hippo-memory 1.57.0 → 1.58.0

package/dist/capture.js

@@ -25,6 +25,7 @@ import { RejectedValueError, checkRejectionGuard } from './rejection.js';
 import { openHippoDb, closeHippoDb } from './db.js';
 import { loadConfig } from './config.js';
 import { classifyOriginProject } from './project-identity.js';
+import { isObjectLike, isStringValue, readClaudeCodePreCompact } from './capture-contract.js';
 // Sentence-level patterns
 //
 // T1 (DF2): each pattern now carries TWO capture groups — group 1 is the
@@ -471,23 +472,6 @@ export function extractFromText(text) {
     }
     return items;
 }
-/**
- * Runtime shape guards used throughout this file wherever a value arrives
- * unparsed (JSONL transcript records, stdout/stderr write() chunks). Generic
- * over the input so the parameter is never annotated `unknown` directly — TS
- * infers it from the call site — while the check itself avoids `typeof` by
- * testing identity against the coercion (`String(x) === x`) /
- * prototype-chain (`instanceof Object`) instead. Behaviourally equivalent to
- * `typeof x === 'string'` / a truthy `typeof x === 'object'` check for
- * anything `JSON.parse` can produce (the only divergence is boxed
- * primitives, which JSON.parse never yields).
- */
-export function isStringValue(value) {
-    return String(value) === value;
-}
-export function isObjectLike(value) {
-    return value !== null && value instanceof Object;
-}
 /** Message for a caught value of unknown shape. `cause` names the sanctioned unknown-input case (error-cause enrichment). */
 export function errorMessage(cause) {
     return cause instanceof Error ? cause.message : String(cause);
@@ -1161,57 +1145,12 @@ function runPreCompact(hippoRoot, stdinText, stdinTimedOut, logFile) {
         appendPreCompactLog(logFile, 'skip: store not initialized');
         return;
     }
-    // Same hazard X4 guards below, different trigger: a read that timed out
-    // must not reach auto-discovery either, or it snapshots another session.
-    if (stdinTimedOut && (!stdinText || stdinText.trim() === '')) {
-        appendPreCompactLog(logFile, 'skip: no PreCompact payload arrived before the stdin wait window closed');
-        return;
-    }
-    // A true manual invocation has no stdin at all (TTY, or a non-TTY pipe
-    // that yielded an empty read) — that's the ONLY case newest-transcript
-    // auto-discovery is allowed to run. Any other non-empty stdin must
-    // JSON-parse to an object carrying a string transcript_path, or it is
-    // treated as malformed input and skipped (X4) rather than silently
-    // falling back to discovery, which could snapshot an unrelated session's
-    // transcript under this payload's session_id.
-    const manualInvocation = !stdinText || stdinText.trim() === '';
-    let sessionId = null;
-    let payloadTranscriptPath = null;
-    let payloadCwd = null;
-    let payloadTrigger = null;
-    if (!manualInvocation) {
-        let payload;
-        try {
-            payload = JSON.parse(stdinText.trim());
-        }
-        catch {
-            // payload stays undefined; the isObjectLike check below rejects it
-            // the same way it would reject an explicit null.
-        }
-        if (!isObjectLike(payload) || !('transcript_path' in payload) || !isStringValue(payload.transcript_path)) {
-            // Covers non-JSON stdin, a JSON value that isn't an object, and
-            // `"transcript_path": null` (or the key missing entirely) — all fail
-            // the string check. Log and skip; never fall through to auto-discovery.
-            appendPreCompactLog(logFile, 'skip: malformed or incomplete PreCompact payload (missing string transcript_path)');
-            return;
-        }
-        if ('session_id' in payload && isStringValue(payload.session_id))
-            sessionId = payload.session_id;
-        payloadTranscriptPath = payload.transcript_path;
-        payloadCwd = 'cwd' in payload && isStringValue(payload.cwd) ? payload.cwd : null;
-        payloadTrigger = 'trigger' in payload && isStringValue(payload.trigger) ? payload.trigger : null;
-    }
-    // X11: payload transcript_path must end .jsonl. No directory-containment
-    // check is applied on top of this — CLAUDE_CONFIG_DIR can relocate the
-    // transcript root entirely, so a path-prefix allowlist would just reject
-    // legitimate relocated installs. The trust boundary here is process
-    // identity, not path shape: a local process able to feed this hook
-    // arbitrary stdin already runs as the same user who owns every transcript
-    // this check could gate on, so containment buys no real isolation.
-    if (payloadTranscriptPath !== null && !/\.jsonl$/i.test(payloadTranscriptPath)) {
-        appendPreCompactLog(logFile, `skip: payload transcript_path is not a .jsonl file: ${payloadTranscriptPath}`);
+    const receipt = readClaudeCodePreCompact(stdinText, stdinTimedOut);
+    if (receipt.status !== 'received') {
+        appendPreCompactLog(logFile, `skip: ${receipt.reason}`);
         return;
     }
+    const { sessionId, transcriptPath: payloadTranscriptPath, cwd: payloadCwd, trigger: payloadTrigger } = receipt.input;
     // The record is the "something saved before every compaction", so it lands even when no snapshot is derivable below.
     let recordId = null;
     if (sessionId !== null && sessionId !== '') {

