hippo-memory 1.56.0 → 1.58.0

package/dist/capture-error.js

@@ -7,6 +7,7 @@ import { loadConfig } from './config.js';
 import { closeHippoDb, openHippoDb } from './db.js';
 import { recordFailure } from './failure-log.js';
 import { blockHash } from './token-ledger.js';
+import { redactSecretsStrict } from './secret-detect.js';
 const MAX_LEN = 200;
 /** The user, a permission prompt or a hook said no: routine, not a lesson. */
 const DECLINED = /user (?:doesn't|does not) want|denied by (?:the )?user|user (?:rejected|declined|denied)|permission to use|was blocked by (?:a )?hook/i;
@@ -44,7 +45,7 @@ export function lessonFromFailure(payload) {
     if (!isString(p.error) || p.error.trim().length < 12)
         return { skip: 'skipped-invalid', text: null, detail: null };
     const tool = isString(p.tool_name) ? p.tool_name : 'tool';
-    const error = p.error.replace(/\s+/g, ' ').trim();
+    const error = redactSecretsStrict(p.error.replace(/\s+/g, ' ').trim());
     const text = `${tool}: ${error}`.slice(0, MAX_LEN);
     const command = isObject(p.tool_input) && isString(p.tool_input['command']) ? p.tool_input['command'].replace(LEADING_CD, '') : '';
     const head = command.trim().split(/\s+/).slice(0, 2).join(' ');

package/dist/capture.d.ts

@@ -49,19 +49,6 @@ export interface CaptureOptions {
     tenantId?: string;
     originProject?: string;
 }
-/**
- * Runtime shape guards used throughout this file wherever a value arrives
- * unparsed (JSONL transcript records, stdout/stderr write() chunks). Generic
- * over the input so the parameter is never annotated `unknown` directly — TS
- * infers it from the call site — while the check itself avoids `typeof` by
- * testing identity against the coercion (`String(x) === x`) /
- * prototype-chain (`instanceof Object`) instead. Behaviourally equivalent to
- * `typeof x === 'string'` / a truthy `typeof x === 'object'` check for
- * anything `JSON.parse` can produce (the only divergence is boxed
- * primitives, which JSON.parse never yields).
- */
-export declare function isStringValue<T>(value: T): value is T & string;
-export declare function isObjectLike<T>(value: T): value is T & object;
 /** Message for a caught value of unknown shape. `cause` names the sanctioned unknown-input case (error-cause enrichment). */
 export declare function errorMessage(cause: unknown): string;
 /** Transcript-line flags isNonHumanUserLine reads (any may be absent); `promptSource: 'system'` marks Claude Code's own notices. */

