hippo-memory 1.46.0 → 1.47.0

package/README.md

@@ -630,6 +630,7 @@ hippo watch "npm run build"
 | `hippo dormant forget <id>` | Delete a dormant memory permanently |
 | `hippo doctor [--json]` | Check the install: Node, store, schema, sleep, agent hooks; each problem names its fix |
 | `hippo tokens [--days n]` | Estimated tokens of memory text handed to agents, per surface, and what skipping unchanged hook blocks saved |
+| `hippo failures [--days n]` | Failed tool calls the capture-error hook saw, by outcome, and how many errors first happened in another session |
 | `hippo embed` | Embed all memories for semantic search |
 | `hippo embed --status` | Show embedding coverage |
 | `hippo watch "<command>"` | Run command, auto-learn from failures |
@@ -725,7 +726,7 @@ For Claude Code, it also adds:
 - a `PreCompact` hook that runs `hippo pre-compact` before the transcript gets summarized. It saves a working-state snapshot (task/summary/next step) and extracts durable memories from the tail, so mid-session compaction can't drop them.
 - a second `SessionStart` hook (matcher `compact`) that runs `hippo compact-resume`, printing that snapshot plus the recent session trail back into context right after compaction.
 - a `PostCompact` hook that runs `hippo post-compact`, which tells you what was saved ("Hippo saved your task snapshot and 2 new memories before compacting"). It prints nothing when nothing was saved.
-- a `PostToolUseFailure` hook that runs `hippo capture-error`, which stores a failed tool call as an error memory. It skips interrupts, declined permissions and searches that found nothing, and stores a repeated failure once.
+- a `PostToolUseFailure` hook that runs `hippo capture-error`, which stores a failed tool call as an error memory. It skips interrupts, declined permissions and searches that found nothing, and stores a repeated failure once. It also logs every failure, stored or not, for `hippo failures`: the session, the tool and hashes of the error, never its text. A hash is not anonymous, since anyone who guesses an error's text can check it against the hash. The log keeps 90 days.
 
 To remove: `hippo hook uninstall claude-code`
 

package/dist/api.d.ts

@@ -11,6 +11,7 @@ import { deleteEntry, loadAllEntries, type TaskSnapshot, type SessionEvent } fro
 import { type RejectedValueRow } from './rejection.js';
 import { type DormantMemory, type ListDormantOpts } from './dormant.js';
 import { type TokenSummary, type TokenSurface } from './token-ledger.js';
+import { type FailureSummary } from './failure-log.js';
 import { type SessionHandoff } from './handoff.js';
 import { type MemoryKind, type MemoryEntry } from './memory.js';
 import { auditMemories, type AuditEvent, type AuditOp } from './audit.js';
@@ -82,6 +83,7 @@ import { isPrivateScope, passesScopeFilterForRecall } from './recall-scope.js';
 export { isPrivateScope, passesScopeFilterForRecall };
 export { passesCliRecallScopeFilter, ScopeForbiddenError } from './recall-scope.js';
 export type { TokenSummary, TokenSurface, TokenSurfaceSummary } from './token-ledger.js';
+export type { FailureSummary } from './failure-log.js';
 export { classifyOriginProject } from './project-identity.js';
 /**
  * v39 S4: the secret half of the ambient policy on its own, for surfaces
@@ -1019,6 +1021,10 @@ export declare function recordTokens(ctx: Context, surface: TokenSurface, use: {
 export declare function tokenSummary(ctx: Context, opts?: {
     days?: number;
 }): TokenSummary;
+/** Failed tool calls by outcome, and repeats across sessions, over the last `days` days (default 30); ROADMAP CD13. */
+export declare function failureSummary(ctx: Context, opts?: {
+    days?: number;
+}): FailureSummary;
 /**
  * A tenant's dormant memories (src/dormant.ts): what sleep moved out of
  * active memory instead of deleting, when `dormant.enabled` is on. Newest

