hippo-memory 1.60.0 → 1.61.0

package/dist/cli/session-hooks.js

@@ -0,0 +1,637 @@
+// Agent lifecycle hook verbs: session end, compaction, tool-failure capture and the Codex wrapper.
+import * as path from 'path';
+import * as fs from 'fs';
+import { spawn } from 'child_process';
+import { defaultSleepLogPath } from '../hooks/shared.js';
+import { resolveCodexSessionTranscript } from '../hooks/codex-session.js';
+import { resolveCodexWrapperPaths } from '../hooks/codex-wrapper.js';
+import { isInitialized } from '../store/open.js';
+import { loadActiveTaskSnapshot, loadFreshActiveTaskSnapshot, closeTaskSnapshotsForSession, listSessionEvents, } from '../store/sessions.js';
+import { writeSessionEndHandoff } from '../store/handoffs.js';
+import { readSessionScan, recordSessionDigest } from '../session-digest.js';
+import { openHippoDb, closeHippoDb } from '../db.js';
+import { captureToolFailure } from '../capture-error.js';
+import { estimateTokens, isSubagentPayload, readApiCalls, recordRereads, recordTokenUse, } from '../token-ledger.js';
+import { currentMachine, importAtCompaction } from '../agent-memories/sync.js';
+import { summaryLine } from '../agent-memories/report.js';
+import { deriveOriginProject } from '../project-identity.js';
+import { getGlobalRoot } from '../shared.js';
+import { cmdCapture } from '../capture/command.js';
+import { cmdPreCompact, cmdPostCompact, transcriptWorkingState } from '../capture/compact.js';
+import { resolveLastSessionTranscript } from '../capture/transcript.js';
+import { truncateCodePointSafe } from '../transcript-tail.js';
+import { COMPACTION_DB_WAIT_MS } from '../compaction-record.js';
+import { readStdinBounded } from '../stdin.js';
+import { resolveTenantId } from '../tenant.js';
+import { log } from '../log.js';
+import { printError } from './output.js';
+import { collectHandoffEvidence, logSessionEndImport, appendSessionEndCloseLog, printActiveTaskSnapshot, printSessionEvents, resetHookInjection, captureConsole, hookStoreRoot, withLedgerDb, runHookWithStores, inPilotHoldout, } from './shared.js';
+/** Prints the SessionEnd sleep log, then clears it. Stderr, because Claude Code adds
+ *  SessionStart stdout to the model's context and this log is for the user. */
+export function cmdLastSleep(flags) {
+    const logPath = typeof flags['path'] === 'string'
+        ? flags['path']
+        : defaultSleepLogPath();
+    if (!fs.existsSync(logPath))
+        return;
+    let content;
+    try {
+        content = fs.readFileSync(logPath, 'utf8');
+    }
+    catch {
+        // Removed or locked since the exists check: there is nothing to show this session.
+        return;
+    }
+    if (content.trim().length > 0) {
+        printError('=== Previous session hippo consolidation ===');
+        process.stderr.write(content);
+        if (!content.endsWith('\n'))
+            printError();
+        printError('===========================================');
+    }
+    if (!flags['keep']) {
+        try {
+            fs.unlinkSync(logPath);
+        }
+        catch { /* non-fatal */ }
+    }
+}
+/**
+ * SessionStart(compact) injector. Prints the active task snapshot + recent
+ * session trail so working state that would otherwise be lost to
+ * compaction summarisation survives into the new context window. No pinned
+ * memories here — the UserPromptSubmit hook already re-injects those every
+ * turn, so duplicating them here would double token cost for nothing.
+ *
+ * Same exit-0/crash-safety contract as `hippo pre-compact` (critic round
+ * 2): every path exits 0. A malformed payload or a store read failure
+ * degrades to empty stdout, never a thrown error — a failing SessionStart
+ * hook must not pollute session startup.
+ */
+// X8: session-event content is capped at print time only — the shared
+// printSessionEvents stays untouched for every other caller.
+const COMPACT_RESUME_EVENT_CONTENT_CAP = 400;
+// A snapshot older than this was not written for this compaction (pre-compact skipped), so restoring it is stale, not a resume.
+const COMPACT_RESUME_MAX_AGE_MS = 15 * 60_000;
+function cmdCompactResume(hippoRoot, stdinText, stdinTimedOut) {
+    try {
+        // X3: gate on the non-exiting isInitialized check before any
+        // store-opening call (loadActiveTaskSnapshot/listSessionEvents both
+        // call initStore internally, which would silently create a store in a
+        // project that never ran `hippo init` — this hook fires globally).
