hippo-memory 1.56.0 → 1.58.0

package/dist/connectors/slack/webhook.js

@@ -0,0 +1,203 @@
+import { verifySlackSignature } from './signature.js';
+import { isSlackEventEnvelope, isSlackMessageEvent } from './types.js';
+import { ingestMessage } from './ingest.js';
+import { handleMessageDeleted } from './deletion.js';
+import { writeToDlq } from './dlq.js';
+import { resolveTenantForTeam } from './tenant-routing.js';
+import { resolveTenantId } from '../../tenant.js';
+import { openHippoDb, closeHippoDb } from '../../db.js';
+import { adminActor } from '../../api.js';
+import { HttpError, JSON_HEADERS, isHeaderString, isJsonObjectRecord, readBody, sendJson, } from '../../http-util.js';
+/**
+ * Slack Events API webhook. Auth is signature-based (HMAC over the raw
+ * body with SLACK_SIGNING_SECRET); Bearer is NOT required, which is why
+ * this route is in PUBLIC_ROUTES. The route is responsible for:
+ *   1. Echoing the one-time url_verification challenge.
+ *   2. Verifying the HMAC on every other inbound payload.
+ *   3. Resolving body.team_id → tenantId via slack_workspaces, falling
+ *      back to HIPPO_TENANT then 'default'.
+ *   4. Dispatching event_callback envelopes to ingestMessage /
+ *      handleMessageDeleted.
+ *   5. Parking malformed or unhandled payloads in slack_dlq and STILL
+ *      ACKing 200 - Slack retries forever otherwise.
+ *
+ * When SLACK_SIGNING_SECRET is unset we return 404, not
+ * 503, so an external probe cannot distinguish "route gated off by config"
+ * from "route does not exist on this build".
+ *
+ * Bearer auth is skipped on purpose: server.ts checks isPublicRoute before calling this.
+ */
+export async function handleSlackEventsWebhook({ req, res, opts }) {
+    const rawBody = await readBody(req);
+    const secret = process.env.SLACK_SIGNING_SECRET;
+    if (!secret) {
+        res.writeHead(404, JSON_HEADERS);
+        res.end(JSON.stringify({ error: 'not found' }));
+        return;
+    }
+    const previousSecret = process.env.SLACK_SIGNING_SECRET_PREVIOUS;
+    const sig = req.headers['x-slack-signature'];
+    const tsHdr = req.headers['x-slack-request-timestamp'];
+    const sigStr = isHeaderString(sig) ? sig : null;
+    const tsStr = isHeaderString(tsHdr) ? tsHdr : null;
+    if (sigStr === null ||
+        tsStr === null ||
+        !verifySlackSignature({
+            rawBody,
+            timestamp: tsStr,
+            signature: sigStr,
+            signingSecret: secret,
+            previousSecret,
+        })) {
+        throw new HttpError(401, 'invalid Slack signature');
+    }
+    // Cheap regex extracts team_id from a (possibly malformed) raw body so the
+    // DLQ row carries it for triage even when JSON.parse fails.
+    const teamIdFromRaw = (() => {
+        const m = rawBody.match(/"team_id"\s*:\s*"([^"]+)"/);
+        return m ? m[1] : null;
+    })();
+    let body;
+    try {
+        body = JSON.parse(rawBody);
+    }
+    catch {
+        // Attribute the parse failure to the originating workspace via the regex-extracted
+        // team_id; a null or unknown team writes tenantId=null, which lands as '__unroutable__'.
+        const db = openHippoDb(opts.hippoRoot);
+        try {
+            const parseFailTenant = teamIdFromRaw !== null ? resolveTenantForTeam(db, teamIdFromRaw) : null;
+            writeToDlq(db, {
+                tenantId: parseFailTenant, // null → '__unroutable__' sentinel
+                teamId: teamIdFromRaw,
+                rawPayload: rawBody,
+                error: 'invalid JSON',
+                bucket: 'parse_error',
+                signature: sigStr,
+                slackTimestamp: tsStr,
+            });
+        }
+        finally {
+            closeHippoDb(db);
+        }
+        sendJson(res, 200, { ok: true, status: 'dlq' });
+        return;
+    }
+    if (isJsonObjectRecord(body)) {
+        const bodyRecord = body;
+        if (bodyRecord.type === 'url_verification') {
+            sendJson(res, 200, {
