hippo-memory 1.59.0 → 1.60.0

package/dist/compaction-record.js

@@ -12,6 +12,7 @@ import { deriveOriginProject, isGlobalStoreRoot } from './project-identity.js';
 import { maskEmails, redactSecretsStrict } from './secret-detect.js';
 import { strengthenRetrievedOn, updateStats, writeEntryMirrors } from './store.js';
 import { resolveTenantId } from './tenant.js';
+import { log as logger } from './log.js';
 /** PostCompact has 10 s in all (PreCompact 30 s), so a locked store must be given up on early. */
 export const COMPACTION_DB_WAIT_MS = 2000;
 /** Tested verbatim: Claude Code hands PreCompact stdout to the summariser as instructions. */
@@ -262,7 +263,7 @@ export function parsePostCompactPayload(stdinText) {
         raw = JSON.parse((stdinText ?? '').trim());
     }
     catch {
-        return null;
+        return null; // non-JSON stdin is not a PostCompact payload; the caller skips it
     }
     if (!isObjectLike(raw) || !('session_id' in raw) || !isStringValue(raw.session_id) || raw.session_id === '')
         return null;
@@ -309,7 +310,7 @@ export function saveCompaction(hippoRoot, payload, log) {
             if (isSqliteBusy(err))
                 throw err;
             log(`record step failed: ${errorMessage(err)}`);
-            console.error(`hippo post-compact: record step failed: ${errorMessage(err)}`);
+            logger.error(`post-compact: record step failed: ${errorMessage(err)}`);
         }
         try {
             result.written = saveItems(db, hippoRoot, {
@@ -337,12 +338,12 @@ export function saveCompaction(hippoRoot, payload, log) {
             }
             catch (spoolErr) {
                 log(`spool failed: ${errorMessage(spoolErr)}`);
-                console.error(`hippo post-compact: spool failed: ${errorMessage(spoolErr)}`);
+                logger.error(`post-compact: spool failed: ${errorMessage(spoolErr)}`);
             }
         }
         else {
             log(`items step failed: ${errorMessage(err)}`);
-            console.error(`hippo post-compact: items step failed: ${errorMessage(err)}`);
+            logger.error(`post-compact: items step failed: ${errorMessage(err)}`);
         }
     }
     finally {
@@ -380,7 +381,7 @@ function transcriptSummary(transcriptPath, afterMs, beforeMs) {
                 lines.push(JSON.parse(raw));
             }
             catch {
-                continue;
+                continue; // the tail can start mid-line; a torn line holds no summary
             }
         }
         const stamp = (line) => (isStringValue(line.timestamp) ? Date.parse(line.timestamp) : Number.NaN);
@@ -409,7 +410,7 @@ function readSpooled(file, fallbackTenantId) {
         raw = JSON.parse(fs.readFileSync(file, 'utf8'));
     }
     catch {
-        return null;
+        return null; // a half-written or vanished spool file is skipped; the caller treats null as unreadable
     }
     if (!isObjectLike(raw) || !('sessionId' in raw) || !isStringValue(raw.sessionId) || !('summary' in raw) || !isStringValue(raw.summary))
         return null;

