codemem 0.29.1 → 0.29.2

package/dist/index.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { DEDUP_KEY_BACKFILL_JOB, DEFAULT_COORDINATOR_DB_PATH, DedupKeyBackfillRunner, MUTATING_TOOL_NAMES, MemoryStore, ObserverClient, REF_BACKFILL_JOB, RawEventSweeper, RefBackfillRunner, SESSION_CONTEXT_BACKFILL_JOB, SUMMARY_DEDUP_BACKFILL_JOB, SessionContextBackfillRunner, SummaryDedupBackfillRunner, SyncRetentionRunner, VERSION, VectorModelMigrationRunner, aiBackfillStructuredContent, applyBootstrapSnapshot, backfillMemoryDedupKeys, backfillNarrativeFromBody, backfillTagsText, backfillVectors, buildAuthHeaders, buildBaseUrl, buildRawEventEnvelopeFromHook, compareMemoryRoleReports, connect, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorDisableDeviceAction, coordinatorEnrollDeviceAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, createBetterSqliteCoordinatorApp, deactivateLowSignalMemories, deactivateLowSignalObservations, dedupNearDuplicateMemories, ensureDeviceIdentity, ensureSchemaBootstrapped, exportMemories, extractApplyPatchPaths, fetchAllSnapshotPages, fingerprintPublicKey, flushRawEvents, getExtractionBenchmarkProfile, getInjectionEvalScenarioPack, getInjectionEvalScenarioPrompts, getMaintenanceJob, getMemoryRoleReport, getRawEventRelinkPlan, getRawEventRelinkReport, getRawEventStatus, getSemanticIndexDiagnostics, getSessionExtractionEval, getSessionExtractionEvalScenario, getWorkspaceCodememConfigPath, hasPendingDedupKeyBackfill, hasPendingRefBackfill, hasPendingSessionContextBackfill, hasPendingSummaryDedupBackfill, hasUnsyncedSharedMemoryChanges, importMemories, initDatabase, isEmbeddingDisabled, listMaintenanceJobs, loadObserverConfig, loadPublicKey, loadSqliteVec, mdnsEnabled, planReplicationOpsAgePrune, pruneReplicationOpsUntilCaughtUp, rawEventsGate, readCodememConfigFile, readCodememConfigFileAtPath, readCoordinatorSyncConfig, readImportPayload, replayBatchExtraction, replayBatchExtractionWithTierRouting, requestJson, resolveCodememConfigPath, resolveDbPath, resolveHookProject, resolveProject, retryRawEventFailures, runSyncDaemon, runSyncPass, schema, setPeerProjectFilter, stripJsonComments, stripPrivateObj, stripTrailingCommas, syncPassPreflight, updatePeerAddresses, vacuumDatabase, writeCodememConfigFile } from "@codemem/core";
+import { DEDUP_KEY_BACKFILL_JOB, DEFAULT_COORDINATOR_DB_PATH, DedupKeyBackfillRunner, MUTATING_TOOL_NAMES, MemoryStore, ObserverClient, REF_BACKFILL_JOB, RawEventSweeper, RefBackfillRunner, SESSION_CONTEXT_BACKFILL_JOB, SUMMARY_DEDUP_BACKFILL_JOB, SessionContextBackfillRunner, SummaryDedupBackfillRunner, SyncRetentionRunner, VERSION, VectorModelMigrationRunner, aiBackfillStructuredContent, applyBootstrapSnapshot, backfillMemoryDedupKeys, backfillNarrativeFromBody, backfillTagsText, backfillVectors, buildAuthHeaders, buildBaseUrl, buildRawEventEnvelopeFromHook, compareMemoryRoleReports, connect, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorDisableDeviceAction, coordinatorEnrollDeviceAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, createBetterSqliteCoordinatorApp, deactivateLowSignalMemories, deactivateLowSignalObservations, dedupNearDuplicateMemories, ensureDeviceIdentity, ensureSchemaBootstrapped, exportMemories, extractApplyPatchPaths, fetchAllSnapshotPages, fingerprintPublicKey, flushRawEvents, getExtractionBenchmarkProfile, getInjectionEvalScenarioPack, getInjectionEvalScenarioPrompts, getMaintenanceJob, getMemoryRoleReport, getRawEventRelinkPlan, getRawEventRelinkReport, getRawEventStatus, getSemanticIndexDiagnostics, getSessionExtractionEval, getSessionExtractionEvalScenario, getWorkspaceCodememConfigPath, hasPendingDedupKeyBackfill, hasPendingRefBackfill, hasPendingSessionContextBackfill, hasPendingSummaryDedupBackfill, hasUnsyncedSharedMemoryChanges, importMemories, initDatabase, isEmbeddingDisabled, listMaintenanceJobs, loadObserverConfig, loadPublicKey, loadSqliteVec, mdnsEnabled, planReplicationOpsAgePrune, pruneReplicationOpsUntilCaughtUp, rawEventsGate, readCodememConfigFile, readCodememConfigFileAtPath, readCoordinatorSyncConfig, readImportPayload, replayBatchExtraction, replayBatchExtractionWithTierRouting, requestJson, resolveCodememConfigPath, resolveDbPath, resolveHookProject, resolveProject, retryRawEventFailures, runSyncDaemon, runSyncPass, scanSecretsRetroactive, schema, setPeerProjectFilter, stripJsonComments, stripPrivateObj, stripTrailingCommas, syncPassPreflight, updatePeerAddresses, vacuumDatabase, writeCodememConfigFile } from "@codemem/core";
 import { Command, Option } from "commander";
 import omelette from "omelette";
 import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { homedir, networkInterfaces } from "node:os";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { styleText } from "node:util";
 import { randomInt } from "node:crypto";
-import { homedir, networkInterfaces } from "node:os";
-import { dirname, join } from "node:path";
 import * as p from "@clack/prompts";
 import { serve } from "@hono/node-server";
 import { spawn, spawnSync } from "node:child_process";
@@ -79,9 +79,9 @@ function emitJsonError(errorCode, message, exitCode = 1) {
 //#endregion
 //#region src/commands/claude-hook-plugin-log.ts
 /**
-* Append-only plugin failure log used by both `claude-hook-inject` and
-* `claude-hook-ingest` to record errors that don't justify crashing the
-* hook command itself.
