@gamaze/hicortex 0.18.3 → 0.19.1

package/dist/dashboard.d.ts

@@ -42,12 +42,21 @@ export interface DashboardMetrics {
          *  cap; undefined on backfill rows (a stage outcome, not reconstructable). */
         evicted?: number;
         /**
-         * Total LLM tokens consumed by this run's consolidation (#246). Undefined
-         * in lockstep with `tokens_by_stage` (and on backfill rows, which can't
-         * reconstruct a per-run meter).
+         * Total LLM tokens consumed by this run (#246 consolidation meter; #287
+         * widened to the TRUE total — distill + consolidation). Undefined in
+         * lockstep with `tokens_by_stage` (and on backfill rows, which can't
+         * reconstruct a per-run meter). Older snapshots are consolidation-only:
+         * historical rows can't be reconstructed, which is accepted (#287).
+         * Inherent under-count, same acceptance: attribution is response-based,
+         * so tokens a FAILED distill already spent (500 after spend, response
+         * lost after commit) reach the monthly meter but never a run's total —
+         * after such a night, the month's bars sum slightly below the headline.
          */
         tokens?: number;
-        /** Per-stage breakdown of `tokens` (#246). Undefined on backfill rows. */
+        /**
+         * Per-stage breakdown of `tokens` (#246; #287 adds a `distill` entry for
+         * capture-time distillation). Undefined on backfill rows.
+         */
         tokens_by_stage?: Record<string, {
             prompt: number;
             completion: number;
@@ -79,6 +88,19 @@ export interface DashboardMetrics {
          * shape is clean on healthy runs.
          */
         budget_deferred_by_stage?: Record<string, number>;
+        /**
+         * #6 backup stage outcome (Phase 0B). Present whenever the backup stage
+         * ran (full nightly); absent on capture-only / dry-run / backfill rows.
+         * `ok` is false when the snapshot OR the operator's offsite hook failed —
+         * the page flags a night the offsite copy didn't land. `bytes` is the
+         * compressed artifact size; `path` is the on-disk artifact (for "where
+         * did the last backup land?" debugging — not a restore button).
+         */
+        backup?: {
+            ok: boolean;
+            bytes: number;
+            path?: string;
+        };
     };
     /** Corpus capacity (#245). `memory_soft_cap` is the configured ceiling (0 =
      *  disabled); always present in real snapshots, undefined on backfilled
@@ -102,6 +124,17 @@ export interface DashboardSnapshot {
 }
 /** The /dashboard/data response — the full payload the page renders. */
 export interface DashboardData {
+    /**
+     * Account identity (hosted): who the viewer is, so a user holding two
+     * tenant tokens can tell whose data the page shows. Each field is null when
+     * its config key (displayName/orgName/planLabel) is absent — the page
+     * renders nothing when ALL are null (the self-hosted default).
+     */
+    account: {
+        name: string | null;
+        org: string | null;
+        plan: string | null;
+    };
     headline: {
         total_memories: number;
         uses_per_showing: number | null;
@@ -149,9 +182,10 @@ export interface DashboardData {
             supersession: number;
             added: number;
             evicted?: number;
-            /** Total tokens consumed that run (#246). Undefined = no metered run. */
+            /** Total tokens consumed that run (#246; #287: distill + consolidation).
+             *  Undefined = no metered run. */
             tokens?: number;
-            /** Per-stage breakdown of `tokens` (#246). */
+            /** Per-stage breakdown of `tokens` (#246; #287 adds `distill`). */
             tokens_by_stage?: Record<string, {
                 prompt: number;
                 completion: number;
@@ -207,6 +241,19 @@ export interface NightlyDelta {
         completion: number;
         total: number;
     }>;
+    /**
+     * Distill tokens metered by the daemon across this run's capture POSTs
+     * (#287) — summed from the /distill responses by the capture loop. Merged
+     * into the snapshot so `new_this_run.tokens` is the run's TRUE total
+     * (distill + consolidation) and `distill` joins `tokens_by_stage`. Zero
+     * (a daemon predating the usage field, or nothing distilled) is a no-op:
+     * the row keeps its consolidation-only shape.
+     */
+    distillUsage?: {
+        prompt: number;
+        completion: number;
+        total: number;
+    };
     /**
      * Always-on consolidation-budget usage (#255 CR). Forwarded whenever
      * consolidation ran so the dashboard renders a continuous used/max bar.
@@ -227,6 +274,15 @@ export interface NightlyDelta {
      * with `budgetExhausted`.
      */
     budgetDeferredByStage?: Record<string, number>;
+    /**
+     * #6 backup stage (Phase 0B). Hoisted from the nightly backup block. Present
+     * whenever the backup stage ran (full nightly); undefined on capture-only /
+     * dry-run. `backupOk` flips to false on snapshot OR hook failure so the
+     * digest can flag a night the offsite copy didn't land.
+     */
+    backupPath?: string;
+    backupBytes?: number;
+    backupOk?: boolean;
 }
 /**
  * Write one snapshot row for `runAt` (an ISO timestamp the caller chooses —
@@ -286,3 +342,12 @@ export declare function handleDashboardData(db: Database.Database, query: {
  * Failures surface as a 500 with the usual {error} shape — no silent degrade.
  */
 export declare function dashboardDataHandler(getDb: () => Database.Database, getConfig: () => Record<string, unknown> | null | undefined): express.RequestHandler;
+/**
+ * Express adapter for GET /account — the account identity ONLY (name/org/plan
+ * from config), so the /viz and /identity/ui pages can render the nav account
+ * element without pulling the full /dashboard/data payload. Same readAccount()
+ * construction as the dashboard payload — one shape, two surfaces. Also the
+ * natural whoami for the future OAuth session (#292). Failures surface as a
+ * 500 with the usual {error} shape (same as dashboardDataHandler).
+ */
+export declare function accountHandler(getConfig: () => Record<string, unknown> | null | undefined): express.RequestHandler;