package/dist/config.js

@@ -5,6 +5,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { DEFAULT_PHYSICS_CONFIG, mergePhysicsConfig } from './physics-config.js';
 import { DEFAULT_HALF_LIFE_DAYS } from './memory.js';
+import { log } from './log.js';
 const DEFAULT_CONFIG = {
     defaultHalfLifeDays: DEFAULT_HALF_LIFE_DAYS,
     defaultBudget: 4000,
@@ -114,7 +115,7 @@ function deliveryLedgerEnabled(value) {
         return enabled;
     if (isObject && enabled === undefined)
         return false;
-    console.error(`Warning: config.json's "deliveryLedger" must be an object like {"enabled": true} ` +
+    log.warn(`config.json's "deliveryLedger" must be an object like {"enabled": true} ` +
         `(got ${JSON.stringify(value)}) - using false.`);
     return false;
 }
@@ -127,7 +128,7 @@ function pilotHoldoutRate(value) {
         return 0;
     if (Number.isInteger(rate) && rate >= 0 && rate <= 10000)
         return rate;
-    console.error(`Warning: config.json's "pilot" must be an object like {"holdoutRateBp": 2000}, an integer from 0 to 10000 ` +
+    log.warn(`config.json's "pilot" must be an object like {"holdoutRateBp": 2000}, an integer from 0 to 10000 ` +
         `(got ${JSON.stringify(value)}) - using 0 (pilot off).`);
     return 0;
 }
@@ -136,7 +137,7 @@ function agentMemoryTools(value) {
         return null;
     if (Array.isArray(value) && value.every((t) => String(t) === t))
         return value;
-    console.error(`Warning: config.json's "agentMemories.tools" must be a list of tool ids like ["claude-code", "codex"] ` +
+    log.warn(`config.json's "agentMemories.tools" must be a list of tool ids like ["claude-code", "codex"] ` +
         `(got ${JSON.stringify(value)}) - importing none.`);
     return [];
 }
@@ -158,7 +159,7 @@ export function loadConfig(hippoRoot) {
         const memoryValueRaw = raw.memoryValue;
         const validMemoryValueConfig = memoryValueRaw === undefined || isMemoryValueConfig(memoryValueRaw);
         if (!validMemoryValueConfig) {
-            console.error(`Warning: config.json's "memoryValue" must be an object like {"enabled": true} ` +
+            log.warn(`config.json's "memoryValue" must be an object like {"enabled": true} ` +
                 `(got ${JSON.stringify(memoryValueRaw)}) - using defaults.`);
         }
         const memoryValueOverride = memoryValueRaw !== undefined && isMemoryValueConfig(memoryValueRaw) ? memoryValueRaw : {};
@@ -167,20 +168,20 @@ export function loadConfig(hippoRoot) {
         // warns and falls back to the default, which keeps faded memories.
         const dormantRaw = raw.dormant;
         if (dormantRaw !== undefined && !isDormantConfig(dormantRaw)) {
-            console.error(`Warning: config.json's "dormant" must be an object like {"enabled": false} ` +
+            log.warn(`config.json's "dormant" must be an object like {"enabled": false} ` +
                 `(got ${JSON.stringify(dormantRaw)}) - using the default (faded memories kept dormant).`);
         }
         const dormantOverride = dormantRaw !== undefined && isDormantConfig(dormantRaw) ? dormantRaw : {};
         // Only a real boolean counts: {"enabled": "false"} is a truthy string.
         let dormantEnabled = dormantOverride.enabled ?? DEFAULT_CONFIG.dormant.enabled;
         if (dormantEnabled !== true && dormantEnabled !== false) {
-            console.error(`Warning: config.json's "dormant.enabled" must be true or false ` +
+            log.warn(`config.json's "dormant.enabled" must be true or false ` +
                 `(got ${JSON.stringify(dormantEnabled)}) - using the default (faded memories kept dormant).`);
             dormantEnabled = DEFAULT_CONFIG.dormant.enabled;
         }
         let dormantRetentionDays = dormantOverride.retentionDays ?? DEFAULT_CONFIG.dormant.retentionDays;
         if (!Number.isFinite(dormantRetentionDays) || dormantRetentionDays < 0) {
-            console.error(`Warning: config.json's "dormant.retentionDays" must be a number of days, 0 or more ` +
+            log.warn(`config.json's "dormant.retentionDays" must be a number of days, 0 or more ` +
                 `(got ${JSON.stringify(dormantRetentionDays)}) - using ${DEFAULT_CONFIG.dormant.retentionDays}.`);
             dormantRetentionDays = DEFAULT_CONFIG.dormant.retentionDays;
         }
@@ -188,21 +189,21 @@ export function loadConfig(hippoRoot) {
         const churnStalenessRaw = raw.churnStaleness;
         const validChurnStalenessConfig = churnStalenessRaw === undefined || isChurnStalenessConfig(churnStalenessRaw);
         if (!validChurnStalenessConfig) {
-            console.error(`Warning: config.json's "churnStaleness" must be an object like {"enabled": true} ` +
+            log.warn(`config.json's "churnStaleness" must be an object like {"enabled": true} ` +
                 `(got ${JSON.stringify(churnStalenessRaw)}) - using defaults.`);
         }
         let churnStalenessEnabled = churnStalenessRaw !== undefined && isChurnStalenessConfig(churnStalenessRaw)
             ? churnStalenessRaw.enabled
             : DEFAULT_CONFIG.churnStaleness.enabled;
         if (churnStalenessEnabled !== true && churnStalenessEnabled !== false) {
-            console.error(`Warning: config.json's "churnStaleness.enabled" must be true or false ` +
+            log.warn(`config.json's "churnStaleness.enabled" must be true or false ` +
                 `(got ${JSON.stringify(churnStalenessEnabled)}) - using false.`);
             churnStalenessEnabled = false;
         }
         // Every writer starts a memory on this, and a zero or negative half-life scores zero strength, so sleep would retire it.
         let defaultHalfLifeDays = raw.defaultHalfLifeDays ?? DEFAULT_CONFIG.defaultHalfLifeDays;
         if (!Number.isFinite(defaultHalfLifeDays) || defaultHalfLifeDays <= 0) {
-            console.error(`Warning: config.json's "defaultHalfLifeDays" must be a number of days above 0 ` +
+            log.warn(`config.json's "defaultHalfLifeDays" must be a number of days above 0 ` +
                 `(got ${JSON.stringify(defaultHalfLifeDays)}) - using ${DEFAULT_CONFIG.defaultHalfLifeDays}.`);
             defaultHalfLifeDays = DEFAULT_CONFIG.defaultHalfLifeDays;
         }
@@ -247,7 +248,7 @@ export function loadConfig(hippoRoot) {
     }
     catch (err) {
         if (fs.existsSync(configPath)) {
-            console.error(`Warning: failed to parse ${configPath}: ${err instanceof Error ? err.message : err}`);
+            log.warn(`failed to parse ${configPath}: ${err instanceof Error ? err.message : err}`);
         }
         return { ...DEFAULT_CONFIG };
     }

