hippo-memory 1.52.8 → 1.53.0

package/dist/server.js

@@ -2,12 +2,13 @@ import { createServer } from 'node:http';
 import { createHash } from 'node:crypto';
 import { dirname, resolve } from 'node:path';
 import { resolveProjectIdentity } from './project-identity.js';
+import { assembleCost, contextCost, drillCost } from './context-render.js';
 import { detectServer, writePidfile, removePidfileIfOwned } from './server-detect.js';
 import { resolveTenantId } from './tenant.js';
 import { openHippoDb, closeHippoDb } from './db.js';
 import { updateStats } from './store.js';
 import { buildSessionKey, getOrCreateRing, appendRecall, snapshotRing, hashQueryText, } from './recall-history.js';
-import { appendAuditEvent } from './audit.js';
+import { appendAuditEvent, AUDIT_OPS } from './audit.js';
 // v0.33 / J1 — Module-level per-(tenant, session) recall-history ring map
 // for the HTTP pipeline. Separate from CLI/MCP rings per plan v3 (per-
 // pipeline rings; no IPC). HTTP is the only caller that threads its
@@ -63,65 +64,7 @@ const PUBLIC_ROUTES = new Set([
 function isPublicRoute(method, path) {
     return PUBLIC_ROUTES.has(`${method} ${path}`);
 }
-const VALID_AUDIT_OPS = new Set([
-    'remember',
-    'recall',
-    'promote',
-    'supersede',
-    'forget',
-    'archive_raw',
-    'auth_revoke',
-    'auth_create', // v1.12.4: emitted by api.authCreate
-    'outcome', // v1.11.5: pre-existing drift — emitted today but rejected by old Set
-    'consolidate', // v1.11.5: emitted by api.sleep / POST /v1/sleep
-    'audit_prune', // v1.12.9: emitted by pruneAuditLog
-    'summary_marked_dirty', // v0.30 / E1 — lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS (v1.11.5 CRIT A institutional rule)
-    'summary_marked_clean', // v0.30 / E3 — buildDag post-link clean op; lockstep
-    'summary_rebuilt', // v0.30 / E3 — sleep-cycle rebuild op; lockstep
-    'predict_create', // v0.31 / E2 prediction first-class object — emitted by savePrediction
-    'predict_close', // v0.31 / E2 — emitted by closePrediction
-    'predict_baserate', // v0.31 / J3 — emitted by computePredictionBaserate
-    'recall_autodebias_hint', // v0.32 / J3.2 — emitted by computePlanningFallacyHint on success
-    'recall_autodebias_hint_no_class_match', // v0.32 / J3.2 — telemetry: forward-claim, no class scored
-    'recall_autodebias_hint_tiebreak', // v0.32 / J3.2 — telemetry: forward-claim, >=2 classes tied
-    'recall_anchor_detected_query_repeat', // v0.33 / J1 — emitted by detector on R1 fire
-    'recall_anchor_detected_memory_dominance', // v0.33 / J1 — emitted by detector on R2 fire
-    'recall_anchor_skipped_no_session', // v0.33 / J1 — telemetry: no sessionId, ring skipped
-    'recall_availability_detected', // v1.13.x / J2 - emitted when availability/recency-bias hint fires
-    'decision_create', // E2 decision first-class object — emitted by saveDecision
-    'decision_supersede', // E2 — emitted by saveDecision when --supersedes resolves to an active decision row
-    'decision_close', // E2 — emitted by closeDecision
-    'incident_open', // E2 incident first-class object — emitted by saveIncident
-    'incident_resolve', // E2 — emitted by resolveIncident (open -> resolved)
-    'incident_close', // E2 — emitted by closeIncident (open|resolved -> closed)
-    'process_create', // E2 process first-class object — emitted by saveProcess
-    'process_supersede', // E2 — emitted by saveProcess on a supersession
-    'process_close', // E2 — emitted by closeProcess