+* Append-only plugin event log used by `claude-hook-inject` and
+* `claude-hook-ingest` to record successes (e.g. `inject.pack.ok ...`) and
+* errors that don't justify crashing the hook command itself.
 *
 * Behavior:
 * - Default log path is `~/.codemem/plugin.log`.
@@ -101,7 +101,7 @@ var BOOLEAN_TOGGLE_VALUES = new Set([
 	"on",
 	"no"
 ]);
-function expandHome$2(value) {
+function expandHome$3(value) {
 	const home = process.env.HOME?.trim() || homedir();
 	if (value === "~") return home;
 	if (value.startsWith("~/")) return join(home, value.slice(2));
@@ -110,15 +110,15 @@ function expandHome$2(value) {
 function pluginLogPath() {
 	const raw = process.env.CODEMEM_PLUGIN_LOG_PATH ?? process.env.CODEMEM_PLUGIN_LOG ?? "";
 	const normalized = raw.trim().toLowerCase();
-	if (BOOLEAN_TOGGLE_VALUES.has(normalized)) return expandHome$2("~/.codemem/plugin.log");
-	return expandHome$2(raw.trim());
+	if (BOOLEAN_TOGGLE_VALUES.has(normalized)) return expandHome$3("~/.codemem/plugin.log");
+	return expandHome$3(raw.trim());
 }
 /**
 * Append a single timestamped line to the plugin log. Best-effort: any
 * filesystem error is swallowed so a logging failure can never bubble up
 * into a Claude hook crash.
 */
-function logHookFailure(message) {
+function logHookEvent(message) {
 	const path = pluginLogPath();
 	try {
 		mkdirSync(dirname(path), { recursive: true });
@@ -126,6 +126,264 @@ function logHookFailure(message) {
 	} catch {}
 }
 //#endregion
+//#region src/commands/claude-hook-file-context.ts
+var FILE_GATE_MIN_BYTES = 1500;
+var FETCH_LIMIT = 40;
+var DISPLAY_LIMIT = 15;
+var MTIME_FRESH_TOLERANCE_MS = 300 * 1e3;
+var SMALL_FILE_BYPASS_PATTERNS = [
+	/\.(json|jsonc|toml|ya?ml)$/i,
+	/\.env(\.|$)/i,
+	/(^|\/)dockerfile(\.|$)/i,
+	/\.config\.(js|ts|mjs|cjs|json)$/i
+];
+var KIND_ICONS = {
+	decision: "⚖️",
+	bugfix: "🔴",
+	feature: "🟢",
+	refactor: "🔄",
+	discovery: "🔵",
+	change: "✅",
+	exploration: "🔬"
+};
+function emitJson$1(value) {
+	console.log(JSON.stringify(value));
+}
+function emitError$1(value) {
+	process.stderr.write(`${JSON.stringify(value)}\n`);
+}
+function continueResult$1() {
+	return { continue: true };
+}
+function envNotDisabled$1(value) {
+	const normalized = String(value ?? "").trim().toLowerCase();
+	return normalized !== "0" && normalized !== "false" && normalized !== "off";
+}
+function envTruthy$2(value) {
+	const normalized = String(value ?? "").trim().toLowerCase();
+	return normalized === "1" || normalized === "true" || normalized === "yes" || normalized === "on";
+}
+function expandHome$2(value) {
+	if (value === "~") return homedir();
+	if (value.startsWith("~/")) return resolve(homedir(), value.slice(2));
+	return value;
+}
+function extractFilePath(payload) {
+	const toolInput = payload.tool_input;
+	if (!toolInput || typeof toolInput !== "object" || Array.isArray(toolInput)) return null;
+	const filePath = toolInput.file_path;
+	return typeof filePath === "string" && filePath.trim() ? filePath.trim() : null;
+}
+function statFile(absPath) {
+	try {
+		const stat = statSync(absPath);
+		return {
+			sizeBytes: stat.size,
+			mtimeMs: stat.mtimeMs
+		};
+	} catch {
+		return null;
+	}
+}
+function parseJsonArray(value) {
+	if (!value) return [];
+	try {
+		const parsed = JSON.parse(value);
+		if (!Array.isArray(parsed)) return [];
+		return parsed.filter((item) => typeof item === "string");
+	} catch {
+		return [];
+	}
+}
+function normalizePathForCompare(path) {
+	return path.replace(/\\/g, "/");
+}
+function scoreRow(row, normalizedTarget, idx) {
+	const filesModified = parseJsonArray(row.files_modified);
+	const inModified = filesModified.some((f) => normalizePathForCompare(f) === normalizedTarget);
+	let score = 0;
+	if (inModified) score += 2;
+	if (filesModified.length <= 1) score += 2;
+	else if (filesModified.length <= 3) score += 1;
+	return {
+		row,
+		score,
+		idx
+	};
+}
+function scoreAndDedupe(rows, targetPath, limit) {
+	const normalizedTarget = normalizePathForCompare(targetPath);
+	const scored = rows.map((row, idx) => scoreRow(row, normalizedTarget, idx));
+	const bestPerSession = /* @__PURE__ */ new Map();
+	for (const item of scored) {
+		const existing = bestPerSession.get(item.row.session_id);