package/dist/dashboard.js

@@ -25,6 +25,7 @@ exports.writeSnapshot = writeSnapshot;
 exports.backfillSnapshots = backfillSnapshots;
 exports.handleDashboardData = handleDashboardData;
 exports.dashboardDataHandler = dashboardDataHandler;
+exports.accountHandler = accountHandler;
 const recall_index_js_1 = require("./recall-index.js");
 const config_read_js_1 = require("./config-read.js");
 const consolidate_js_1 = require("./consolidate.js");
@@ -92,17 +93,36 @@ function computeDashboardMetrics(db) {
  */
 function writeSnapshot(db, runAt, delta, memorySoftCap) {
     const metrics = computeDashboardMetrics(db);
+    // #287: merge the run's two meters into the customer-facing total. `tokens`
+    // = consolidation (tokensThisRun) + distill (distillUsage.total); the distill
+    // share joins the stage map under its own key. Both fields stay in lockstep —
+    // emitted when EITHER phase metered, omitted when neither did (the page
+    // treats undefined as "no data for this day"). A zero/absent distillUsage
+    // (old daemon, nothing distilled) changes nothing: tokens/tokens_by_stage
+    // come through exactly as the consolidation report produced them.
+    const hasDistill = (delta.distillUsage?.total ?? 0) > 0;
+    const metered = delta.tokensThisRun !== undefined || hasDistill;
+    const mergedTokens = metered
+        ? (delta.tokensThisRun ?? 0) + (hasDistill ? delta.distillUsage.total : 0)
+        : undefined;
+    const mergedStages = metered
+        ? { ...(delta.tokensByStage ?? {}), ...(hasDistill ? { distill: delta.distillUsage } : {}) }
+        : undefined;
+    // Shape fidelity: `tokens_by_stage` with zero keys never existed pre-#287
+    // (the key was simply absent) — keep it that way so consumers that treat
+    // "present" as "has a breakdown" stay right.
+    const emitStages = mergedStages && Object.keys(mergedStages).length > 0 ? mergedStages : undefined;
     metrics.new_this_run = {
         added: delta.added,
         lessonsGenerated: delta.lessonsGenerated,
         dedup: delta.dedup,
         supersession: delta.supersession,
         evicted: delta.evicted,
-        // #246: forward only when consolidation actually metered tokens this run.
-        // Absent on capture-only / throttled / no-LLM / no-metered-call runs — the
-        // page treats undefined as "no data for this day", matching adoption.
-        ...(delta.tokensThisRun !== undefined ? { tokens: delta.tokensThisRun } : {}),
-        ...(delta.tokensByStage !== undefined ? { tokens_by_stage: delta.tokensByStage } : {}),
+        // #246: forward only when a phase actually metered tokens this run. Absent
+        // on capture-only / throttled / no-LLM / no-metered-call runs — the page
+        // treats undefined as "no data for this day", matching adoption.
+        ...(mergedTokens !== undefined ? { tokens: mergedTokens } : {}),
+        ...(emitStages !== undefined ? { tokens_by_stage: emitStages } : {}),
         // #255 CR: always-on usage metric — forward calls_used + max_calls
         // whenever consolidation ran (regardless of exhaustion) so the page can
         // render a continuous used/max bar. Presence = a run happened; absence =
@@ -121,6 +141,17 @@ function writeSnapshot(db, runAt, delta, memorySoftCap) {
                     : {}),
             }
             : {}),
+        // #6 backup stage — forwarded as a nested object only when the stage ran
+        // (backupOk !== undefined). Absent on capture-only / dry-run / backfill.
+        ...(delta.backupOk !== undefined
+            ? {
+                backup: {
+                    ok: delta.backupOk === true,
+                    bytes: delta.backupBytes ?? 0,
+                    ...(delta.backupPath ? { path: delta.backupPath } : {}),
+                },
+            }
+            : {}),
     };
     if (memorySoftCap !== undefined) {
         metrics.capacity = { memory_soft_cap: memorySoftCap };
@@ -418,8 +449,9 @@ function handleDashboardData(db, query, config) {
             supersession: dayMetrics?.new_this_run?.supersession ?? supersessionCount,
             added: dayMetrics?.new_this_run?.added ?? sampleRows.length,
             evicted: dayMetrics?.new_this_run?.evicted,
-            // #246: only present when the day's nightly metered tokens. Both fields
-            // are forwarded together — the page renders either the breakdown or nothing.
+            // #246/#287: only present when the day's nightly metered tokens (distill
+            // or consolidation). Both fields are forwarded together — the page
+            // renders either the breakdown or nothing.
             tokens: dayMetrics?.new_this_run?.tokens,
             tokens_by_stage: dayMetrics?.new_this_run?.tokens_by_stage,
             // #255 CR: always-on usage metric — present whenever consolidation ran
@@ -441,6 +473,10 @@ function handleDashboardData(db, query, config) {
     return {
         status: 200,
         body: {
+            // Account identity — read defensively like the numeric knobs above:
+            // null when absent/not a string (page renders nothing, never "null").
+            // Shared readAccount() so GET /account renders the identical shape.
+            account: (0, config_read_js_1.readAccount)(config),
             range: rangeParam,
             headline,
             series,
@@ -469,3 +505,21 @@ function dashboardDataHandler(getDb, getConfig) {
         }
     };
 }
+/**
+ * Express adapter for GET /account — the account identity ONLY (name/org/plan
+ * from config), so the /viz and /identity/ui pages can render the nav account
+ * element without pulling the full /dashboard/data payload. Same readAccount()
+ * construction as the dashboard payload — one shape, two surfaces. Also the
+ * natural whoami for the future OAuth session (#292). Failures surface as a
+ * 500 with the usual {error} shape (same as dashboardDataHandler).
+ */
+function accountHandler(getConfig) {
+    return (_req, res) => {
+        try {
+            res.status(200).json({ account: (0, config_read_js_1.readAccount)(getConfig()) });
+        }
+        catch (err) {
+            res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+        }
+    };
+}