+                challenge: String(bodyRecord.challenge ?? ''),
+            });
+            return;
+        }
+    }
+    // Resolve tenant, failing closed: when slack_workspaces is non-empty
+    // and the team_id is unknown, resolveTenantForTeam returns null and we
+    // park the envelope in slack_dlq with bucket='unroutable'. Mandatory ACK
+    // 200 so Slack stops retrying; do NOT call ingest.
+    let resolvedTenant = null;
+    if (body !== undefined && isSlackEventEnvelope(body)) {
+        const db = openHippoDb(opts.hippoRoot);
+        try {
+            resolvedTenant = resolveTenantForTeam(db, body.team_id);
+        }
+        finally {
+            closeHippoDb(db);
+        }
+        if (resolvedTenant === null) {
+            const db2 = openHippoDb(opts.hippoRoot);
+            try {
+                writeToDlq(db2, {
+                    tenantId: null, // unroutable - stored as '__unroutable__'
+                    teamId: body.team_id,
+                    rawPayload: rawBody,
+                    error: `unroutable team_id: ${body.team_id}`,
+                    bucket: 'unroutable',
+                    signature: sigStr,
+                    slackTimestamp: tsStr,
+                });
+            }
+            finally {
+                closeHippoDb(db2);
+            }
+            sendJson(res, 200, { ok: true, status: 'dlq' });
+            return;
+        }
+    }
+    else {
+        // Non-envelope payload: use env tenant for the DLQ row's bookkeeping.
+        resolvedTenant = resolveTenantId({});
+    }
+    const ctx = {
+        hippoRoot: opts.hippoRoot,
+        tenantId: resolvedTenant,
+        actor: adminActor('connector:slack'),
+    };
+    if (body === undefined || !isSlackEventEnvelope(body)) {
+        const db = openHippoDb(ctx.hippoRoot);
+        try {
+            writeToDlq(db, {
+                tenantId: ctx.tenantId,
+                teamId: teamIdFromRaw,
+                rawPayload: rawBody,
+                error: 'not an event_callback envelope',
+                bucket: 'parse_error',
+                signature: sigStr,
+                slackTimestamp: tsStr,
+            });
+        }
+        finally {
+            closeHippoDb(db);
+        }
+        sendJson(res, 200, { ok: true, status: 'dlq' });
+        return;
+    }
+    const inner = body.event;
+    if (isSlackMessageEvent(inner)) {
+        if (inner.subtype === 'message_deleted' && inner.deleted_ts) {
+            const r = handleMessageDeleted(ctx, {
+                teamId: body.team_id,
+                channelId: inner.channel,
+                deletedTs: inner.deleted_ts,
+                eventId: body.event_id,
+            });
+            sendJson(res, 200, { ok: true, status: r.status });
+            return;
+        }
+        const r = ingestMessage(ctx, {
+            teamId: body.team_id,
+            // channel privacy isn't on the inner event; use channel_type as a
+            // proxy. 'group'|'im'|'mpim' → private. 'channel' → public. Unknown
+            // → private (fail closed).
+            channel: {
+                id: inner.channel,
+                is_private: inner.channel_type !== 'channel',
+                is_im: inner.channel_type === 'im',
+                is_mpim: inner.channel_type === 'mpim',
+            },
+            message: inner,
+            eventId: body.event_id,
+        });
+        sendJson(res, 200, { ok: true, status: r.status, memoryId: r.memoryId });
+        return;
+    }
+    const db = openHippoDb(ctx.hippoRoot);
+    try {
+        writeToDlq(db, {
+            tenantId: ctx.tenantId,
+            teamId: body.team_id,
+            rawPayload: rawBody,
+            error: `unhandled event type: ${inner.type ?? 'unknown'}`,
+            bucket: 'parse_error',
+            signature: sigStr,
+            slackTimestamp: tsStr,
+        });
+    }
+    finally {
+        closeHippoDb(db);
+    }
+    sendJson(res, 200, { ok: true, status: 'dlq' });
+    return;
+}
+//# sourceMappingURL=webhook.js.map

