hippo-memory 1.57.0 → 1.59.0

package/dist/capture-contract.js

@@ -0,0 +1,49 @@
+// The shared shape every agent adapter turns a host payload into, so capture code is written once for all runtimes.
+// Field meanings, statuses and how to add a runtime: docs/integrations/agent-inventory.md.
+/** A string guard that avoids `typeof`; it matches it for every value `JSON.parse` can produce. */
+export function isStringValue(value) {
+    return String(value) === value;
+}
+/** An object guard that avoids `typeof`; arrays count as objects, as they do for `typeof`. */
+export function isObjectLike(value) {
+    return value !== null && value instanceof Object;
+}
+/** Reads a Claude Code PreCompact payload; only an empty stdin counts as a manual run. */
+export function readClaudeCodePreCompact(stdinText, timedOut) {
+    const empty = !stdinText || stdinText.trim() === '';
+    if (timedOut && empty) {
+        return { status: 'unavailable', reason: 'no PreCompact payload arrived before the stdin wait window closed' };
+    }
+    const base = { runtime: 'claude-code', event: 'pre-compact' };
+    if (empty) {
+        return { status: 'received', input: { ...base, manual: true, sessionId: null, cwd: null, transcriptPath: null, trigger: null } };
+    }
+    let payload;
+    try {
+        payload = JSON.parse(stdinText.trim());
+    }
+    catch {
+        // Non-JSON stdin leaves payload undefined, which the shape check rejects like an explicit null.
+    }
+    // A bad payload is skipped, never treated as manual: discovery could pick up another session's transcript.
+    if (!isObjectLike(payload) || !('transcript_path' in payload) || !isStringValue(payload.transcript_path)) {
+        return { status: 'skipped', reason: 'malformed or incomplete PreCompact payload (missing string transcript_path)' };
+    }
+    const transcriptPath = payload.transcript_path;
+    // Path shape only: CLAUDE_CONFIG_DIR can move the transcript root, and a same-user process can already read every transcript.
+    if (!/\.jsonl$/i.test(transcriptPath)) {
+        return { status: 'skipped', reason: `payload transcript_path is not a .jsonl file: ${transcriptPath}` };
+    }
+    return {
+        status: 'received',
+        input: {
+            ...base,
+            manual: false,
+            sessionId: 'session_id' in payload && isStringValue(payload.session_id) ? payload.session_id : null,
+            cwd: 'cwd' in payload && isStringValue(payload.cwd) ? payload.cwd : null,
+            transcriptPath,
+            trigger: 'trigger' in payload && isStringValue(payload.trigger) ? payload.trigger : null,
+        },
+    };
+}
+//# sourceMappingURL=capture-contract.js.map

package/dist/capture-error.js

@@ -7,6 +7,7 @@ import { loadConfig } from './config.js';
 import { closeHippoDb, openHippoDb } from './db.js';
 import { recordFailure } from './failure-log.js';
 import { blockHash } from './token-ledger.js';
+import { redactSecretsStrict } from './secret-detect.js';
 const MAX_LEN = 200;
 /** The user, a permission prompt or a hook said no: routine, not a lesson. */
 const DECLINED = /user (?:doesn't|does not) want|denied by (?:the )?user|user (?:rejected|declined|denied)|permission to use|was blocked by (?:a )?hook/i;
@@ -44,7 +45,7 @@ export function lessonFromFailure(payload) {
     if (!isString(p.error) || p.error.trim().length < 12)
         return { skip: 'skipped-invalid', text: null, detail: null };
     const tool = isString(p.tool_name) ? p.tool_name : 'tool';
-    const error = p.error.replace(/\s+/g, ' ').trim();
+    const error = redactSecretsStrict(p.error.replace(/\s+/g, ' ').trim());
     const text = `${tool}: ${error}`.slice(0, MAX_LEN);
     const command = isObject(p.tool_input) && isString(p.tool_input['command']) ? p.tool_input['command'].replace(LEADING_CD, '') : '';
     const head = command.trim().split(/\s+/).slice(0, 2).join(' ');

