hippo-memory 1.57.0 → 1.58.0

package/dist/session-digest.js

@@ -2,7 +2,8 @@
 import { createHash } from 'crypto';
 import * as fs from 'fs';
 import * as path from 'path';
-import { collectSessionTurns, errorMessage, isObjectLike, isStringValue, readTranscriptTail, splitSentences, } from './capture.js';
+import { collectSessionTurns, errorMessage, readTranscriptTail, splitSentences, } from './capture.js';
+import { isObjectLike, isStringValue } from './capture-contract.js';
 import { PATCH_SUCCESS_LINE, patchPaths, shellPatch } from './codex-patch.js';
 import { loadConfig } from './config.js';
 import { createMemory, Layer } from './memory.js';

package/dist/shared.js

@@ -4,6 +4,7 @@
  * Resolution: $HIPPO_HOME > $XDG_DATA_HOME/hippo > ~/.hippo/
  * Local .hippo/ stores are per-project.
  */
+import { BadRequestError, NotFoundError } from './api-errors.js';
 import * as fs from 'fs';
 import * as path from 'path';
 import { generateId, COMPACTION_MEMORY_TAG } from './memory.js';
@@ -48,16 +49,16 @@ export function initGlobal() {
 export function promoteToGlobal(localRoot, id, opts) {
     const entry = readEntry(localRoot, id, opts?.tenantId);
     if (!entry)
-        throw new Error(`Memory not found: ${id}`);
+        throw new NotFoundError(`Memory not found: ${id}`);
     // CD5: same veto as shareMemory; a promoted copy would have no quarantine record to review.
     if (isQuarantineScope(entry.scope)) {
-        throw new Error(`Refusing to promote ${id}: it is quarantined pending review. Approve it first via 'hippo quarantine approve ${id}'.`);
+        throw new BadRequestError(`Refusing to promote ${id}: it is quarantined pending review. Approve it first via 'hippo quarantine approve ${id}'.`);
     }
     // v39 S4 producer veto: promote is a producer path to the global store
     // exactly like shareMemory - same hard rule (codex gating review P2).
     const promoteSecret = detectSecret(entry);
     if (promoteSecret.flagged) {
-        throw new Error(`Refusing to promote ${id} to the global store: content matches secret material (${promoteSecret.reason}). ` +
+        throw new BadRequestError(`Refusing to promote ${id} to the global store: content matches secret material (${promoteSecret.reason}). ` +
             `Secrets stay in their owning project's store.`);
     }
     initGlobal();
@@ -273,18 +274,18 @@ export function shareMemory(localRoot, id, options = {}) {
     // when tenantId is provided.
     const entry = readEntry(localRoot, id, options.tenantId);
     if (!entry)
-        throw new Error(`Memory not found: ${id}`);
+        throw new NotFoundError(`Memory not found: ${id}`);
     // v39 S4 producer veto: secrets never go to the global store, not even
     // with --force. Explicit and loud - a silent null would read as "low
     // transfer score" and invite retries.
     const secret = detectSecret(entry);
     if (secret.flagged) {
-        throw new Error(`Refusing to share ${id} to the global store: content matches secret material (${secret.reason}). ` +
+        throw new BadRequestError(`Refusing to share ${id} to the global store: content matches secret material (${secret.reason}). ` +
             `Secrets stay in their owning project's store.`);
     }
     // CD5: a quarantined row is unreviewed input, not a lesson; sharing it would spread poison globally.
     if (isQuarantineScope(entry.scope)) {
-        throw new Error(`Refusing to share ${id}: it is quarantined pending review. Approve it first via 'hippo quarantine approve ${id}'.`);
+        throw new BadRequestError(`Refusing to share ${id}: it is quarantined pending review. Approve it first via 'hippo quarantine approve ${id}'.`);
     }
     const score = transferScore(entry);
     if (score < 0.3 && !options.force)