package/dist/api.js

@@ -13,6 +13,7 @@ import { RejectedValueError } from './rejection.js';
 import { rejectValue, unrejectValue, listRejectionsForTenant } from './reject-flow.js';
 import { listDormantRows, readDormantSnapshot, deleteDormantRow, hasDormantRow, } from './dormant.js';
 import { recordTokenUse, summarizeTokenUse } from './token-ledger.js';
+import { summarizeFailures } from './failure-log.js';
 import { formatHandoffEvidenceLine } from './handoff.js';
 import { createMemory, applyOutcome, calculateStrength, Layer, } from './memory.js';
 import { appendAuditEvent, queryAuditEvents, auditMemories, isContentWorthStoring, } from './audit.js';
@@ -1896,16 +1897,28 @@ export function recordTokens(ctx, surface, use) {
  * saved, and mean tokens per session.
  */
 export function tokenSummary(ctx, opts = {}) {
-    const days = opts.days !== undefined && Number.isFinite(opts.days) && opts.days > 0 ? opts.days : 30;
-    const since = new Date(Date.now() - days * 86_400_000).toISOString();
     const db = openHippoDb(ctx.hippoRoot);
     try {
-        return summarizeTokenUse(db, ctx.tenantId, since);
+        return summarizeTokenUse(db, ctx.tenantId, reportWindowStart(opts.days));
     }
     finally {
         closeHippoDb(db);
     }
 }
+/** Failed tool calls by outcome, and repeats across sessions, over the last `days` days (default 30); ROADMAP CD13. */
+export function failureSummary(ctx, opts = {}) {
+    const db = openHippoDb(ctx.hippoRoot);
+    try {
+        return summarizeFailures(db, ctx.tenantId, reportWindowStart(opts.days));
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+function reportWindowStart(days) {
+    const span = days !== undefined && Number.isFinite(days) && days > 0 ? days : 30;
+    return new Date(Date.now() - span * 86_400_000).toISOString();
+}
 /**
  * A tenant's dormant memories (src/dormant.ts): what sleep moved out of
  * active memory instead of deleting, when `dormant.enabled` is on. Newest

package/dist/capture-error.d.ts

@@ -1,20 +1,26 @@
 import type { JsonValue } from './working-memory.js';
 /** Why a failure was not stored, or `stored`. */
 export type CaptureErrorOutcome = 'stored' | 'duplicate' | 'skipped-interrupt' | 'skipped-routine' | 'skipped-invalid';
-/** Normalised form used to spot repeats of the same failure. */
-export declare function failureSignature(text: string): string;
-/**
- * The memory text for a failure payload, or the reason it is not stored.
- * Pure: no store access.
- */
-export declare function lessonFromFailure(payload: JsonValue): {
+/** Which routine check skipped a failure; the log keeps it so declines can be told apart from empty searches. */
+export type RoutineRule = 'declined' | 'os-permission' | 'no-match' | 'search-tool' | 'quiet-exit';
+/** What {@link lessonFromFailure} read from a payload; `detail` is the finer failure-log key (untruncated, command head). */
+export type FailureReading = {
+    text: string;
+    detail: string;
+} | {
+    skip: 'skipped-routine';
+    rule: RoutineRule;
     text: string;
+    detail: string;
 } | {
-    skip: Exclude<CaptureErrorOutcome, 'stored' | 'duplicate'>;
+    skip: 'skipped-interrupt' | 'skipped-invalid';
+    text: null;
+    detail: null;
 };
-/**
- * Store a failure payload as an error memory unless it is routine or a
- * repeat of an auto-captured error already in the store.
- */
+/** Normalised form used to spot repeats. The failure log keeps only its hash, so changing it breaks repeat counts. */
+export declare function failureSignature(text: string): string;
+/** The memory text for a failure payload, or why it is not stored; a routine skip keeps its text for the log. Pure. */
+export declare function lessonFromFailure(payload: JsonValue): FailureReading;
+/** Store a failure as an error memory unless it is routine or a repeat, and log it either way, even when storing throws. */
 export declare function captureToolFailure(hippoRoot: string, tenantId: string, payload: JsonValue): CaptureErrorOutcome;
 //# sourceMappingURL=capture-error.d.ts.map