-    'policy_create', // E2 policy first-class object — emitted by savePolicy
-    'policy_supersede', // E2 — emitted by savePolicy on a supersession
-    'policy_close', // E2 — emitted by closePolicy
-    'skill_create', // E2 skill first-class object — emitted by saveSkill
-    'skill_supersede', // E2 — emitted by saveSkill on a supersession
-    'skill_close', // E2 — emitted by closeSkill
-    'project_brief_create', // E2 project_brief first-class object — emitted by saveProjectBrief
-    'project_brief_supersede', // E2 — emitted by saveProjectBrief on a supersession (incl. refresh)
-    'project_brief_close', // E2 — emitted by closeProjectBrief
-    'customer_note_create', // E2 customer_note first-class object — emitted by saveCustomerNote
-    'customer_note_supersede', // E2 — emitted by saveCustomerNote on a supersession
-    'customer_note_close', // E2 — emitted by closeCustomerNote
-    'mv_rescue', // LC2-E3 — emitted by consolidate() per rescue; lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS
-    'reject_value', // AT1 — emitted by `hippo reject`; lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS
-    'reject_refusal', // AT1 — emitted when the rejection guard refuses a write; lockstep
-    'unreject_value', // AT1 — emitted by `hippo unreject`; lockstep
-    'conflict_resolve', // AT1 — emitted by resolveConflict on every resolution path; lockstep
-    'half_life_migrate', // Decay default change — emitted by migrateDefaultHalfLife; lockstep with AuditOp union
-    'dormant_restore', // Dormant memories — emitted by api.restoreDormant; lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS
-    'auth_grant', // EI2: emitted by api.authGrant; lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS
-    'auth_ungrant', // EI2: emitted by api.authUngrant; lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS
-    'quarantine', // CD5: emitted by recordQuarantine; lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS
-    'quarantine_approve', // CD5: emitted by api.quarantineApprove; lockstep
-    'quarantine_reject', // CD5: emitted by api.quarantineReject; lockstep
-]);
+const VALID_AUDIT_OPS = new Set(AUDIT_OPS);
 // Cap on GET /v1/audit?limit=. Matches docs/api.md (when written) and is large
 // enough to dump a small deployment's full audit log without paginating, but
 // small enough that a malicious client can't ask for the world.
@@ -853,7 +796,7 @@ async function handleRequest(req, res, opts, startedAt, limiter) {
             assembleExtra.summarizeOlder = summarizeOlder;
         if (scope !== undefined)
             assembleExtra.scope = scope;
-        const result = assemble(ctx, assembleMatch.id, assembleExtra);
+        const result = assemble(ctx, assembleMatch.id, { ...assembleExtra, cost: assembleCost(assembleMatch.id) });
         recordTokens(ctx, 'http_assemble', { items: result.items.length, tokens: result.tokens, sessionId: assembleMatch.id });
         sendJson(res, 200, result);
         return;
@@ -896,7 +839,7 @@ async function handleRequest(req, res, opts, startedAt, limiter) {
             drillExtra.budget = budget;
         if (depth !== undefined)
             drillExtra.depth = depth;
-        const result = drillDown(ctx, drillMatch.id, drillExtra);
+        const result = drillDown(ctx, drillMatch.id, { ...drillExtra, cost: drillCost });
         if ('failure' in result) {
             // v1.6.4: leaf id maps to 422 (caller-actionable). Other cases stay
             // as 404 to avoid leaking cross-tenant existence or scope grants.