+		if (!existing || item.score > existing.score || item.score === existing.score && item.idx < existing.idx) bestPerSession.set(item.row.session_id, item);
+	}
+	const deduped = Array.from(bestPerSession.values());
+	deduped.sort((a, b) => b.score - a.score || a.idx - b.idx);
+	return deduped.slice(0, limit).map((s) => s.row);
+}
+function compactTime(timeStr) {
+	return timeStr.toLowerCase().replace(" am", "a").replace(" pm", "p");
+}
+function formatTime(epochMs) {
+	return new Date(epochMs).toLocaleString("en-US", {
+		hour: "numeric",
+		minute: "2-digit",
+		hour12: true
+	});
+}
+function formatDate(epochMs) {
+	return new Date(epochMs).toLocaleString("en-US", {
+		month: "short",
+		day: "numeric",
+		year: "numeric"
+	});
+}
+function formatTimeline(rows, filePath, staleness) {
+	const safePath = filePath.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n");
+	const enriched = rows.map((row) => ({
+		row,
+		epochMs: Date.parse(row.created_at)
+	})).filter((item) => Number.isFinite(item.epochMs) && item.epochMs > 0);
+	const byDay = /* @__PURE__ */ new Map();
+	for (const item of enriched) {
+		const day = formatDate(item.epochMs);
+		const bucket = byDay.get(day);
+		if (bucket) bucket.push(item);
+		else byDay.set(day, [item]);
+	}
+	const sortedDays = Array.from(byDay.entries()).sort((a, b) => {
+		return Math.min(...a[1].map((i) => i.epochMs)) - Math.min(...b[1].map((i) => i.epochMs));
+	});
+	const ids = rows.map((r) => r.id);
+	const lines = [`This file (${safePath}) has prior codemem observations. The Read result below is unchanged.`, `- Fetch full bodies on demand: memory.get_observations([${ids.join(", ")}]).`];
+	if (staleness) {
+		const driftMinutes = Math.max(1, Math.round((staleness.fileMtimeMs - staleness.newestObservationMs) / 6e4));
+		lines.unshift(`Heads up: this file was modified ~${driftMinutes} min after the most recent observation below. Past entries may be partially stale — verify against the Read result before relying on them.`);
+	}
+	for (const [day, dayItems] of sortedDays) {
+		const chronological = [...dayItems].sort((a, b) => a.epochMs - b.epochMs);
+		lines.push(`### ${day}`);
+		for (const { row, epochMs } of chronological) {
+			const title = (row.title || "Untitled").replace(/[\r\n\t]+/g, " ").replace(/\s+/g, " ").trim().slice(0, 160);
+			const icon = KIND_ICONS[row.kind] ?? "❔";
+			const time = compactTime(formatTime(epochMs));
+			lines.push(`${row.id} ${time} ${icon} (${row.kind}) ${title}`);
+		}
+	}
+	return lines.join("\n");
+}
+function queryByFile(dbPath, relativePath, project, limit) {
+	const store = new MemoryStore(dbPath);
+	try {
+		const opts = { limit };
+		if (project) opts.project = project;
+		return store.findByFile(relativePath, opts);
+	} finally {
+		store.close();
+	}
+}
+function resolveProject$1(payload) {
+	return resolveHookProject(typeof payload.cwd === "string" ? payload.cwd : null, payload.project);
+}
+async function buildClaudeFileContext(payload, opts, deps = {}) {
+	if (envTruthy$2(process.env.CODEMEM_PLUGIN_IGNORE)) return continueResult$1();
+	if (!envNotDisabled$1(process.env.CODEMEM_FILE_CONTEXT || "1")) return continueResult$1();
+	const filePath = extractFilePath(payload);
+	if (!filePath) return continueResult$1();
+	const cwd = typeof payload.cwd === "string" && payload.cwd.trim() ? payload.cwd : process.cwd();
+	const expandedPath = expandHome$2(filePath);
+	const absolutePath = isAbsolute(expandedPath) ? expandedPath : resolve(cwd, expandedPath);
+	const relativePath = relative(cwd, absolutePath).split(sep).join("/");
+	const escapesCwd = relativePath === ".." || relativePath.startsWith("../") || isAbsolute(relativePath);
+	if (!relativePath || escapesCwd) {
+		logHookEvent(`file_context.skip reason=outside_cwd path=${JSON.stringify(filePath)} cwd=${JSON.stringify(cwd)}`);
+		return continueResult$1();
+	}
+	const minBytes = Number.parseInt(process.env.CODEMEM_FILE_CONTEXT_MIN_BYTES ?? `${FILE_GATE_MIN_BYTES}`, 10);
+	const minBytesEffective = Number.isFinite(minBytes) && minBytes >= 0 ? minBytes : FILE_GATE_MIN_BYTES;
+	const stat = (deps.statFile ?? statFile)(absolutePath);
+	if (!stat) {
+		logHookEvent(`file_context.skip reason=stat_failed path=${JSON.stringify(relativePath)}`);
+		return continueResult$1();
+	}