package/dist/cli/shared.js

@@ -10,7 +10,7 @@ import { RejectedValueError } from '../rejection.js';
 import { explainMatch } from '../search.js';
 import { embedMemory } from '../embeddings.js';
 import { loadConfig } from '../config.js';
-import { openHippoDb, closeHippoDb } from '../db.js';
+import { openHippoDb, closeHippoDb, isSqliteBusy, noteStoreBusy } from '../db.js';
 import { hookPayloadSessionId, isSubagentPayload, recordTokenUse } from '../token-ledger.js';
 import { isGitRepo, fetchGitLog, extractLessons, partitionLessons } from '../autolearn.js';
 import { storedTextKeys, duplicateKey } from '../same-text.js';
@@ -22,7 +22,7 @@ import { extractPathTags } from '../path-context.js';
 import { getGlobalRoot, initGlobal } from '../shared.js';
 import { DAILY_TASK_NAME, buildDailyRunnerCommand, buildSchtasksCreateArgs, buildWindowsTaskRun } from '../scheduler.js';
 import { sanitizeLogMessage } from '../capture.js';
-import { appendAuditEvent } from '../audit.js';
+import { appendAuditEvent, reportAuditWriteFailure } from '../audit.js';
 import { createHash } from 'node:crypto';
 import * as client from '../client.js';
 import { detectServer, removePidfileIfOwned } from '../server-detect.js';
@@ -77,8 +77,9 @@ export function emitCliAudit(hippoRoot, op, targetId, metadata) {
             closeHippoDb(db);
         }
     }
-    catch {
-        // Audit is best-effort; surface failures only via missing rows.
+    catch (error) {
+        // Best effort: the command already did its work.
+        reportAuditWriteFailure(op, String(error), targetId);
     }
 }
 export function requireInit(hippoRoot) {
@@ -158,7 +159,7 @@ export async function runViaServerIfAvailable(hippoRoot, httpFn) {
             // Every caller of this helper is a non-idempotent write, so replaying on
             // the direct path would store a row the server may already have committed.
             // Leave the pidfile alone: the next command's connect-phase failure heals it.
-            console.error(`hippo: the connection to ${info.url} dropped mid-request, so the write may already have been applied. Not retrying locally. Check with \`hippo recall\` before running this again.`);
+            console.error(`hippo: the connection to ${info.url} dropped or timed out mid-request, so the write may already have been applied. Not retrying locally. Check with \`hippo recall\` before running this again.`);
             process.exit(1);
         }
         throw err;
@@ -485,7 +486,10 @@ export function withLedgerDb(hippoRoot, fn) {
         db = openHippoDb(root);
         return fn(db);
     }
-    catch {
+    catch (error) {
+        // Best effort, but a busy store is the one failure an operator can act on, so it warns once.
+        if (isSqliteBusy(error))
+            noteStoreBusy('token ledger row skipped');
         return undefined;
     }
     finally {