@@ -1054,6 +997,7 @@ async function handleRequest(req, res, opts, startedAt, limiter) {
             includeRecent,
             crossProject,
             currentProject: resolveProjectIdentity(dirname(resolve(opts.hippoRoot))).name,
+            cost: contextCost('markdown', 'observe'), // clients render; the budget prices the block `hippo context` would print
         });
         recordTokens(ctx, 'http_context', { items: result.entries.length, tokens: result.tokens });
         sendJson(res, 200, result);

package/dist/session-digest.d.ts

@@ -0,0 +1,79 @@
+import { type SessionTurn } from './capture.js';
+import { type MemoryEntry } from './memory.js';
+export declare const SESSION_DIGEST_TAG = "session-digest";
+/** Five-word runs are stock phrases; six in a row is a copied clause. */
+export declare const ECHO_WINDOW = 6;
+/** Five sentences of about 150 chars leave room for the Changed line inside the total cap. */
+export declare const MAX_SENTENCES = 5;
+/** A longer "sentence" in agent text is an unsplit list or pasted output. */
+export declare const MAX_SENTENCE_CHARS = 300;
+/** At about 20 chars per repo path this keeps the Changed line near 50 tokens. */
+export declare const MAX_FILES = 10;
+/** 300 tokens at 4 chars each: 20% of the 1500-token default budget of both context surfaces. */
+export declare const MAX_DIGEST_CHARS = 1200;
+/** Bounds a detached worker's memory; the final message sits at the end, so a tail read loses nothing. */
+export declare const READ_CAP_BYTES: number;
+export interface DigestEdit {
+    filePath: string;
+    /** Working directory in effect at the call, for relative paths. */
+    base: string | null;
+}
+export interface SessionScan {
+    turns: SessionTurn[];
+    finalText: string;
+    /** The first working directory the transcript names: where the session ran. */
+    cwd: string | null;
+    /** Edits that landed, in call order. */
+    edits: DigestEdit[];
+}
+/** One pass over a Claude Code or Codex transcript: the turns capture reads, the closing message, and the edits that landed. */
+export declare function scanSessionTranscript(jsonl: string): SessionScan;
+export declare function readSessionTranscript(transcriptPath: string, log: (message: string) => void): string;
+/** The transcript, read once and scanned, or null with the reason logged. */
+export declare function readSessionScan(transcriptPath: string, log: (message: string) => void): SessionScan | null;
+/** Test-only seam, the scheduler's pattern: lets a test prove a network path never reaches the probe. Null restores it. */
+export declare function __setDigestExistsProbe(probe: ((p: string) => boolean) | null): void;
+/** The store root is realpath'd; transcript paths are not, and a deleted file has no realpath of its own. Null for a network path. */
+export declare function realFsPath(p: string): string | null;
+/** Repo-relative with forward slashes, '' for the root itself, null outside the repo or when the path cannot be resolved. */
+export declare function repoRelative(p: string, repoRoot: string): string | null;
+export declare const USER_SEGMENT: readonly RegExp[];
+/** Sentences of the reply; code spans and "e.g." are held out of the split so their dots never end a sentence. */
+export declare function digestSentences(text: string): string[];
+export declare function sentenceScore(sentence: string): number;
+export interface DigestSources {
+    finalText: string;
+    /** Text the session already holds: its own prompts, and what hippo injected into it. */
+    echoTexts: readonly string[];
+    edits: readonly DigestEdit[];
+    repoRoot: string;
+}
+export interface DigestDraft {
+    content: string;
+    sentences: number;
+    files: number;
+}
+/** The digest text, or null when nothing survives the filters. Sentences print in reply order. */
+export declare function buildSessionDigest(sources: DigestSources): DigestDraft | null;
+/** Facts extracted from a digest and DAG summaries over one inherit its tag, but they are not the digest itself. */
+export declare function isSessionDigestRow(entry: Pick<MemoryEntry, 'source' | 'tags' | 'extracted_from'>): boolean;
+/** Same session, same row: a second worker for one session updates the digest instead of adding one. */
+export declare function sessionDigestId(tenantId: string, key: string): string;
+export interface SessionDigestOptions {
+    /** Session id, or the transcript's basename when the host gives none. */
+    key: string;
+    tenantId: string;
+}
+export interface DigestOutcome {
+    written: boolean;
+    reason: string;
+    sentences: number;
+    files: number;
+}
+export declare function writeSessionDigest(hippoRoot: string, scan: SessionScan, opts: SessionDigestOptions): DigestOutcome;
+export interface DigestRunOptions extends SessionDigestOptions {
+    log: (message: string) => void;
+}
+/** Never throws: a digest failure must not block the handoff or the snapshot close. Logs carry no digest text. */
+export declare function recordSessionDigest(hippoRoot: string, scan: SessionScan | null, opts: DigestRunOptions): void;
+//# sourceMappingURL=session-digest.d.ts.map