+        if (!isInitialized(hippoRoot)) {
+            process.exit(0);
+        }
+        // The matcher is an optimization, not a dependency: older Claude Code
+        // that ignores `matcher: 'compact'` would run this on every SessionStart,
+        // so we also gate on payload.source here. A payload that parses but
+        // carries a different source (e.g. 'startup') means the matcher-based
+        // gate failed to apply — stay silent rather than print stale state.
+        const nonEmptyStdin = !!stdinText && stdinText.trim() !== '';
+        // Without a payload session_id the X5 cross-restore guard below can
+        // never fire, so a timed-out empty read must not reach the print path.
+        let suppressOutput = stdinTimedOut && !nonEmptyStdin;
+        let payloadSessionId = null;
+        if (nonEmptyStdin) {
+            let payload = null;
+            try {
+                payload = JSON.parse(stdinText.trim());
+            }
+            catch {
+                // Malformed JSON is handled as a null payload by the fail-closed check below.
+                payload = null;
+            }
+            if (!payload || typeof payload !== 'object') {
+                // X13: fail closed on malformed non-empty stdin. The earlier
+                // "print on malformed" behavior survives only for TTY/no-stdin
+                // manual invocation (nonEmptyStdin is false there, this branch
+                // never runs).
+                suppressOutput = true;
+            }
+            else {
+                // Fail closed on structurally incomplete payloads too ({}, [],
+                // source missing/non-string): any parsed non-empty payload must say
+                // source === 'compact' to print. Real SessionStart payloads always
+                // carry source; only the TTY/no-stdin manual path prints without
+                // one (codex round 3).
+                // A sub-agent's payload carries its parent's session id, so X5 would pass and restore the parent's snapshot into it.
+                if (payload.source !== 'compact' || isSubagentPayload(stdinText)) {
+                    suppressOutput = true;
+                }
+                if (typeof payload.session_id === 'string') {
+                    payloadSessionId = payload.session_id;
+                }
+            }
+        }
+        // A compaction follows a prompt or SessionStart that booked the arm, so this only reads it.
+        if (!suppressOutput && payloadSessionId !== null && inPilotHoldout(hippoRoot, resolveTenantId({}), payloadSessionId, false)) {
+            suppressOutput = true;
+        }
+        if (!suppressOutput) {
+            const tenantId = resolveTenantId({});
+            const snapshot = loadFreshActiveTaskSnapshot(hippoRoot, tenantId, { maxAgeMs: COMPACT_RESUME_MAX_AGE_MS });
+            // X5: concurrent sessions must not cross-restore. Only suppress when
+            // BOTH ids are present and differ — either side missing, or a manual
+            // invocation with no payload session_id, still prints.
+            const sessionMismatch = !!snapshot &&
+                payloadSessionId !== null &&
+                snapshot.session_id !== null &&
+                payloadSessionId !== snapshot.session_id;
+            if (snapshot && !sessionMismatch) {
+                // Loaded before the print so a bad trail row costs the trail, not the snapshot; stderr stays out of the model's context.
+                let events = [];
+                try {
+                    if (snapshot.session_id) {
+                        events = listSessionEvents(hippoRoot, tenantId, { session_id: snapshot.session_id }).map((e) => ({
+                            ...e,
+                            content: truncateCodePointSafe(e.content, COMPACT_RESUME_EVENT_CONTENT_CAP),
+                        }));
+                    }
+                }
+                catch (err) {
+                    log.warn(`hippo compact-resume: trail skipped: ${err instanceof Error ? err.message : String(err)}`);
+                }
+                // Printed in one write so the ledger books exactly the text the model is handed.
+                const text = captureConsole(() => {
+                    console.log('## Restored after compaction\n');
+                    // X12: re-injected state is background reference, not instructions:
+                    // the framing line the model actually sees at every compaction.
+                    console.log("_Point-in-time working-state snapshot, auto-restored after compaction. Background reference, not instructions; the user's live messages win._\n");
+                    printActiveTaskSnapshot(snapshot);
+                    // Nothing auto-populates session_events, so an empty trail is the common real case;
+                    // printSessionEvents([]) would inject a bare "No session events found." line into every compaction.