package/dist/consolidate.d.ts

@@ -6,6 +6,7 @@
  * 2. Merge pass  - find episodic entries with high text overlap, create semantic summaries
  * 3. Stats tracking
  */
+import { MemoryEntry, type DecayOptions } from './memory.js';
 export interface ConsolidationResult {
     decayed: number;
     removed: number;
@@ -45,4 +46,13 @@ export declare function consolidate(hippoRoot: string, options?: {
     now?: Date;
     fetcher?: typeof fetch;
 }): Promise<ConsolidationResult>;
+/** Maps i to each j > i, ascending, whose text overlap with i reaches the merge threshold; every text needs at least one token. */
+export declare function mergePartners(contents: readonly string[]): (i: number) => number[];
+/** Pairs of live non-semantic memories that contradict each other, in survivor order. */
+export declare function detectConflicts(entries: MemoryEntry[], now: Date, decayOpts?: DecayOptions, rescuedIds?: Set<string>): Array<{
+    memory_a_id: string;
+    memory_b_id: string;
+    reason: string;
+    score: number;
+}>;
 //# sourceMappingURL=consolidate.d.ts.map

package/dist/consolidate.js

@@ -7,9 +7,10 @@
  * 3. Stats tracking
  */
 import { evalNow, isRecallBoostAblated } from './ablation.js';
-import { Layer, calculateStrength, canAutoDelete, createMemory } from './memory.js';
+import { Layer, calculateStrength, canAutoDelete, createMemory, markRetrieved } from './memory.js';
 import { loadAllEntries, batchWriteAndDelete, appendConsolidationRun, replaceDetectedConflicts, loadSessionDecayContext, incrementSleepCount, findPromotableSessions, traceExistsForSession, listSessionEvents, memoriesBackingObjects, } from './store.js';
-import { textOverlap, markRetrieved, tokenize } from './search.js';
+import { tokenize } from './tokenize.js';
+import { jaccardMinShared, overlapPartners } from './overlap-index.js';
 import { compareEntryIdentity } from './compare.js';
 import { duplicateKey, mergedText } from './same-text.js';
 import { successorAfterRetirement } from './merged-row.js';
@@ -25,7 +26,7 @@ import { renderTraceContent } from './trace.js';
 import { resolveTenantId } from './tenant.js';
 import { rescueSet, rankNonPinnedByTenant, validateWeights } from './memory-value.js';
 import { MEMORY_VALUE_WEIGHTS, SOURCE_ARTIFACT_SHA256 } from './memory-value-weights.js';
-import { appendAuditEvent } from './audit.js';
+import { appendAuditEvent, reportAuditWriteFailure } from './audit.js';
 import { migrateDefaultHalfLife, LEGACY_TYPED_HALF_LIFE } from './half-life-migration.js';
 import { derivationScope, commonDerivationScope, derivationPartitionKey } from './recall-scope.js';
 import { isQuarantineScope } from './quarantine.js';
@@ -418,8 +419,8 @@ export async function consolidate(hippoRoot, options = {}) {
                                 },
                             });
                         }
-                        catch {
-                            // Best-effort — mirrors store.ts's audit() semantics.
+                        catch (error) {
+                            reportAuditWriteFailure('reject_refusal', String(error));
                         }
                         continue;
                     }
@@ -707,17 +708,14 @@ export async function consolidate(hippoRoot, options = {}) {
         for (const [, tenantCandidates] of mergeCandidatesByTenant) {
             const mergeTenant = tenantCandidates[0].tenantId;
             const mergeScope = derivationScope(tenantCandidates[0].scope);
+            const partnersOf = mergePartners(tenantCandidates.map((e) => e.content));