package/dist/index.d.ts

@@ -23,13 +23,37 @@
  * machine's Hicortex nightly reads them via oc-transcript-reader.ts —
  * canonical nightly-from-logs, same as CC JSONL and Hermes state.db.
  */
-import type { MemorySearchResult } from "./types.js";
+import type { HicortexConfig, MemorySearchResult } from "./types.js";
 export declare function formatToolResults(results: MemorySearchResult[]): {
     content: Array<{
         type: string;
         text: string;
     }>;
 };
+/**
+ * Resolve the plugin's config from the raw `ctx.config` OC hands the service
+ * (the ENTIRE openclaw.json — verified against gateway-cli createServiceContext:
+ * config = params.cfg — not a per-plugin section). Stateless: touches no module
+ * state, never mutates the input, never throws (console.warn is its only side
+ * effect). Three branches, first match wins:
+ *
+ *   1. `plugins.entries.hicortex.config` — the canonical OC per-plugin
+ *      section. Only eligible when it is a non-null object with ≥1 OWN key:
+ *      OC scaffolds `config: {}` for an installed-but-unconfigured plugin,
+ *      and that empty object must not shadow real config further down.
+ *   2. `hicortex` at the top level — but only when `typeof === "object"`:
+ *      a string/bool/number there (e.g. `"hicortex": true` as a feature
+ *      toggle) is not a config and is skipped, not cast.
+ *   3. the top level itself — bare keys (`serverUrl`, `authToken`, …) at the
+ *      root of openclaw.json; the pre-0.19 shape, kept for backcompat.
+ *
+ * `serverUrl` and `authToken` are validated at this boundary: a present but
+ * non-string (or empty-string) value warns naming the key and degrades —
+ * serverUrl falls back to DEFAULT_SERVER_URL, authToken to undefined. No
+ * throw paths: a malformed config degrades to defaults instead of leaving
+ * the plugin half-initialized.
+ */
+export declare function resolveOcPluginConfig(raw: unknown): HicortexConfig;
 declare const _default: {
     id: string;
     name: string;

