hippo-memory 1.52.8 → 1.52.9

package/dist/server-detect.js

@@ -47,10 +47,7 @@ export async function detectServer(hippoRoot) {
         info = JSON.parse(readFileSync(path, 'utf8'));
     }
     catch {
-        try {
-            unlinkSync(path);
-        }
-        catch { }
+        removePidfile(hippoRoot);
         return null;
     }
     // Probe the process. Sending signal 0 throws if the pid is dead or owned
@@ -61,10 +58,7 @@ export async function detectServer(hippoRoot) {
         process.kill(info.pid, 0);
     }
     catch {
-        try {
-            unlinkSync(path);
-        }
-        catch { }
+        removePidfile(hippoRoot);
         return null;
     }
     // The pid is live, but it may have been reused by an unrelated process, and
@@ -77,19 +71,13 @@ export async function detectServer(hippoRoot) {
         probeUrl = new URL(info.url);
     }
     catch {
-        try {
-            unlinkSync(path);
-        }
-        catch { }
+        removePidfile(hippoRoot);
         return null;
     }
     if (probeUrl.protocol !== 'http:' ||
         !PIDFILE_LOOPBACK_HOSTS.has(probeUrl.hostname) ||
         probeUrl.port !== String(info.port)) {
-        try {
-            unlinkSync(path);
-        }
-        catch { }
+        removePidfile(hippoRoot);
         return null;
     }
     // Confirm the process answering on info.url is this hippo server by matching
@@ -103,10 +91,7 @@ export async function detectServer(hippoRoot) {
             signal: AbortSignal.timeout(HEALTH_PROBE_TIMEOUT_MS),
         });
         if (!res.ok || !res.body) {
-            try {
-                unlinkSync(path);
-            }
-            catch { }
+            removePidfile(hippoRoot);
             return null;
         }
         // Read the body under a hard byte cap. The process answering on info.url
@@ -123,10 +108,7 @@ export async function detectServer(hippoRoot) {
             received += value.byteLength;
             if (received > HEALTH_BODY_MAX_BYTES) {
                 await reader.cancel();
-                try {
-                    unlinkSync(path);
-                }
-                catch { }
+                removePidfile(hippoRoot);
                 return null;
             }
             raw += decoder.decode(value, { stream: true });
@@ -134,10 +116,7 @@ export async function detectServer(hippoRoot) {
         raw += decoder.decode();
         const body = JSON.parse(raw);
         if (body.started_at !== info.started_at) {
-            try {
-                unlinkSync(path);
-            }
-            catch { }
+            removePidfile(hippoRoot);
             return null;
         }
     }
@@ -148,10 +127,7 @@ export async function detectServer(hippoRoot) {
         // SAFETY: err's shape is unknown (catch clause); reading an optional
         // .name property structurally is safe regardless of the object's actual type.
         if (err?.name !== 'TimeoutError') {
-            try {
-                unlinkSync(path);
-            }
-            catch { }
+            removePidfile(hippoRoot);
         }
         return null;
     }
@@ -190,7 +166,7 @@ export function removePidfile(hippoRoot) {
     try {
         unlinkSync(path);
     }
-    catch { }
+    catch { /* already gone or undeletable; the next detectServer probe re-checks */ }
 }
 /**
  * Remove the pidfile only if it still describes the caller's own server.