+	const bypassSizeGate = SMALL_FILE_BYPASS_PATTERNS.some((p) => p.test(relativePath));
+	if (stat.sizeBytes < minBytesEffective && !bypassSizeGate) {
+		logHookEvent(`file_context.skip reason=below_size_gate path=${JSON.stringify(relativePath)} size=${stat.sizeBytes} gate=${minBytesEffective}`);
+		return continueResult$1();
+	}
+	const project = resolveProject$1(payload);
+	const resolveDb = deps.resolveDb ?? resolveDbPath;
+	const queryFn = deps.queryByFile ?? queryByFile;
+	let rows = [];
+	try {
+		rows = queryFn(resolveDb(resolveDbOpt(opts)), relativePath, project, FETCH_LIMIT);
+	} catch (err) {
+		logHookEvent(`codemem claude-hook-file-context query failed: ${err instanceof Error ? err.message : String(err)}`);
+		return continueResult$1();
+	}
+	if (rows.length === 0) {
+		logHookEvent(`file_context.skip reason=no_observations path=${JSON.stringify(relativePath)} project=${JSON.stringify(project ?? "")}`);
+		return continueResult$1();
+	}
+	const top = scoreAndDedupe(rows, relativePath, DISPLAY_LIMIT);
+	if (top.length === 0) {
+		logHookEvent(`file_context.skip reason=no_top_after_dedupe path=${JSON.stringify(relativePath)} candidates=${rows.length}`);
+		return continueResult$1();
+	}
+	let staleness = null;
+	if (stat.mtimeMs > 0) {
+		const newestObservationMs = top.reduce((max, row) => {
+			const epoch = Date.parse(row.created_at);
+			return Number.isFinite(epoch) && epoch > max ? epoch : max;
+		}, 0);
+		if (newestObservationMs > 0 && stat.mtimeMs > newestObservationMs + MTIME_FRESH_TOLERANCE_MS) staleness = {
+			fileMtimeMs: stat.mtimeMs,
+			newestObservationMs
+		};
+	}
+	const timeline = formatTimeline(top, relativePath, staleness);
+	logHookEvent(`file_context.ok path=${JSON.stringify(relativePath)} candidates=${rows.length} surfaced=${top.length} project=${JSON.stringify(project ?? "")} stale=${staleness ? "true" : "false"}`);
+	return { hookSpecificOutput: {
+		hookEventName: "PreToolUse",
+		permissionDecision: "allow",
+		additionalContext: timeline
+	} };
+}
+var claudeHookFileContextCmd = new Command("claude-hook-file-context").configureHelp(helpStyle).description("Return Claude PreToolUse:Read additionalContext from per-file observation timeline");
+addDbOption(claudeHookFileContextCmd);
+var claudeHookFileContextCommand = claudeHookFileContextCmd.action(async (opts) => {
+	let raw = "";
+	for await (const chunk of process.stdin) raw += String(chunk);
+	const trimmed = raw.trim();
+	if (!trimmed) {
+		emitJson$1(continueResult$1());
+		return;
+	}
+	let payload;
+	try {
+		const parsed = JSON.parse(trimmed);
+		if (parsed == null || typeof parsed !== "object" || Array.isArray(parsed)) {
+			emitError$1({
+				error: "parse_error",
+				message: "payload must be a JSON object"
+			});
+			process.exitCode = 1;
+			return;
+		}
+		payload = parsed;
+	} catch {
+		emitError$1({
+			error: "parse_error",
+			message: "invalid JSON"
+		});
+		process.exitCode = 1;
+		return;
+	}
+	emitJson$1(await buildClaudeFileContext(payload, opts));
+});
+//#endregion
 //#region src/commands/claude-hook-ingest-spool.ts
 /**
 * Durability layer for `claude-hook-ingest`: file-based mutex to
@@ -350,7 +608,7 @@ function spoolPayload(payload) {
 	try {
 		mkdirSync(dir, { recursive: true });
 	} catch {
-		logHookFailure("codemem claude-hook-ingest failed to create spool dir");
+		logHookEvent("codemem claude-hook-ingest failed to create spool dir");
 		return false;
 	}
 	const payloadText = JSON.stringify(payload);
@@ -358,7 +616,7 @@ function spoolPayload(payload) {
 	try {
 		writeFileSync(tmpPath, payloadText, { encoding: "utf8" });
 	} catch {
-		logHookFailure("codemem claude-hook-ingest failed to allocate spool temp file");
+		logHookEvent("codemem claude-hook-ingest failed to allocate spool temp file");
 		return false;
 	}
 	const finalPath = join(dir, `hook-${Math.floor(Date.now() / 1e3)}-${process.pid}-${randomInt(1e3, 1e4)}.json`);
@@ -368,10 +626,10 @@ function spoolPayload(payload) {
 		try {
 			unlinkSync(tmpPath);
 		} catch {}
-		logHookFailure("codemem claude-hook-ingest failed to spool payload");
+		logHookEvent("codemem claude-hook-ingest failed to spool payload");
 		return false;
 	}
-	logHookFailure(`codemem claude-hook-ingest spooled payload: ${finalPath}`);
