declare function birthAgent(manifest: BriefingManifest, name: string, opts?: {
     fetchImpl?: typeof fetch;
 }): Promise<BirthResult>;
+/** A server refusal, as the CLI's error types carry it. */
+export interface ServerRefusal {
+    status?: number;
+    code?: string;
+    message?: string;
+    details?: unknown;
+}
+/**
+ * Where to recharge: the server's `details.top_up_url` (absolute, or a path on
+ * the website), else the website's billing page.
+ */
+export declare function rechargeUrl(details: unknown, websiteBase?: string): string;
+/**
+ * The human message for a refusal that means the org is out of µ (or has no
+ * billing account): what happened, where to recharge, and how to resume.
+ * Undefined for any other refusal.
+ */
+export declare function describeOutOfMu(refusal: ServerRefusal, websiteBase?: string): string | undefined;
 /** The slice of the public agent projection the claim poll reads. */
 export interface PublicAgentStatus {
     id?: string;