package/dist/cli.js

@@ -59,7 +59,8 @@ import { resolveEmbeddingProvider } from './embedding-provider.js';
 import { loadPhysicsState, resetAllPhysicsState } from './physics-state.js';
 import { computeSystemEnergy, vecNorm } from './physics.js';
 import { loadConfig } from './config.js';
-import { openHippoDb, closeHippoDb } from './db.js';
+import { ensurePilotArm, hashArm, readPilotArm } from './pilot-arm.js';
+import { openHippoDb, closeHippoDb, withSharedStoreHandles, HOOK_DB_WAIT_MS, isSqliteBusy, noteStoreBusy } from './db.js';
 import { runDoctor, formatDoctor } from './doctor.js';
 import { buildSupportBundle, TAIL_MAX_LINES } from './support-bundle.js';
 import { PACKAGE_VERSION } from './version.js';
@@ -88,6 +89,7 @@ import { listApiKeys } from './auth.js';
 import { buildProvenanceCoverage } from './provenance-coverage.js';
 import { buildCorrectionLatency } from './correction-latency.js';
 import * as api from './api.js';
+import { vetSecrets } from './secret-detect.js';
 import * as predictionsModule from './predictions.js';
 import { computePlanningFallacyOutput } from './predictions.js';
 import * as decisionsModule from './decisions.js';
@@ -695,6 +697,8 @@ async function cmdRemember(hippoRoot, text, flags) {
         console.log(`   Tags: ${entry.tags.join(', ')}`);
     if (entry.pinned)
         console.log('   Pinned (no decay)');
+    for (const w of vetSecrets(entry.content, entry.tags, false).warnings)
+        console.error(`Warning: ${w}`);
     void embedMemory(targetRoot, entry);
     const config = loadConfig(targetRoot);
     const shouldExtract = flags['extract'] || config.extraction.enabled === true;
@@ -1908,6 +1912,10 @@ function cmdCompactResume(hippoRoot, stdinText, stdinTimedOut) {
                 }
             }
         }
+        // A compaction follows a prompt or SessionStart that booked the arm, so this only reads it.
+        if (!suppressOutput && payloadSessionId !== null && inPilotHoldout(hippoRoot, resolveTenantId({}), payloadSessionId, false)) {
+            suppressOutput = true;
+        }
         if (!suppressOutput) {
             const tenantId = resolveTenantId({});
             const snapshot = loadFreshActiveTaskSnapshot(hippoRoot, tenantId, { maxAgeMs: COMPACT_RESUME_MAX_AGE_MS });
@@ -5191,6 +5199,18 @@ function cmdCurrent(hippoRoot, args, flags) {
     console.error('Usage: hippo current <show>');
     process.exit(1);
 }
+/** Hook commands share one handle per store and wait at most HOOK_DB_WAIT_MS for a lock; a store still busy after that skips the hook's work with one warning, exit 0. */
+async function runHookWithStores(fn) {
+    try {
+        return await withSharedStoreHandles(fn, { busyWaitMs: HOOK_DB_WAIT_MS });
+    }
+    catch (error) {
+        if (!isSqliteBusy(error))
+            throw error;
+        noteStoreBusy('hook skipped');
+        return undefined;
+    }
+}
 async function cmdContext(hippoRoot, args, flags, stdinText) {
     const rec = startDeliveryRecorder(hippoRoot, flags, stdinText);
     // No try/finally: a render throw keeps its own exit code and writes no event.
@@ -5231,6 +5251,22 @@ function flushDeliveryRecorder(rec, db) {
         console.error(`[hippo] delivery ledger write failed: ${error instanceof Error ? error.message : String(error)}`);
     }
 }
+/**
+ * Whether this session sits in the pilot's holdout arm (src/pilot-arm.ts). Off at rate 0 and with no session id.
+ * `write` books the arm row; a read-only caller (env-only id, sub-agent) follows the stored arm, else the hash.
+ */
+function inPilotHoldout(hippoRoot, tenantId, sessionId, write) {
+    if (sessionId === undefined || sessionId.trim() === '')
+        return false;
+    const root = isInitialized(hippoRoot) ? hippoRoot : isInitialized(getGlobalRoot()) ? getGlobalRoot() : null;
+    if (root === null)
+        return false;
+    const rate = loadConfig(root).pilot.holdoutRateBp;
+    if (rate <= 0)
+        return false;
+    const arm = withLedgerDb(hippoRoot, (db) => write ? ensurePilotArm(db, tenantId, sessionId, rate) : readPilotArm(db, sessionId) ?? hashArm(sessionId, rate));
+    return (arm ?? hashArm(sessionId, rate)) === 'holdout';
+}
 async function renderContext(hippoRoot, args, flags, stdinText, rec) {
     // --pinned-only fires on every UserPromptSubmit — including in directories
     // that don't have a local .hippo. Skip requireInit for that path and fall
@@ -5240,30 +5276,6 @@ async function renderContext(hippoRoot, args, flags, stdinText, rec) {
     if (!pinnedOnly) {
         requireInit(hippoRoot);
     }
-    const budget = parseBudgetFlag(flags['budget'], 1500);
-    if (budget <= 0) {
-        rec?.disabled();
-        return;
-    }
-    // Resolve query: explicit args, --auto (git diff via CLI-side helper), or
-    // fall through to api.getContext's '*' fallback. api.getContext is host-