package/dist/capture-error.js

@@ -1,25 +1,20 @@
-/**
- * `hippo capture-error`: turn a failed tool call into an error memory. Run by
- * the Claude Code `PostToolUseFailure` hook (both `hippo hook install
- * claude-code` and the plugin), which writes the failure as JSON on stdin.
- *
- * Most failed tool calls are not lessons. An interrupt, a permission the
- * user declined, a search that found nothing or a `grep` that exits 1 is
- * routine, and error memories decay slower than other memories, so storing
- * them would crowd out real lessons. Those are dropped here, repeats of the
- * same failure are stored once, and what is stored is marked `observed`
- * (auto-captured, not verified): outcome feedback, not capture, is what
- * should strengthen it.
- */
+// `hippo capture-error`, run by the Claude Code PostToolUseFailure hook: routine failures and repeats are not
+// stored, because error memories decay slowly and would crowd out real lessons; what is stored stays `observed`
+// until outcome feedback confirms it. Every failure, stored or not, goes to the failure log (ROADMAP CD13).
 import { createMemory } from './memory.js';
 import { writeEntry, loadAllEntries } from './store.js';
 import { loadConfig } from './config.js';
+import { closeHippoDb, openHippoDb } from './db.js';
+import { recordFailure } from './failure-log.js';
+import { blockHash } from './token-ledger.js';
 const MAX_LEN = 200;
-/** Failures that are routine, not lessons. */
-const ROUTINE_PATTERNS = [
-    /user (?:doesn't|does not) want|denied by (?:the )?user|user (?:rejected|declined|denied)|permission (?:denied|to use)|was blocked by (?:a )?hook/i,
-    /\bno (?:matches|files|results) found\b/i,
-];
+/** The user, a permission prompt or a hook said no: routine, not a lesson. */
+const DECLINED = /user (?:doesn't|does not) want|denied by (?:the )?user|user (?:rejected|declined|denied)|permission to use|was blocked by (?:a )?hook/i;
+/** The OS or a remote host refused access (EACCES, SSH publickey): routine too, but nobody declined anything. */
+const OS_PERMISSION = /permission denied/i;
+/** Leading `cd` or `pushd` steps say where a command ran, not what it ran. */
+const LEADING_CD = /^\s*(?:(?:cd|pushd)\b[^;&|]*(?:&&|\|\||;)\s*)+/;
+const NO_MATCH = /\bno (?:matches|files|results) found\b/i;
 /** Shell commands whose exit code 1 means "nothing found" or "differs", not an error. */
 const QUIET_EXIT_1 = /^\s*(?:grep|rg|egrep|fgrep|find|test|\[|diff|cmp|git diff|git grep)\b/;
 function isString(v) {
@@ -28,48 +23,81 @@ function isString(v) {
 function isObject(v) {
     return v !== undefined && v !== null && !Array.isArray(v) && v.constructor === Object;
 }
-/** Normalised form used to spot repeats of the same failure. */
+function payloadString(payload, key) {
+    if (!isObject(payload))
+        return null;
+    const value = payload[key];
+    return isString(value) && value.trim() !== '' ? value : null;
+}
+/** Normalised form used to spot repeats. The failure log keeps only its hash, so changing it breaks repeat counts. */
 export function failureSignature(text) {
     return text.toLowerCase().replace(/[0-9a-f]{7,}/g, '#').replace(/\d+/g, '#').replace(/\s+/g, ' ').trim();
 }
-/**
- * The memory text for a failure payload, or the reason it is not stored.
- * Pure: no store access.
- */
+/** The memory text for a failure payload, or why it is not stored; a routine skip keeps its text for the log. Pure. */
 export function lessonFromFailure(payload) {
     if (!isObject(payload))
-        return { skip: 'skipped-invalid' };
+        return { skip: 'skipped-invalid', text: null, detail: null };