package/dist/connectors/github/cli-impl.js

@@ -52,6 +52,7 @@ function parsedToIngestEvent(parsed, eventName) {
     }
     return null;
 }
+// Console lines below are the `hippo github` command's printed result and usage text, so they stay off the logger.
 export function printGithubBackfillUsage() {
     console.log('hippo github backfill --repo <owner/name> [--since ISO] [--max <N>]');
     console.log('  --repo   GitHub repository in owner/name format (required, e.g. acme/widgets)');

package/dist/consolidate.js

@@ -31,6 +31,7 @@ import { migrateDefaultHalfLife, LEGACY_TYPED_HALF_LIFE } from './half-life-migr
 import { derivationScope, commonDerivationScope, derivationPartitionKey } from './recall-scope.js';
 import { isQuarantineScope } from './quarantine.js';
 import { NO_MERGE_TAGS } from './shared.js';
+import { log } from './log.js';
 const DECAY_THRESHOLD = 0.05;
 const MERGE_OVERLAP_THRESHOLD = 0.35; // Jaccard similarity for "related"
 const MERGE_MIN_CLUSTER = 2; // minimum cluster size to merge
@@ -434,7 +435,7 @@ export async function consolidate(hippoRoot, options = {}) {
                 result.details.push(`  🧬 promoted ${result.promotedTraces} trace${result.promotedTraces === 1 ? '' : 's'} from completed session${result.promotedTraces === 1 ? '' : 's'}`);
             }
             if (tracesSkippedRejected > 0) {
-                console.error(`consolidate: skipped ${tracesSkippedRejected} auto-promoted trace(s) whose content matches a rejected value`);
+                log.warn(`consolidate: skipped ${tracesSkippedRejected} auto-promoted trace(s) whose content matches a rejected value`);
             }
         }
         // -------------------------------------------------------------------------
@@ -490,7 +491,7 @@ export async function consolidate(hippoRoot, options = {}) {
                 return;
             llmErrorsSeen.add(line);
             result.details.push(line);
-            console.error(`consolidate ${phase}: ${msg}`);
+            log.warn(`consolidate ${phase}: ${msg}`);
         };
         const llmOpts = { apiKey, model: config.extraction.model, fetcher: options.fetcher };
         if (apiKey && extractionCandidates.length > 0 && !dryRun) {
@@ -831,7 +832,7 @@ export async function consolidate(hippoRoot, options = {}) {
             closeHippoDb(consolidateDbHandle);
     }
     if (mergesSkippedRejected > 0) {
-        console.error(`consolidate: skipped ${mergesSkippedRejected} merge(s) whose content matches a rejected value`);
+        log.warn(`consolidate: skipped ${mergesSkippedRejected} merge(s) whose content matches a rejected value`);
     }
     result.removedIds = pendingDeletes;
     // One transaction; the snapshot keeps what the DAG passes and other writers changed while sleep ran.