package/dist/capture.d.ts

@@ -49,19 +49,6 @@ export interface CaptureOptions {
     tenantId?: string;
     originProject?: string;
 }
-/**
- * Runtime shape guards used throughout this file wherever a value arrives
- * unparsed (JSONL transcript records, stdout/stderr write() chunks). Generic
- * over the input so the parameter is never annotated `unknown` directly — TS
- * infers it from the call site — while the check itself avoids `typeof` by
- * testing identity against the coercion (`String(x) === x`) /
- * prototype-chain (`instanceof Object`) instead. Behaviourally equivalent to
- * `typeof x === 'string'` / a truthy `typeof x === 'object'` check for
- * anything `JSON.parse` can produce (the only divergence is boxed
- * primitives, which JSON.parse never yields).
- */
-export declare function isStringValue<T>(value: T): value is T & string;
-export declare function isObjectLike<T>(value: T): value is T & object;
 /** Message for a caught value of unknown shape. `cause` names the sanctioned unknown-input case (error-cause enrichment). */
 export declare function errorMessage(cause: unknown): string;
 /** Transcript-line flags isNonHumanUserLine reads (any may be absent); `promptSource: 'system'` marks Claude Code's own notices. */

package/dist/capture.js

@@ -25,6 +25,7 @@ import { RejectedValueError, checkRejectionGuard } from './rejection.js';
 import { openHippoDb, closeHippoDb } from './db.js';
 import { loadConfig } from './config.js';
 import { classifyOriginProject } from './project-identity.js';
+import { isObjectLike, isStringValue, readClaudeCodePreCompact } from './capture-contract.js';
 // Sentence-level patterns
 //
 // T1 (DF2): each pattern now carries TWO capture groups — group 1 is the
@@ -471,23 +472,6 @@ export function extractFromText(text) {
     }
     return items;
 }
-/**
- * Runtime shape guards used throughout this file wherever a value arrives
- * unparsed (JSONL transcript records, stdout/stderr write() chunks). Generic
- * over the input so the parameter is never annotated `unknown` directly — TS
- * infers it from the call site — while the check itself avoids `typeof` by
- * testing identity against the coercion (`String(x) === x`) /
- * prototype-chain (`instanceof Object`) instead. Behaviourally equivalent to
- * `typeof x === 'string'` / a truthy `typeof x === 'object'` check for
- * anything `JSON.parse` can produce (the only divergence is boxed
- * primitives, which JSON.parse never yields).
- */
-export function isStringValue(value) {
-    return String(value) === value;
-}
-export function isObjectLike(value) {
-    return value !== null && value instanceof Object;
-}
 /** Message for a caught value of unknown shape. `cause` names the sanctioned unknown-input case (error-cause enrichment). */
 export function errorMessage(cause) {
     return cause instanceof Error ? cause.message : String(cause);
@@ -1161,57 +1145,12 @@ function runPreCompact(hippoRoot, stdinText, stdinTimedOut, logFile) {
         appendPreCompactLog(logFile, 'skip: store not initialized');
         return;
     }
-    // Same hazard X4 guards below, different trigger: a read that timed out
-    // must not reach auto-discovery either, or it snapshots another session.
-    if (stdinTimedOut && (!stdinText || stdinText.trim() === '')) {
-        appendPreCompactLog(logFile, 'skip: no PreCompact payload arrived before the stdin wait window closed');
-        return;
-    }
-    // A true manual invocation has no stdin at all (TTY, or a non-TTY pipe
-    // that yielded an empty read) — that's the ONLY case newest-transcript
-    // auto-discovery is allowed to run. Any other non-empty stdin must
-    // JSON-parse to an object carrying a string transcript_path, or it is
-    // treated as malformed input and skipped (X4) rather than silently
-    // falling back to discovery, which could snapshot an unrelated session's
-    // transcript under this payload's session_id.
-    const manualInvocation = !stdinText || stdinText.trim() === '';
-    let sessionId = null;
-    let payloadTranscriptPath = null;
-    let payloadCwd = null;
-    let payloadTrigger = null;
-    if (!manualInvocation) {
-        let payload;
-        try {
-            payload = JSON.parse(stdinText.trim());
-        }
-        catch {
-            // payload stays undefined; the isObjectLike check below rejects it
-            // the same way it would reject an explicit null.
-        }
-        if (!isObjectLike(payload) || !('transcript_path' in payload) || !isStringValue(payload.transcript_path)) {
-            // Covers non-JSON stdin, a JSON value that isn't an object, and
-            // `"transcript_path": null` (or the key missing entirely) — all fail
-            // the string check. Log and skip; never fall through to auto-discovery.
-            appendPreCompactLog(logFile, 'skip: malformed or incomplete PreCompact payload (missing string transcript_path)');
-            return;
-        }
-        if ('session_id' in payload && isStringValue(payload.session_id))
-            sessionId = payload.session_id;
-        payloadTranscriptPath = payload.transcript_path;
-        payloadCwd = 'cwd' in payload && isStringValue(payload.cwd) ? payload.cwd : null;
-        payloadTrigger = 'trigger' in payload && isStringValue(payload.trigger) ? payload.trigger : null;
-    }
-    // X11: payload transcript_path must end .jsonl. No directory-containment
-    // check is applied on top of this — CLAUDE_CONFIG_DIR can relocate the
-    // transcript root entirely, so a path-prefix allowlist would just reject
-    // legitimate relocated installs. The trust boundary here is process
-    // identity, not path shape: a local process able to feed this hook
-    // arbitrary stdin already runs as the same user who owns every transcript
-    // this check could gate on, so containment buys no real isolation.
-    if (payloadTranscriptPath !== null && !/\.jsonl$/i.test(payloadTranscriptPath)) {
-        appendPreCompactLog(logFile, `skip: payload transcript_path is not a .jsonl file: ${payloadTranscriptPath}`);
+    const receipt = readClaudeCodePreCompact(stdinText, stdinTimedOut);
+    if (receipt.status !== 'received') {
+        appendPreCompactLog(logFile, `skip: ${receipt.reason}`);
         return;
     }
+    const { sessionId, transcriptPath: payloadTranscriptPath, cwd: payloadCwd, trigger: payloadTrigger } = receipt.input;
     // The record is the "something saved before every compaction", so it lands even when no snapshot is derivable below.
     let recordId = null;
     if (sessionId !== null && sessionId !== '') {