package/dist/index.js

@@ -26,6 +26,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.formatToolResults = formatToolResults;
+exports.resolveOcPluginConfig = resolveOcPluginConfig;
 const paths_js_1 = require("./paths.js");
 const features_js_1 = require("./features.js");
 const extensions_js_1 = require("./extensions.js");
@@ -256,6 +257,104 @@ function formatToolResults(results) {
     return { content: [{ type: "text", text }] };
 }
 // ---------------------------------------------------------------------------
+// Config resolution
+// ---------------------------------------------------------------------------
+/** Object (not null, not array) → itself as a record; anything else → undefined. */
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v)
+        ? v
+        : undefined;
+}
+function isNonEmptyString(v) {
+    return typeof v === "string" && v.length > 0;
+}
+/** Human name for a config value that failed validation. Only ever called
+ *  with INVALID values (non-strings and empty strings), so the string branch
+ *  means "empty string". */
+function describeInvalid(v) {
+    if (v === null)
+        return "null";
+    if (Array.isArray(v))
+        return "an array";
+    if (typeof v === "string")
+        return "an empty string";
+    return typeof v === "object" ? "an object" : `a ${typeof v}`;
+}
+/**
+ * Resolve the plugin's config from the raw `ctx.config` OC hands the service
+ * (the ENTIRE openclaw.json — verified against gateway-cli createServiceContext:
+ * config = params.cfg — not a per-plugin section). Stateless: touches no module
+ * state, never mutates the input, never throws (console.warn is its only side
+ * effect). Three branches, first match wins:
+ *
+ *   1. `plugins.entries.hicortex.config` — the canonical OC per-plugin
+ *      section. Only eligible when it is a non-null object with ≥1 OWN key:
+ *      OC scaffolds `config: {}` for an installed-but-unconfigured plugin,
+ *      and that empty object must not shadow real config further down.
+ *   2. `hicortex` at the top level — but only when `typeof === "object"`:
+ *      a string/bool/number there (e.g. `"hicortex": true` as a feature
+ *      toggle) is not a config and is skipped, not cast.
+ *   3. the top level itself — bare keys (`serverUrl`, `authToken`, …) at the
+ *      root of openclaw.json; the pre-0.19 shape, kept for backcompat.
+ *
+ * `serverUrl` and `authToken` are validated at this boundary: a present but
+ * non-string (or empty-string) value warns naming the key and degrades —
+ * serverUrl falls back to DEFAULT_SERVER_URL, authToken to undefined. No
+ * throw paths: a malformed config degrades to defaults instead of leaving
+ * the plugin half-initialized.
+ */
+function resolveOcPluginConfig(raw) {
+    const warn = (msg) => console.warn(`[hicortex] WARNING: ${msg}`);
+    const full = isRecord(raw) ?? {};
+    // Branch 1 — isRecord at every level: a missing key, string, array, or
+    // null anywhere in the chain just falls through to the next branch.
+    const plugins = isRecord(full.plugins);
+    const entries = isRecord(plugins?.entries);
+    const entry = isRecord(entries?.hicortex);
+    const entryConfig = isRecord(entry?.config);
+    const nested = entryConfig !== undefined && Object.keys(entryConfig).length > 0
+        ? entryConfig
+        : undefined;
+    // Branch 2 — top-level `hicortex`, object-guarded (see doc block).
+    const hicortexObj = isRecord(full.hicortex);
+    const winner = nested ?? hicortexObj ?? full;
+    const winnerPath = nested !== undefined
+        ? "plugins.entries.hicortex.config"
+        : hicortexObj !== undefined ? "hicortex" : "the top level of openclaw.json";
+    // Copy, never the caller's object: sanitizing below must not mutate
+    // ctx.config, and pluginConfig must not alias OC's config state.
+    const resolved = { ...winner };
+    const rawUrl = winner.serverUrl;
+    if (rawUrl !== undefined && !isNonEmptyString(rawUrl)) {
+        warn(`plugin config key "serverUrl" must be a non-empty string (got ${describeInvalid(rawUrl)}) ` +
+            `— falling back to ${DEFAULT_SERVER_URL}`);
+        resolved.serverUrl = DEFAULT_SERVER_URL;
+    }
+    const rawToken = winner.authToken;
+    if (rawToken !== undefined && !isNonEmptyString(rawToken)) {
+        warn(`plugin config key "authToken" must be a non-empty string (got ${describeInvalid(rawToken)}) — ignoring it`);
+        resolved.authToken = undefined;
+    }
+    // Shadow detection (F2) — two configs disagreeing, surfaced instead of
+    // silently honoring one of them. Case 1: an OC-scaffolded EMPTY
+    // plugins.entries.hicortex.config was skipped while a bare top-level
+    // serverUrl exists (the exact shape the ≥1-own-key rule exists for).
+    // Gate on the ACTUAL winner (re-CR F1): in the compound shape (empty
+    // nested config + a top-level hicortex object + bare serverUrl) the hicortex
+    // object wins — the warn must not claim the bare key is being used.
+    if (nested === undefined && entryConfig !== undefined && winner === full && isNonEmptyString(full.serverUrl)) {
+        warn(`plugins.entries.hicortex.config is empty, so the top-level serverUrl is used instead — ` +
+            `remove the empty config section or move serverUrl into it`);
+    }
+    // Case 2: a real nested/hicortex section won the chain but carries no valid
+    // serverUrl, while a bare top-level serverUrl is set and will NOT be read.
+    if (winner !== full && !isNonEmptyString(rawUrl) && isNonEmptyString(full.serverUrl)) {
+        warn(`top-level serverUrl is set but ${winnerPath} takes precedence and has no valid serverUrl — ` +
+            `the plugin will NOT use the top-level value; move serverUrl into ${winnerPath}`);
+    }
+    return resolved;
+}
+// ---------------------------------------------------------------------------
 // Plugin export
 // ---------------------------------------------------------------------------
 exports.default = {
@@ -269,12 +368,19 @@ exports.default = {
         api.registerService({
             id: "hicortex-service",
             async start(ctx) {
-                const config = (ctx.config ?? {});
+                // OC passes the ENTIRE openclaw.json as ctx.config (verified against
+                // gateway-cli createServiceContext: config = params.cfg), not a
+                // per-plugin section. resolveOcPluginConfig picks our section out of
+                // it (branch order documented on the function) and validates the
+                // scalar keys at the boundary. It never throws, so a malformed config
+                // can only degrade (warn + default), never half-initialize the plugin.
+                const config = resolveOcPluginConfig(ctx.config);
                 pluginConfig = config;
                 const log = ctx.logger
                     ? (msg) => ctx.logger.info(msg)
                     : console.log;
-                // Resolve server URL and auth token from plugin config
+                // Resolve server URL and auth token from plugin config (both already
+                // validated strings — or absent, hence the ?? default)
                 serverUrl = (config.serverUrl ?? DEFAULT_SERVER_URL).replace(/\/+$/, "");
                 authToken = config.authToken;
                 // Use stateDir from context so tests can redirect state writes

