hippo-memory 1.63.1 → 1.64.0

package/dist/hooks/json-hooks.js

@@ -10,8 +10,9 @@
  *        sequence, writing both outputs to the log file. The parent returns in
  *        <100ms so the TUI teardown can't kill the child before it finishes.
  *      - SessionStart: `hippo last-sleep --path <path>` - prints the log
- *        written by the previous session's detached worker to stderr, which
- *        keeps it out of the model's context, and then clears it.
+ *        written by the previous session's detached worker on stderr and
+ *        clears it. Stdout carries only a `systemMessage` problems line,
+ *        because Claude Code shows that to the user, not the model.
  *    Earlier Claude Code forms are detected and migrated automatically:
  *      - < 0.20.2: `Stop` hook firing `hippo sleep` on every assistant turn.
  *      - < 0.21.0: bare `hippo sleep` in SessionEnd, no `--log-file`.
@@ -34,15 +35,18 @@
  */
 import * as fs from 'fs';
 import * as path from 'path';
-import { isJsonObject, HIPPO_SLEEP_MARKER, HIPPO_LAST_SLEEP_MARKER, HIPPO_CAPTURE_MARKER, HIPPO_SESSION_END_MARKER, HIPPO_PINNED_INJECT_MARKER, HIPPO_PINNED_INJECT_COMMAND, HIPPO_PRE_COMPACT_MARKER, HIPPO_COMPACT_RESUME_MARKER, HIPPO_CAPTURE_ERROR_MARKER, HIPPO_POST_COMPACT_MARKER, homeDir, codexHomeDir, defaultPreCompactLogPath } from './shared.js';
-import { isJsonString } from '../json.js';
+import { isJsonObject, HIPPO_SLEEP_MARKER, HIPPO_LAST_SLEEP_MARKER, HIPPO_CAPTURE_MARKER, HIPPO_SESSION_END_MARKER, HIPPO_PINNED_INJECT_MARKER, HIPPO_PINNED_INJECT_COMMAND, HIPPO_PRE_COMPACT_MARKER, HIPPO_COMPACT_RESUME_MARKER, HIPPO_CAPTURE_ERROR_MARKER, HIPPO_POST_COMPACT_MARKER, homeDir, claudeConfigDir, codexHomeDir, defaultPreCompactLogPath } from './shared.js';
+import { isJsonString, readJsonFile } from '../json.js';
+import { escapeRegex } from '../escape.js';
+import { errorMessage, log } from '../log.js';
+/** The paths for `target` under the current home directory; reads and writes nothing. */
 export function resolveJsonHookPaths(target) {
     const home = homeDir();
     const logsDir = path.join(home, '.hippo', 'logs');
     switch (target) {
         case 'claude-code':
             return {
-                settings: path.join(home, '.claude', 'settings.json'),
+                settings: path.join(claudeConfigDir(), 'settings.json'),
                 logFile: path.join(logsDir, 'claude-code-sleep.log'),
                 display: 'Claude Code',
             };
@@ -54,13 +58,58 @@ export function resolveJsonHookPaths(target) {
             };
     }
 }
-function hookArrayContains(hookArray, marker) {
-    if (!Array.isArray(hookArray))
+// An unterminated quote runs to the end, as in a shell, which also keeps the scan linear.
+const QUOTED_SPAN = /'[^']*(?:'|$)|"(?:[^"\\]|\\[\s\S]?)*(?:"|$)/g;
+/** Hippo's command only at string start or after `(`, past env assignments and an install path, with quoted text ignored: `say hippo sleep`, `echo "a; hippo sleep"` and `./backup.sh && hippo sleep` stay a user's. */
+function isHippoCommand(command, marker) {
+    const unquoted = command.replace(QUOTED_SPAN, '');
+    return new RegExp(`(?:^|\\()\\s*(?:[A-Za-z_]\\w*=\\S*\\s+)*(?:[^\\s(]*[/\\\\])?${escapeRegex(marker)}(?![\\w.-])`).test(unquoted);
+}
+const runsHippo = (...markers) => (command) => markers.some((m) => isHippoCommand(command, m));
+function handlerCommand(handler) {
+    return isJsonObject(handler) && isJsonString(handler.command) ? handler.command : null;
+}
+/** `groups` minus the handlers `isOurs` picks; a group goes only once it has no handler left. Null when no handler matched. */
+function withoutHandlers(groups, isOurs) {
+    let removed = false;
+    const kept = groups.flatMap((group) => {
+        if (!isJsonObject(group) || !Array.isArray(group.hooks))
+            return [group];
+        const handlers = group.hooks.filter((h) => {
+            const command = handlerCommand(h);
+            return command === null || !isOurs(command);
+        });
+        if (handlers.length === group.hooks.length)
+            return [group];
+        removed = true;
+        return handlers.length > 0 ? [{ ...group, hooks: handlers }] : [];
+    });
+    return removed ? kept : null;
+}
+/** Removes the matching handlers from one event's groups; the event key goes once no group is left. */
+function stripHandlers(hooks, event, isOurs) {
+    const groups = hooks[event];
+    if (!Array.isArray(groups))
+        return false;
+    const kept = withoutHandlers(groups, isOurs);
+    if (kept === null)
         return false;
-    return JSON.stringify(hookArray).includes(marker);
+    if (kept.length > 0)
+        hooks[event] = kept;
+    else
+        delete hooks[event];
+    return true;
+}
+/** Every command string in `groups`; a group or handler of an unexpected shape adds none. */
+function handlerCommands(groups) {
+    return groups.flatMap((group) => (isJsonObject(group) && Array.isArray(group.hooks) ? group.hooks.flatMap((h) => handlerCommand(h) ?? []) : []));
+}
+/** The loose "already installed?" test, on purpose weaker than isHippoCommand: a launcher or env prefix still counts, and a false hit only skips an append. */