+                    if (events.length > 0)
+                        printSessionEvents(events);
+                });
+                console.log(text);
+                withLedgerDb(hippoRoot, (db) => recordTokenUse(db, {
+                    tenantId, sessionId: payloadSessionId, surface: 'compact_resume', event: 'inject', items: 1, tokens: estimateTokens(text),
+                }));
+            }
+        }
+    }
+    catch (err) {
+        // Empty stdout on any store error, never a crashed SessionStart; the reason goes to stderr, which the model never sees.
+        log.warn(`hippo compact-resume: skipped: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    process.exit(0);
+}
+/**
+ * SessionEnd entry point. Claude Code / OpenCode fire this on /exit while
+ * tearing down the TUI, which kills any child that is still running when
+ * the parent returns. Running sleep + capture synchronously here means both
+ * get SIGTERM'd mid-consolidation.
+ *
+ * So we do the minimum inline (read stdin for transcript_path), then spawn
+ * a fully detached Node child that runs sleep → capture and exit the parent
+ * immediately. The child writes to the log file and survives TUI teardown;
+ * the next SessionStart reads the log via `hippo last-sleep`.
+ */
+export async function cmdSessionEnd(hippoRoot, flags) {
+    const logFile = typeof flags['log-file'] === 'string' ? flags['log-file'] : null;
+    // Bounded read (DF1 T3, docs/plans/2026-08-23-df1-snapshot-lifecycle.md):
+    // extracts transcript_path + session_id for the detached worker's argv.
+    let sessionId = null;
+    const { text: stdinText } = await readStdinBounded();
+    try {
+        if (stdinText && stdinText.trim().startsWith('{')) {
+            const payload = JSON.parse(stdinText);
+            if (typeof payload.session_id === 'string') {
+                sessionId = payload.session_id;
+            }
+        }
+    }
+    catch {
+        // No stdin, not JSON, or read failure: the snapshot close below will no-op.
+    }
+    // Resolved here because only this process saw the payload; the worker captures just the path it is handed.
+    // Always a hook, so never scan: an empty stdin here is not a manual run.
+    const transcriptPath = resolveLastSessionTranscript(undefined, stdinText, { mayScan: false });
+    const workerArgs = [process.argv[1], '__session-end-worker'];
+    if (logFile)
+        workerArgs.push('--log-file', logFile);
+    if (transcriptPath)
+        workerArgs.push('--transcript', transcriptPath);
+    if (sessionId)
+        workerArgs.push('--session-id', sessionId);
+    try {
+        const child = spawn(process.execPath, workerArgs, {
+            detached: true,
+            stdio: 'ignore',
+            windowsHide: true,
+        });
+        child.unref();
+    }
+    catch (err) {
+        // If spawn fails, run inline as a last resort, handed what the child's argv would have carried.
+        if (transcriptPath)
+            flags['transcript'] = transcriptPath;
+        if (sessionId)
+            flags['session-id'] = sessionId;
+        await cmdSessionEndWorker(hippoRoot, flags);
+        return;
+    }
+}
+export async function cmdSessionEndWorker(hippoRoot, flags) {
+    const transcriptPath = typeof flags['transcript'] === 'string' ? flags['transcript'] : undefined;
+    const closeLogFile = typeof flags['log-file'] === 'string' ? flags['log-file'] : null;
+    const closeSessionId = typeof flags['session-id'] === 'string' ? flags['session-id'] : null;
+    const rereadLog = await bookSessionRereads(hippoRoot, transcriptPath, closeSessionId)
+        .catch((err) => [`re-read count failed: ${err instanceof Error ? err.message : String(err)}`]);
+    // Sleep starts the log file afresh, so the lines go in after it; on exit too, in case sleep exits the process.
+    const flushRereadLog = () => { for (const line of rereadLog.splice(0))
+        appendSessionEndCloseLog(closeLogFile, line); };
+    process.once('exit', flushRereadLog);
+    // Like the other hooks: project store, else global; a folder with neither must not get one made.
+    const store = hookStoreRoot(hippoRoot);
+    if (!isInitialized(store)) {
+        appendSessionEndCloseLog(closeLogFile, 'skip: no hippo store for this folder or globally', { startFresh: true });
+        flushRereadLog();
+        return;
+    }
+    // Sleeping the global store from here would learn this folder's git commits into it; it has its own daily sleep.