     // SAFETY: isObject narrowed payload to a plain JSON object; the fields read are all optional.
     const p = payload;
     if (p.is_interrupt === true)
-        return { skip: 'skipped-interrupt' };
+        return { skip: 'skipped-interrupt', text: null, detail: null };
     if (!isString(p.error) || p.error.trim().length < 12)
-        return { skip: 'skipped-invalid' };
+        return { skip: 'skipped-invalid', text: null, detail: null };
     const tool = isString(p.tool_name) ? p.tool_name : 'tool';
     const error = p.error.replace(/\s+/g, ' ').trim();
-    if (ROUTINE_PATTERNS.some((re) => re.test(error)))
-        return { skip: 'skipped-routine' };
+    const text = `${tool}: ${error}`.slice(0, MAX_LEN);
+    const command = isObject(p.tool_input) && isString(p.tool_input['command']) ? p.tool_input['command'].replace(LEADING_CD, '') : '';
+    const head = command.trim().split(/\s+/).slice(0, 2).join(' ');
+    const detail = `${tool}${head ? ` ${head}` : ''}: ${error}`;
+    const routine = (rule) => ({ skip: 'skipped-routine', rule, text, detail });
+    if (DECLINED.test(error))
+        return routine('declined');
+    if (OS_PERMISSION.test(error))
+        return routine('os-permission');
+    if (NO_MATCH.test(error))
+        return routine('no-match');
     if (tool === 'Grep' || tool === 'Glob')
-        return { skip: 'skipped-routine' };
-    if (tool === 'Bash' && isObject(p.tool_input) && isString(p.tool_input['command'])
-        && QUIET_EXIT_1.test(p.tool_input['command']) && /exit code 1\b/i.test(error)) {
-        return { skip: 'skipped-routine' };
-    }
-    return { text: `${tool}: ${error}`.slice(0, MAX_LEN) };
+        return routine('search-tool');
+    if (tool === 'Bash' && QUIET_EXIT_1.test(command) && /exit code 1\b/i.test(error))
+        return routine('quiet-exit');
+    return { text, detail };
 }
-/**
- * Store a failure payload as an error memory unless it is routine or a
- * repeat of an auto-captured error already in the store.
- */
+/** Store a failure as an error memory unless it is routine or a repeat, and log it either way, even when storing throws. */
 export function captureToolFailure(hippoRoot, tenantId, payload) {
     const lesson = lessonFromFailure(payload);
-    if ('skip' in lesson)
-        return lesson.skip;
-    const sig = failureSignature(lesson.text);
+    let outcome = 'store-failed';
+    try {
+        outcome = 'skip' in lesson ? lesson.skip : storeLesson(hippoRoot, tenantId, lesson.text);
+        return outcome;
+    }
+    finally {
+        logFailure(hippoRoot, tenantId, payload, lesson, outcome);
+    }
+}
+function logFailure(hippoRoot, tenantId, payload, lesson, outcome) {
+    const hash = (s) => (s === null ? null : blockHash(failureSignature(s)));
+    const db = openHippoDb(hippoRoot);
+    try {
+        recordFailure(db, {
+            tenantId,
+            sessionId: payloadString(payload, 'session_id'),
+            tool: payloadString(payload, 'tool_name'),
+            outcome,
+            rule: 'rule' in lesson ? lesson.rule : null,
+            sigHash: hash(lesson.text),
+            detailHash: hash(lesson.detail),
+        });
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+function storeLesson(hippoRoot, tenantId, text) {
+    const sig = failureSignature(text);
     const repeat = loadAllEntries(hippoRoot, tenantId).some((e) => e.tags.includes('auto-captured') && failureSignature(e.content) === sig);
     if (repeat)
         return 'duplicate';
-    const entry = createMemory(lesson.text, {
+    const entry = createMemory(text, {
         tags: ['error', 'auto-captured'],
         source: 'tool-failure',
         confidence: 'observed',