+function hookArrayContains(hookArray, marker) {
+    return Array.isArray(hookArray) && handlerCommands(hookArray).some((command) => command.includes(marker));
 }
 function addIncludeRecentToPinnedCommand(command) {
-    if (!command.includes(HIPPO_PINNED_INJECT_MARKER) || command.includes('--include-recent'))
+    if (!isHippoCommand(command, HIPPO_PINNED_INJECT_MARKER) || command.includes('--include-recent'))
         return command;
     return command.includes(' --format ')
         ? command.replace(' --format ', ' --include-recent 5 --format ')
@@ -90,19 +139,6 @@ function migratePinnedInjectRecentCommands(hookArray) {
     }
     return changed;
 }
-/**
- * Returns true when `hooks.SessionEnd` still contains either of the legacy
- * split entries (bare `hippo sleep` / `hippo capture --last-session`)
- * without the current consolidated `hippo session-end` entry.
- */
-function hasLegacySplitSessionEnd(hookArray) {
-    if (!Array.isArray(hookArray))
-        return false;
-    const serialized = JSON.stringify(hookArray);
-    const hasSleep = serialized.includes(HIPPO_SLEEP_MARKER);
-    const hasCapture = serialized.includes(HIPPO_CAPTURE_MARKER);
-    return (hasSleep || hasCapture) && !serialized.includes(HIPPO_SESSION_END_MARKER);
-}
 function nothingInstalled(target, settingsPath) {
     return {
         target,
@@ -125,18 +161,23 @@ function nothingInstalled(target, settingsPath) {
 function codexCommandHook(command, timeout) {
     return { type: 'command', command, commandWindows: command.replace(/^hippo /, 'hippo.cmd '), timeout };
 }
+/** Assigns `settings.hooks = {}` when it is absent, then returns it if it is an object whose `events`, where present, are arrays; null when appending would overwrite anything else. */
+function ensureHooksObject(settings, events) {
+    if (settings.hooks === undefined)
+        settings.hooks = {};
+    const hooks = settings.hooks;
+    if (!isJsonObject(hooks) || events.some((e) => hooks[e] !== undefined && !Array.isArray(hooks[e])))
+        return null;
+    return hooks;
+}
 /** Codex keys trust to each hook's position and hash and re-asks for a changed one, so hippo only appends and never edits an entry. */
 function installCodexHooks(settingsPath, settings) {
     const result = nothingInstalled('codex', settingsPath);
     if (!isJsonObject(settings))
         return { ...result, invalidJson: true };
-    if (settings.hooks === undefined)
-        settings.hooks = {};
-    const hooks = settings.hooks;
-    const events = ['UserPromptSubmit', 'SessionStart'];
-    if (!isJsonObject(hooks) || events.some((e) => hooks[e] !== undefined && !Array.isArray(hooks[e]))) {
+    const hooks = ensureHooksObject(settings, ['UserPromptSubmit', 'SessionStart']);
+    if (hooks === null)
         return { ...result, invalidJson: true };
-    }
     const append = (event, marker, group) => {
         const groups = hooks[event];
         if (hookArrayContains(groups, marker))
@@ -151,11 +192,11 @@ function installCodexHooks(settingsPath, settings) {
         matcher: 'compact',
         hooks: [codexCommandHook(HIPPO_COMPACT_RESUME_MARKER, 10)],
     });
-    if (installedUserPromptSubmit || installedCompactResume) {
-        fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf8');
-    }
+    if (installedUserPromptSubmit || installedCompactResume)
+        writeSettingsFile(settingsPath, settings);
     return { ...result, installedUserPromptSubmit, installedCompactResume };
 }
+/** Adds hippo's hooks to `target`'s settings file and migrates older hippo entries; a file that is not JSON stays untouched. */
 export function installJsonHooks(target) {
     const { settings: settingsPath, logFile } = resolveJsonHookPaths(target);
     const dir = path.dirname(settingsPath);
@@ -164,7 +205,7 @@ export function installJsonHooks(target) {
     let settings = {};
     if (fs.existsSync(settingsPath)) {
         try {
-            settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
+            settings = readJsonFile(settingsPath);
         }
         catch {
             return { ...nothingInstalled(target, settingsPath), invalidJson: true };
@@ -172,35 +213,129 @@ export function installJsonHooks(target) {
     }
     if (target === 'codex')
         return installCodexHooks(settingsPath, settings);
+    if (!isJsonObject(settings))
+        return { ...nothingInstalled(target, settingsPath), invalidJson: true };
     return installClaudeCodeHooks(settingsPath, settings, logFile);
 }
-function migrateLegacyClaudeHooks(hooks) {
-    let migratedFromStop = false;
-    if (Array.isArray(hooks.Stop) && hookArrayContains(hooks.Stop, HIPPO_SLEEP_MARKER)) {
-        hooks.Stop = hooks.Stop.filter((entry) => !JSON.stringify(entry).includes(HIPPO_SLEEP_MARKER));
-        if (hooks.Stop.length === 0)
-            delete hooks.Stop;
-        migratedFromStop = true;
+const RENAME_RETRY_MS = 1000;
+const WINDOWS_RENAME_REFUSALS = ['EPERM', 'EACCES', 'EBUSY'];
+// A rename can be refused where an in-place write still works (a bind-mounted file, a read-only folder), so these fall back to one.