package/dist/mcp-server.d.ts

@@ -10,7 +10,25 @@
  *   GET  /sse        — SSE stream for MCP clients
  *   POST /messages   — message endpoint for MCP clients
  */
+import express from "express";
 import type { MemorySearchResult } from "./types.js";
+/**
+ * Resolve the request body-size limit in MB (#7). Pure — exported for tests.
+ * Precedence: an explicit config value > hosted-mode default (5) > self-hosted
+ * default (25, the historical fixed value → no regression). A finite positive
+ * config value wins; invalid/absent falls through.
+ */
+export declare function resolveBodyLimitMb(configVal: unknown, hostedMode: boolean): number;
+/**
+ * Express error middleware (#7): translate express.json's default HTML 413
+ * (entity.too.large) into a consistent JSON response. Catches body-parser
+ * errors only — which express.json emits BEFORE any route runs — so by
+ * registration order (this sits ahead of the routes) it never intercepts an
+ * error thrown inside a route handler; those reach Express's default handler.
+ * The `status === 413 || type === "entity.too.large"` check is defense-in-depth
+ * on top of that ordering. Exported so tests exercise the real handler.
+ */
+export declare function makeBodyLimitErrorHandler(limitMb: number): express.ErrorRequestHandler;
 export declare function startServer(options?: {
     port?: number;
     host?: string;