-    // agnostic so the auto-detect (which shells out to git) stays CLI-side.
-    let query = args.join(' ').trim();
-    if (!query && flags['auto']) {
-        query = autoDetectContext();
-    }
-    // Scope detection (CLI-side: uses cwd). api.getContext takes the resolved
-    // scope via opts.scope to stay host-agnostic.
-    const ctxExplicitScope = flags['scope'] !== undefined ? String(flags['scope']).trim() : null;
-    const ctxActiveScope = ctxExplicitScope || detectScope();
-    const ctx = {
-        hippoRoot,
-        tenantId: resolveTenantId({}),
-        actor: api.adminActor('cli'),
-    };
-    // v39 memory scope isolation: --cross-project re-includes other-project
-    // memories (rendered under a demarcated section below).
-    const crossProject = flags['cross-project'] === true;
     // DF1 T2: resolve the calling session's id for the bounded active-task-
     // snapshot read (api.getContext -> loadFreshActiveTaskSnapshot). Stdin
     // payload (the UserPromptSubmit hook JSON) wins; falls back to
@@ -5291,6 +5303,36 @@ async function renderContext(hippoRoot, args, flags, stdinText, rec) {
     const ledgerSessionId = subagent ? undefined : currentSessionId;
     if (subagent)
         payloadSessionId = undefined;
+    // The pilot arm is booked at the first hook call whatever the flags, so the holdout sees no budget or content branch.
+    const resolvedTenant = resolveTenantId({});
+    if (inPilotHoldout(hippoRoot, resolvedTenant, currentSessionId, payloadSessionId !== undefined)) {
+        rec?.disabled();
+        return;
+    }
+    const budget = parseBudgetFlag(flags['budget'], 1500);
+    if (budget <= 0) {
+        rec?.disabled();
+        return;
+    }
+    // Resolve query: explicit args, --auto (git diff via CLI-side helper), or
+    // fall through to api.getContext's '*' fallback. api.getContext is host-
+    // agnostic so the auto-detect (which shells out to git) stays CLI-side.
+    let query = args.join(' ').trim();
+    if (!query && flags['auto']) {
+        query = autoDetectContext();
+    }
+    // Scope detection (CLI-side: uses cwd). api.getContext takes the resolved
+    // scope via opts.scope to stay host-agnostic.
+    const ctxExplicitScope = flags['scope'] !== undefined ? String(flags['scope']).trim() : null;
+    const ctxActiveScope = ctxExplicitScope || detectScope();
+    const ctx = {
+        hippoRoot,
+        tenantId: resolvedTenant,
+        actor: api.adminActor('cli'),
+    };
+    // v39 memory scope isolation: --cross-project re-includes other-project
+    // memories (rendered under a demarcated section below).
+    const crossProject = flags['cross-project'] === true;
     const format = String(flags['format'] ?? 'markdown');
     const framing = String(flags['framing'] ?? 'observe');
     const opts = {
@@ -5448,7 +5490,10 @@ async function renderContext(hippoRoot, args, flags, stdinText, rec) {
                             items: staticItems.length, tokens: estimateTokens(finalStatic), hash: blockHash(finalStatic),
                         });
                     }
-                    catch { /* best effort; see withLedgerDb doc comment */ }
+                    catch (error) {
+                        if (isSqliteBusy(error))
+                            noteStoreBusy('token ledger row skipped');
+                    }
                 }
                 if (recallBlock) {
                     try {
@@ -5457,7 +5502,10 @@ async function renderContext(hippoRoot, args, flags, stdinText, rec) {
                             items: recallItems.length, tokens: estimateTokens(recallBlock), hash: blockHash(recallBlock),
                         });
                     }
-                    catch { /* best effort; see withLedgerDb doc comment */ }
+                    catch (error) {
+                        if (isSqliteBusy(error))
+                            noteStoreBusy('token ledger row skipped');
+                    }
                 }
                 flushDeliveryRecorder(rec, db);
             });
@@ -5678,6 +5726,10 @@ function cmdLearn(hippoRoot, flags) {
 // ---------------------------------------------------------------------------
 // Import command
 // ---------------------------------------------------------------------------
+function warnRedacted(count) {
+    if (count)
+        console.error(`Warning: secret-shaped text was redacted from ${count} imported ${count === 1 ? 'entry' : 'entries'} before storing`);
+}
 function cmdImport(hippoRoot, args, flags) {
     const useGlobal = Boolean(flags['global']);
     const dryRun = Boolean(flags['dry-run']);
@@ -5758,6 +5810,7 @@ function cmdImport(hippoRoot, args, flags) {
         if ((vaultResult.rejected ?? 0) > 0) {
             console.log(`  Rejected (tombstoned): ${vaultResult.rejected}`);
         }
+        warnRedacted(vaultResult.redacted);