package/dist/capture.js

@@ -25,6 +25,7 @@ import { RejectedValueError, checkRejectionGuard } from './rejection.js';
 import { openHippoDb, closeHippoDb } from './db.js';
 import { loadConfig } from './config.js';
 import { classifyOriginProject } from './project-identity.js';
+import { isObjectLike, isStringValue, readClaudeCodePreCompact } from './capture-contract.js';
 // Sentence-level patterns
 //
 // T1 (DF2): each pattern now carries TWO capture groups — group 1 is the
@@ -471,23 +472,6 @@ export function extractFromText(text) {
     }
     return items;
 }
-/**
- * Runtime shape guards used throughout this file wherever a value arrives
- * unparsed (JSONL transcript records, stdout/stderr write() chunks). Generic
- * over the input so the parameter is never annotated `unknown` directly — TS
- * infers it from the call site — while the check itself avoids `typeof` by
- * testing identity against the coercion (`String(x) === x`) /
- * prototype-chain (`instanceof Object`) instead. Behaviourally equivalent to
- * `typeof x === 'string'` / a truthy `typeof x === 'object'` check for
- * anything `JSON.parse` can produce (the only divergence is boxed
- * primitives, which JSON.parse never yields).
- */
-export function isStringValue(value) {
-    return String(value) === value;
-}
-export function isObjectLike(value) {
-    return value !== null && value instanceof Object;
-}
 /** Message for a caught value of unknown shape. `cause` names the sanctioned unknown-input case (error-cause enrichment). */
 export function errorMessage(cause) {
     return cause instanceof Error ? cause.message : String(cause);
@@ -1161,57 +1145,12 @@ function runPreCompact(hippoRoot, stdinText, stdinTimedOut, logFile) {
         appendPreCompactLog(logFile, 'skip: store not initialized');
         return;
     }
-    // Same hazard X4 guards below, different trigger: a read that timed out
-    // must not reach auto-discovery either, or it snapshots another session.
-    if (stdinTimedOut && (!stdinText || stdinText.trim() === '')) {
-        appendPreCompactLog(logFile, 'skip: no PreCompact payload arrived before the stdin wait window closed');
-        return;
-    }
-    // A true manual invocation has no stdin at all (TTY, or a non-TTY pipe
-    // that yielded an empty read) — that's the ONLY case newest-transcript
-    // auto-discovery is allowed to run. Any other non-empty stdin must
-    // JSON-parse to an object carrying a string transcript_path, or it is
-    // treated as malformed input and skipped (X4) rather than silently
-    // falling back to discovery, which could snapshot an unrelated session's
-    // transcript under this payload's session_id.
-    const manualInvocation = !stdinText || stdinText.trim() === '';
-    let sessionId = null;
-    let payloadTranscriptPath = null;
-    let payloadCwd = null;
-    let payloadTrigger = null;
-    if (!manualInvocation) {
-        let payload;
-        try {
-            payload = JSON.parse(stdinText.trim());
-        }
-        catch {
-            // payload stays undefined; the isObjectLike check below rejects it
-            // the same way it would reject an explicit null.
-        }
-        if (!isObjectLike(payload) || !('transcript_path' in payload) || !isStringValue(payload.transcript_path)) {
-            // Covers non-JSON stdin, a JSON value that isn't an object, and
-            // `"transcript_path": null` (or the key missing entirely) — all fail
-            // the string check. Log and skip; never fall through to auto-discovery.
-            appendPreCompactLog(logFile, 'skip: malformed or incomplete PreCompact payload (missing string transcript_path)');
-            return;
-        }
-        if ('session_id' in payload && isStringValue(payload.session_id))
-            sessionId = payload.session_id;
-        payloadTranscriptPath = payload.transcript_path;
-        payloadCwd = 'cwd' in payload && isStringValue(payload.cwd) ? payload.cwd : null;
-        payloadTrigger = 'trigger' in payload && isStringValue(payload.trigger) ? payload.trigger : null;
-    }
-    // X11: payload transcript_path must end .jsonl. No directory-containment
-    // check is applied on top of this — CLAUDE_CONFIG_DIR can relocate the
-    // transcript root entirely, so a path-prefix allowlist would just reject
-    // legitimate relocated installs. The trust boundary here is process
-    // identity, not path shape: a local process able to feed this hook
-    // arbitrary stdin already runs as the same user who owns every transcript
-    // this check could gate on, so containment buys no real isolation.
-    if (payloadTranscriptPath !== null && !/\.jsonl$/i.test(payloadTranscriptPath)) {
-        appendPreCompactLog(logFile, `skip: payload transcript_path is not a .jsonl file: ${payloadTranscriptPath}`);
+    const receipt = readClaudeCodePreCompact(stdinText, stdinTimedOut);
+    if (receipt.status !== 'received') {
+        appendPreCompactLog(logFile, `skip: ${receipt.reason}`);
         return;
     }
+    const { sessionId, transcriptPath: payloadTranscriptPath, cwd: payloadCwd, trigger: payloadTrigger } = receipt.input;
     // The record is the "something saved before every compaction", so it lands even when no snapshot is derivable below.
     let recordId = null;
     if (sessionId !== null && sessionId !== '') {

package/dist/card-detail.d.ts

@@ -1,6 +1,6 @@
 import type { Card, CardComment, CardRun } from './card.js';
 import type { SessionHandoff } from './handoff.js';
-import { loadCardDeps } from './store.js';
+import { loadCardDeps } from './store-cards.js';
 /** A card plus everything `hippo card show` prints about it. */
 export interface CardDetail {
     card: Card;