package/dist/dag.js

@@ -1,11 +1,12 @@
 import { createMemory, Layer } from './memory.js';
 import { writeEntry, loadAllDirtySummaries, loadChildrenOfSummary, applyRebuildResult, clearSummaryDirtyAfterBuild, } from './store.js';
 import { RejectedValueError } from './rejection.js';
-import { redactSecrets } from './secret-detect.js';
+import { redactSecretsStrict } from './secret-detect.js';
 import { fetchWithRetry, llmTimeoutMs } from './http-retry.js';
 import { derivationScope, derivationPartitionKey } from './recall-scope.js';
 import { loadConfig } from './config.js';
 import { neverAutoShareTags } from './shared.js';
+import { log } from './log.js';
 export function clusterFacts(facts) {
     if (facts.length === 0)
         return [];
@@ -47,9 +48,9 @@ Write a single concise paragraph (2-4 sentences) that captures all the key infor
 export async function generateDagSummary(label, factContents, opts) {
     const model = opts.model ?? 'claude-sonnet-4-6';
     const fetchFn = opts.fetcher ?? fetch;
-    const factsBlock = factContents.map((f, i) => `${i + 1}. ${redactSecrets(f)}`).join('\n');
+    const factsBlock = factContents.map((f, i) => `${i + 1}. ${redactSecretsStrict(f)}`).join('\n');
     const prompt = DAG_SUMMARY_PROMPT
-        .replace('{label}', redactSecrets(label))
+        .replace('{label}', redactSecretsStrict(label))
         .replace('{facts}', factsBlock);
     let res;
     try {
@@ -157,7 +158,7 @@ export async function buildDag(hippoRoot, facts, opts) {
             catch (err) {
                 if (err instanceof RejectedValueError) {
                     result.rejected++;
-                    console.error(`[buildDag] cluster "${cluster.label}" skipped: summary matches a rejected value`);
+                    log.warn(`buildDag: cluster "${cluster.label}" skipped: summary matches a rejected value`);
                     continue;
                 }
                 throw err;
@@ -274,8 +275,7 @@ export async function rebuildDirtySummaries(hippoRoot, opts) {
             // (audit() wraps its own writes try/catch per store.ts:2566, so a
             // throw here is exotic: SQLite I/O error, prepare failure, etc).
             result.failed++;
-            // eslint-disable-next-line no-console
-            console.error(`[rebuildDirtySummaries] summary ${summary.id} (tenant ${summary.tenantId}) failed: ${err instanceof Error ? err.message : String(err)}`);
+            log.error(`rebuildDirtySummaries: summary ${summary.id} (tenant ${summary.tenantId}) failed: ${err instanceof Error ? err.message : String(err)}`);
         }
     }
     return result;
@@ -353,7 +353,7 @@ export async function buildEntityProfiles(hippoRoot, l2Summaries, opts) {
             catch (err) {
                 if (err instanceof RejectedValueError) {
                     result.rejected++;
-                    console.error(`[buildEntityProfiles] cluster "${cluster.label}" skipped: profile matches a rejected value`);
+                    log.warn(`buildEntityProfiles: cluster "${cluster.label}" skipped: profile matches a rejected value`);
                     continue;
                 }
                 throw err;