             for (let i = 0; i < tenantCandidates.length; i++) {
                 if (used.has(tenantCandidates[i].id) || tenantCandidates[i].content.length > MERGE_MAX_CHARS)
                     continue;
                 const related = [tenantCandidates[i]];
-                for (let j = i + 1; j < tenantCandidates.length; j++) {
-                    if (used.has(tenantCandidates[j].id))
-                        continue;
-                    const overlap = textOverlap(tenantCandidates[i].content, tenantCandidates[j].content);
-                    if (overlap >= MERGE_OVERLAP_THRESHOLD) {
+                for (const j of partnersOf(i)) {
+                    if (!used.has(tenantCandidates[j].id))
                         related.push(tenantCandidates[j]);
-                    }
                 }
                 const cluster = [];
                 let clusterChars = 0;
@@ -792,8 +790,8 @@ export async function consolidate(hippoRoot, options = {}) {
                                 },
                             });
                         }
-                        catch {
-                            // Best-effort — mirrors store.ts's audit() semantics.
+                        catch (error) {
+                            reportAuditWriteFailure('reject_refusal', String(error));
                         }
                         continue;
                     }
@@ -910,8 +908,9 @@ export async function consolidate(hippoRoot, options = {}) {
                                     : {},
                             });
                         }
-                        catch {
+                        catch (error) {
                             auditFailures++;
+                            reportAuditWriteFailure('mv_rescue', String(error), entry.id);
                         }
                     }
                     if (auditFailures > 0) {
@@ -964,7 +963,14 @@ function pickStrongestValence(entries) {
     }
     return 'neutral';
 }
-function detectConflicts(entries, now, decayOpts = {}, 
+/** Maps i to each j > i, ascending, whose text overlap with i reaches the merge threshold; every text needs at least one token. */
+export function mergePartners(contents) {
+    const sets = contents.map((text) => new Set(tokenize(text)));
+    const candidatesOf = overlapPartners(sets, jaccardMinShared(MERGE_OVERLAP_THRESHOLD));
+    return (i) => candidatesOf(i).filter((j) => jaccardSets(sets[i], sets[j]) >= MERGE_OVERLAP_THRESHOLD);
+}
+/** Pairs of live non-semantic memories that contradict each other, in survivor order. */
+export function detectConflicts(entries, now, decayOpts = {}, 
 // LC2-E3 (opt-in, default off): ids rescued by this cycle's decay pass.
 // detectConflicts recomputes its own strength>=DECAY_THRESHOLD survivor
 // filter independently of the decay pass above; without this bypass,
@@ -977,8 +983,10 @@ rescuedIds = new Set()) {
         && !isQuarantineScope(entry.scope ?? null)
         && (rescuedIds.has(entry.id) || calculateStrength(entry, now, decayOpts) >= DECAY_THRESHOLD));
     const detected = [];
+    const profiles = survivors.map((entry) => conflictProfile(entry.content));
+    const partnersOf = overlapPartners(profiles.map((p) => p.distinct), jaccardMinShared(CONFLICT_OVERLAP_THRESHOLD, CONFLICT_MIN_RARE_SHARED));
     for (let i = 0; i < survivors.length; i++) {
-        for (let j = i + 1; j < survivors.length; j++) {
+        for (const j of partnersOf(i)) {
             // Traces are variants of each other, not contradictions. Two
             // strategies for the same task can both be valid; conflict detection