package/dist/cli.js

@@ -62,6 +62,7 @@ import { openHippoDb, closeHippoDb } from './db.js';
 import { runDoctor, formatDoctor } from './doctor.js';
 import { captureToolFailure } from './capture-error.js';
 import { blockHash, hookPayloadSessionId, lastSentState, recordTokenUse, shouldSkipUnchanged } from './token-ledger.js';
+import { FAILURE_LOG_RETENTION_DAYS } from './failure-log.js';
 import { pushGoal, getActiveGoals, completeGoal, suspendGoal, resumeGoal, applyGoalStackBoost } from './goals.js';
 import { rowToGoal } from './goals.js';
 import { captureError, extractLessons, partitionLessons, deduplicateLesson, runWatched, fetchGitLog, isGitRepo, } from './autolearn.js';
@@ -3929,6 +3930,48 @@ function cmdTokens(hippoRoot, flags) {
         console.log(`  Mean per session (rows with a session id): ${summary.meanTokensPerSession} tokens.`);
     }
 }
+/** `hippo failures [--days <n>] [--json] [--global]`: failed tool calls by outcome, and repeats across sessions (CD13). */
+function cmdFailures(hippoRoot, flags) {
+    // The store the capture-error hook writes to; a report never creates one.
+    const root = flags['global'] ? getGlobalRoot() : hookStoreRoot(hippoRoot);
+    requireInit(root);
+    const ctx = {
+        hippoRoot: root,
+        tenantId: resolveTenantId({}),
+        actor: api.adminActor('cli'),
+    };
+    const days = parseCountFlag(flags['days']);
+    const summary = api.failureSummary(ctx, { days: days > 0 ? days : undefined });
+    if (flags['json']) {
+        console.log(JSON.stringify(summary, null, 2));
+        return;
+    }
+    const windowDays = days > 0 ? days : 30;
+    const kept = windowDays > FAILURE_LOG_RETENTION_DAYS ? ` (rows are kept ${FAILURE_LOG_RETENTION_DAYS} days)` : '';
+    if (summary.total === 0) {
+        console.log(`No failed tool calls recorded in the last ${windowDays} days${kept}.`);
+        return;
+    }
+    const o = summary.outcomes;
+    const errors = o.stored + o.duplicate + o['store-failed'];
+    const unsaved = o['store-failed'] > 0 ? `, ${o['store-failed']} could not be saved` : '';
+    const rows = [
+        ['errors', errors, `(${o.stored} new, ${o.duplicate} already in memory${unsaved})`],
+        ['routine', o['skipped-routine'], ''],
+        ['interrupted', o['skipped-interrupt'], ''],
+        ['unreadable', o['skipped-invalid'], ''],
+    ];
+    console.log(`Failed tool calls seen by the capture-error hook, last ${windowDays} days${kept}\n`);
+    for (const [label, count, note] of rows) {
+        console.log(`  ${label.padEnd(13)}${String(count).padStart(6)}  ${note}`.trimEnd());
+    }
+    // Counts, not a rate: a share means little without a holdout arm to compare against (CD11).
+    if (summary.rated > 0) {
+        const noSession = errors - summary.rated;
+        const unrated = noSession > 0 ? ` ${noSession} more had no session id.` : '';
+        console.log(`\n  Repeats: ${summary.repeats} of ${summary.rated} errors first happened in another session.${unrated}`);
+    }
+}
 function cmdSnapshot(hippoRoot, args, flags) {
     requireInit(hippoRoot);
     const subcommand = args[0] ?? 'show';
@@ -8638,6 +8681,11 @@ Commands:
     --days <n>             Window in days (default: 30)
     --json                 Output as JSON
     --global               Operate on the global store
+  failures                 Failed tool calls capture-error saw, by outcome, and how
+                           many errors first happened in another session
+    --days <n>             Window in days (default: 30)
+    --json                 Output as JSON
+    --global               Operate on the global store
   snapshot <sub>           Persist or inspect the current active task
     snapshot save          Save active task state
       --task <task>
@@ -9373,6 +9421,9 @@ async function main(command, args, flags, hippoRoot) {
         case 'tokens':
             cmdTokens(hippoRoot, flags);
             break;
+        case 'failures':
+            cmdFailures(hippoRoot, flags);
+            break;
         case 'doctor': {
             // SAFETY: package.json always carries a string "version" (checked at release by check-manifest-versions).
             const pkg = JSON.parse(fs.readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'package.json'), 'utf-8'));