         console.log(`  ${dryRun ? 'Would archive:        ' : 'Archived (removed):   '}${vaultResult.archived ?? 0}`);
         console.log(`  Store:                 ${hippoRoot}`);
         // Batch producer, same contract as the single-file import below: vault rows
@@ -5829,6 +5882,7 @@ function cmdImport(hippoRoot, args, flags) {
     if ((result.rejected ?? 0) > 0) {
         console.log(`  Rejected (tombstoned): ${result.rejected}`);
     }
+    warnRedacted(result.redacted);
     if (dryRun) {
         console.log('\n  (dry run - nothing written)');
         if (result.entries.length > 0) {
@@ -7922,6 +7976,8 @@ async function main(command, args, flags, hippoRoot) {
                         });
                         console.log(`Remembered [${result.id}] (via ${info.url})`);
                         console.log(`   Kind: ${result.kind} | Tenant: ${result.tenantId}`);
+                        for (const w of result.warnings ?? [])
+                            console.error(`Warning: ${w}`);
                     });
                     if (remembered)
                         break;
@@ -8012,11 +8068,13 @@ async function main(command, args, flags, hippoRoot) {
         case 'pre-compact': {
             // Bounded wait, not a TTY guard: an idle non-TTY pipe must not hang.
             const { text: stdinText, timedOut: stdinTimedOut } = await readStdinBounded();
-            resetHookInjection(hippoRoot, stdinText, null);
-            await cmdPreCompact(hookStoreRoot(hippoRoot), {
-                stdinText,
-                stdinTimedOut,
-                logFile: typeof flags['log-file'] === 'string' ? flags['log-file'] : undefined,
+            await runHookWithStores(async () => {
+                resetHookInjection(hippoRoot, stdinText, null);
+                await cmdPreCompact(hookStoreRoot(hippoRoot), {
+                    stdinText,
+                    stdinTimedOut,
+                    logFile: typeof flags['log-file'] === 'string' ? flags['log-file'] : undefined,
+                });
             });
             break;
         }
@@ -8025,7 +8083,7 @@ async function main(command, args, flags, hippoRoot) {
             const { text } = await readStdinBounded();
             const logFlag = flags['log-file'];
             const store = hookStoreRoot(hippoRoot);
-            const line = cmdPostCompact(store, {
+            const line = await runHookWithStores(() => cmdPostCompact(store, {
                 stdinText: text,
                 logFile: logFlag === true || logFlag === false || Array.isArray(logFlag) ? undefined : logFlag,
                 // Passed in, since capture.ts importing the sync would close an import cycle.
@@ -8037,8 +8095,8 @@ async function main(command, args, flags, hippoRoot) {
                     for (const warning of report.warnings)
                         log(`agent memories: ${warning}`);
                 },
-            });
-            if (line !== null)
+            }));
+            if (line !== null && line !== undefined)
                 console.log(line);
             break;
         }
@@ -8051,7 +8109,8 @@ async function main(command, args, flags, hippoRoot) {
                 const payload = (text ?? '').trim();
                 if (isInitialized(root) && payload) {
                     // SAFETY: JSON.parse returns a JSON value by definition.
-                    captureToolFailure(root, resolveTenantId({}), JSON.parse(payload));
+                    const failure = JSON.parse(payload);
+                    await runHookWithStores(() => captureToolFailure(root, resolveTenantId({}), failure));
                 }
             }
             catch {
@@ -8061,8 +8120,10 @@ async function main(command, args, flags, hippoRoot) {
         }
         case 'compact-resume': {
             const { text: stdinText, timedOut: stdinTimedOut } = await readStdinBounded();
-            resetHookInjection(hippoRoot, stdinText, 'compact');
-            cmdCompactResume(hookStoreRoot(hippoRoot), stdinText, stdinTimedOut);
+            await runHookWithStores(() => {
+                resetHookInjection(hippoRoot, stdinText, 'compact');
+                cmdCompactResume(hookStoreRoot(hippoRoot), stdinText, stdinTimedOut);
+            });
             break;
         }
         case 'codex-run':
@@ -8337,7 +8398,7 @@ async function main(command, args, flags, hippoRoot) {
             // Bounded, not a TTY guard (DF1 T2, docs/plans/2026-08-23-df1-snapshot-lifecycle.md):
             // the hot stdin path and a manual run share this one command.
             const { text: stdinText } = await readStdinBounded();
-            await cmdContext(hookStoreRoot(hippoRoot), args, flags, stdinText);
+            await runHookWithStores(() => cmdContext(hookStoreRoot(hippoRoot), args, flags, stdinText));
             break;
         }
         case 'hook':