             // exists for stated-rule disagreement, not strategy diversity.
@@ -988,7 +996,7 @@ rescuedIds = new Set()) {
                 continue;
             if ([survivors[i], survivors[j]].some((e) => e.tags.includes('extracted') || e.tags.includes('session-digest')))
                 continue;
-            const reasonAndScore = describeConflict(survivors[i], survivors[j]);
+            const reasonAndScore = describeConflict(profiles[i], profiles[j]);
             if (!reasonAndScore)
                 continue;
             detected.push({
@@ -1001,25 +1009,26 @@ rescuedIds = new Set()) {
     }
     return detected;
 }
+function conflictProfile(text) {
+    const opening = openingWindow(text);
+    // Polarity is measured only in the first POLARITY_WINDOW_WORDS, so a stray
+    // negation deep in a prose memory doesn't flip the intent.
+    // Pad with spaces so space-delimited patterns match words at the start/end.
+    return { distinct: distinctiveTokens(text), polarity: inferConflictPolarity(opening), window: ' ' + opening.toLowerCase() + ' ' };
+}
 function describeConflict(a, b) {
-    const aDistinct = distinctiveTokens(a.content);
-    const bDistinct = distinctiveTokens(b.content);
     // Jaccard on stopword-stripped tokens. Defer the threshold check until we
     // know whether an explicit polarity pair is present (lower bar for those).
-    const overlapScore = jaccardSets(aDistinct, bDistinct);
+    const overlapScore = jaccardSets(a.distinct, b.distinct);
     // Require at least N shared distinctive tokens so two short memories sharing
     // only "the project name" don't register.
     let shared = 0;
-    for (const t of aDistinct)
-        if (bDistinct.has(t))
+    for (const t of a.distinct)
+        if (b.distinct.has(t))
             shared++;
     if (shared < CONFLICT_MIN_RARE_SHARED)
         return null;
-    // Polarity is measured only in the first POLARITY_WINDOW_WORDS, so a stray
-    // negation deep in a prose memory doesn't flip the intent.
-    const polarityA = inferConflictPolarity(openingWindow(a.content));
-    const polarityB = inferConflictPolarity(openingWindow(b.content));
-    const conflictType = classifyConflictType(a.content, b.content, polarityA, polarityB);
+    const conflictType = classifyConflictType(a.window, b.window, a.polarity, b.polarity);
     if (!conflictType)
         return null;
     if (overlapScore < CONFLICT_OVERLAP_THRESHOLD)
@@ -1051,14 +1060,8 @@ function jaccardSets(a, b) {
 function openingWindow(text) {
     return text.split(/\s+/).slice(0, POLARITY_WINDOW_WORDS).join(' ');
 }
-function classifyConflictType(aText, bText, aPolarity, bPolarity) {
-    // Classifier scans only the opening window of each memory so " on " and
-    // " off " used as English prepositions deep in a long prose memory don't
-    // trigger an enabled/disabled flag. The opening window is where a rule or
-    // declaration is typically stated.
-    // Pad with spaces so space-delimited patterns match words at the start/end.
-    const a = ' ' + openingWindow(aText).toLowerCase() + ' ';
-    const b = ' ' + openingWindow(bText).toLowerCase() + ' ';
+// Takes opening windows only, so " on " and " off " as prepositions deep in long prose don't read as enabled/disabled.
+function classifyConflictType(a, b, aPolarity, bPolarity) {
     // Tightened tokens: require whole-word boundaries so " on " alone doesn't
     // match "on/off". Pair only `enabled` ↔ `disabled` and explicit on/off in
     // imperative context.