package/dist/mcp-server.js

@@ -48,6 +48,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveBodyLimitMb = resolveBodyLimitMb;
+exports.makeBodyLimitErrorHandler = makeBodyLimitErrorHandler;
 exports.startServer = startServer;
 exports.formatResults = formatResults;
 const express_1 = __importDefault(require("express"));
@@ -407,6 +409,38 @@ function createMcpServer() {
 // ---------------------------------------------------------------------------
 // HTTP server with SSE transport
 // ---------------------------------------------------------------------------
+/**
+ * Resolve the request body-size limit in MB (#7). Pure — exported for tests.
+ * Precedence: an explicit config value > hosted-mode default (5) > self-hosted
+ * default (25, the historical fixed value → no regression). A finite positive
+ * config value wins; invalid/absent falls through.
+ */
+function resolveBodyLimitMb(configVal, hostedMode) {
+    const cfg = Number(configVal);
+    if (Number.isFinite(cfg) && cfg > 0)
+        return cfg;
+    return hostedMode ? 5 : 25;
+}
+/**
+ * Express error middleware (#7): translate express.json's default HTML 413
+ * (entity.too.large) into a consistent JSON response. Catches body-parser
+ * errors only — which express.json emits BEFORE any route runs — so by
+ * registration order (this sits ahead of the routes) it never intercepts an
+ * error thrown inside a route handler; those reach Express's default handler.
+ * The `status === 413 || type === "entity.too.large"` check is defense-in-depth
+ * on top of that ordering. Exported so tests exercise the real handler.
+ */
+function makeBodyLimitErrorHandler(limitMb) {
+    return (err, _req, res, next) => {
+        const status = err.status;
+        const type = err.type;
+        if (status === 413 || type === "entity.too.large") {
+            res.status(413).json({ error: "request body too large", limit_mb: limitMb });
+            return;
+        }
+        next(err);
+    };
+}
 async function startServer(options = {}) {
     const port = options.port ?? 8787;
     const host = options.host ?? "0.0.0.0";
@@ -493,6 +527,12 @@ async function startServer(options = {}) {
     // env (provider-set, tenant-immutable) which takes precedence. Initialised here
     // (after stateDir + savedConfig are known) so the warn-dedup can seed from state.
     (0, token_budget_js_1.initTokenBudget)(stateDir, savedConfig?.llmTokensPerMonth);
+    // #7: request body-size limit. Config key wins; else 5 MB hosted / 25 MB
+    // self-hosted (the prior fixed value → no regression). Guards the OOM vector
+    // (the body is fully parsed into memory before the distiller truncates to 80K
+    // chars). Legitimate capture segments are ≤60K chars (~200KB), so this never
+    // constrains real flow — it's an abuse/backstop. Oversized → 413.
+    const bodyLimitMb = resolveBodyLimitMb(savedConfig?.distillBodyLimitMb, hostedMode);
     if (savedConfig?.llmBackend === "claude-cli") {
         const claudePath = (0, llm_js_1.findClaudeBinary)();
         if (claudePath) {
@@ -636,7 +676,11 @@ async function startServer(options = {}) {
     // Express app
     const app = (0, express_1.default)();
     // Raise the body limit — whole-session denoised transcripts exceed the 100 kB default.
-    app.use(express_1.default.json({ limit: "25mb" }));
+    app.use(express_1.default.json({ limit: `${bodyLimitMb}mb` }));
+    // #7: JSON 413 on body-limit exceed (see makeBodyLimitErrorHandler). Server-side
+    // only — the client capture loop treats 413 like any non-2xx (holds cursor);
+    // it never fires for legitimate capture (segments ≤200KB ≪ the limit).
+    app.use(makeBodyLimitErrorHandler(bodyLimitMb));