package/dist/client.js

@@ -13,6 +13,8 @@
  * Network errors (ECONNREFUSED on a stale pidfile, etc.) propagate as the
  * native fetch failure so the caller can detect them and self-heal.
  */
+/** A write the local server has not answered in this long is stuck; the caller treats it as delivery-unknown. */
+const SERVER_TIMEOUT_MS = 30_000;
 function buildHeaders(apiKey, withBody) {
     const headers = {};
     if (withBody)
@@ -58,6 +60,7 @@ export async function remember(serverUrl, apiKey, opts) {
     const res = await fetch(`${serverUrl}/v1/memories`, {
         method: 'POST',
         headers: buildHeaders(apiKey, true),
+        signal: AbortSignal.timeout(SERVER_TIMEOUT_MS),
         body: JSON.stringify(opts),
     });
     if (!res.ok)
@@ -69,6 +72,7 @@ export async function forget(serverUrl, apiKey, id) {
     const res = await fetch(`${serverUrl}/v1/memories/${encodeURIComponent(id)}`, {
         method: 'DELETE',
         headers: buildHeaders(apiKey, false),
+        signal: AbortSignal.timeout(SERVER_TIMEOUT_MS),
     });
     if (!res.ok)
         await throwForStatus(res);
@@ -79,6 +83,7 @@ export async function promote(serverUrl, apiKey, id) {
     const res = await fetch(`${serverUrl}/v1/memories/${encodeURIComponent(id)}/promote`, {
         method: 'POST',
         headers: buildHeaders(apiKey, false),
+        signal: AbortSignal.timeout(SERVER_TIMEOUT_MS),
     });
     if (!res.ok)
         await throwForStatus(res);
@@ -89,6 +94,7 @@ export async function archiveRaw(serverUrl, apiKey, id, reason) {
     const res = await fetch(`${serverUrl}/v1/memories/${encodeURIComponent(id)}/archive`, {
         method: 'POST',
         headers: buildHeaders(apiKey, true),
+        signal: AbortSignal.timeout(SERVER_TIMEOUT_MS),
         body: JSON.stringify({ reason }),
     });
     if (!res.ok)
@@ -123,6 +129,9 @@ export function classifyTransportFailure(err) {
     }
     if (message.includes('socket hang up') || message.includes('fetch failed'))
         return 'delivery-unknown';
+    // The request was sent and the server went quiet, so it may have committed.
+    if (err.name === 'TimeoutError')
+        return 'delivery-unknown';
     return 'none';
 }
 //# sourceMappingURL=client.js.map

package/dist/codex-patch.js

@@ -1,7 +1,7 @@
 // Files named by a Codex apply_patch call, read the way openai/codex codex-rs/apply-patch reads them
 // (parser.rs for the body, invocation.rs for the shell forms it runs as apply_patch).
 import * as path from 'path';
-import { isStringValue } from './capture.js';
+import { isStringValue } from './capture-contract.js';
 /** Codex prints this line only when a patch applied (apply-patch lib.rs). */
 export const PATCH_SUCCESS_LINE = 'Success. Updated the following files:';
 const BEGIN_PATCH = '*** Begin Patch';

package/dist/compaction-record.d.ts

@@ -2,7 +2,7 @@ import { type DatabaseSyncLike } from './db.js';
 /** PostCompact has 10 s in all (PreCompact 30 s), so a locked store must be given up on early. */
 export declare const COMPACTION_DB_WAIT_MS = 2000;
 /** Tested verbatim: Claude Code hands PreCompact stdout to the summariser as instructions. */
-export declare const PRE_COMPACT_INSTRUCTION = "In your summary, add a last section titled 'Memories for hippo'. List, one per line starting with '- ', each lesson learned, decision made (with its reason) and correction the user gave in this session that should outlive it. Write each as a standalone sentence that names its subject. Leave out anything an earlier summary already listed under 'Memories for hippo'. Write '- none' if nothing new remains.";
+export declare const PRE_COMPACT_INSTRUCTION = "In your summary, add a last section titled 'Memories for hippo'. List, one per line starting with '- ', each lesson learned, decision made (with its reason) and correction the user gave in this session that should outlive it. Write each as a standalone sentence that names its subject. Leave out anything an earlier summary already listed under 'Memories for hippo', and anything this session already saved with `hippo remember`. Write '- none' if nothing new remains.";
 /** Long enough that a live hook has finished with its own record. */
 export declare const REPLAY_AFTER_MS: number;
 /** Claude Code deletes transcripts after 30 days, so an older gap can never be filled. */