package/dist/card-detail.js

@@ -1,4 +1,4 @@
-import { loadCard, loadCardComments, loadCardDeps, loadCardRuns, loadLatestHandoffForCard } from './store.js';
+import { loadCard, loadCardComments, loadCardDeps, loadCardRuns, loadLatestHandoffForCard } from './store-cards.js';
 /** Loads the detail behind `hippo card show` and `GET /api/cards/:id` (null when the tenant has no such card); five separate reads, so a write landing between them can show a mixed view, as `card show` always could. */
 export function loadCardDetail(hippoRoot, tenantId, id) {
     const card = loadCard(hippoRoot, tenantId, id);

package/dist/cli/shared.d.ts

@@ -0,0 +1,137 @@
+import { TaskSnapshot, SessionEvent } from '../store.js';
+import type { HandoffEvidence, SessionHandoff } from '../handoff.js';
+import { type SearchResult } from '../search.js';
+import { type HippoConfig } from '../config.js';
+import { openHippoDb } from '../db.js';
+import { type ImportReport } from '../agent-memories/report.js';
+import { type ChurnStaleResult } from '../invalidation.js';
+import { type AuditOp } from '../audit.js';
+import { type ServerInfo } from '../server-detect.js';
+import type { RecallSearchOpts } from '../recall-pipeline.js';
+export declare function parseLimitFlag(value: string | boolean | string[] | undefined): number;
+export declare function parseCountFlag(value: string | boolean | string[] | undefined): number;
+export declare function parseBudgetFlag(value: string | boolean | string[] | undefined, fallback: number): number;
+/**
+ * Emit an audit event against `hippoRoot`'s db. Opens its own short-lived
+ * connection so callers don't have to thread a db handle. Swallows all errors
+ * — audit must never crash a CLI command.
+ */
+export declare function emitCliAudit(hippoRoot: string, op: AuditOp, targetId?: string, metadata?: Record<string, unknown>): void;
+export declare function requireInit(hippoRoot: string): void;
+/** Runs detectChurnStale against every store this repo's memories can live in. */
+export declare function runChurnStaleForRepo(hippoRoot: string, dryRun: boolean): {
+    root: string;
+    result: ChurnStaleResult;
+}[];
+/**
+ * Run an HTTP-routed command if a `hippo serve` instance is detected for
+ * `hippoRoot`. Returns:
+ *   - true  if the HTTP path ran (success OR a structured server error that
+ *           was already surfaced to stdout/stderr by `httpFn`),
+ *   - false if no server was detected, or if the detected pidfile turned out
+ *           to be stale (connection refused). On stale, the pidfile is removed
+ *           if it still names that dead server (a newer one may have replaced
+ *           it) and the caller should fall back to the direct path.
+ *
+ * Stale pidfiles must self-heal, not crash.
+ * When HIPPO_REQUIRE_SERVER is set, both fallback paths throw instead of
+ * returning false, so a missing server fails loudly rather than silently
+ * degrading to direct mode.
+ */
+export declare function runViaServerIfAvailable(hippoRoot: string, httpFn: (info: ServerInfo, apiKey: string | undefined) => Promise<void>): Promise<boolean>;
+export declare function fmt(n: number, digits?: number): string;
+export declare function recallEntryText(r: SearchResult, query: string, showWhy: boolean, isGlobal: boolean): string;
+export declare function recallHeading(entries: number, tokens: number, query: string): string;
+/** One line when an agent memory import moved anything; its warnings go to stderr. */
+export declare function printAgentImport(report: ImportReport, indent?: string): void;
+/** The first hippo block in `text` and the agent whose current or shipped text it is; `owner` is undefined for an edited block. */
+export declare function hippoBlock(text: string): {
+    start: number;
+    end: number;
+    eol: string;
+    inner: string;
+    owner?: string;
+} | null;
+/** Adds hippo's two Codex hooks and says what changed; each install ends on the trust reminder, since Codex skips an untrusted hook. */
+export declare function installCodexMemoryHooks(indent: string): void;
+/**
+ * Set up a machine-level daily runner that sweeps all registered Hippo
+ * workspaces.
+ * Linux/macOS: writes to user crontab.
+ * Windows: creates a scheduled task.
