mneme-ai 2.60.0 → 2.62.0

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAuIA,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA6jLvD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAuIA,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsxLvD"}

package/dist/index.js

@@ -4682,6 +4682,240 @@ export async function run(argv) {
             process.exitCode = 1;
         }
     });
+    // v2.62.0 — MIRRAGE: live conscience for AI agents via MCP reverse-channel.
+    // Agent calls `mneme.mirrage.scan {draft}` BEFORE shipping; per-sentence
+    // nudges (5-level conscience ladder) + suggested edit + ship-block on
+    // critical findings.
+    const mirrageParent = program
+        .command("mirrage")
+        .description("v2.62 — live conscience. Default action = ledger audit.")
+        .action(async () => {
+        try {
+            const core = await import("@mneme-ai/core");
+            const led = core.mirrage.verifyLedgerChain(process.cwd());
+            const rows = core.mirrage.readLedger(process.cwd());
+            process.stdout.write(JSON.stringify({ ok: led.ok, rows: led.rows, brokenAt: led.brokenAt, recent: rows.slice(-10) }, null, 2) + "\n");
+        }
+        catch (e) {
+            process.stdout.write(JSON.stringify({ ok: false, error: e.message }) + "\n");
+            process.exitCode = 1;
+        }
+    });
+    mirrageParent.command("scan")
+        .description("Scan a draft for refutable claims. Returns per-sentence nudges + suggested edit + ship-block decision.")
+        .requiredOption("--draft <text>", "Draft text (or use --stdin)")
+        .requiredOption("--agent <id>", "Requesting agent identifier")
+        .option("--cursor <n>", "Streaming mode: only scan sentences ending before this offset", (v) => Number(v))
+        .option("--min-risk <n>", "Risk threshold below which no nudge is emitted (default 0.30)", (v) => Number(v), 0.30)
+        .option("--banner", "Render ASCII banner instead of JSON")
+        .action(async (opts) => {
+        try {
+            const core = await import("@mneme-ai/core");
+            const r = core.mirrage.scanDraft({
+                draft: opts.draft,
+                agent: opts.agent,
+                cursorPos: opts.cursor,
+                minRisk: opts.minRisk ?? 0.30,
+                cwd: process.cwd(),
+            });
+            if (opts.banner)
+                process.stdout.write(core.mirrage.renderBanner(r) + "\n");
+            else
+                process.stdout.write(JSON.stringify(r, null, 2) + "\n");
+            if (r.blocksShip)
+                process.exitCode = 1;
+        }
+        catch (e) {
+            process.stdout.write(JSON.stringify({ ok: false, error: e.message }) + "\n");
+            process.exitCode = 1;
+        }
+    });
+    mirrageParent.command("ack")
+        .description("Acknowledge a nudge (closes alert + bumps fatigue counter + optional cross-agent wisdom broadcast).")
+        .requiredOption("--scan-id <id>", "Scan id from a prior scan")
+        .requiredOption("--nudge-id <id>", "Nudge id within that scan")
+        .requiredOption("--agent <id>", "Acknowledging agent")
+        .option("--broadcast", "Append lesson to cross-agent wisdom feed")
+        .option("--sentence <text>", "Sentence (required if --broadcast)")
+        .option("--level <l>", "Conscience level (hint/suggestion/warning/block/reject)")
+        .option("--reason <r>", "Why the agent acked")
+        .option("--fingerprint <fp>", "Fingerprint hash (for fatigue gating)")
+        .action(async (opts) => {
+        try {
+            const core = await import("@mneme-ai/core");
+            const r = core.mirrage.acknowledgeNudge({
+                scanId: opts.scanId,
+                nudgeId: opts.nudgeId,
+                agent: opts.agent,
+                broadcast: opts.broadcast === true,
+                sentence: opts.sentence,
+                level: opts.level,
+                reason: opts.reason,
+                fingerprint: opts.fingerprint,
+                cwd: process.cwd(),
+            });
+            process.stdout.write(JSON.stringify(r, null, 2) + "\n");
+        }
+        catch (e) {
+            process.stdout.write(JSON.stringify({ ok: false, error: e.message }) + "\n");
+            process.exitCode = 1;
+        }
+    });
+    mirrageParent.command("wisdom")
+        .description("Show cross-agent wisdom feed (lessons broadcast after nudge acks).")