package/dist/compaction-record.js

@@ -1,7 +1,8 @@
 // One record per Claude Code compaction, and what turns its summary into kept memories.
 import * as fs from 'fs';
 import * as path from 'path';
-import { errorMessage, isObjectLike, isStringValue, readTranscriptTail, truncateCodePointSafe } from './capture.js';
+import { errorMessage, readTranscriptTail, truncateCodePointSafe } from './capture.js';
+import { isObjectLike, isStringValue } from './capture-contract.js';
 import { compactSummaryBody, parseCompactionItems, selectItemRows } from './compaction-items.js';
 import { loadConfig } from './config.js';
 import { closeHippoDb, isSqliteBusy, openHippoDb } from './db.js';
@@ -14,7 +15,7 @@ import { resolveTenantId } from './tenant.js';
 /** PostCompact has 10 s in all (PreCompact 30 s), so a locked store must be given up on early. */
 export const COMPACTION_DB_WAIT_MS = 2000;
 /** Tested verbatim: Claude Code hands PreCompact stdout to the summariser as instructions. */
-export const PRE_COMPACT_INSTRUCTION = "In your summary, add a last section titled 'Memories for hippo'. List, one per line starting with '- ', each lesson learned, decision made (with its reason) and correction the user gave in this session that should outlive it. Write each as a standalone sentence that names its subject. Leave out anything an earlier summary already listed under 'Memories for hippo'. Write '- none' if nothing new remains.";
+export const PRE_COMPACT_INSTRUCTION = "In your summary, add a last section titled 'Memories for hippo'. List, one per line starting with '- ', each lesson learned, decision made (with its reason) and correction the user gave in this session that should outlive it. Write each as a standalone sentence that names its subject. Leave out anything an earlier summary already listed under 'Memories for hippo', and anything this session already saved with `hippo remember`. Write '- none' if nothing new remains.";
 const SUMMARY_MAX_CHARS = 256 * 1024;
 /** Long enough that a live hook has finished with its own record. */
 export const REPLAY_AFTER_MS = 10 * 60_000;

package/dist/config.d.ts

@@ -145,6 +145,11 @@ export interface HippoConfig {
     deliveryLedger: {
         enabled: boolean;
     };
+    /** Pilot holdout (src/pilot-arm.ts): share of sessions, in basis points 0-10000, that get no memories pushed.
+     *  Default 0 = off. Read from the store the token ledger writes to. */
+    pilot: {
+        holdoutRateBp: number;
+    };
 }
 export declare function loadConfig(hippoRoot: string): HippoConfig;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.js

@@ -88,6 +88,9 @@ const DEFAULT_CONFIG = {
     deliveryLedger: {
         enabled: false,
     },
+    pilot: {
+        holdoutRateBp: 0,
+    },
 };
 function isMemoryValueConfig(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
@@ -115,6 +118,19 @@ function deliveryLedgerEnabled(value) {
         `(got ${JSON.stringify(value)}) - using false.`);
     return false;
 }
+// Only an integer 0..10000 counts; anything else warns and turns the pilot off.
+function pilotHoldoutRate(value) {
+    if (value === undefined)
+        return 0;
+    const rate = value?.holdoutRateBp;
+    if (rate === undefined && value !== null && value.constructor === Object)
+        return 0;
+    if (Number.isInteger(rate) && rate >= 0 && rate <= 10000)
+        return rate;
+    console.error(`Warning: config.json's "pilot" must be an object like {"holdoutRateBp": 2000}, an integer from 0 to 10000 ` +
+        `(got ${JSON.stringify(value)}) - using 0 (pilot off).`);
+    return 0;
+}
 function agentMemoryTools(value) {
     if (value === undefined || value === null)
         return null;
@@ -226,6 +242,7 @@ export function loadConfig(hippoRoot) {
             },
             agentMemories: { tools: agentMemoryTools(raw.agentMemories?.tools) },
             deliveryLedger: { enabled: deliveryLedgerEnabled(raw.deliveryLedger) },
+            pilot: { holdoutRateBp: pilotHoldoutRate(raw.pilot) },
         };
     }
     catch (err) {