     // CORS: reflect ONLY explicitly-allowlisted origins (config.corsAllowedOrigins),
     // and never send Access-Control-Allow-Credentials. Reflecting any origin with
     // credentials — combined with the localhost auth bypass and the default 0.0.0.0
@@ -997,7 +1041,8 @@ async function startServer(options = {}) {
     });
     // REST /distill — canonical capture endpoint (0.9.0+).
     // Every machine (including the server itself) POSTs denoised session text here.
-    // The server distills, embeds, stores. Body limit: 25 MB (raised at app init).
+    // The server distills, embeds, stores. Body limit: see `distillBodyLimitMb`
+    // (default 25 MB self-hosted / 5 MB hosted); oversized → 413 (#7).
     //
     // Accepts text (string, preferred nightly path) OR messages (array, legacy).
     // Performs session-level dedup when session_id is present without segment_id.
@@ -1161,6 +1206,12 @@ async function startServer(options = {}) {
                 ids,
                 distilled: ids.length,
                 dropped: dropped.map((d) => (d.length > 120 ? `${d.slice(0, 120)}…` : d)),
+                // #287: this segment's metered usage — the same breakdown
+                // recordDistillUsage accrues below. Lets the capturing nightly
+                // attribute distill tokens in its dashboard snapshot
+                // (new_this_run.tokens_by_stage.distill). Always present (zeros when
+                // no chunk reached an LLM call); pre-#287 clients ignore it.
+                usage: distillUsage,
             });
         }
         catch (err) {
@@ -1452,6 +1503,13 @@ async function startServer(options = {}) {
     // express adapter that injects the live db + config. STRICTLY view-only —
     // no mutation endpoints on the dashboard surface.
     app.get("/dashboard/data", (0, dashboard_js_1.dashboardDataHandler)(() => db, () => readConfigFile(stateDir)));
+    // GET /account — account identity for the console nav (name/org/plan from
+    // config). The LIGHTWEIGHT twin of the account block inside /dashboard/data:
+    // the /viz and /identity/ui pages need only this, not the metric payload;
+    // also the natural whoami for the future OAuth session (#292). Bearer-only
+    // (standard auth middleware, no shell exemption — it carries data); localhost
+    // bypass applies. Handler lives in src/dashboard.ts next to its twin.
+    app.get("/account", (0, dashboard_js_1.accountHandler)(() => readConfigFile(stateDir)));
     // SSE endpoint — each connection gets its own McpServer + transport
     app.get("/sse", async (req, res) => {
         const transport = new sse_js_1.SSEServerTransport("/messages", res);

package/dist/memory-instructions.js

@@ -30,7 +30,7 @@ exports.MEMORY_SECTION_NAME = "memory";
  *  injected once per session into every agent on the fleet. */
 function renderMemoryInstructions() {
     return [
-        "Your long-term memory is Hicortex — shared across all agents and sessions.",
+        "Hicortex is your persistent identity and long-term memory: what you learn, decide, and correct survives every session, compaction, and model switch — one memory shared by all your agents.",
         "- A `## Memory recall (auto)` index may arrive with prompts: it is a MENU, not content. Fetch a full memory with `hicortex_get(id)` when the entry could change how you handle the current task.",
         "- Recall before assuming: `hicortex_search` for prior decisions/facts/preferences, `hicortex_recent` to catch up on a project.",
         "- Cite any memory you rely on by id + date, and mark it `FETCHED` (you read the full memory via `hicortex_get`) or `SNIPPET` (the one-line entry only). Don't present a SNIPPET citation as established. On conflicts, newer memories supersede older.",