package/dist/cli/output.d.ts

@@ -0,0 +1,3 @@
+/** Writes a message the user asked for, or must act on, to stderr. */
+export declare function printError(...args: unknown[]): void;
+//# sourceMappingURL=output.d.ts.map

package/dist/cli/output.js

@@ -0,0 +1,7 @@
+// User-facing CLI messages (usage, not-found, refusals) print at every HIPPO_LOG level; diagnostics go to `log`.
+// Both forward to console.error so the bytes match the old calls and console spies in tests still see them.
+/** Writes a message the user asked for, or must act on, to stderr. */
+export function printError(...args) {
+    console.error(...args);
+}
+//# sourceMappingURL=output.js.map

package/dist/cli/projects.d.ts

@@ -0,0 +1,4 @@
+type Flags = Record<string, string | boolean | string[]>;
+export declare function cmdProjects(hippoRoot: string, args: string[], flags: Flags): void;
+export {};
+//# sourceMappingURL=projects.d.ts.map

package/dist/cli/projects.js

@@ -0,0 +1,90 @@
+// The `hippo projects` verb: list a store's project names, fold an old worktree name into its repo, repair sleep's user-global merges.
+import * as path from 'path';
+import { execFileSync } from 'child_process';
+import { closeHippoDb, openHippoDb } from '../db.js';
+import { listProjects, mergeProjects, repairUserGlobalMerges } from '../project-merge.js';
+import { resolveTenantId } from '../tenant.js';
+import { resolveAuthRoot } from './shared.js';
+import { printError } from './output.js';
+/** Old per-worktree project names of the repo at cwd, mapped to the repo's main checkout name; empty outside git. */
+function worktreeNames() {
+    try {
+        const out = execFileSync('git', ['worktree', 'list', '--porcelain'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], windowsHide: true });
+        const paths = out.split(/\r?\n/).filter((l) => l.startsWith('worktree ')).map((l) => path.basename(l.slice('worktree '.length)));
+        return new Map(paths.slice(1).map((name) => [name, paths[0]]));
+    }
+    catch {
+        // Outside a git checkout, or no git on PATH: the list just has no worktree hints.
+        return new Map();
+    }
+}
+function label(origin) {
+    return origin === null ? '(unknown)' : origin === '' ? '(user-global)' : origin;
+}
+function hint(p, worktrees) {
+    const main = p.origin ? worktrees.get(p.origin) : undefined;
+    if (main)
+        return `\n    a worktree of ${main}: hippo projects merge ${p.origin} ${main}`;
+    return p.copiesElsewhere > 0 ? `\n    ${p.copiesElsewhere} of its imported notes are copies also held under another name` : '';
+}
+function count(n, one, many = `${one}s`) {
+    return `${n} ${n === 1 ? one : many}`;
+}
+export function cmdProjects(hippoRoot, args, flags) {
+    const root = resolveAuthRoot(hippoRoot, flags);
+    const tenantId = resolveTenantId({});
+    const apply = flags['apply'] === true;
+    const sub = args[0] ?? 'list';
+    const db = openHippoDb(root);
+    try {
+        if (sub === 'list') {
+            const projects = listProjects(db, tenantId);
+            if (flags['json']) {
+                console.log(JSON.stringify({ store: root, projects }, null, 2));
+                return;
+            }
+            const worktrees = worktreeNames();
+            console.log(`${count(projects.length, 'project name')} in ${root} (newest write first):\n`);
+            for (const p of projects) {
+                console.log(`${label(p.origin)}  ${count(p.live, 'memory', 'memories')}, ${p.imported} imported from agent notes, newest ${p.newest.slice(0, 10)}${hint(p, worktrees)}`);
+            }
+            return;
+        }
+        if (sub === 'merge') {
+            const [from, into] = [args[1] ?? '', args[2] ?? ''];
+            const r = mergeProjects(db, root, { tenantId, from, into, dryRun: !apply });
+            if (flags['json']) {
+                console.log(JSON.stringify(r, null, 2));
+                return;
+            }
+            console.log(`${apply ? 'Merged' : 'Dry run: would merge'} ${from} into ${into}:`);
+            console.log(`  ${count(r.setAside.length, 'imported note copy', 'imported note copies')} set aside (dormant; the next sync under ${into} imports the notes still on disk)`);
+            console.log(`  ${count(r.restamped.length, 'memory', 'memories')} re-tagged, plus ${r.dormantRestamped.length} dormant and ${count(r.compactions, 'compaction record')}`);
+            console.log(apply ? `Backup: ${r.backup}\nEvery id is in the audit log: hippo audit list --op project_merge` : 'Nothing written. Add --apply to run it.');
+            return;
+        }
+        if (sub === 'repair') {
+            const r = repairUserGlobalMerges(db, root, { tenantId, dryRun: !apply });
+            if (flags['json']) {
+                console.log(JSON.stringify(r, null, 2));
+                return;
+            }
+            console.log(`${apply ? 'Repaired' : 'Dry run: would repair'} sleep's user-global merged rows:`);
+            console.log(`  ${r.toProject.length} re-tagged to their parents' project`);
+            console.log(`  ${r.setAside.length} set aside (parents in two projects; sleep re-merges them per project)`);
+            console.log(`  ${r.untraced.length} left as they are (no parent left to show which project; check them with hippo inspect <id>)`);
+            console.log(apply ? `Backup: ${r.backup}\nEvery id is in the audit log: hippo audit list --op project_repair` : 'Nothing written. Add --apply to run it.');
+            return;
+        }
+        printError('Usage: hippo projects [list] [--json] | merge <from> <into> [--apply] | repair [--apply]  [--global]');
+        process.exitCode = 1;
+    }
+    catch (err) {
+        printError(err instanceof Error ? err.message : String(err));
+        process.exitCode = 1;
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+//# sourceMappingURL=projects.js.map