+    if (isInitialized(hippoRoot)) {
+        try {
+            await (await import('./sleep.js')).cmdSleep(hippoRoot, flags);
+        }
+        catch {
+            // sleep errors are already tee'd to the log file via cmdSleep's
+            // `[hippo] sleep failed: ...` line. Continue to capture regardless.
+        }
+    }
+    else {
+        appendSessionEndCloseLog(closeLogFile, 'skip sleep: this folder has no store of its own', { startFresh: true });
+        logSessionEndImport(closeLogFile, transcriptPath);
+    }
+    flushRereadLog();
+    const digestLog = (message) => appendSessionEndCloseLog(closeLogFile, message);
+    const scan = transcriptPath ? readSessionScan(transcriptPath, digestLog) : null;
+    try {
+        const logFile = typeof flags['log-file'] === 'string' ? flags['log-file'] : undefined;
+        // With no stdin of its own, capture would read this as a manual run and scan every project.
+        if (!transcriptPath) {
+            appendSessionEndCloseLog(logFile ?? null, 'skip capture: no transcript for this session');
+        }
+        else {
+            cmdCapture(store, {
+                source: 'last-session',
+                transcriptPath,
+                logFile,
+                dryRun: false,
+                global: false,
+                tenantId: resolveTenantId({}),
+                // In the global store, rows would otherwise read as user-global and show up in every project.
+                originProject: store === hippoRoot ? undefined : deriveOriginProject(process.cwd()),
+                sessionTurns: scan?.turns,
+            });
+        }
+    }
+    catch {
+        // Same treatment — the failure line is already in the log.
+    }
+    recordSessionDigest(hippoRoot, scan, {
+        key: closeSessionId || path.basename(transcriptPath ?? '', '.jsonl'),
+        tenantId: resolveTenantId({}),
+        log: digestLog,
+    });
+    // DF1 T3: close the ending session's own active task snapshot AFTER
+    // sleep+capture complete — neither producer (runPreCompact,
+    // `hippo snapshot save`) runs inside session-end, so this can never
+    // destroy same-run work. Scoped to `--session-id`: a concurrent session's
+    // active snapshot is untouched (closeTaskSnapshotsForSession's own WHERE
+    // clause). Absent session id -> no-op plus one log line; session-end is
+    // not guaranteed to fire at all (crash, kill -9), so the freshness bound
+    // in loadFreshActiveTaskSnapshot is the backstop layer, not this close.
+    // Handoff write happens BEFORE the snapshot close below, while the
+    // snapshot writeSessionEndHandoff reads is still active.
+    if (closeSessionId) {
+        try {
+            const tenantId = resolveTenantId({});
+            const ownSnapshot = loadActiveTaskSnapshot(store, tenantId)?.session_id === closeSessionId;
+            // A never-compacted session has no snapshot; read even when it has one, as another session's PreCompact can take the slot before the write.
+            const derived = transcriptPath
+                ? transcriptWorkingState(transcriptPath, (message) => appendSessionEndCloseLog(closeLogFile, message))
+                : null;
+            if (!ownSnapshot && !derived) {
+                appendSessionEndCloseLog(closeLogFile, 'skip: no snapshot or transcript for session');
+            }
+            else {
+                const evidence = collectHandoffEvidence(process.cwd(), 'unknown');
+                const handoff = writeSessionEndHandoff(store, tenantId, closeSessionId, evidence, derived);
+                appendSessionEndCloseLog(closeLogFile, handoff ? `wrote handoff for session ${closeSessionId}` : `skip: kept the existing handoff for session ${closeSessionId}`);
+            }
+        }
+        catch (err) {
+            // SAFETY: catch clauses bind unknown, but Node/V8 always throws an Error here.