+	logHookEvent(`codemem claude-hook-ingest spooled payload: ${finalPath}`);
 	return true;
 }
 /**
@@ -408,7 +666,7 @@ function recoverStaleTmpSpool(ttlSeconds) {
 		const recoveredPath = join(dir, `hook-recovered-${Math.floor(nowS)}-${process.pid}-${randomInt(1e3, 1e4)}.json`);
 		try {
 			renameSync(tmpPath, recoveredPath);
-			logHookFailure(`codemem claude-hook-ingest recovered stale temp spool payload: ${recoveredPath}`);
+			logHookEvent(`codemem claude-hook-ingest recovered stale temp spool payload: ${recoveredPath}`);
 		} catch {}
 	}
 }
@@ -423,11 +681,11 @@ function quarantineSpoolEntry(dir, name, reason) {
 	const quarantineName = `.bad-${reason}-${Date.now()}-${randomInt(1e3, 1e4)}-${name}`;
 	try {
 		renameSync(sourcePath, join(dir, quarantineName));
-		logHookFailure(`codemem claude-hook-ingest quarantined corrupt spool payload (${reason}): ${quarantineName}`);
+		logHookEvent(`codemem claude-hook-ingest quarantined corrupt spool payload (${reason}): ${quarantineName}`);
 	} catch {
 		try {
 			unlinkSync(sourcePath);
-			logHookFailure(`codemem claude-hook-ingest dropped corrupt spool payload (${reason}): ${name}`);
+			logHookEvent(`codemem claude-hook-ingest dropped corrupt spool payload (${reason}): ${name}`);
 		} catch {}
 	}
 }
@@ -469,7 +727,7 @@ async function drainSpool(handler) {
 		try {
 			raw = readFileSync(path, "utf8");
 		} catch {
-			logHookFailure(`codemem claude-hook-ingest failed to read spooled payload: ${path}`);
+			logHookEvent(`codemem claude-hook-ingest failed to read spooled payload: ${path}`);
 			result.failed++;
 			continue;
 		}
@@ -496,7 +754,7 @@ async function drainSpool(handler) {
 			result.processed++;
 		} catch {}
 		else {
-			logHookFailure(`codemem claude-hook-ingest failed processing spooled payload: ${path}`);
+			logHookEvent(`codemem claude-hook-ingest failed processing spooled payload: ${path}`);
 			result.failed++;
 		}
 	}
@@ -799,7 +1057,7 @@ async function tryHttpIngest(payload, host, port) {
 		try {
 			body = await res.json();
 		} catch {
-			logHookFailure("codemem claude-hook-ingest HTTP accepted with invalid response body");
+			logHookEvent("codemem claude-hook-ingest HTTP accepted with invalid response body");
 			return {
 				ok: false,
 				inserted: 0,
@@ -807,7 +1065,7 @@ async function tryHttpIngest(payload, host, port) {
 			};
 		}
 		if (body == null || typeof body !== "object" || Array.isArray(body)) {
-			logHookFailure("codemem claude-hook-ingest HTTP accepted with invalid response type");
+			logHookEvent("codemem claude-hook-ingest HTTP accepted with invalid response type");
 			return {
 				ok: false,
 				inserted: 0,
@@ -816,7 +1074,7 @@ async function tryHttpIngest(payload, host, port) {
 		}
 		const obj = body;
 		if (typeof obj.inserted !== "number" || typeof obj.skipped !== "number") {
-			logHookFailure("codemem claude-hook-ingest HTTP accepted with unexpected response body");
+			logHookEvent("codemem claude-hook-ingest HTTP accepted with unexpected response body");
 			return {
 				ok: false,
 				inserted: 0,
@@ -902,14 +1160,14 @@ async function flushBoundaryRawEvents(payload, dbPath) {
 	try {
 		observer = new ObserverClient();
 	} catch (err) {
-		logHookFailure(`codemem claude-hook-ingest boundary flush observer init failed: ${err instanceof Error ? err.message : String(err)}`);
+		logHookEvent(`codemem claude-hook-ingest boundary flush observer init failed: ${err instanceof Error ? err.message : String(err)}`);
 		return;
 	}
 	let store;
 	try {
 		store = new MemoryStore(dbPath);
 	} catch (err) {
-		logHookFailure(`codemem claude-hook-ingest boundary flush store init failed: ${err instanceof Error ? err.message : String(err)}`);
+		logHookEvent(`codemem claude-hook-ingest boundary flush store init failed: ${err instanceof Error ? err.message : String(err)}`);
 		return;
 	}
 	try {
@@ -922,7 +1180,7 @@ async function flushBoundaryRawEvents(payload, dbPath) {
 			maxEvents: null
 		});
 	} catch (err) {
-		logHookFailure(`codemem claude-hook-ingest boundary flush raw events failed: ${err instanceof Error ? err.message : String(err)}`);
+		logHookEvent(`codemem claude-hook-ingest boundary flush raw events failed: ${err instanceof Error ? err.message : String(err)}`);
 	} finally {
 		store.close();
 	}