package/dist/cli/shared.js

@@ -10,7 +10,7 @@ import { RejectedValueError } from '../rejection.js';
 import { explainMatch } from '../search.js';
 import { embedMemory } from '../embeddings.js';
 import { loadConfig } from '../config.js';
-import { openHippoDb, closeHippoDb } from '../db.js';
+import { openHippoDb, closeHippoDb, isSqliteBusy, noteStoreBusy } from '../db.js';
 import { hookPayloadSessionId, isSubagentPayload, recordTokenUse } from '../token-ledger.js';
 import { isGitRepo, fetchGitLog, extractLessons, partitionLessons } from '../autolearn.js';
 import { storedTextKeys, duplicateKey } from '../same-text.js';
@@ -22,12 +22,14 @@ import { extractPathTags } from '../path-context.js';
 import { getGlobalRoot, initGlobal } from '../shared.js';
 import { DAILY_TASK_NAME, buildDailyRunnerCommand, buildSchtasksCreateArgs, buildWindowsTaskRun } from '../scheduler.js';
 import { sanitizeLogMessage } from '../capture.js';
-import { appendAuditEvent } from '../audit.js';
+import { appendAuditEvent, reportAuditWriteFailure } from '../audit.js';
 import { createHash } from 'node:crypto';
 import * as client from '../client.js';
 import { detectServer, removePidfileIfOwned } from '../server-detect.js';
 import { resolveTenantId } from '../tenant.js';
 import { snapshotText, sessionTrailText, handoffText } from '../context-render.js';
+import { log } from '../log.js';
+import { printError } from './output.js';
 export function parseLimitFlag(value) {
     if (!value)
         return Infinity;
@@ -45,13 +47,13 @@ export function parseBudgetFlag(value, fallback) {
         return fallback;
     // A value-less flag and a junk value are different typos; the --hops guard already splits them.
     if (typeof value !== 'string') {
-        console.error('--budget requires an integer value (e.g. --budget 1500).');
+        printError('--budget requires an integer value (e.g. --budget 1500).');
         process.exit(1);
     }
     // Number(), like the --hops guard: parseInt('12abc') is 12, silently accepting what this message rejects.
     const parsed = Number(value);
     if (!Number.isInteger(parsed) || parsed < 0) {
-        console.error(`Invalid --budget: "${value}". Must be a non-negative integer.`);
+        printError(`Invalid --budget: "${value}". Must be a non-negative integer.`);
         process.exit(1);
     }
     return parsed;
@@ -77,13 +79,14 @@ export function emitCliAudit(hippoRoot, op, targetId, metadata) {
             closeHippoDb(db);
         }
     }
-    catch {
-        // Audit is best-effort; surface failures only via missing rows.
+    catch (error) {
+        // Best effort: the command already did its work.
+        reportAuditWriteFailure(op, String(error), targetId);
     }
 }
 export function requireInit(hippoRoot) {
     if (!isInitialized(hippoRoot)) {
-        console.error(`No hippo store at ${hippoRoot} (searched ${process.cwd()} and its parents up to your home directory). Run \`hippo init\` first.`);
+        printError(`No hippo store at ${hippoRoot} (searched ${process.cwd()} and its parents up to your home directory). Run \`hippo init\` first.`);
         process.exit(1);
     }
 }
@@ -148,7 +151,7 @@ export async function runViaServerIfAvailable(hippoRoot, httpFn) {
         const failure = client.classifyTransportFailure(err);
         if (failure === 'never-sent') {
             failIfServerRequired('the server pidfile was stale (connection refused)');
-            console.error('hippo: stale server pidfile detected, falling back to direct mode');
+            log.warn('stale server pidfile detected, falling back to direct mode');
             // Clear the pidfile only if it still names the dead server we just
             // probed — a newer server may have rewritten it (removePidfileIfOwned).
             removePidfileIfOwned(hippoRoot, { pid: info.pid, startedAt: info.started_at });