+        .option("--limit <n>", "Max rows", (v) => Number(v), 20)
+        .action(async (opts) => {
+        try {
+            const core = await import("@mneme-ai/core");
+            const rows = core.mirrage.readWisdom(process.cwd());
+            process.stdout.write(JSON.stringify({ ok: true, total: rows.length, recent: rows.slice(-(opts.limit ?? 20)) }, null, 2) + "\n");
+        }
+        catch (e) {
+            process.stdout.write(JSON.stringify({ ok: false, error: e.message }) + "\n");
+            process.exitCode = 1;
+        }
+    });
+    mirrageParent.command("audit")
+        .description("Verify the HMAC-chained nudge ledger + last N entries.")
+        .option("--limit <n>", "Max rows", (v) => Number(v), 20)
+        .action(async (opts) => {
+        try {
+            const core = await import("@mneme-ai/core");
+            const led = core.mirrage.verifyLedgerChain(process.cwd());
+            const rows = core.mirrage.readLedger(process.cwd());
+            process.stdout.write(JSON.stringify({ ok: led.ok, totalRows: led.rows, brokenAt: led.brokenAt, recent: rows.slice(-(opts.limit ?? 20)) }, null, 2) + "\n");
+            if (!led.ok)
+                process.exitCode = 1;
+        }
+        catch (e) {
+            process.stdout.write(JSON.stringify({ ok: false, error: e.message }) + "\n");
+            process.exitCode = 1;
+        }
+    });
+    // v2.61.0 — PASSPORT: capability-based security for MCP.
+    // Agents request HMAC-signed passports before sensitive tool calls;
+    // trust score gates issuance; delegation chain + revocation cascade
+    // + HMAC-chained audit ledger.
+    const passportParent = program
+        .command("capability")
+        .description("v2.61 — capability-based security. Default action = audit ledger.")
+        .action(async () => {
+        try {
+            const core = await import("@mneme-ai/core");
+            const led = core.passport.verifyLedgerChain(process.cwd());
+            const rows = core.passport.readLedger(process.cwd());
+            process.stdout.write(JSON.stringify({ ok: led.ok, rows: led.rows, brokenAt: led.brokenAt, recent: rows.slice(-10) }, null, 2) + "\n");
+        }
+        catch (e) {
+            process.stdout.write(JSON.stringify({ ok: false, error: e.message }) + "\n");
+            process.exitCode = 1;
+        }
+    });
+    passportParent.command("request")
+        .description("Request a passport for a sensitive tool. Trust score must clear tier threshold.")
+        .requiredOption("--tool <name>", "Tool name (e.g. shell.exec)")
+        .requiredOption("--agent <id>", "Requesting agent identifier")
+        .option("--tier <t>", "Explicit risk tier (safe/read/write/network/destructive). Default: auto-classify from tool name.")
+        .option("--env-confidence <n>", "Trust signal: NEMESIS env-scan confidence 0..1", (v) => Number(v))
+        .option("--identity-verdict <v>", "Trust signal: NEMESIS verify_identity (CONFIRMED|DISPUTED|IMPOSSIBLE|INCONCLUSIVE)")
+        .option("--hm-weight <n>", "Trust signal: HONEST_MIRROR weight 0..1", (v) => Number(v))
+        .option("--stealth <n>", "Trust signal: STEALTH score 0..1 (inverted)", (v) => Number(v))
+        .option("--history <n>", "Trust signal: historical approval rate 0..1", (v) => Number(v))
+        .option("--scope <list>", "Comma-separated scope sub-restrictions", (v) => v.split(",").map((s) => s.trim()).filter(Boolean))
+        .option("--parent <token>", "Parent passport token (for delegation)")
+        .action(async (opts) => {
+        try {
+            const core = await import("@mneme-ai/core");
+            const trustInputs = {
+                envScanConfidence: opts.envConfidence,
+                identityVerdict: opts.identityVerdict,
+                honestMirrorWeight: opts.hmWeight,
+                stealthScore: opts.stealth,
+                historicalApprovalRate: opts.history,
+            };
+            const r = core.passport.issuePassport({
+                tool: opts.tool,
+                agent: opts.agent,
+                tier: opts.tier,
+                trustInputs,
+                scope: opts.scope,
+                parent: opts.parent,
+                cwd: process.cwd(),
+            });
+            process.stdout.write(JSON.stringify(r, null, 2) + "\n");
+            if (!r.ok)
+                process.exitCode = 1;
+        }
+        catch (e) {
+            process.stdout.write(JSON.stringify({ ok: false, error: e.message }) + "\n");
+            process.exitCode = 1;
+        }
+    });
+    passportParent.command("verify")
+        .description("Verify a passport token (HMAC + TTL + revocation + optional expected tool/scope).")