package/dist/skills.js

@@ -21,6 +21,7 @@
  * Lifecycle: active -> superseded (a newer version replaces it) or active ->
  * closed (retired). Export renders ACTIVE skills only.
  */
+import { BadRequestError, ConflictError, NotFoundError } from './api-errors.js';
 import { openHippoDb, closeHippoDb } from './db.js';
 import { writeEntry } from './store.js';
 import { assertTenantId } from './tenant.js';
@@ -49,28 +50,28 @@ export const MAX_EXPORT_SKILLS = 1000;
 function validateSkillFields(skillName, instructions, trigger) {
     const name = (skillName ?? '').trim();
     if (name.length === 0)
-        throw new Error('saveSkill: skillName is required');
+        throw new BadRequestError('saveSkill: skillName is required');
     if (/[\r\n]/.test(name))
-        throw new Error('saveSkill: skillName must be a single line (no newlines)');
+        throw new BadRequestError('saveSkill: skillName must be a single line (no newlines)');
     if (name.length > MAX_SKILL_NAME_LEN) {
-        throw new Error(`saveSkill: skillName exceeds the ${MAX_SKILL_NAME_LEN}-char cap`);
+        throw new BadRequestError(`saveSkill: skillName exceeds the ${MAX_SKILL_NAME_LEN}-char cap`);
     }
     if (!instructions || instructions.trim().length === 0) {
-        throw new Error('saveSkill: instructions are required');
+        throw new BadRequestError('saveSkill: instructions are required');
     }
     if (instructions.length > MAX_SKILL_INSTRUCTIONS_LEN) {
-        throw new Error(`saveSkill: instructions exceed the ${MAX_SKILL_INSTRUCTIONS_LEN}-char cap`);
+        throw new BadRequestError(`saveSkill: instructions exceed the ${MAX_SKILL_INSTRUCTIONS_LEN}-char cap`);
     }
     let triggerVal = null;
     if (trigger !== undefined && trigger !== null && trigger.trim().length > 0) {
         if (trigger.length > MAX_SKILL_TRIGGER_LEN) {
-            throw new Error(`saveSkill: trigger exceeds the ${MAX_SKILL_TRIGGER_LEN}-char cap`);
+            throw new BadRequestError(`saveSkill: trigger exceeds the ${MAX_SKILL_TRIGGER_LEN}-char cap`);
         }
         // Single-line, like skill_name: a trigger is a short "when to apply" phrase,
         // and a newline would let it forge a heading inside the export **When:** line
         // (independent-review 2026-05-30). Reject rather than emit a multi-line trigger.
         if (/[\r\n]/.test(trigger)) {
-            throw new Error('saveSkill: trigger must be a single line (no newlines)');
+            throw new BadRequestError('saveSkill: trigger must be a single line (no newlines)');
         }
         triggerVal = trigger;
     }
@@ -148,10 +149,10 @@ export function saveSkill(hippoRoot, tenantId, opts, actor = 'cli') {
                 // SAFETY: row shape matches the `status, version` columns named in the SELECT below.
                 const pred = db.prepare(`SELECT status, version FROM skills WHERE id = ? AND tenant_id = ?`).get(opts.supersedesSkillId, tenantId);
                 if (!pred) {
-                    throw new Error(`saveSkill: skill ${opts.supersedesSkillId} to supersede not found for tenant ${tenantId}`);
+                    throw new NotFoundError(`saveSkill: skill ${opts.supersedesSkillId} to supersede not found for tenant ${tenantId}`);
                 }
                 if (pred.status !== 'active') {
-                    throw new Error(`saveSkill: skill ${opts.supersedesSkillId} is not active (status='${pred.status}'); only active skills can be superseded.`);
+                    throw new ConflictError(`saveSkill: skill ${opts.supersedesSkillId} is not active (status='${pred.status}'); only active skills can be superseded.`);
                 }
                 version = pred.version + 1;
             }
@@ -169,7 +170,7 @@ export function saveSkill(hippoRoot, tenantId, opts, actor = 'cli') {
           WHERE id = ? AND tenant_id = ? AND status = 'active' AND id != ?
         `).run(skillId, now, opts.supersedesSkillId, tenantId, skillId);
                 if (sup.changes === 0) {
-                    throw new Error(`saveSkill: skill ${opts.supersedesSkillId} could not be superseded (no longer active or self-reference).`);
+                    throw new ConflictError(`saveSkill: skill ${opts.supersedesSkillId} could not be superseded (no longer active or self-reference).`);
                 }
                 appendAuditEvent(db, {
                     tenantId,
@@ -228,15 +229,15 @@ export function closeSkill(hippoRoot, tenantId, id, actor = 'cli') {
                 // SAFETY: row shape matches the single `status` column named in the SELECT above.
                 const existing = db.prepare(`SELECT status FROM skills WHERE id = ? AND tenant_id = ?`).get(id, tenantId);
                 if (!existing) {
-                    throw new Error(`closeSkill: skill ${id} not found for tenant ${tenantId}`);
+                    throw new NotFoundError(`closeSkill: skill ${id} not found for tenant ${tenantId}`);
                 }
-                throw new Error(`closeSkill: skill ${id} is not active (status='${existing.status}'); only active skills can be closed.`);
+                throw new ConflictError(`closeSkill: skill ${id} is not active (status='${existing.status}'); only active skills can be closed.`);
             }
             // SAFETY: row's shape matches the columns named in SKILL_COLS above.
             const row = db.prepare(`SELECT ${SKILL_COLS} FROM skills WHERE id = ? AND tenant_id = ?`)
                 .get(id, tenantId);
             if (!row)
-                throw new Error(`closeSkill: skill ${id} not found after UPDATE`);
+                throw new NotFoundError(`closeSkill: skill ${id} not found after UPDATE`);
             appendAuditEvent(db, {
                 tenantId,
                 actor,
@@ -282,7 +283,7 @@ export function loadSkills(hippoRoot, tenantId, opts = {}) {
         let rows;
         if (opts.status) {
             if (!VALID_SKILL_STATES.has(opts.status)) {
-                throw new Error(`loadSkills: status must be one of ${Array.from(VALID_SKILL_STATES).join('|')}; got ${opts.status}`);
+                throw new BadRequestError(`loadSkills: status must be one of ${Array.from(VALID_SKILL_STATES).join('|')}; got ${opts.status}`);
             }
             // SAFETY: rows' shape matches the columns named in SKILL_COLS above.
             rows = db.prepare(`