@@ -953,7 +1211,7 @@ async function ingestClaudeHookPayload(payload, opts, deps = {}) {
 				result: directIngest(queued, getDbPath())
 			};
 		} catch (err) {
-			logHookFailure(`codemem claude-hook-ingest direct fallback failed: ${err instanceof Error ? err.message : String(err)}`);
+			logHookEvent(`codemem claude-hook-ingest direct fallback failed: ${err instanceof Error ? err.message : String(err)}`);
 			return { ok: false };
 		}
 	};
@@ -962,12 +1220,12 @@ async function ingestClaudeHookPayload(payload, opts, deps = {}) {
 		try {
 			directIngest(payload, getDbPath());
 		} catch (err) {
-			logHookFailure(`codemem claude-hook-ingest boundary flush direct write failed: ${err instanceof Error ? err.message : String(err)}`);
+			logHookEvent(`codemem claude-hook-ingest boundary flush direct write failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
 		try {
 			await boundaryFlush(payload, getDbPath());
 		} catch (err) {
-			logHookFailure(`codemem claude-hook-ingest boundary flush failed: ${err instanceof Error ? err.message : String(err)}`);
+			logHookEvent(`codemem claude-hook-ingest boundary flush failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
 	};
 	const drainBacklogIfPresent = async () => {
@@ -982,7 +1240,7 @@ async function ingestClaudeHookPayload(payload, opts, deps = {}) {
 			});
 		} catch (err) {
 			if (err instanceof LockBusyError) return;
-			logHookFailure(`codemem claude-hook-ingest backlog drain failed: ${err instanceof Error ? err.message : String(err)}`);
+			logHookEvent(`codemem claude-hook-ingest backlog drain failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
 	};
 	const httpResult = await httpIngest(payload, opts.host, port);
@@ -1024,12 +1282,12 @@ async function ingestClaudeHookPayload(payload, opts, deps = {}) {
 				skipped: 0,
 				via: "spool"
 			};
-			logHookFailure("codemem claude-hook-ingest failed: fallback and spool failed");
+			logHookEvent("codemem claude-hook-ingest failed: fallback and spool failed");
 			throw new Error("claude-hook-ingest: fallback and spool both failed");
 		});
 	} catch (err) {
 		if (!(err instanceof LockBusyError)) throw err;
-		logHookFailure("codemem claude-hook-ingest lock busy; trying unlocked fallback");
+		logHookEvent("codemem claude-hook-ingest lock busy; trying unlocked fallback");
 		const direct = tryDirectFallback(payload);
 		if (direct.ok) return {
 			...direct.result,
@@ -1040,7 +1298,7 @@ async function ingestClaudeHookPayload(payload, opts, deps = {}) {
 			skipped: 0,
 			via: "spool_lock_busy"
 		};
-		logHookFailure("codemem claude-hook-ingest failed: unlocked fallback and spool failed");
+		logHookEvent("codemem claude-hook-ingest failed: unlocked fallback and spool failed");
 		throw err;
 	}
 }
@@ -1086,6 +1344,11 @@ var claudeHookIngestCommand = claudeHookCmd.action(async (opts) => {
 //#endregion
 //#region src/commands/claude-hook-inject.ts
 var HOOK_EVENT_NAME = "UserPromptSubmit";
+var EMPTY_PACK = {
+	packText: "",
+	items: 0,
+	packTokens: 0
+};
 var DEFAULT_VIEWER_HOST = "127.0.0.1";
 var DEFAULT_VIEWER_PORT = 38888;
 var DEFAULT_MAX_CHARS = 16e3;
@@ -1093,6 +1356,9 @@ var DEFAULT_HTTP_MAX_TIME_S = 2;
 function emitJson(value) {
 	console.log(JSON.stringify(value));
 }
+function emitError(value) {
+	process.stderr.write(`${JSON.stringify(value)}\n`);
+}
 function envNotDisabled(value) {
 	const normalized = String(value ?? "").trim().toLowerCase();
 	return normalized !== "0" && normalized !== "false" && normalized !== "off";
@@ -1137,12 +1403,21 @@ async function buildLocalPack(context, project, dbPath, workingSetPaths = []) {
 		if (project) filters.project = project;
 		if (workingSetPaths.length > 0) filters.working_set_paths = workingSetPaths;
 		const pack = await store.buildMemoryPackAsync(context, limit, budget, filters);
-		return String(pack.pack_text ?? "").trim();
+		return {
+			packText: String(pack.pack_text ?? "").trim(),
+			items: Array.isArray(pack.items) ? pack.items.length : 0,
+			packTokens: Number.isFinite(Number(pack.metrics?.pack_tokens)) ? Number(pack.metrics.pack_tokens) : 0
+		};
 	} finally {
 		store.close();
 	}
 }
 async function tryHttpPack(context, project, maxTimeMs = DEFAULT_HTTP_MAX_TIME_S * 1e3) {
+	const empty = {
+		packText: "",