@@ -158,7 +161,7 @@ export async function runViaServerIfAvailable(hippoRoot, httpFn) {
             // Every caller of this helper is a non-idempotent write, so replaying on
             // the direct path would store a row the server may already have committed.
             // Leave the pidfile alone: the next command's connect-phase failure heals it.
-            console.error(`hippo: the connection to ${info.url} dropped mid-request, so the write may already have been applied. Not retrying locally. Check with \`hippo recall\` before running this again.`);
+            printError(`hippo: the connection to ${info.url} dropped or timed out mid-request, so the write may already have been applied. Not retrying locally. Check with \`hippo recall\` before running this again.`);
             process.exit(1);
         }
         throw err;
@@ -215,7 +218,7 @@ export function printAgentImport(report, indent = '   ') {
     if (line !== null)
         console.log(`${indent}${line}`);
     for (const warning of report.warnings)
-        console.error(`hippo: agent memories: ${warning}`);
+        printError(`hippo: agent memories: ${warning}`);
 }
 /** The first hippo block in `text` and the agent whose current or shipped text it is; `owner` is undefined for an edited block. */
 export function hippoBlock(text) {
@@ -300,6 +303,7 @@ export function setupDailySchedule(globalRoot) {
             console.log(`   Scheduled machine-level daily runner (6:15am) via crontab`);
         }
         catch {
+            // No crontab or no permission: print the line for the user to add by hand.
             const cronLine = `15 6 * * * ${cmd}`;
             console.log(`   To schedule the machine-level daily runner, add to crontab (crontab -e):`);
             console.log(`   ${cronLine}`);
@@ -309,7 +313,7 @@ export function setupDailySchedule(globalRoot) {
 export function parseAsOfFlag(flags) {
     const asOf = typeof flags['as-of'] === 'string' ? flags['as-of'] : undefined;
     if (asOf !== undefined && Number.isNaN(new Date(asOf).getTime())) {
-        console.error(`Error: --as-of value "${asOf}" is not a valid ISO date (e.g. 2026-04-22 or 2026-04-22T12:00:00Z).`);
+        printError(`Error: --as-of value "${asOf}" is not a valid ISO date (e.g. 2026-04-22 or 2026-04-22T12:00:00Z).`);
         process.exit(1);
     }
     return asOf;
@@ -341,6 +345,7 @@ export function collectHandoffEvidence(cwd, testStatus) {
         }).trim() || null;
     }
     catch {
+        // No git, not a repo, or timed out: evidence is optional, so the field stays null.
         gitRef = null;
     }
     let dirtyTree = null;
@@ -351,6 +356,7 @@ export function collectHandoffEvidence(cwd, testStatus) {
         dirtyTree = status.trim().length > 0;
     }
     catch {
+        // Same as gitRef: unknown tree state is reported as null, never as an error.
         dirtyTree = null;
     }
     return { gitRef, dirtyTree, testStatus };
@@ -407,7 +413,7 @@ export function cardStringFlag(flags, key) {
     if (v === undefined)
         return undefined;
     if (v === true || v === false || Array.isArray(v)) {
-        console.error(`--${key} requires a value`);
+        printError(`--${key} requires a value`);
         process.exit(1);
     }
     return v.trim();
@@ -476,6 +482,7 @@ export function withLedgerDb(hippoRoot, fn) {
             root = getGlobalRoot();
     }
     catch {
+        // An unreadable store root means no ledger write; the ledger must never break context or recall.
         return undefined;
     }
     if (root === null)
@@ -485,7 +492,10 @@ export function withLedgerDb(hippoRoot, fn) {
         db = openHippoDb(root);
         return fn(db);
     }
-    catch {
+    catch (error) {
+        // Best effort, but a busy store is the one failure an operator can act on, so it warns once.
+        if (isSqliteBusy(error))
+            noteStoreBusy('token ledger row skipped');
         return undefined;
     }
     finally {