package/dist/store.js

@@ -15,7 +15,7 @@ import { RECALL_DEFAULT_DENY_SCOPES } from './recall-scope.js';
 import { assertTenantId } from './tenant.js';
 import { isRecallBoostAblated } from './ablation.js';
 import { rarestPromptTerms, RAREST_TERM_COUNT } from './prompt-recall.js';
-import { appendAuditEvent } from './audit.js';
+import { appendAuditEvent, reportAuditWriteFailure } from './audit.js';
 import { resolveTenantId } from './tenant.js';
 import { redactSecretsStrict } from './secret-detect.js';
 import { deriveOriginProject, originFromSource, findHippoStoreDir, realpathOrResolve } from './project-identity.js';
@@ -42,9 +42,9 @@ function audit(db, op, targetId, metadata, actor = 'cli', tenantId) {
             metadata,
         });
     }
-    catch {
-        // Audit must never crash a mutation. Failures here mean the audit_log
-        // table is broken; the mutation has already succeeded.
+    catch (error) {
+        // The mutation has already succeeded; a broken audit table must not undo it.
+        reportAuditWriteFailure(op, String(error), targetId);
     }
 }
 /**

package/dist/token-ledger.d.ts

@@ -7,8 +7,9 @@ import type { DatabaseSyncLike } from './db.js';
  * - `context`, `recall`: the CLI commands.
  * - `mcp_recall`, `mcp_context`: the MCP tools.
  * - `http_recall`, `http_context`, `http_assemble`: the HTTP API.
+ * - `pilot`: the session's pilot arm row (src/pilot-arm.ts); not a send, so it is in no surface list.
  */
-export type TokenSurface = 'hook' | 'hook_recall' | 'compact_resume' | 'context' | 'recall' | 'mcp_recall' | 'mcp_context' | 'http_recall' | 'http_context' | 'http_assemble';
+export type TokenSurface = 'hook' | 'hook_recall' | 'compact_resume' | 'context' | 'recall' | 'mcp_recall' | 'mcp_context' | 'http_recall' | 'http_context' | 'http_assemble' | 'pilot';
 /** All surfaces, in report order. */
 export declare const TOKEN_SURFACES: readonly TokenSurface[];
 /** Surfaces whose re-reads are counted: only a hook payload tells a sub-agent's block from its parent's, as both carry one session id. */
@@ -19,8 +20,9 @@ export declare const REREAD_SURFACES: readonly TokenSurface[];
  * - `skip`: identical to the session's last injected block, so not sent again.
  * - `reset`: the host compacted its context, so the next block must be sent.
  * - `reread`: tokens later calls read again, booked at session end as one row per session, hook surface and UTC day of the calls.
+ * - `arm`: the pilot assignment; `block_hash` is `hippo` or `holdout`, `items` the holdout rate in basis points.
  */
-export type TokenEvent = 'inject' | 'skip' | 'reset' | 'reread';
+export type TokenEvent = 'inject' | 'skip' | 'reset' | 'reread' | 'arm';
 /** Rows older than this are pruned on write. */
 export declare const TOKEN_LEDGER_RETENTION_DAYS = 90;
 /**