package/dist/context-auto.d.ts

@@ -0,0 +1,3 @@
+/** A context query from the cwd's git state ('' means `getContext` lists by strength); kept out of the api layer, which never shells out. */
+export declare function autoDetectContext(): string;
+//# sourceMappingURL=context-auto.d.ts.map

package/dist/context-auto.js

@@ -0,0 +1,34 @@
+import { execSync } from 'child_process';
+const SKIPPED_PATH_TERMS = ['src', 'dist', 'test', 'tests', 'node_modules', 'index'];
+/** A context query from the cwd's git state ('' means `getContext` lists by strength); kept out of the api layer, which never shells out. */
+export function autoDetectContext() {
+    try {
+        const diff = execSync('git diff --name-only HEAD 2>&1', {
+            encoding: 'utf8',
+            timeout: 3000,
+            windowsHide: true,
+        }).trim();
+        if (diff) {
+            const terms = diff
+                .split('\n')
+                .flatMap((f) => f.replace(/[/\\.]/g, ' ').split(/\s+/))
+                .filter((t) => t.length > 2 && !SKIPPED_PATH_TERMS.includes(t))
+                .slice(0, 10);
+            if (terms.length > 0)
+                return terms.join(' ');
+        }
+        const branch = execSync('git branch --show-current 2>&1', {
+            encoding: 'utf8',
+            timeout: 3000,
+            windowsHide: true,
+        }).trim();
+        if (branch && branch !== 'main' && branch !== 'master') {
+            return branch.replace(/[-_/]/g, ' ');
+        }
+    }
+    catch {
+        // Not a git repo or git missing: no query, so the caller lists by strength.
+    }
+    return '';
+}
+//# sourceMappingURL=context-auto.js.map