package/dist/db.js

@@ -11,7 +11,7 @@ const require = createRequire(import.meta.url);
 // runtime (Node's built-in synchronous SQLite module); there are no bundled
 // types for it here, so this require + cast is the module's documented boundary.
 const { DatabaseSync } = require('node:sqlite');
-const CURRENT_SCHEMA_VERSION = 45;
+const CURRENT_SCHEMA_VERSION = 46;
 const MIGRATIONS = [
     {
         version: 1,
@@ -2423,6 +2423,30 @@ const MIGRATIONS = [
       `);
         },
     },
+    {
+        version: 46,
+        up: (db) => {
+            // CD13 failure log (src/failure-log.ts): hashes only, since failure text can carry paths and secrets.
+            // Additive only: no min_compatible_binary bump.
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS failure_log (
+          id          INTEGER PRIMARY KEY AUTOINCREMENT,
+          ts          TEXT NOT NULL,
+          tenant_id   TEXT NOT NULL DEFAULT 'default',
+          session_id  TEXT,
+          tool        TEXT,
+          outcome     TEXT NOT NULL,
+          skip_rule   TEXT,
+          sig_hash    TEXT,
+          detail_hash TEXT
+        );
+        CREATE INDEX IF NOT EXISTS idx_failure_log_tenant
+          ON failure_log(tenant_id, id);
+        CREATE INDEX IF NOT EXISTS idx_failure_log_ts
+          ON failure_log(ts);
+      `);
+        },
+    },
 ];
 function tableHasColumn(db, tableName, columnName) {
     if (!/^[a-z_]+$/i.test(tableName))

package/dist/doctor.js

@@ -97,6 +97,15 @@ export function runDoctor(opts) {
             catch {
                 checks.push({ id: 'tokens', status: 'info', detail: 'no token ledger yet (created on the next write)' });
             }
+            try {
+                // SAFETY: COUNT aggregate row.
+                const row = db.prepare(`SELECT COUNT(*) AS n FROM failure_log WHERE ts >= ?`).get(since);
+                checks.push({ id: 'failures', status: 'info', detail: `${Number(row?.n ?? 0)} failed tool calls logged in 7 days (hippo failures for detail)` });
+            }
+            catch {
+                // Opening the store migrates it, so a missing table was dropped: the hook is logging nothing.
+                checks.push({ id: 'failures', status: 'warn', detail: 'the failure_log table is missing, so failed tool calls are not being logged' });
+            }
         }
         catch (err) {
             checks.push({ id: 'schema', status: 'fail', detail: `cannot open the database: ${err instanceof Error ? err.message : String(err)}`, fix: 'check file permissions on the .hippo folder' });