package/dist/cli/sleep.js

@@ -8,7 +8,9 @@ import { replayCompactionsAt } from '../compaction-record.js';
 import * as api from '../api.js';
 import { resolveTenantId } from '../tenant.js';
 import { renderAmbientSummary } from '../ambient.js';
+import { log } from '../log.js';
 import { requireInit, learnFromRepo, runChurnStaleForRepo, printAgentImport } from './shared.js';
+import { printError } from './output.js';
 /** Runs `hippo sleep`; with `--log-file` it also tees its output to that file. */
 export async function cmdSleep(hippoRoot, flags) {
     // Tee stdout/stderr to a log file when --log-file is set. The SessionEnd
@@ -45,7 +47,7 @@ export async function cmdSleep(hippoRoot, flags) {
             };
         }
         catch (err) {
-            console.error(`[hippo] warning: could not open log file ${logFile}: ${err.message}`);
+            log.warn(`could not open log file ${logFile}: ${err.message}`);
         }
     }
     try {
@@ -145,14 +147,14 @@ async function cmdSleepCore(hippoRoot, flags) {
                 if (result.marked > 0)
                     console.log(`Tagged ${result.marked} memories churn-stale in ${root}.`);
                 if (result.error)
-                    console.error(`Churn-staleness check failed for ${root}: ${result.error}`);
+                    printError(`Churn-staleness check failed for ${root}: ${result.error}`);
             }
         }
         printAgentImport(importForStore(hippoRoot, { machine: currentMachine() }), '');
     }
     // Finishes compactions a killed or busy post-compact hook left; never throws, and a dry run writes nothing.
     if (!flags['dry-run']) {
-        const finished = replayCompactionsAt(hippoRoot, (message) => console.error(`compaction replay: ${message}`));
+        const finished = replayCompactionsAt(hippoRoot, (message) => log.warn(`compaction replay: ${message}`));
         if (finished > 0)
             console.log(`Finished saving ${finished} compaction${finished === 1 ? '' : 's'} left over from earlier sessions.`);
     }

package/dist/cli.d.ts

@@ -20,6 +20,7 @@
  *   hippo rejections
  *   hippo unreject <digest-prefix>
  *   hippo dormant [<query>] [--limit <n>] [--json] | restore <id> | forget <id>
+ *   hippo projects [--json] | merge <from> <into> [--apply] | repair [--apply]
  *   hippo tokens [--days <n>] [--json] [--global]
  *   hippo doctor [--json]
  *   hippo inspect <id>