+        .requiredOption("--token <t>", "Passport token to verify")
+        .option("--tool <name>", "Optional expected tool")
+        .option("--scope <list>", "Optional expected scope (comma-separated; all must be present)", (v) => v.split(",").map((s) => s.trim()).filter(Boolean))
+        .action(async (opts) => {
+        try {
+            const core = await import("@mneme-ai/core");
+            const r = core.passport.verifyPassport({ token: opts.token, expectedTool: opts.tool, expectedScope: opts.scope, cwd: process.cwd() });
+            process.stdout.write(JSON.stringify(r, null, 2) + "\n");
+            if (!r.valid)
+                process.exitCode = 1;
+        }
+        catch (e) {
+            process.stdout.write(JSON.stringify({ ok: false, error: e.message }) + "\n");
+            process.exitCode = 1;
+        }
+    });
+    passportParent.command("revoke")
+        .description("Revoke a passport. Cascade revoke = also revokes every delegated descendant (default).")
+        .option("--token <t>", "Passport token")
+        .option("--jti <id>", "Direct jti (when you don't have the token)")
+        .option("--no-cascade", "Disable cascade revoke of descendants")
+        .action(async (opts) => {
+        try {
+            const core = await import("@mneme-ai/core");
+            const r = core.passport.revokePassport({ token: opts.token, jti: opts.jti, cascade: opts.cascade !== false, cwd: process.cwd() });
+            process.stdout.write(JSON.stringify(r, null, 2) + "\n");
+            if (!r.ok)
+                process.exitCode = 1;
+        }
+        catch (e) {
+            process.stdout.write(JSON.stringify({ ok: false, error: e.message }) + "\n");
+            process.exitCode = 1;
+        }
+    });
+    passportParent.command("audit")
+        .description("Verify the HMAC-chained passport ledger + show last N entries.")
+        .option("--limit <n>", "How many entries to show", (v) => Number(v), 20)
+        .action(async (opts) => {
+        try {
+            const core = await import("@mneme-ai/core");
+            const led = core.passport.verifyLedgerChain(process.cwd());
+            const rows = core.passport.readLedger(process.cwd());
+            process.stdout.write(JSON.stringify({ ok: led.ok, totalRows: led.rows, brokenAt: led.brokenAt, recent: rows.slice(-(opts.limit ?? 20)) }, null, 2) + "\n");
+            if (!led.ok)
+                process.exitCode = 1;
+        }
+        catch (e) {
+            process.stdout.write(JSON.stringify({ ok: false, error: e.message }) + "\n");
+            process.exitCode = 1;
+        }
+    });
+    passportParent.command("policy")
+        .description("Show the current default policy (tier → minTrust + ttlMs).")
+        .action(async () => {
+        try {
+            const core = await import("@mneme-ai/core");
+            process.stdout.write(JSON.stringify({ policy: core.passport.DEFAULT_POLICY }, null, 2) + "\n");
+        }
+        catch (e) {
+            process.stdout.write(JSON.stringify({ ok: false, error: e.message }) + "\n");
+            process.exitCode = 1;
+        }
+    });
     // v2.60.0 — SKELETON KEY: MCP server security auditor.
     // First MCP security audit tool in the ecosystem. Discovers MCP
     // servers in Claude Desktop / Cursor / Continue / Cline configs +