package/dist/dashboard.js

@@ -18,6 +18,7 @@ import { loadEmbeddingIndex } from './embeddings.js';
 import { resolveTenantId } from './tenant.js';
 import { loadCardDetail } from './card-detail.js';
 import { isCrossSite, LOOPBACK_HOST_HEADER } from './server.js';
+import { log } from './log.js';
 function buildDashboardData(hippoRoot) {
     // A5: scope dashboard to active tenant. Without this, the UI surfaces every
     // tenant's memories on a multi-tenant deployment.
@@ -152,7 +153,7 @@ function serveStaticFile(res, filePath) {
         return true;
     }
     catch {
-        return false;
+        return false; // an unreadable asset falls through to the next route, which answers 404 or the fallback page
     }
 }
 export function serveDashboard(hippoRoot, port = 3333) {
@@ -249,7 +250,7 @@ export function serveDashboard(hippoRoot, port = 3333) {
             handleRequest(req, res);
         }
         catch (err) {
-            console.error('Dashboard request failed:', err);
+            log.error(`dashboard request failed: ${err instanceof Error ? err.message : String(err)}`);
             if (res.headersSent)
                 res.end();
             else
@@ -257,6 +258,7 @@ export function serveDashboard(hippoRoot, port = 3333) {
         }
     });
     server.listen(port, '127.0.0.1', () => {
+        // The banner is the `hippo dashboard` command's printed result, so it stays on stdout.
         console.log(`Hippo Dashboard running at http://localhost:${port}`);
         if (hasDistUi)
             console.log(`Serving React UI from ${distUiDir}`);

package/dist/db.js

@@ -12,7 +12,7 @@ const require = createRequire(import.meta.url);
 // runtime (Node's built-in synchronous SQLite module); there are no bundled
 // types for it here, so this require + cast is the module's documented boundary.
 const { DatabaseSync } = require('node:sqlite');
-const CURRENT_SCHEMA_VERSION = 50;
+const CURRENT_SCHEMA_VERSION = 51;
 const MIGRATIONS = [
     {
         version: 1,
@@ -2568,6 +2568,19 @@ const MIGRATIONS = [
       `);
         },
     },
+    {
+        version: 51,
+        up: (db) => {
+            // Both indexes serve loadAmbientCandidates (src/store.ts); their WHERE text must match its SQL for the planner to pick them.
+            // The drift index stays empty on a healthy store, so the drift probe is one index seek instead of a tenant scan. Additive only.
+            db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_memories_pinned
+          ON memories(tenant_id, created, id) WHERE pinned = 1;
+        CREATE INDEX IF NOT EXISTS idx_memories_created_drift
+          ON memories(tenant_id) WHERE superseded_by IS NULL AND (length(created) <> 24 OR created NOT LIKE '%Z');
+      `);
+        },
+    },
 ];
 function tableHasColumn(db, tableName, columnName) {
     if (!/^[a-z_]+$/i.test(tableName))
@@ -2700,7 +2713,7 @@ function openOwnHippoDb(hippoRoot, opts) {
             cleanupArchivedMirrors(hippoRoot, db);
         }
         catch (cleanupErr) {
-            console.error('openHippoDb: cleanupArchivedMirrors failed (non-fatal):', cleanupErr);
+            log.error(`openHippoDb: cleanupArchivedMirrors failed (non-fatal): ${cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr)}`);
         }
         return db;
     }
@@ -2964,7 +2977,7 @@ function ensureOptionalFts(db) {
         available = true;
     }
     catch (err) {
-        console.error(`hippo: full-text index unavailable (${err instanceof Error ? err.message : String(err)}); search falls back to slower LIKE matching`);
+        log.warn(`full-text index unavailable (${err instanceof Error ? err.message : String(err)}); search falls back to slower LIKE matching`);
     }
     // Read-first: only write when the flag actually changed, so a healthy
     // store's open doesn't take a write lock for a same-value upsert.