+            appendSessionEndCloseLog(closeLogFile, `handoff write failed: ${err.message}`);
+        }
+    }
+    try {
+        if (closeSessionId) {
+            const closed = closeTaskSnapshotsForSession(store, resolveTenantId({}), closeSessionId);
+            appendSessionEndCloseLog(closeLogFile, `closed ${closed} active snapshot(s) for session ${closeSessionId}`);
+        }
+        else {
+            appendSessionEndCloseLog(closeLogFile, 'skip: no session_id in SessionEnd payload, active snapshot left untouched');
+        }
+    }
+    catch (err) {
+        appendSessionEndCloseLog(closeLogFile, `snapshot close failed: ${err.message}`);
+    }
+}
+/** Books the ending session's re-reads in each store its ledger rows can land in (project and global); returns the log lines. */
+async function bookSessionRereads(hippoRoot, transcriptPath, sessionId) {
+    if (!transcriptPath || !sessionId)
+        return [];
+    let read;
+    try {
+        read = await readApiCalls(transcriptPath);
+    }
+    catch (err) {
+        return [`skip re-read count: cannot read the transcript: ${err instanceof Error ? err.message : String(err)}`];
+    }
+    const roots = new Set([hippoRoot, getGlobalRoot()].filter((root) => isInitialized(root)).map((root) => path.resolve(root)));
+    const lines = [];
+    let tokens = 0;
+    for (const root of roots) {
+        try {
+            const db = openHippoDb(root);
+            try {
+                tokens += recordRereads(db, resolveTenantId({}), sessionId, read.calls);
+            }
+            finally {
+                closeHippoDb(db);
+            }
+        }
+        catch (err) {
+            lines.push(`re-read count failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    const skipped = read.malformed > 0 ? `, ${read.malformed} unparsable transcript lines skipped` : '';
+    lines.push(`re-read ${tokens} tokens over ${read.calls.length} model calls for session ${sessionId}${skipped}`);
+    return lines;
+}
+function loadCodexWrapperMetadata() {
+    const { metadataPath } = resolveCodexWrapperPaths();
+    if (!fs.existsSync(metadataPath)) {
+        throw new Error('Codex wrapper is not installed. Run `hippo hook install codex` first.');
+    }
+    return JSON.parse(fs.readFileSync(metadataPath, 'utf8'));
+}
+/** Quotes one cmd.exe argument; each `%` leaves the quotes as `^%`, so no %NAME% pair can expand. */
+export function quoteCmdArg(arg) {
+    if (arg.length === 0)
+        return '""';
+    if (!/[ \t"&()^<>|%!]/.test(arg))
+        return arg;
+    return `"${arg.replace(/"/g, '""').replace(/%/g, '"^%"')}"`;
+}
+/** cmd.exe arguments that run a .cmd or .bat shim with every forwarded argument delivered verbatim. */
+export function cmdShimArgs(shimPath, forwardArgs) {
+    const command = `"${shimPath}"${forwardArgs.length > 0 ? ` ${forwardArgs.map(quoteCmdArg).join(' ')}` : ''}`;
+    // The line is already quoted for cmd.exe, so Node must not quote it again; /s strips the outer pair.
+    return ['/d', '/v:off', '/s', '/c', `"${command}"`];
+}
+function spawnRealCodex(realCodexPath, forwardArgs, cwd) {
+    const ext = path.extname(realCodexPath).toLowerCase();
+    if (process.platform === 'win32' && ext === '.ps1') {
+        return spawn('powershell.exe', ['-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', realCodexPath, ...forwardArgs], { cwd, stdio: 'inherit', windowsHide: false });
+    }
+    if (process.platform === 'win32' && (ext === '.cmd' || ext === '.bat')) {
+        return spawn('cmd.exe', cmdShimArgs(realCodexPath, forwardArgs), { cwd, stdio: 'inherit', windowsHide: false, windowsVerbatimArguments: true });
+    }
+    return spawn(realCodexPath, forwardArgs, { cwd, stdio: 'inherit', windowsHide: false });
+}
+export function cmdCodexRun(hippoRoot, args) {
+    const metadata = loadCodexWrapperMetadata();
+    const startedAtMs = Date.now();
+    // Codex reads CODEX_HOME at each launch, so resolve it now, not from the install-time metadata.
+    const { historyPath } = resolveCodexWrapperPaths();
+    const startOffsetBytes = fs.existsSync(historyPath) ? fs.statSync(historyPath).size : 0;
+    try {
+        cmdLastSleep({ path: metadata.logFile });
+    }
+    catch {
+        // best-effort only
+    }
+    const child = spawnRealCodex(metadata.realCodexPath, args, process.cwd());
+    child.on('error', (err) => {
+        printError(`Failed to launch Codex: ${err.message}`);
+        process.exit(1);
+    });
+    child.on('exit', async (code, signal) => {
+        const workerArgs = [
+            process.argv[1],
+            '__codex-session-end-worker',
+            '--codex-home',
+            path.dirname(historyPath),
+            '--history-path',
+            historyPath,
+            '--start-offset',
+            String(startOffsetBytes),
+            '--started-at',
+            String(startedAtMs),
+            '--log-file',
+            metadata.logFile,
+        ];
+        try {
+            const worker = spawn(process.execPath, workerArgs, {
+                detached: true,
+                stdio: 'ignore',
+                windowsHide: true,
+            });
+            worker.unref();
+        }
+        catch {
+            // Fall back to the inline path if the detached worker cannot be created.
