hippo-memory 1.33.0 → 1.34.0

package/dist/cli.js

@@ -38,7 +38,7 @@ import { installJsonHooks, uninstallJsonHooks, resolveJsonHookPaths, detectInsta
 import { createMemory, calculateStrength, calculateRewardFactor, deriveHalfLife, resolveConfidence, computeSchemaFit, Layer, } from './memory.js';
 import { resolveProjectIdentity } from './project-identity.js';
 import { detectSecret } from './secret-detect.js';
-import { getHippoRoot, isInitialized, initStore, writeEntry, readEntry, deleteEntry, loadAllEntries, loadSearchEntries, loadRecallSearchEntries, loadIndex, saveIndex, loadStats, updateStats, saveActiveTaskSnapshot, loadActiveTaskSnapshot, clearActiveTaskSnapshot, appendSessionEvent, listSessionEvents, listMemoryConflicts, resolveConflict, saveSessionHandoff, loadLatestHandoff, loadHandoffById, RECALL_DEFAULT_DENY_SCOPES, } from './store.js';
+import { getHippoRoot, isInitialized, initStore, writeEntry, readEntry, deleteEntry, loadAllEntries, loadSearchEntries, loadRecallSearchEntries, loadIndex, saveIndex, loadStats, updateStats, saveActiveTaskSnapshot, loadActiveTaskSnapshot, closeTaskSnapshotsForSession, clearActiveTaskSnapshot, appendSessionEvent, listSessionEvents, listMemoryConflicts, resolveConflict, saveSessionHandoff, loadLatestHandoff, loadHandoffById, RECALL_DEFAULT_DENY_SCOPES, } from './store.js';
 import { rejectValue, unrejectValue, listRejectionsForTenant } from './reject-flow.js';
 import { RejectedValueError } from './rejection.js';
 import { markRetrieved, hybridSearch, physicsSearch, explainMatch, textOverlap, tokenize as tokenizeQuery } from './search.js';
@@ -61,7 +61,7 @@ import { detectScope } from './scope.js';
 import { getGlobalRoot, initGlobal, shareMemory, listPeers, autoShare, transferScore, searchBothHybrid, syncGlobalToLocal, } from './shared.js';
 import { DAILY_TASK_NAME, buildDailyRunnerCommand, listRegisteredWorkspaces, registerWorkspace, runDailyMaintenance, } from './scheduler.js';
 import { importChatGPT, importClaude, importCursor, importGenericFile, importMarkdown, importVault, } from './importers.js';
-import { cmdCapture, cmdPreCompact, truncateCodePointSafe } from './capture.js';
+import { cmdCapture, cmdPreCompact, truncateCodePointSafe, sanitizeLogMessage } from './capture.js';
 import { auditMemories, appendAuditEvent, } from './audit.js';
 import { listApiKeys, revokeApiKey } from './auth.js';
 import { buildProvenanceCoverage } from './provenance-coverage.js';
@@ -2805,7 +2805,11 @@ function cmdSessionEnd(hippoRoot, flags) {
     // Read stdin synchronously. The SessionEnd hook payload carries
     // `transcript_path` as JSON; we extract it here and pass it to the worker
     // via argv so the detached child doesn't need to inherit stdin.
+    // DF1 T3 (docs/plans/2026-08-23-df1-snapshot-lifecycle.md): `session_id`
+    // is extracted the same way, so the worker can close the ending session's
+    // own active task snapshot after sleep+capture finish.
     let transcriptPath = null;
+    let sessionId = null;
     try {
         const stdinText = fs.readFileSync(0, 'utf8');
         if (stdinText && stdinText.trim().startsWith('{')) {
@@ -2813,17 +2817,22 @@ function cmdSessionEnd(hippoRoot, flags) {
             if (typeof payload.transcript_path === 'string') {
                 transcriptPath = payload.transcript_path;
             }
+            if (typeof payload.session_id === 'string') {
+                sessionId = payload.session_id;
+            }
         }
     }
     catch {
         // No stdin, not JSON, or read failure — capture will fall back to
-        // transcript auto-discovery.
+        // transcript auto-discovery; the snapshot close below will no-op.
     }
     const workerArgs = [process.argv[1], '__session-end-worker'];
     if (logFile)
         workerArgs.push('--log-file', logFile);
     if (transcriptPath)
         workerArgs.push('--transcript', transcriptPath);
+    if (sessionId)
+        workerArgs.push('--session-id', sessionId);
     try {
         const child = spawn(process.execPath, workerArgs, {
             detached: true,
@@ -2834,7 +2843,10 @@ function cmdSessionEnd(hippoRoot, flags) {
     }
     catch (err) {
         // If spawn fails, run inline as a last resort — better late output than
-        // no consolidation at all.
+        // no consolidation at all. NOTE: `flags` carries neither --transcript nor
+        // --session-id (both are stdin-derived, argv-only for the child), so in
+        // this fallback capture auto-discovers the transcript and the DF1
+        // snapshot close no-ops — the ambient freshness bound is the backstop.
         cmdSessionEndWorker(hippoRoot, flags);
         return;
     }
@@ -2870,6 +2882,49 @@ function cmdSessionEndWorker(hippoRoot, flags) {
     catch {
         // Same treatment — the failure line is already in the log.