package/dist/server.js

@@ -2,12 +2,13 @@ import { createServer } from 'node:http';
 import { createHash } from 'node:crypto';
 import { dirname, resolve } from 'node:path';
 import { resolveProjectIdentity } from './project-identity.js';
+import { assembleCost, contextCost, drillCost } from './context-render.js';
 import { detectServer, writePidfile, removePidfileIfOwned } from './server-detect.js';
 import { resolveTenantId } from './tenant.js';
 import { openHippoDb, closeHippoDb } from './db.js';
 import { updateStats } from './store.js';
 import { buildSessionKey, getOrCreateRing, appendRecall, snapshotRing, hashQueryText, } from './recall-history.js';
-import { appendAuditEvent } from './audit.js';
+import { appendAuditEvent, AUDIT_OPS } from './audit.js';
 // v0.33 / J1 — Module-level per-(tenant, session) recall-history ring map
 // for the HTTP pipeline. Separate from CLI/MCP rings per plan v3 (per-
 // pipeline rings; no IPC). HTTP is the only caller that threads its
@@ -63,65 +64,7 @@ const PUBLIC_ROUTES = new Set([
 function isPublicRoute(method, path) {
     return PUBLIC_ROUTES.has(`${method} ${path}`);
 }
-const VALID_AUDIT_OPS = new Set([
-    'remember',
-    'recall',
-    'promote',
-    'supersede',
-    'forget',
-    'archive_raw',
-    'auth_revoke',
-    'auth_create', // v1.12.4: emitted by api.authCreate
-    'outcome', // v1.11.5: pre-existing drift — emitted today but rejected by old Set
-    'consolidate', // v1.11.5: emitted by api.sleep / POST /v1/sleep
-    'audit_prune', // v1.12.9: emitted by pruneAuditLog
-    'summary_marked_dirty', // v0.30 / E1 — lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS (v1.11.5 CRIT A institutional rule)
-    'summary_marked_clean', // v0.30 / E3 — buildDag post-link clean op; lockstep
-    'summary_rebuilt', // v0.30 / E3 — sleep-cycle rebuild op; lockstep
-    'predict_create', // v0.31 / E2 prediction first-class object — emitted by savePrediction
-    'predict_close', // v0.31 / E2 — emitted by closePrediction
-    'predict_baserate', // v0.31 / J3 — emitted by computePredictionBaserate
-    'recall_autodebias_hint', // v0.32 / J3.2 — emitted by computePlanningFallacyHint on success
-    'recall_autodebias_hint_no_class_match', // v0.32 / J3.2 — telemetry: forward-claim, no class scored
-    'recall_autodebias_hint_tiebreak', // v0.32 / J3.2 — telemetry: forward-claim, >=2 classes tied
-    'recall_anchor_detected_query_repeat', // v0.33 / J1 — emitted by detector on R1 fire
-    'recall_anchor_detected_memory_dominance', // v0.33 / J1 — emitted by detector on R2 fire
-    'recall_anchor_skipped_no_session', // v0.33 / J1 — telemetry: no sessionId, ring skipped
-    'recall_availability_detected', // v1.13.x / J2 - emitted when availability/recency-bias hint fires
-    'decision_create', // E2 decision first-class object — emitted by saveDecision
-    'decision_supersede', // E2 — emitted by saveDecision when --supersedes resolves to an active decision row
-    'decision_close', // E2 — emitted by closeDecision
-    'incident_open', // E2 incident first-class object — emitted by saveIncident
-    'incident_resolve', // E2 — emitted by resolveIncident (open -> resolved)
-    'incident_close', // E2 — emitted by closeIncident (open|resolved -> closed)
-    'process_create', // E2 process first-class object — emitted by saveProcess
-    'process_supersede', // E2 — emitted by saveProcess on a supersession
-    'process_close', // E2 — emitted by closeProcess