+            // Awaited so the sleep write can't be killed by the exit calls below.
+            try {
+                await cmdCodexSessionEndWorker(hippoRoot, {
+                    'codex-home': path.dirname(historyPath),
+                    'history-path': historyPath,
+                    'start-offset': String(startOffsetBytes),
+                    'started-at': String(startedAtMs),
+                    'log-file': metadata.logFile,
+                });
+            }
+            catch {
+                // cmdCodexSessionEndWorker already fail-softs internally; this is belt-and-braces.
+            }
+        }
+        if (signal) {
+            try {
+                process.kill(process.pid, signal);
+            }
+            catch {
+                // Cannot re-raise the child's signal on this platform; a non-zero exit still reports the failure.
+                process.exit(1);
+            }
+            return;
+        }
+        process.exit(code ?? 0);
+    });
+}
+export async function cmdCodexSessionEndWorker(hippoRoot, flags) {
+    const logFile = typeof flags['log-file'] === 'string' ? flags['log-file'] : undefined;
+    // Like the other hooks: project store, else global; a folder with neither must not get one made.
+    const store = hookStoreRoot(hippoRoot);
+    if (!isInitialized(store)) {
+        appendSessionEndCloseLog(logFile ?? null, 'skip: no hippo store for this folder or globally', { startFresh: true });
+        return;
+    }
+    // Sleeping the global store from here would learn this folder's git commits into it; it has its own daily sleep.
+    if (isInitialized(hippoRoot)) {
+        try {
+            await (await import('./sleep.js')).cmdSleep(hippoRoot, logFile ? { 'log-file': logFile } : {});
+        }
+        catch {
+            // sleep errors are already written via cmdSleep
+        }
+    }
+    else {
+        appendSessionEndCloseLog(logFile ?? null, 'skip sleep: this folder has no store of its own', { startFresh: true });
+        logSessionEndImport(logFile ?? null, undefined);
+    }
+    try {
+        const codexHome = typeof flags['codex-home'] === 'string'
+            ? flags['codex-home']
+            : resolveCodexWrapperPaths().codexHome;
+        const historyPath = typeof flags['history-path'] === 'string'
+            ? flags['history-path']
+            : path.join(codexHome, 'history.jsonl');
+        const startOffsetBytes = parseInt(String(flags['start-offset'] ?? '0'), 10) || 0;
+        const startedAtMs = parseInt(String(flags['started-at'] ?? Date.now()), 10) || Date.now();
+        const transcriptPath = resolveCodexSessionTranscript({
+            codexHome,
+            historyPath,
+            startOffsetBytes,
+            startedAtMs,
+        }) ?? undefined;
+        // No Codex transcript must not fall through to the scan of Claude Code projects.
+        if (!transcriptPath) {
+            appendSessionEndCloseLog(logFile ?? null, 'skip capture: no Codex transcript for this session');
+            return;
+        }
+        const digestLog = (message) => appendSessionEndCloseLog(logFile ?? null, message);
+        const scan = readSessionScan(transcriptPath, digestLog);
+        const captureOpts = {
+            source: 'last-session',
+            transcriptPath,
+            logFile,
+            dryRun: false,
+            global: false,
+            tenantId: resolveTenantId({}),
+            originProject: store === hippoRoot ? undefined : deriveOriginProject(process.cwd()),
+            sessionTurns: scan?.turns,
+        };
+        try {
+            cmdCapture(store, captureOpts);
+        }
+        catch {
+            // capture path logs its own failures
+        }
+        // The Codex wrapper passes no session id, so the rollout file names the session.
+        recordSessionDigest(hippoRoot, scan, { key: path.basename(transcriptPath, '.jsonl'), tenantId: resolveTenantId({}), log: digestLog });
+    }
+    catch {
+        // capture path logs its own failures
+    }
+}
+export async function handlePreCompact({ hippoRoot, flags }) {
+    // Bounded wait, not a TTY guard: an idle non-TTY pipe must not hang.