package/dist/delivery-recorder.js

@@ -205,6 +205,7 @@ export function createDeliveryRecorder(init) {
                 return;
             flushed = true;
             if (broken !== null) {
+                // Same pinned `[hippo] delivery ledger` hook stderr line as recall-trace.ts's write failure.
                 console.error(`[hippo] delivery ledger skipped: recorder failed: ${broken}`);
                 return;
             }

package/dist/doctor.js

@@ -36,6 +36,7 @@ function readJson(file) {
         return JSON.parse(fs.readFileSync(file, 'utf8'));
     }
     catch {
+        // A missing or corrupt file is the finding doctor reports, so null is the answer.
         return null;
     }
 }

package/dist/dormant.js

@@ -36,6 +36,7 @@ function parseSnapshot(row) {
         return entry;
     }
     catch {
+        // A row that will not parse is out of shape, so it is not restorable.
         return null;
     }
 }

package/dist/embedding-provider.js

@@ -32,7 +32,7 @@
  */
 import { getEmbedding, isEmbeddingAvailable, resolveEmbeddingModel, DEFAULT_EMBEDDING_MODEL, } from './embeddings.js';
 import { loadConfig } from './config.js';
-import { redactSecrets } from './secret-detect.js';
+import { redactSecretsStrict } from './secret-detect.js';
 import { fetchWithRetry } from './http-retry.js';
 export const API_PROVIDER_KINDS = ['openai', 'voyage', 'cohere'];
 function isApiProviderKind(x) {
@@ -191,7 +191,7 @@ class ApiEmbeddingProvider {
                     'content-type': 'application/json',
                     authorization: `Bearer ${key}`,
                 },
-                body: JSON.stringify(spec.buildBody(this.model, chunk.map(redactSecrets), role)),
+                body: JSON.stringify(spec.buildBody(this.model, chunk.map(redactSecretsStrict), role)),
             }, { timeoutMs: REQUEST_TIMEOUT_MS });
         }
         catch (err) {
@@ -237,6 +237,7 @@ function readEmbeddingsConfig(hippoRoot) {
         return loadConfig(hippoRoot).embeddings;
     }
     catch {
+        // An unreadable config falls back to provider defaults; loadConfig warns on a bad parse.
         return {};
     }
 }

package/dist/embeddings.js

@@ -147,7 +147,7 @@ function resolveTransformersPackage() {
         return '@xenova/transformers';
     }
     catch {
-        return null;
+        return null; // neither optional package is installed; callers fall back to no local embeddings
     }
 }
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -177,7 +177,8 @@ async function loadPipeline(model) {
             }
             pipelineFn = mod.pipeline ?? mod.default?.pipeline;
         }
-        catch {
+        catch (err) {
+            log.debug(`transformers import failed (${pkg}): ${err instanceof Error ? err.message : String(err)}`);
             return null;
         }
         if (!pipelineFn)
@@ -193,7 +194,8 @@ async function loadPipeline(model) {
             _pipelineInstances.set(model, instance);
             return instance;
         }
-        catch {
+        catch (err) {
+            log.debug(`embedding pipeline load failed (${model}): ${err instanceof Error ? err.message : String(err)}`);
             return null;
         }
         finally {
@@ -228,7 +230,8 @@ function loadStoredEmbeddingModel(hippoRoot) {
             closeHippoDb(db);
         }
     }
-    catch {
+    catch (err) {
+        log.debug(`stored embedding model unreadable: ${err instanceof Error ? err.message : String(err)}`);
         return null;
     }
 }
@@ -363,7 +366,7 @@ function parseEmbeddingIndex(raw) {
         return parsed instanceof Object && !Array.isArray(parsed) ? parsed : null;
     }
     catch {
-        return null;
+        return null; // the caller quarantines the corrupt file and logs it
     }
 }
 /** Move a corrupt index aside and flag a full rebuild, so no later save can write over the only copy of those bytes. */
@@ -523,7 +526,7 @@ function warnEmbedFailureOnce(source, rawMessage) {
     _embedFailureWarned = true;
     // Strict scrub: this line can land in a hook log file, and an API may echo the key back in its error body.
     const message = redactSecretsStrict(rawMessage).replace(/\s+/g, ' ').replace(/\.+$/, '');
-    console.error(`hippo: embedding failed (${source}): ${message}. Memories are stored without embeddings until this is fixed.`);
+    log.warn(`embedding failed (${source}): ${message}. Memories are stored without embeddings until this is fixed.`);
 }
 /**
  * Embed a single memory entry and cache the result in the embedding index.
@@ -591,7 +594,7 @@ export async function embedMemory(hippoRoot, entry, model) {
             warnEmbedFailureOnce(provider.kind, err instanceof Error ? err.message : String(err));
         }
     }).catch((err) => {
-        console.error(`hippo: skipped embedding ${entry.id} (${err instanceof Error ? err.message : String(err)}); run 'hippo embed' to backfill`);
+        log.warn(`skipped embedding ${entry.id} (${err instanceof Error ? err.message : String(err)}); run 'hippo embed' to backfill`);
     });
 }
 /**