package/dist/failure-log.d.ts

@@ -0,0 +1,49 @@
+/** Failure log (ROADMAP CD13): every failed tool call the capture-error hook sees, stored or not. */
+import type { CaptureErrorOutcome, RoutineRule } from './capture-error.js';
+import type { DatabaseSyncLike } from './db.js';
+/** Rows older than this are pruned on write, which also bounds how far back a repeat can be found. */
+export declare const FAILURE_LOG_RETENTION_DAYS = 90;
+/** A capture-error outcome, or `store-failed` when storing the lesson threw. */
+export type FailureOutcome = CaptureErrorOutcome | 'store-failed';
+/** One failed tool call, for {@link recordFailure}. Never the failure text: it can carry paths and secrets. */
+export interface FailureEvent {
+    tenantId: string;
+    /** Host session id from the hook payload; null when it had none. */
+    sessionId?: string | null;
+    tool?: string | null;
+    outcome: FailureOutcome;
+    /** The routine check that skipped it, for `skipped-routine`. */
+    rule?: RoutineRule | null;
+    /** Hash of the lesson text's signature, the key dedupe uses; null when the payload had no readable error. */
+    sigHash?: string | null;
+    /** Hash of the untruncated error plus the command's first two words, finer than `sigHash`. */
+    detailHash?: string | null;
+    /** Override the timestamp (tests). ISO string. */
+    now?: string;
+}
+/** Append one failure row and prune rows past {@link FAILURE_LOG_RETENTION_DAYS}. */
+export declare function recordFailure(db: DatabaseSyncLike, event: FailureEvent): void;
+/** Rated failures and repeats in one session, for {@link failuresBySession}. */
+export interface SessionFailures {
+    sessionId: string;
+    /** Failures hippo treats as lessons (stored, duplicate or store-failed) in the window. */
+    failures: number;
+    /** Of those, failures whose signature another session hit first. */
+    repeats: number;
+}
+/** Rated failures per session since `sinceIso`, the input for repeat-error rate per arm (CD11, CD12). */
+export declare function failuresBySession(db: DatabaseSyncLike, tenantId: string, sinceIso: string): SessionFailures[];
+/** Failure log totals over a window, for {@link summarizeFailures}. Counts only: a rate needs a holdout arm (CD11). */
+export interface FailureSummary {
+    /** ISO start of the window (inclusive). */
+    since: string;
+    outcomes: Record<FailureOutcome, number>;
+    total: number;
+    /** Rated failures from sessions with an id: the failures a repeat is counted among. */
+    rated: number;
+    repeats: number;
+    sessions: number;
+}
+/** Sum the failure log for one tenant since `sinceIso`. */
+export declare function summarizeFailures(db: DatabaseSyncLike, tenantId: string, sinceIso: string): FailureSummary;
+//# sourceMappingURL=failure-log.d.ts.map

package/dist/failure-log.js

@@ -0,0 +1,58 @@
+/** Rows older than this are pruned on write, which also bounds how far back a repeat can be found. */
+export const FAILURE_LOG_RETENTION_DAYS = 90;
+/** Longest session id or tool name kept; the hook payload is not trusted to be short. */
+const MAX_FIELD = 128;
+/** Append one failure row and prune rows past {@link FAILURE_LOG_RETENTION_DAYS}. */
+export function recordFailure(db, event) {
+    // Normalised, because the window and prune compare timestamps as strings.
+    const now = new Date(event.now ?? Date.now()).toISOString();
+    db.prepare(`INSERT INTO failure_log (ts, tenant_id, session_id, tool, outcome, skip_rule, sig_hash, detail_hash)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(now, event.tenantId, event.sessionId?.slice(0, MAX_FIELD) ?? null, event.tool?.slice(0, MAX_FIELD) ?? null, event.outcome, event.rule ?? null, event.sigHash ?? null, event.detailHash ?? null);
+    const cutoff = new Date(Date.parse(now) - FAILURE_LOG_RETENTION_DAYS * 86_400_000).toISOString();
+    db.prepare(`DELETE FROM failure_log WHERE ts < ?`).run(cutoff);
+}
+/** Rated failures per session since `sinceIso`, the input for repeat-error rate per arm (CD11, CD12). */
+export function failuresBySession(db, tenantId, sinceIso) {
+    // SAFETY: the SELECT names exactly these three TEXT columns.
+    const rows = db.prepare(`SELECT ts, session_id, sig_hash FROM failure_log
+     WHERE tenant_id = ? AND session_id IS NOT NULL AND sig_hash IS NOT NULL
+       AND outcome IN ('stored', 'duplicate', 'store-failed')
+     ORDER BY id`).all(tenantId);
+    const firstSession = new Map();
+    const bySession = new Map();
+    for (const row of rows) {
+        if (!firstSession.has(row.sig_hash))
+            firstSession.set(row.sig_hash, row.session_id);
+        // Rows before the window are not counted but still decide which session hit a signature first.
+        if (row.ts < sinceIso)
+            continue;
+        const repeat = firstSession.get(row.sig_hash) !== row.session_id;
+        const s = bySession.get(row.session_id) ?? { sessionId: row.session_id, failures: 0, repeats: 0 };
+        bySession.set(row.session_id, { ...s, failures: s.failures + 1, repeats: s.repeats + (repeat ? 1 : 0) });
+    }
+    return [...bySession.values()];
+}
+/** Sum the failure log for one tenant since `sinceIso`. */
+export function summarizeFailures(db, tenantId, sinceIso) {
+    // SAFETY: the SELECT names exactly these two columns, TEXT and an aggregate.
+    const rows = db.prepare(`SELECT outcome, COUNT(*) AS n FROM failure_log WHERE tenant_id = ? AND ts >= ? GROUP BY outcome`).all(tenantId, sinceIso);
+    const counts = new Map(rows.map((r) => [r.outcome, Number(r.n)]));
+    const outcomes = {
+        stored: counts.get('stored') ?? 0,
+        duplicate: counts.get('duplicate') ?? 0,
+        'store-failed': counts.get('store-failed') ?? 0,
+        'skipped-interrupt': counts.get('skipped-interrupt') ?? 0,
+        'skipped-routine': counts.get('skipped-routine') ?? 0,
+        'skipped-invalid': counts.get('skipped-invalid') ?? 0,
+    };
+    const sessions = failuresBySession(db, tenantId, sinceIso);
+    return {
+        since: sinceIso,
+        outcomes,
+        total: Object.values(outcomes).reduce((sum, n) => sum + n, 0),
+        rated: sessions.reduce((sum, s) => sum + s.failures, 0),
+        repeats: sessions.reduce((sum, s) => sum + s.repeats, 0),
+        sessions: sessions.length,
+    };
+}
+//# sourceMappingURL=failure-log.js.map