-    'policy_create', // E2 policy first-class object — emitted by savePolicy
-    'policy_supersede', // E2 — emitted by savePolicy on a supersession
-    'policy_close', // E2 — emitted by closePolicy
-    'skill_create', // E2 skill first-class object — emitted by saveSkill
-    'skill_supersede', // E2 — emitted by saveSkill on a supersession
-    'skill_close', // E2 — emitted by closeSkill
-    'project_brief_create', // E2 project_brief first-class object — emitted by saveProjectBrief
-    'project_brief_supersede', // E2 — emitted by saveProjectBrief on a supersession (incl. refresh)
-    'project_brief_close', // E2 — emitted by closeProjectBrief
-    'customer_note_create', // E2 customer_note first-class object — emitted by saveCustomerNote
-    'customer_note_supersede', // E2 — emitted by saveCustomerNote on a supersession
-    'customer_note_close', // E2 — emitted by closeCustomerNote
-    'mv_rescue', // LC2-E3 — emitted by consolidate() per rescue; lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS
-    'reject_value', // AT1 — emitted by `hippo reject`; lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS
-    'reject_refusal', // AT1 — emitted when the rejection guard refuses a write; lockstep
-    'unreject_value', // AT1 — emitted by `hippo unreject`; lockstep
-    'conflict_resolve', // AT1 — emitted by resolveConflict on every resolution path; lockstep
-    'half_life_migrate', // Decay default change — emitted by migrateDefaultHalfLife; lockstep with AuditOp union
-    'dormant_restore', // Dormant memories — emitted by api.restoreDormant; lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS
-    'auth_grant', // EI2: emitted by api.authGrant; lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS
-    'auth_ungrant', // EI2: emitted by api.authUngrant; lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS
-    'quarantine', // CD5: emitted by recordQuarantine; lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS
-    'quarantine_approve', // CD5: emitted by api.quarantineApprove; lockstep
-    'quarantine_reject', // CD5: emitted by api.quarantineReject; lockstep
-]);
+const VALID_AUDIT_OPS = new Set(AUDIT_OPS);
 // Cap on GET /v1/audit?limit=. Matches docs/api.md (when written) and is large
 // enough to dump a small deployment's full audit log without paginating, but
 // small enough that a malicious client can't ask for the world.
@@ -853,7 +796,7 @@ async function handleRequest(req, res, opts, startedAt, limiter) {
             assembleExtra.summarizeOlder = summarizeOlder;
         if (scope !== undefined)
             assembleExtra.scope = scope;
-        const result = assemble(ctx, assembleMatch.id, assembleExtra);
+        const result = assemble(ctx, assembleMatch.id, { ...assembleExtra, cost: assembleCost(assembleMatch.id) });
         recordTokens(ctx, 'http_assemble', { items: result.items.length, tokens: result.tokens, sessionId: assembleMatch.id });
         sendJson(res, 200, result);
         return;
@@ -896,7 +839,7 @@ async function handleRequest(req, res, opts, startedAt, limiter) {
             drillExtra.budget = budget;
         if (depth !== undefined)
             drillExtra.depth = depth;
-        const result = drillDown(ctx, drillMatch.id, drillExtra);
+        const result = drillDown(ctx, drillMatch.id, { ...drillExtra, cost: drillCost });
         if ('failure' in result) {
             // v1.6.4: leaf id maps to 422 (caller-actionable). Other cases stay
             // as 404 to avoid leaking cross-tenant existence or scope grants.