package/dist/extract.js

@@ -2,9 +2,10 @@ import { Layer, createMemory } from './memory.js';
 import { writeEntry } from './store.js';
 import { loadConfig } from './config.js';
 import { RejectedValueError } from './rejection.js';
-import { redactSecrets } from './secret-detect.js';
+import { redactSecretsStrict } from './secret-detect.js';
 import { fetchWithRetry, llmTimeoutMs } from './http-retry.js';
 import { neverAutoShareTags } from './shared.js';
+import { log } from './log.js';
 function isJsonString(value) {
     return typeof value === 'string';
 }
@@ -35,7 +36,7 @@ export async function extractFacts(text, opts) {
             body: JSON.stringify({
                 model,
                 max_tokens: 1200,
-                messages: [{ role: 'user', content: EXTRACTION_PROMPT + redactSecrets(text) }],
+                messages: [{ role: 'user', content: EXTRACTION_PROMPT + redactSecretsStrict(text) }],
             }),
         }, { timeoutMs: llmTimeoutMs(), fetchFn });
     }
@@ -124,7 +125,7 @@ export function storeExtractedFacts(hippoRoot, source, facts) {
         entries.push(entry);
     }
     if (rejected > 0) {
-        console.error(`storeExtractedFacts: skipped ${rejected} rejected value(s)`);
+        log.warn(`storeExtractedFacts: skipped ${rejected} rejected value(s)`);
     }
     return entries;
 }

package/dist/graph.js

@@ -19,6 +19,7 @@
  */
 import { openHippoDb, closeHippoDb } from './db.js';
 import { assertTenantId } from './tenant.js';
+import { log } from './log.js';
 const SOURCE_OBJECT_TABLE = {
     decision: 'decisions',
     policy: 'policies',
@@ -665,10 +666,7 @@ export function markGraphDirty(hippoRoot, tenantId, memoryId) {
     catch (err) {
         // Logged (warn) so a SYSTEMATIC enqueue failure surfaces to operators, but
         // swallowed so the already-committed E2 write is never rolled back.
-        // SAFETY: this is a best-effort log message only; property access on any
-        // JS value is safe (undefined if absent), preserving the existing lenient
-        // formatting even when something non-Error was thrown.
-        console.warn(`markGraphDirty: enqueue failed for tenant=${tenantId} memory=${memoryId}: ${err.message}`);
+        log.warn(`markGraphDirty: enqueue failed for tenant=${tenantId} memory=${memoryId}: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
 /**
@@ -707,10 +705,7 @@ export function removeGraphEntitiesForObject(hippoRoot, tenantId, sourceObjectTy
         }
     }
     catch (err) {
-        // SAFETY: this is a best-effort log message only; property access on any
-        // JS value is safe (undefined if absent), preserving the existing lenient
-        // formatting even when something non-Error was thrown.
-        console.warn(`removeGraphEntitiesForObject: failed for tenant=${tenantId} ${sourceObjectType}#${sourceObjectId}: ${err.message}`);
+        log.warn(`removeGraphEntitiesForObject: failed for tenant=${tenantId} ${sourceObjectType}#${sourceObjectId}: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
 /**

package/dist/handoff.js

@@ -25,6 +25,7 @@ export function rowToSessionHandoff(row) {
         }
     }
     catch {
+        // A corrupt column degrades to empty instead of hiding the whole handoff.
         artifacts = [];
     }
     let constraints = [];
@@ -35,6 +36,7 @@ export function rowToSessionHandoff(row) {
         }
     }
     catch {
+        // Same degrade-to-empty rule as artifacts.
         constraints = [];
     }
     let evidence = null;
@@ -43,6 +45,7 @@ export function rowToSessionHandoff(row) {
         evidence = row.evidence_json ? JSON.parse(row.evidence_json) : null;
     }
     catch {
+        // Same degrade rule as artifacts: bad evidence reads as none.
         evidence = null;
     }
     return {