package/dist/token-ledger.js

@@ -125,7 +125,7 @@ export function summarizeTokenUse(db, tenantId, sinceIso) {
             COUNT(DISTINCT CASE WHEN event = 'reread' THEN session_id END) AS reread_sessions,
             SUM(CASE WHEN event = 'inject' THEN tokens ELSE 0 END) AS tokens
      FROM token_ledger
-     WHERE tenant_id = ? AND ts >= ? AND session_id IS NOT NULL`).get(...REREAD_SURFACES, tenantId, sinceIso);
+     WHERE tenant_id = ? AND ts >= ? AND session_id IS NOT NULL AND event <> 'arm'`).get(...REREAD_SURFACES, tenantId, sinceIso);
     const sessionCount = Number(perSession?.sessions ?? 0);
     const sessionTokens = Number(perSession?.tokens ?? 0);
     return {
@@ -197,7 +197,7 @@ export function tokensBySession(db, tenantId, sinceIso) {
             SUM(CASE WHEN event = 'skip' THEN tokens ELSE 0 END) AS skipped,
             SUM(CASE WHEN event = 'inject' THEN 1 ELSE 0 END) AS injections
      FROM token_ledger
-     WHERE tenant_id = ? AND ts >= ? AND session_id IS NOT NULL
+     WHERE tenant_id = ? AND ts >= ? AND session_id IS NOT NULL AND event <> 'arm'
      GROUP BY session_id`).all(tenantId, sinceIso);
     return rows.map((r) => ({
         sessionId: r.session_id,

package/dist/version.d.ts

@@ -16,7 +16,7 @@
  * an ESM `import` can resolve cleanly, and a hardcoded constant survives
  * any packager that drops .json files.
  */
-export declare const PACKAGE_VERSION = "1.57.0";
+export declare const PACKAGE_VERSION = "1.58.0";
 /** Compares plain x.y.z versions, positive if a > b; tags throw so the rollback guard never misfires silently. */
 export declare function compareSemver(a: string, b: string): number;
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -16,7 +16,7 @@
  * an ESM `import` can resolve cleanly, and a hardcoded constant survives
  * any packager that drops .json files.
  */
-export const PACKAGE_VERSION = '1.57.0';
+export const PACKAGE_VERSION = '1.58.0';
 /** Compares plain x.y.z versions, positive if a > b; tags throw so the rollback guard never misfires silently. */
 export function compareSemver(a, b) {
     const parse = (v) => {

package/extensions/openclaw-plugin/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "hippo-memory",
   "name": "Hippo Memory",
   "description": "Memory for AI agents that learns what is wrong and ranks it down. Injects context at session start and captures errors.",
-  "version": "1.57.0",
+  "version": "1.58.0",
 
   "configSchema": {
     "type": "object",

package/extensions/openclaw-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hippo-memory",
-  "version": "1.57.0",
+  "version": "1.58.0",
   "type": "module",
   "description": "Hippo Memory plugin for OpenClaw - biologically-inspired agent memory",
   "main": "index.ts",

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "hippo-memory",
   "name": "Hippo Memory",
   "description": "Memory for AI agents that learns what is wrong and ranks it down. Injects context at session start and captures errors.",
-  "version": "1.57.0",
+  "version": "1.58.0",
   "configSchema": {
     "type": "object",
     "additionalProperties": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hippo-memory",
-  "version": "1.57.0",
+  "version": "1.58.0",
   "description": "Memory for AI agents that learns what is wrong and ranks it down. MCP server, hooks for Claude Code, OpenCode and Codex, AGENTS.md instructions for Codex, Cursor, OpenClaw and Pi. SQLite, zero runtime deps.",
   "mcpName": "io.github.kitfunso/hippo-memory",
   "type": "module",

package/dist/connectors/slack/ratelimit.d.ts

@@ -1,9 +0,0 @@
-export interface RetryOpts {
-    url: string;
-    init?: RequestInit;
-    fetchImpl?: typeof fetch;
-    sleep?: (ms: number) => Promise<void>;
-    maxRetries?: number;
-}
-export declare function fetchWithRetry(opts: RetryOpts): Promise<Response>;
-//# sourceMappingURL=ratelimit.d.ts.map

package/dist/connectors/slack/ratelimit.js

@@ -1,18 +0,0 @@
-export async function fetchWithRetry(opts) {
-    const f = opts.fetchImpl ?? fetch;
-    const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-    const max = opts.maxRetries ?? 3;
-    let attempt = 0;
-    while (true) {
-        const r = await f(opts.url, opts.init);
-        if (r.status !== 429)
-            return r;
-        if (attempt >= max)
-            throw new Error(`rate-limited after ${attempt + 1} attempts: ${opts.url}`);
-        const ra = r.headers.get('retry-after');
-        const delaySec = ra ? Number(ra) : Math.pow(2, attempt);
-        await sleep(Math.max(0, delaySec) * 1000);
-        attempt++;
-    }
-}
-//# sourceMappingURL=ratelimit.js.map