package/dist/customer-notes.js

@@ -19,8 +19,10 @@
  *
  * Lifecycle: active -> superseded (a corrected version) or active -> closed (retired).
  */
+import { BadRequestError, ConflictError, NotFoundError } from './api-errors.js';
 import { openHippoDb, closeHippoDb } from './db.js';
-import { writeEntry, assertTenantId } from './store.js';
+import { writeEntry } from './store.js';
+import { assertTenantId } from './tenant.js';
 import { markGraphDirty, removeGraphEntitiesForObject } from './graph.js';
 import { createMemory, Layer } from './memory.js';
 import { appendAuditEvent } from './audit.js';
@@ -46,21 +48,21 @@ export const MAX_CHANGE_SUMMARY_LEN = 4096;
 function validateNoteFields(customer, note, changeSummary) {
     const normalizedCustomer = (customer ?? '').trim();
     if (normalizedCustomer.length === 0)
-        throw new Error('saveCustomerNote: customer is required');
+        throw new BadRequestError('saveCustomerNote: customer is required');
     if (/[\r\n]/.test(normalizedCustomer)) {
-        throw new Error('saveCustomerNote: customer must be a single line (no newlines)');
+        throw new BadRequestError('saveCustomerNote: customer must be a single line (no newlines)');
     }
     if (normalizedCustomer.length > MAX_CUSTOMER_LEN) {
-        throw new Error(`saveCustomerNote: customer exceeds the ${MAX_CUSTOMER_LEN}-char cap`);
+        throw new BadRequestError(`saveCustomerNote: customer exceeds the ${MAX_CUSTOMER_LEN}-char cap`);
     }
     if (!note || note.trim().length === 0) {
-        throw new Error('saveCustomerNote: note is required');
+        throw new BadRequestError('saveCustomerNote: note is required');
     }
     if (note.length > MAX_NOTE_LEN) {
-        throw new Error(`saveCustomerNote: note exceeds the ${MAX_NOTE_LEN}-char cap`);
+        throw new BadRequestError(`saveCustomerNote: note exceeds the ${MAX_NOTE_LEN}-char cap`);
     }
     if (changeSummary !== undefined && changeSummary.length > MAX_CHANGE_SUMMARY_LEN) {
-        throw new Error(`saveCustomerNote: changeSummary exceeds the ${MAX_CHANGE_SUMMARY_LEN}-char cap`);
+        throw new BadRequestError(`saveCustomerNote: changeSummary exceeds the ${MAX_CHANGE_SUMMARY_LEN}-char cap`);
     }
     return { customer: normalizedCustomer };
 }
@@ -136,10 +138,10 @@ export function saveCustomerNote(hippoRoot, tenantId, opts, actor = 'cli') {
                 // shape for the matching row, or undefined when no note/tenant pair matches.
                 const pred = db.prepare(`SELECT status, version FROM customer_notes WHERE id = ? AND tenant_id = ?`).get(opts.supersedesNoteId, tenantId);
                 if (!pred) {
-                    throw new Error(`saveCustomerNote: note ${opts.supersedesNoteId} to supersede not found for tenant ${tenantId}`);
+                    throw new NotFoundError(`saveCustomerNote: note ${opts.supersedesNoteId} to supersede not found for tenant ${tenantId}`);
                 }
                 if (pred.status !== 'active') {
-                    throw new Error(`saveCustomerNote: note ${opts.supersedesNoteId} is not active (status='${pred.status}'); only active notes can be superseded.`);
+                    throw new ConflictError(`saveCustomerNote: note ${opts.supersedesNoteId} is not active (status='${pred.status}'); only active notes can be superseded.`);
                 }
                 version = pred.version + 1;
             }
@@ -157,7 +159,7 @@ export function saveCustomerNote(hippoRoot, tenantId, opts, actor = 'cli') {
           WHERE id = ? AND tenant_id = ? AND status = 'active' AND id != ?
         `).run(noteId, now, opts.supersedesNoteId, tenantId, noteId);
                 if (sup.changes === 0) {
-                    throw new Error(`saveCustomerNote: note ${opts.supersedesNoteId} could not be superseded (no longer active or self-reference).`);
+                    throw new ConflictError(`saveCustomerNote: note ${opts.supersedesNoteId} could not be superseded (no longer active or self-reference).`);
                 }
                 appendAuditEvent(db, {
                     tenantId,
@@ -220,9 +222,9 @@ export function closeCustomerNote(hippoRoot, tenantId, id, actor = 'cli') {
                 // shape, or undefined when the id/tenant pair doesn't exist.
                 const existing = db.prepare(`SELECT status FROM customer_notes WHERE id = ? AND tenant_id = ?`).get(id, tenantId);
                 if (!existing) {
-                    throw new Error(`closeCustomerNote: note ${id} not found for tenant ${tenantId}`);
+                    throw new NotFoundError(`closeCustomerNote: note ${id} not found for tenant ${tenantId}`);
                 }
-                throw new Error(`closeCustomerNote: note ${id} is not active (status='${existing.status}'); only active notes can be closed.`);
+                throw new ConflictError(`closeCustomerNote: note ${id} is not active (status='${existing.status}'); only active notes can be closed.`);
             }
             // SAFETY: SELECT ${NOTE_COLS} projects exactly the CustomerNoteRow columns;
             // .get() returns that row for the just-updated id, or undefined only in an
@@ -230,7 +232,7 @@ export function closeCustomerNote(hippoRoot, tenantId, id, actor = 'cli') {
             const row = db.prepare(`SELECT ${NOTE_COLS} FROM customer_notes WHERE id = ? AND tenant_id = ?`)
                 .get(id, tenantId);
             if (!row)
-                throw new Error(`closeCustomerNote: note ${id} not found after UPDATE`);
+                throw new NotFoundError(`closeCustomerNote: note ${id} not found after UPDATE`);
             appendAuditEvent(db, {
                 tenantId,
                 actor,
@@ -283,7 +285,7 @@ export function loadCustomerNotes(hippoRoot, tenantId, opts = {}) {
     assertTenantId('loadCustomerNotes', tenantId);
     const limit = opts.limit ?? 100;
     if (opts.status && !VALID_NOTE_STATES.has(opts.status)) {
-        throw new Error(`loadCustomerNotes: status must be one of ${Array.from(VALID_NOTE_STATES).join('|')}; got ${opts.status}`);
+        throw new BadRequestError(`loadCustomerNotes: status must be one of ${Array.from(VALID_NOTE_STATES).join('|')}; got ${opts.status}`);
     }
     const db = openHippoDb(hippoRoot);
     try {