package/dist/hooks.js

@@ -183,6 +183,7 @@ function readCodexWrapperMetadata() {
         return parsed;
     }
     catch {
+        // Unreadable metadata is treated like the missing-file case above.
         return null;
     }
 }
@@ -191,6 +192,7 @@ function readTextFile(filePath) {
         return fs.readFileSync(filePath, 'utf8');
     }
     catch {
+        // Callers treat an unreadable file as absent.
         return null;
     }
 }
@@ -879,6 +881,7 @@ export function uninstallJsonHooks(target) {
         settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
     }
     catch {
+        // Never rewrite a settings file we cannot parse; report nothing uninstalled.
         return false;
     }
     if (!isJsonObject(settings) || !isJsonObject(settings.hooks))

package/dist/importers.js

@@ -14,6 +14,7 @@ import { openHippoDb, closeHippoDb } from './db.js';
 import { RejectedValueError, checkRejectionGuard } from './rejection.js';
 import { loadConfig } from './config.js';
 import { vetSecrets } from './secret-detect.js';
+import { log } from './log.js';
 // ---------------------------------------------------------------------------
 // Shared core: dedup + write
 // ---------------------------------------------------------------------------
@@ -48,7 +49,7 @@ export function importEntries(chunks, source, tags, options) {
             const trimmed = vetSecrets(original, allTags, true).content;
             const wasRedacted = trimmed !== original;
             if (trimmed.length > 1000) {
-                console.error(`Warning: imported memory truncated from ${trimmed.length} to 1000 chars`);
+                log.warn(`imported memory truncated from ${trimmed.length} to 1000 chars`);
             }
             const chunk = trimmed.slice(0, 1000);
             // Skip empty or too-short chunks
@@ -584,7 +585,8 @@ function realpathOrResolve(p) {
     try {
         return fs.realpathSync.native(p);
     }
-    catch {
+    catch (err) {
+        log.debug(`import: realpath fell back to resolve for ${p}: ${err instanceof Error ? err.message : String(err)}`);
         return path.resolve(p);
     }
 }
@@ -890,7 +892,8 @@ function parseJsonArrayLoose(value) {
         const parsed = JSON.parse(value);
         return Array.isArray(parsed) ? parsed.filter(isJsonString) : [];
     }
-    catch {
+    catch (err) {
+        log.debug(`import: unreadable tags_json read as no tags: ${err instanceof Error ? err.message : String(err)}`);
         return [];
     }
 }

package/dist/incidents.js

@@ -48,6 +48,7 @@ function parseLinkedMemoryIds(raw) {
         return [];
     }
     catch {
+        // A malformed list column reads as empty instead of failing the incident read.
         return [];
     }
 }

package/dist/judgment.js

@@ -2,6 +2,7 @@
  *  Regex picks WHAT is a candidate; it cannot say what is worth keeping, so
  *  every captured memory currently lands on a flat schema_fit of 0.5. */
 import { fetchWithRetry } from './http-retry.js';
+import { log } from './log.js';
 const ENDPOINT = 'https://api.typesafe.ai/v1/systemone';
 const DEFAULT_MODEL = 'jev-1.13.0';
 const MAX_CONCURRENCY = 8;
@@ -66,7 +67,8 @@ async function post(content, opts) {
             }),
         }, { timeoutMs: JUDGE_TIMEOUT_MS, fetchFn: opts.fetcher });
     }
-    catch {
+    catch (err) {
+        log.debug(`judge: request failed: ${err instanceof Error ? err.message : String(err)}`);
         return null;
     }
     return res.ok ? res : null;
@@ -87,7 +89,8 @@ export async function judge(content, opts) {
         // optional-chained and range-checked before use, so a lie here returns null.
         data = await res.json();
     }
-    catch {
+    catch (err) {
+        log.debug(`judge: unreadable response: ${err instanceof Error ? err.message : String(err)}`);
         return null;
     }
     const durable = data.answers?.durable?.noul;