+		items: 0,
+		packTokens: 0
+	};
 	const host = process.env.CODEMEM_VIEWER_HOST || DEFAULT_VIEWER_HOST;
 	const port = parsePositiveInt$1(process.env.CODEMEM_VIEWER_PORT, DEFAULT_VIEWER_PORT);
 	const url = new URL(`http://${host}:${port}/api/pack`);
@@ -1154,11 +1429,15 @@ async function tryHttpPack(context, project, maxTimeMs = DEFAULT_HTTP_MAX_TIME_S
 	const timeout = setTimeout(() => controller.abort(), maxTimeMs);
 	try {
 		const res = await fetch(url, { signal: controller.signal });
-		if (!res.ok) return "";
+		if (!res.ok) return empty;
 		const body = await res.json();
-		return String(body.pack_text ?? "").trim();
+		return {
+			packText: String(body.pack_text ?? "").trim(),
+			items: Array.isArray(body.items) ? body.items.length : 0,
+			packTokens: Number.isFinite(Number(body.metrics?.pack_tokens)) ? Number(body.metrics?.pack_tokens) : 0
+		};
 	} catch {
-		return "";
+		return empty;
 	} finally {
 		clearTimeout(timeout);
 	}
@@ -1186,15 +1465,30 @@ async function buildClaudeHookInjection(payload, opts, deps = {}) {
 	const workingSetPaths = workingSetPathsFromState(state);
 	const maxChars = parsePositiveInt$1(process.env.CODEMEM_INJECT_MAX_CHARS, DEFAULT_MAX_CHARS);
 	const httpMaxTimeMs = parsePositiveInt$1(process.env.CODEMEM_INJECT_HTTP_MAX_TIME_S, DEFAULT_HTTP_MAX_TIME_S) * 1e3;
-	let additionalContext = "";
+	let pack = EMPTY_PACK;
+	let origin = "none";
 	try {
-		additionalContext = await buildPack(query, project, resolveDb(resolveDbOpt(opts)), workingSetPaths);
+		pack = await buildPack(query, project, resolveDb(resolveDbOpt(opts)), workingSetPaths);
+		if (pack.packText) origin = "local";
 	} catch (err) {
-		additionalContext = "";
-		logHookFailure(`codemem claude-hook-inject local pack failed: ${err instanceof Error ? err.message : String(err)}`);
-	}
-	if (!additionalContext && envNotDisabled(process.env.CODEMEM_INJECT_HTTP_FALLBACK || "1")) additionalContext = await httpPack(query, project, httpMaxTimeMs);
-	return continueResult(truncateAdditionalContext(additionalContext, maxChars));
+		logHookEvent(`codemem claude-hook-inject local pack failed: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	if (!pack.packText && envNotDisabled(process.env.CODEMEM_INJECT_HTTP_FALLBACK || "1")) {
+		pack = await httpPack(query, project, httpMaxTimeMs);
+		if (pack.packText) origin = "http";
+	}
+	const fields = [
+		"inject.pack.ok",
+		"source=claude",
+		`origin=${origin}`,
+		`items=${pack.items}`,
+		`pack_tokens=${pack.packTokens}`,
+		`query_len=${query.length}`,
+		`empty=${pack.packText ? "false" : "true"}`
+	];
+	if (project) fields.push(`project=${JSON.stringify(project)}`);
+	logHookEvent(fields.join(" "));
+	return continueResult(truncateAdditionalContext(pack.packText, maxChars));
 }
 var claudeHookInjectCmd = new Command("claude-hook-inject").configureHelp(helpStyle).description("Return Claude hook additionalContext from local pack generation");
 addDbOption(claudeHookInjectCmd);
@@ -1210,7 +1504,7 @@ var claudeHookInjectCommand = claudeHookInjectCmd.action(async (opts) => {
 	try {
 		const parsed = JSON.parse(trimmed);
 		if (parsed == null || typeof parsed !== "object" || Array.isArray(parsed)) {
-			emitJson({
+			emitError({
 				error: "parse_error",
 				message: "payload must be a JSON object"
 			});
@@ -1219,7 +1513,7 @@ var claudeHookInjectCommand = claudeHookInjectCmd.action(async (opts) => {
 		}
 		payload = parsed;
 	} catch {
-		emitJson({
+		emitError({
 			error: "parse_error",
 			message: "invalid JSON"
 		});
@@ -2169,7 +2463,8 @@ backfillTagsCmd.action((opts) => {
 			since: opts.since ?? null,
 			project,
 			activeOnly: !opts.inactive,
-			dryRun: opts.dryRun === true
+			dryRun: opts.dryRun === true,
+			scanner: store.scanner
 		});
 		if (opts.json) {
 			console.log(JSON.stringify(result, null, 2));
@@ -2303,7 +2598,8 @@ backfillNarrativeCmd.action((opts) => {
 		const limit = parseOptionalPositiveInt$1(opts.limit);
 		const result = backfillNarrativeFromBody(store.db, {
 			limit,
-			dryRun: opts.dryRun === true
+			dryRun: opts.dryRun === true,
+			scanner: store.scanner
 		});
 		if (opts.json) {
 			console.log(JSON.stringify(result, null, 2));
@@ -2333,7 +2629,8 @@ aiBackfillStructuredCmd.action(async (opts) => {
 			limit,