     }
+    // DF1 T3: close the ending session's own active task snapshot AFTER
+    // sleep+capture complete — neither producer (runPreCompact,
+    // `hippo snapshot save`) runs inside session-end, so this can never
+    // destroy same-run work. Scoped to `--session-id`: a concurrent session's
+    // active snapshot is untouched (closeTaskSnapshotsForSession's own WHERE
+    // clause). Absent session id -> no-op plus one log line; session-end is
+    // not guaranteed to fire at all (crash, kill -9), so the freshness bound
+    // in loadFreshActiveTaskSnapshot is the backstop layer, not this close.
+    const closeLogFile = typeof flags['log-file'] === 'string' ? flags['log-file'] : null;
+    const closeSessionId = typeof flags['session-id'] === 'string' ? flags['session-id'] : null;
+    try {
+        if (closeSessionId) {
+            const closed = closeTaskSnapshotsForSession(hippoRoot, resolveTenantId({}), closeSessionId);
+            appendSessionEndCloseLog(closeLogFile, `closed ${closed} active snapshot(s) for session ${closeSessionId}`);
+        }
+        else {
+            appendSessionEndCloseLog(closeLogFile, 'skip: no session_id in SessionEnd payload, active snapshot left untouched');
+        }
+    }
+    catch (err) {
+        appendSessionEndCloseLog(closeLogFile, `snapshot close failed: ${err.message}`);
+    }
+}
+/**
+ * Best-effort log line for the DF1 T3 snapshot-close step in
+ * `cmdSessionEndWorker`. `cmdSleep`/`cmdCapture` each tee console output to
+ * `logFile` only for their own duration (the tee is restored before this
+ * runs), so a plain `console.log` here would be silently discarded under
+ * the detached worker's `stdio: 'ignore'` — write straight to the file
+ * instead, matching capture.ts's `appendPreCompactLog` convention.
+ */
+function appendSessionEndCloseLog(logFile, message) {
+    if (!logFile)
+        return;
+    try {
+        fs.mkdirSync(path.dirname(logFile), { recursive: true });
+        // sanitizeLogMessage: `message` interpolates the payload-controlled
+        // session_id — same log-forgery guard appendPreCompactLog applies.
+        fs.appendFileSync(logFile, `[hippo] ${new Date().toISOString()} ${sanitizeLogMessage(message)}\n`, 'utf8');
+    }
+    catch {
+        // Best-effort only — never let a log-write failure surface as an error.
+    }
 }
 function loadCodexWrapperMetadata() {
     const { metadataPath } = resolveCodexWrapperPaths();
@@ -5316,7 +5371,7 @@ function cmdCurrent(hippoRoot, args, flags) {
     console.error('Usage: hippo current <show>');
     process.exit(1);
 }
-async function cmdContext(hippoRoot, args, flags) {
+async function cmdContext(hippoRoot, args, flags, stdinText) {
     // --pinned-only fires on every UserPromptSubmit — including in directories
     // that don't have a local .hippo. Skip requireInit for that path and fall
     // back to global-only inside api.getContext. The non-pinned path still
@@ -5347,6 +5402,24 @@ async function cmdContext(hippoRoot, args, flags) {
     // v39 memory scope isolation: --cross-project re-includes other-project
     // memories (rendered under a demarcated section below).
     const crossProject = flags['cross-project'] === true;
+    // DF1 T2: resolve the calling session's id for the bounded active-task-
+    // snapshot read (api.getContext -> loadFreshActiveTaskSnapshot). Stdin
+    // payload (the UserPromptSubmit hook JSON) wins; falls back to
+    // HIPPO_SESSION_ID; absent both, undefined -- api.getContext then applies
+    // the pure freshness bound with no owner-match short-circuit.
+    let payloadSessionId;
+    if (stdinText && stdinText.trim() !== '') {
+        try {
+            const payload = JSON.parse(stdinText.trim());
+            if (payload && typeof payload === 'object' && typeof payload.session_id === 'string') {
+                payloadSessionId = payload.session_id;
+            }
+        }
+        catch {
+            // Malformed/non-JSON stdin: fall through to the env fallback below.
+        }
+    }
+    const currentSessionId = payloadSessionId ?? (process.env.HIPPO_SESSION_ID || undefined);
     const opts = {
         q: query,
         budget,
@@ -5355,6 +5428,7 @@ async function cmdContext(hippoRoot, args, flags) {
         scope: ctxActiveScope ?? undefined,
         includeRecent: parseCountFlag(flags['include-recent']),
         crossProject,
+        currentSessionId,
     };
     const result = await api.getContext(ctx, opts);
     // Early exit when there's nothing to render (matches pre-extraction behavior).
@@ -8301,9 +8375,27 @@ async function main() {
             cmdInspect(hippoRoot, id);
             break;
         }
-        case 'context':
-            await cmdContext(hippoRoot, args, flags);
+        case 'context': {
+            // DF1 T2 (docs/plans/2026-08-23-df1-snapshot-lifecycle.md): same TTY
+            // guard as `pre-compact` / `compact-resume` above — skip reading stdin
+            // when it's an interactive terminal so a manual invocation never
+            // hangs. `hippo context` is both the hot UserPromptSubmit path
+            // (non-TTY, stdin carries the hook JSON with `session_id`) and a
+            // manually-invocable command (TTY, no payload) — the guardless read in
+            // cmdSessionEnd is the wrong sibling to copy here; it only runs under
+            // a hook that always supplies stdin.
+            let stdinText;
+            if (!process.stdin.isTTY) {
+                try {
+                    stdinText = fs.readFileSync(0, 'utf8');
+                }
+                catch {
+                    stdinText = undefined;
+                }
+            }
+            await cmdContext(hippoRoot, args, flags, stdinText);
             break;
+        }
         case 'hook':
             cmdHook(args, flags);
             break;