+    const { text: stdinText, timedOut: stdinTimedOut } = await readStdinBounded();
+    await runHookWithStores(async () => {
+        resetHookInjection(hippoRoot, stdinText, null);
+        await cmdPreCompact(hookStoreRoot(hippoRoot), {
+            stdinText,
+            stdinTimedOut,
+            logFile: typeof flags['log-file'] === 'string' ? flags['log-file'] : undefined,
+        });
+    });
+}
+export async function handlePostCompact({ hippoRoot, flags }) {
+    // PostCompact hook: saves the compaction summary and its memories, then prints one plain line, because Claude Code shows this hook's stdout as-is. Always exits 0.
+    const { text } = await readStdinBounded();
+    const logFlag = flags['log-file'];
+    const store = hookStoreRoot(hippoRoot);
+    const line = await runHookWithStores(() => cmdPostCompact(store, {
+        stdinText: text,
+        logFile: logFlag === true || logFlag === false || Array.isArray(logFlag) ? undefined : logFlag,
+        // Passed in, since capture.ts importing the sync would close an import cycle.
+        afterSave: (transcriptPath, originProject, log) => {
+            const report = importAtCompaction(store, transcriptPath, originProject, { machine: currentMachine(), busyWaitMs: COMPACTION_DB_WAIT_MS });
+            const summary = summaryLine(report);
+            if (summary !== null)
+                log(summary);
+            for (const warning of report.warnings)
+                log(`agent memories: ${warning}`);
+        },
+    }));
+    if (line !== null && line !== undefined)
+        console.log(line);
+}
+export async function handleCaptureError({ hippoRoot }) {
+    // PostToolUseFailure hook: every path exits 0, and nothing is created
+    // when no store exists (the hook fires in every directory).
+    const { text } = await readStdinBounded();
+    try {
+        const root = hookStoreRoot(hippoRoot);
+        const payload = (text ?? '').trim();
+        if (isInitialized(root) && payload) {
+            // SAFETY: JSON.parse returns a JSON value by definition.
+            const failure = JSON.parse(payload);
+            await runHookWithStores(() => captureToolFailure(root, resolveTenantId({}), failure));
+        }
+    }
+    catch {
+        // A malformed payload or store error must never fail the agent's tool call.
+    }
+}
+export async function handleCompactResume({ hippoRoot }) {
+    const { text: stdinText, timedOut: stdinTimedOut } = await readStdinBounded();
+    await runHookWithStores(() => {
+        resetHookInjection(hippoRoot, stdinText, 'compact');
+        cmdCompactResume(hookStoreRoot(hippoRoot), stdinText, stdinTimedOut);
+    });
+}
+export async function handleCapture({ hippoRoot, flags }) {
+    let captureSource = null;
+    let captureFile;
+    let transcriptPath;
+    if (flags['stdin']) {
+        captureSource = 'stdin';
+    }
+    else if (flags['file']) {
+        captureSource = 'file';
+        captureFile = String(flags['file']);
+    }
+    else if (flags['last-session']) {
+        captureSource = 'last-session';
+    }
+    if (flags['transcript']) {
+        transcriptPath = String(flags['transcript']);
+        if (!captureSource)
+            captureSource = 'last-session';
+    }
+    if (!captureSource) {
+        printError('Usage: hippo capture --stdin|--file <path>|--last-session [--transcript <path>] [--log-file <path>] [--dry-run] [--global]');
+        process.exit(1);
+    }
+    // Bounded, and only when last-session has no explicit path: the
+    // --stdin source keeps its own blocking read in capture.ts by design.
+    const bounded = captureSource === 'last-session' && !transcriptPath
+        ? await readStdinBounded()
+        : { text: undefined, timedOut: false };
+    cmdCapture(hippoRoot, {
+        source: captureSource,
+        filePath: captureFile,
+        transcriptPath,
+        stdinText: bounded.text,
+        stdinTimedOut: bounded.timedOut,
+        logFile: typeof flags['log-file'] === 'string' ? flags['log-file'] : undefined,
+        dryRun: Boolean(flags['dry-run']),
+        global: Boolean(flags['global']),
+        tenantId: resolveTenantId({}),
+    });
+}
+//# sourceMappingURL=session-hooks.js.map

package/dist/cli/setup.d.ts

@@ -0,0 +1,4 @@
+export declare function cmdHook(args: string[], flags: Record<string, string | boolean | string[]>): void;
+export declare function cmdSetup(flags: Record<string, string | boolean | string[]>): void;
+export declare function cmdDailyRunner(): void;
+//# sourceMappingURL=setup.d.ts.map