package/dist/dag.js

@@ -2,6 +2,7 @@ import { createMemory, Layer } from './memory.js';
 import { writeEntry, loadAllDirtySummaries, loadChildrenOfSummary, applyRebuildResult, clearSummaryDirtyAfterBuild, } from './store.js';
 import { RejectedValueError } from './rejection.js';
 import { redactSecrets } from './secret-detect.js';
+import { fetchWithRetry, llmTimeoutMs } from './http-retry.js';
 import { derivationScope, derivationPartitionKey } from './recall-scope.js';
 import { loadConfig } from './config.js';
 import { neverAutoShareTags } from './shared.js';
@@ -52,7 +53,7 @@ export async function generateDagSummary(label, factContents, opts) {
         .replace('{facts}', factsBlock);
     let res;
     try {
-        res = await fetchFn('https://api.anthropic.com/v1/messages', {
+        res = await fetchWithRetry('https://api.anthropic.com/v1/messages', {
             method: 'POST',
             headers: {
                 'content-type': 'application/json',
@@ -64,7 +65,7 @@ export async function generateDagSummary(label, factContents, opts) {
                 max_tokens: 400,
                 messages: [{ role: 'user', content: prompt }],
             }),
-        });
+        }, { timeoutMs: llmTimeoutMs(), fetchFn });
     }
     catch (err) {
         opts.onError?.(`request failed: ${err instanceof Error ? err.message : String(err)}`);

package/dist/dashboard.js

@@ -9,7 +9,8 @@ import * as os from 'os';
 import * as path from 'path';
 import * as fs from 'fs';
 import { extractPathTags } from './path-context.js';
-import { loadAllEntries, listCards, listMemoryConflicts, readEntry, writeEntry } from './store.js';
+import { loadAllEntries, listMemoryConflicts, readEntry, writeEntry } from './store.js';
+import { listCards } from './store-cards.js';
 import { calculateStrength, confidenceFacets } from './memory.js';
 import { loadConfig } from './config.js';
 import { listPeers } from './shared.js';
@@ -28,7 +29,7 @@ function buildDashboardData(hippoRoot) {
     // render resolved conflicts as faded historical context, not just open
     // conflicts. The open_conflicts stat below still counts only 'open' rows
     // to preserve the existing badge meaning.
-    const conflicts = listMemoryConflicts(hippoRoot, '*');
+    const conflicts = listMemoryConflicts(hippoRoot, '*', tenantId);
     // D4 v1.12.10: tenant-scope peer discovery in the dashboard (matches the
     // tenantId already used for loadAllEntries on line 72).
     const peers = listPeers(undefined, tenantId);

package/dist/db.d.ts

@@ -10,6 +10,8 @@ export interface DatabaseSyncLike {
     exec(sql: string): void;
     prepare(sql: string): StatementSyncLike;
     close(): void;
+    readonly isOpen?: boolean;
+    readonly isTransaction?: boolean;
 }
 export declare function getHippoDbPath(hippoRoot: string): string;
 export declare function getCurrentSchemaVersion(): number;
@@ -17,6 +19,16 @@ export declare function getCurrentSchemaVersion(): number;
 export declare class IncompatibleBinaryError extends Error {
 }
 export declare function isSqliteBusy(error: unknown): boolean;
+export declare function execWithBusyRetry(db: DatabaseSyncLike, sql: string, timeoutMs?: number): void;
+/** Lock wait for hook commands: under the 5 s prompt-hook budget even after a few skipped writes, and far above a normal write's hold. */
+export declare const HOOK_DB_WAIT_MS = 1000;
+/** A busy store made a command skip work: warn once per process (the holder is usually `hippo sleep`). */
+export declare function noteStoreBusy(skipped: string): void;
+/** Runs `fn` with one handle per store: openHippoDb reuses it and closeHippoDb leaves it open until `fn` settles or the process exits.
+ *  `busyWaitMs` is the lock wait of every open inside `fn` that does not pass its own. */
+export declare function withSharedStoreHandles<T>(fn: () => T | Promise<T>, opts?: {
+    busyWaitMs?: number;
+}): Promise<T>;
 /** `busyWaitMs` shortens every lock wait of this open, for a hook that must finish inside its own timeout. */
 export declare function openHippoDb(hippoRoot: string, opts?: {
     busyWaitMs?: number;