+ * Skips if already installed.
+ */
+export declare function setupDailySchedule(globalRoot: string): void;
+export type CliFlags = Record<string, string | boolean | string[]>;
+export type EngineFlags = Pick<RecallSearchOpts, 'usePhysics' | 'physicsConfig' | 'mmr' | 'mmrLambda' | 'localBump'>;
+export declare function parseAsOfFlag(flags: CliFlags): string | undefined;
+/** --physics forces physics, --classic forces BM25+cosine, else physics unless the config turns it off. */
+export declare function engineFlags(flags: CliFlags, config: HippoConfig): EngineFlags;
+/**
+ * Detached worker that counts re-reads, runs sleep, then capture. Invoked via the internal
+ * `__session-end-worker` subcommand (not user-facing). Failures in one stage
+ * do not block the other.
+ */
+export declare function collectHandoffEvidence(cwd: string, testStatus: HandoffEvidence['testStatus']): HandoffEvidence;
+/** A folder without its own store never sleeps at session end, so its project's agent notes go to the global store here. */
+export declare function logSessionEndImport(logFile: string | null, transcriptPath: string | undefined): void;
+/**
+ * Best-effort log line for the snapshot-close step in
+ * `cmdSessionEndWorker`. `cmdSleep`/`cmdCapture` each tee console output to
+ * `logFile` only for their own duration (the tee is restored before this
+ * runs), so a plain `console.log` here would be silently discarded under
+ * the detached worker's `stdio: 'ignore'` — write straight to the file
+ * instead, matching capture.ts's `appendPreCompactLog` convention.
+ */
+export declare function appendSessionEndCloseLog(logFile: string | null, message: string, opts?: {
+    startFresh?: boolean;
+}): void;
+export declare function printActiveTaskSnapshot(snapshot: TaskSnapshot): void;
+export declare function printSessionEvents(events: SessionEvent[]): void;
+export declare function printHandoff(handoff: SessionHandoff): void;
+export declare function cardStringFlag(flags: Record<string, string | boolean | string[]>, key: string): string | undefined;
+export declare function hostSessionId(): string | undefined;
+/**
+ * Compaction drops the pinned blocks the per-prompt hook injected
+ * earlier, so record a `reset` for the payload's session and the next prompt
+ * injects again even if nothing changed. `requiredSource` limits it to hook
+ * payloads with that `source` (SessionStart fires for other reasons too).
+ * Best-effort and silent: a malformed payload records nothing.
+ */
+export declare function resetHookInjection(hippoRoot: string, stdinText: string | undefined, requiredSource: string | null): void;
+/**
+ * Run `fn` with console.log captured; returns the captured lines joined by
+ * newlines (what the same calls would have printed, minus the final newline).
+ */
+export declare function captureConsole(fn: () => void): string;
+/**
+ * The store a Claude Code hook writes to: the project store when there is
+ * one, else an existing global store, else the project path (which the hook
+ * then skips, since hooks fire in every directory and must not create one).
+ * Pre-compact and compact-resume must agree, or a snapshot saved to one store
+ * is looked for in the other.
+ */
+export declare function hookStoreRoot(hippoRoot: string): string;
+/**
+ * Run `fn` against the token ledger's store: the local store when it is
+ * initialized, else the global one (the per-prompt hook runs in directories
+ * without a local store). Best-effort: returns undefined and never throws,
+ * because a ledger failure must not break context or recall.
+ */
+export declare function withLedgerDb<T>(hippoRoot: string, fn: (db: ReturnType<typeof openHippoDb>) => T): T | undefined;
+export declare function learnFromRepo(hippoRoot: string, repoPath: string, days: number, label?: string): {
+    added: number;
+    skipped: number;
+    lowInfo: number;
+};
+export declare const HOOK_MARKERS: {
+    start: string;
+    end: string;
+};
+export declare const HOOKS: Record<string, {
+    file: string;
+    content: string;
+    description: string;
+}>;
+export declare function resolveAuthRoot(hippoRoot: string, flags: Record<string, string | boolean | string[]>): string;
+//# sourceMappingURL=shared.d.ts.map