@@ -1054,6 +997,7 @@ async function handleRequest(req, res, opts, startedAt, limiter) {
             includeRecent,
             crossProject,
             currentProject: resolveProjectIdentity(dirname(resolve(opts.hippoRoot))).name,
+            cost: contextCost('markdown', 'observe'), // clients render; the budget prices the block `hippo context` would print
         });
         recordTokens(ctx, 'http_context', { items: result.entries.length, tokens: result.tokens });
         sendJson(res, 200, result);

package/dist/session-digest.d.ts

@@ -0,0 +1,79 @@
+import { type SessionTurn } from './capture.js';
+import { type MemoryEntry } from './memory.js';
+export declare const SESSION_DIGEST_TAG = "session-digest";
+/** Five-word runs are stock phrases; six in a row is a copied clause. */
+export declare const ECHO_WINDOW = 6;
+/** Five sentences of about 150 chars leave room for the Changed line inside the total cap. */
+export declare const MAX_SENTENCES = 5;
+/** A longer "sentence" in agent text is an unsplit list or pasted output. */
+export declare const MAX_SENTENCE_CHARS = 300;
+/** At about 20 chars per repo path this keeps the Changed line near 50 tokens. */
+export declare const MAX_FILES = 10;
+/** 300 tokens at 4 chars each: 20% of the 1500-token default budget of both context surfaces. */
+export declare const MAX_DIGEST_CHARS = 1200;
+/** Bounds a detached worker's memory; the final message sits at the end, so a tail read loses nothing. */
+export declare const READ_CAP_BYTES: number;
+export interface DigestEdit {
+    filePath: string;
+    /** Working directory in effect at the call, for relative paths. */
+    base: string | null;
+}
+export interface SessionScan {
+    turns: SessionTurn[];
+    finalText: string;
+    /** The first working directory the transcript names: where the session ran. */
+    cwd: string | null;
+    /** Edits that landed, in call order. */
+    edits: DigestEdit[];
+}
+/** One pass over a Claude Code or Codex transcript: the turns capture reads, the closing message, and the edits that landed. */
+export declare function scanSessionTranscript(jsonl: string): SessionScan;
+export declare function readSessionTranscript(transcriptPath: string, log: (message: string) => void): string;
+/** The transcript, read once and scanned, or null with the reason logged. */
+export declare function readSessionScan(transcriptPath: string, log: (message: string) => void): SessionScan | null;
+/** Test-only seam, the scheduler's pattern: lets a test prove a network path never reaches the probe. Null restores it. */
+export declare function __setDigestExistsProbe(probe: ((p: string) => boolean) | null): void;
+/** The store root is realpath'd; transcript paths are not, and a deleted file has no realpath of its own. Null for a network path. */
+export declare function realFsPath(p: string): string | null;
+/** Repo-relative with forward slashes, '' for the root itself, null outside the repo or when the path cannot be resolved. */
+export declare function repoRelative(p: string, repoRoot: string): string | null;
+export declare const USER_SEGMENT: readonly RegExp[];
+/** Sentences of the reply; code spans and "e.g." are held out of the split so their dots never end a sentence. */
+export declare function digestSentences(text: string): string[];
+export declare function sentenceScore(sentence: string): number;
+export interface DigestSources {
+    finalText: string;
+    /** Text the session already holds: its own prompts, and what hippo injected into it. */
+    echoTexts: readonly string[];
+    edits: readonly DigestEdit[];
+    repoRoot: string;
+}
+export interface DigestDraft {
+    content: string;
+    sentences: number;
+    files: number;
+}
+/** The digest text, or null when nothing survives the filters. Sentences print in reply order. */
+export declare function buildSessionDigest(sources: DigestSources): DigestDraft | null;
+/** Facts extracted from a digest and DAG summaries over one inherit its tag, but they are not the digest itself. */
+export declare function isSessionDigestRow(entry: Pick<MemoryEntry, 'source' | 'tags' | 'extracted_from'>): boolean;
+/** Same session, same row: a second worker for one session updates the digest instead of adding one. */
+export declare function sessionDigestId(tenantId: string, key: string): string;
+export interface SessionDigestOptions {
+    /** Session id, or the transcript's basename when the host gives none. */
+    key: string;
+    tenantId: string;
+}
+export interface DigestOutcome {
+    written: boolean;
+    reason: string;
+    sentences: number;
+    files: number;
+}
+export declare function writeSessionDigest(hippoRoot: string, scan: SessionScan, opts: SessionDigestOptions): DigestOutcome;
+export interface DigestRunOptions extends SessionDigestOptions {
+    log: (message: string) => void;
+}
+/** Never throws: a digest failure must not block the handoff or the snapshot close. Logs carry no digest text. */
+export declare function recordSessionDigest(hippoRoot: string, scan: SessionScan | null, opts: DigestRunOptions): void;
+//# sourceMappingURL=session-digest.d.ts.map