package/dist/version.d.ts

@@ -16,7 +16,7 @@
  * an ESM `import` can resolve cleanly, and a hardcoded constant survives
  * any packager that drops .json files.
  */
-export declare const PACKAGE_VERSION = "1.46.0";
+export declare const PACKAGE_VERSION = "1.47.0";
 /** Compares plain x.y.z versions, positive if a > b; tags throw so the rollback guard never misfires silently. */
 export declare function compareSemver(a: string, b: string): number;
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -16,7 +16,7 @@
  * an ESM `import` can resolve cleanly, and a hardcoded constant survives
  * any packager that drops .json files.
  */
-export const PACKAGE_VERSION = '1.46.0';
+export const PACKAGE_VERSION = '1.47.0';
 /** Compares plain x.y.z versions, positive if a > b; tags throw so the rollback guard never misfires silently. */
 export function compareSemver(a, b) {
     const parse = (v) => {

package/extensions/openclaw-plugin/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "hippo-memory",
   "name": "Hippo Memory",
   "description": "Biologically-inspired memory for AI agents. Decay by default, retrieval strengthening, sleep consolidation.",
-  "version": "1.46.0",
+  "version": "1.47.0",
 
   "configSchema": {
     "type": "object",

package/extensions/openclaw-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hippo-memory",
-  "version": "1.46.0",
+  "version": "1.47.0",
   "type": "module",
   "description": "Hippo Memory plugin for OpenClaw - biologically-inspired agent memory",
   "main": "index.ts",

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "hippo-memory",
   "name": "Hippo Memory",
   "description": "Biologically-inspired memory for AI agents. Decay by default, retrieval strengthening, sleep consolidation.",
-  "version": "1.46.0",
+  "version": "1.47.0",
   "configSchema": {
     "type": "object",
     "additionalProperties": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hippo-memory",
-  "version": "1.46.0",
+  "version": "1.47.0",
   "description": "Biologically-inspired memory for AI agents. Zero runtime deps, SQLite, MCP server, and an opt-in hosted TypeSafe Jev reranker. Decay, retrieval strengthening, consolidation.",
   "mcpName": "io.github.kitfunso/hippo-memory",
   "type": "module",