 			kinds,
 			overwrite: opts.overwrite === true,
-			dryRun: opts.dryRun === true
+			dryRun: opts.dryRun === true,
+			scanner: store.scanner
 		});
 		if (opts.json) {
 			console.log(JSON.stringify(result, null, 2));
@@ -2351,6 +2648,47 @@ aiBackfillStructuredCmd.action(async (opts) => {
 	}
 });
 dbCommand.addCommand(aiBackfillStructuredCmd);
+var scanSecretsCmd = new Command("scan-secrets").configureHelp(helpStyle).description("Sweep existing memories and redact any secrets found in stored content").option("--limit <n>", "max memories to scan in this run").option("--dry-run", "report detections without rewriting any rows");
+addDbOption(scanSecretsCmd);
+addJsonOption(scanSecretsCmd);
+scanSecretsCmd.action((opts) => {
+	const store = new MemoryStore(resolveDbPath(resolveDbOpt(opts)));
+	try {
+		const limit = parseOptionalPositiveInt$1(opts.limit);
+		const result = scanSecretsRetroactive(store.db, {
+			limit,
+			dryRun: opts.dryRun === true,
+			scanner: store.scanner
+		});
+		if (opts.json) {
+			console.log(JSON.stringify(result, null, 2));
+			return;
+		}
+		const action = opts.dryRun ? "Would redact" : "Redacted";
+		p.intro("codemem db scan-secrets");
+		p.log.success(`${action} ${result.updated} of ${result.checked} memories`);
+		if (result.skippedOversized > 0) p.log.warn(`Skipped ${result.skippedOversized} oversized rows (above default 1 MiB cap)`);
+		if (result.detections.length > 0) {
+			const summary = result.detections.map((d) => `${d.kind}=${d.count}`).join(", ");
+			p.log.info(`Detections: ${summary}`);
+		}
+		if (result.samples.length > 0) {
+			const lines = result.samples.map((s) => {
+				const kinds = s.detections.map((d) => `${d.kind}=${d.count}`).join(", ");
+				const title = (s.redactedTitle ?? "").slice(0, 80);
+				return `  #${s.id} [${kinds}]  ${title}`;
+			});
+			p.log.info(`Affected memories:\n${lines.join("\n")}`);
+		}
+		p.outro("Re-run with no changes to confirm idempotency");
+	} catch (error) {
+		p.log.error(error instanceof Error ? error.message : String(error));
+		process.exitCode = 1;
+	} finally {
+		store.close();
+	}
+});
+dbCommand.addCommand(scanSecretsCmd);
 //#endregion
 //#region src/commands/embed.ts
 function parseOptionalPositiveInt(value) {
@@ -4734,7 +5072,10 @@ onceCmd.action(async (opts) => {
 		let hadFailure = false;
 		const results = [];
 		for (const row of rows) {
-			const result = await runSyncPass(store.db, row.peer_device_id, { keysDir });
+			const result = await runSyncPass(store.db, row.peer_device_id, {
+				keysDir,
+				scanner: store.scanner
+			});
 			if (!result.ok) hadFailure = true;
 			results.push({
 				peer_device_id: row.peer_device_id,
@@ -5103,7 +5444,8 @@ enableCmd.action((opts) => {
 	const effectivePort = opts.syncPort ?? opts.port;
 	const store = new MemoryStore(resolveDbPath(resolveDbOpt(opts)));
 	try {
-		const [deviceId, fingerprint] = ensureDeviceIdentity(store.db);
+		const keysDir = process.env.CODEMEM_KEYS_DIR?.trim() || void 0;
+		const [deviceId, fingerprint] = ensureDeviceIdentity(store.db, { keysDir });
 		const config = readCliConfig(opts.config);
 		config.sync_enabled = true;
 		if (effectiveHost) config.sync_host = effectiveHost;
@@ -5359,7 +5701,7 @@ bootstrapCmd.action(async (peerArg, opts) => {
 			bootstrapGrantId: opts.bootstrapGrant,
 			pageSize
 		});
-		const result = applyBootstrapSnapshot(store.db, peerDeviceId, items, resetInfo);
+		const result = applyBootstrapSnapshot(store.db, peerDeviceId, items, resetInfo, store.scanner);
 		if (opts.json) console.log(JSON.stringify({
 			ok: result.ok,
 			applied: result.applied,
@@ -5416,6 +5758,7 @@ var versionCommand = new Command("version").configureHelp(helpStyle).description
 var completion = omelette("codemem <command>");
 completion.on("command", ({ reply }) => {
 	reply([
+		"claude-hook-file-context",
 		"claude-hook-inject",
 		"claude-hook-ingest",
 		"config",
@@ -5495,6 +5838,7 @@ program.addCommand(coordinatorCommand);
 program.addCommand(mcpCommand);
 program.addCommand(claudeHookInjectCommand);
 program.addCommand(claudeHookIngestCommand);
+program.addCommand(claudeHookFileContextCommand);
 program.addCommand(dbCommand);
 program.addCommand(exportMemoriesCommand);
 program.addCommand(importMemoriesCommand);