package/dist/connectors/github/dlq.js

@@ -1,13 +1,16 @@
 import { openHippoDb, closeHippoDb } from '../../db.js';
 import { verifyGitHubSignature } from './signature.js';
 import { isGitHubWebhookEnvelope } from './types.js';
+import { redactPayload, DLQ_REDACTED_NOTE } from '../../secret-detect.js';
 export function writeToDlq(db, opts) {
+    const rawPayload = redactPayload(opts.rawPayload);
+    const redacted = rawPayload !== opts.rawPayload;
     const result = db
         .prepare(`INSERT INTO github_dlq
         (tenant_id, raw_payload, error, event_name, delivery_id, signature,
          installation_id, repo_full_name, received_at, bucket)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-        .run(opts.tenantId ?? '__unroutable__', opts.rawPayload, opts.error, opts.eventName ?? null, opts.deliveryId ?? null, opts.signature ?? null, opts.installationId ?? null, opts.repoFullName ?? null, new Date().toISOString(), opts.bucket ?? 'parse_error');
+        .run(opts.tenantId ?? '__unroutable__', rawPayload, redacted ? `${opts.error}; ${DLQ_REDACTED_NOTE}` : opts.error, opts.eventName ?? null, opts.deliveryId ?? null, redacted ? null : opts.signature ?? null, opts.installationId ?? null, opts.repoFullName ?? null, new Date().toISOString(), opts.bucket ?? 'parse_error');
     return Number(result.lastInsertRowid);
 }
 const SELECT_COLUMNS = `id, tenant_id, raw_payload, error, event_name, delivery_id,
@@ -107,7 +110,7 @@ export async function replayDlqEntry(ctx, id, opts = {}) {
                 status: 'sig_missing',
                 memoryId: null,
                 retryCount: row.retryCount,
-                reason: 'legacy row without signature; pass --force to replay',
+                reason: 'row has no signature (legacy, or redacted before storing); pass --force to replay',
             };
         }
         const sigOk = verifyGitHubSignature({

package/dist/connectors/github/octokit-client.js

@@ -10,6 +10,7 @@
  * operator signal, so this code path is now load-bearing.
  */
 import { parseRateLimit } from './ratelimit.js';
+import { fetchWithRetry } from '../../http-retry.js';
 export class GitHubFetchError extends Error {
     status;
     bodyExcerpt;
@@ -42,14 +43,15 @@ function headersToRecord(h) {
     });
     return Object.fromEntries(entries);
 }
+const GITHUB_TIMEOUT_MS = 30_000;
 export const realGitHubFetcher = async ({ url, token }) => {
-    const res = await fetch(url, {
+    const res = await fetchWithRetry(url, {
         headers: {
             Authorization: `Bearer ${token}`,
             Accept: 'application/vnd.github+json',
             'X-GitHub-Api-Version': '2022-11-28',
         },
-    });
+    }, { timeoutMs: GITHUB_TIMEOUT_MS });
     const headers = headersToRecord(res.headers);
     const rateLimit = parseRateLimit(headers, res.status);
     // Codex P1 #4: don't silently turn 401/403/404/500 into empty pages.

package/dist/connectors/slack/dlq.js

@@ -5,12 +5,16 @@ import { resolveTenantForTeam } from './tenant-routing.js';
 import { verifySlackSignature } from './signature.js';
 import { isSlackEventEnvelope, isSlackMessageEvent } from './types.js';
 import { handleMessageDeleted } from './deletion.js';
+import { redactPayload, DLQ_REDACTED_NOTE } from '../../secret-detect.js';
 export function writeToDlq(db, opts) {
+    const rawPayload = redactPayload(opts.rawPayload);
+    // A redacted body can never match its signature, so the row keeps none and replay needs --force.
+    const redacted = rawPayload !== opts.rawPayload;
     const result = db
         .prepare(`INSERT INTO slack_dlq
         (tenant_id, team_id, raw_payload, error, received_at, bucket, signature, slack_timestamp)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
-        .run(opts.tenantId ?? '__unroutable__', opts.teamId ?? null, opts.rawPayload, opts.error, new Date().toISOString(), opts.bucket ?? 'parse_error', opts.signature ?? null, opts.slackTimestamp ?? null);
+        .run(opts.tenantId ?? '__unroutable__', opts.teamId ?? null, rawPayload, redacted ? `${opts.error}; ${DLQ_REDACTED_NOTE}` : opts.error, new Date().toISOString(), opts.bucket ?? 'parse_error', redacted ? null : opts.signature ?? null, opts.slackTimestamp ?? null);
     return Number(result.lastInsertRowid);
 }
 export function listDlq(db, opts) {
@@ -95,7 +99,7 @@ export function replayDlqEntry(ctx, id, opts = {}) {
                 status: 'sig_missing',
                 memoryId: null,
                 retryCount: row.retryCount,
-                reason: 'legacy row without signature/timestamp; pass --force to replay',
+                reason: 'row has no signature/timestamp (legacy, or redacted before storing); pass --force to replay',
             };
         }
         if (opts.signingSecret) {