+const REPLACE_REFUSALS = ['EBUSY', 'EXDEV', 'EACCES', 'EPERM'];
+// Matches the usual SYMLOOP_MAX, so a link cycle ends in an error instead of a hang.
+const MAX_LINK_HOPS = 40;
+function errnoCode(err) {
+    return 'code' in err ? String(err.code) : '';
+}
+/** Windows refuses a rename onto a file another program has open, usually for a moment, so a refusal is retried before it is reported. */
+function renameOnto(tmp, target) {
+    const deadline = Date.now() + RENAME_RETRY_MS;
+    const idle = new Int32Array(new SharedArrayBuffer(4));
+    for (let pause = 10;; pause = Math.min(pause * 2, 200)) {
+        try {
+            fs.renameSync(tmp, target);
+            return;
+        }
+        catch (err) {
+            const transient = process.platform === 'win32' && err instanceof Error && WINDOWS_RENAME_REFUSALS.includes(errnoCode(err));
+            const left = deadline - Date.now();
+            if (!transient || left <= 0)
+                throw err;
+            Atomics.wait(idle, 0, 0, Math.min(pause, left));
+        }
+    }
+}
+/** Where a write to `file` lands: through any symlink, a dangling one included, so a dotfile manager's link survives. */
+function writeTarget(file) {
+    let target = file;
+    for (let hop = 0; hop < MAX_LINK_HOPS && fs.lstatSync(target, { throwIfNoEntry: false })?.isSymbolicLink(); hop++) {
+        target = path.resolve(path.dirname(target), fs.readlinkSync(target));
+    }
+    return fs.existsSync(target) ? fs.realpathSync(target) : target;
+}
+/** Gives the replacement the old file's exact mode (umask trims the create mode) and, for root, its owner. */
+function keepAccess(tmp, old) {
+    fs.chmodSync(tmp, old.mode & 0o777);
+    if (process.getuid?.() === 0)
+        fs.chownSync(tmp, old.uid, old.gid);
+}
+/** Cleanup must not hide the failure that made it necessary, so a cleanup error is logged and the first error stays the one thrown. */
+function removeTemp(tmp) {
+    try {
+        fs.rmSync(tmp, { force: true });
+    }
+    catch (err) {
+        log.warn(`could not remove the temporary file ${tmp}: ${errorMessage(err)}`);
+    }
+}
+function replaceViaTemp(target, text, old) {
+    const tmp = `${target}.${process.pid}.tmp`;
+    try {
+        fs.writeFileSync(tmp, text, { encoding: 'utf8', mode: (old?.mode ?? 0o666) & 0o777 });
+        if (old)
+            keepAccess(tmp, old);
+        renameOnto(tmp, target);
+    }
+    catch (err) {
+        removeTemp(tmp);
+        throw err;
+    }
+}
+/** The pre-rename write: it truncates first, so it is only the fallback, but it needs just a writable file and keeps hard links together. */
+function writeInPlace(target, text) {
+    try {
+        fs.writeFileSync(target, text, 'utf8');
+    }
+    catch (err) {
+        if (!(err instanceof Error))
+            throw err;
+        const reason = errnoCode(err) === 'EBUSY'
+            ? 'is in use by another program, so hippo could not replace it; close that program and run the command again'
+            : `could not be replaced (${errnoCode(err) || err.message})`;
+        throw new Error(`${target} ${reason}`, { cause: err });
     }
-    // Migrate legacy SessionEnd forms:
-    //   - pre-0.21 bare `hippo sleep`
-    //   - 0.21.x+ `hippo sleep --log-file` split across two entries
-    //   - 0.22.x `hippo capture --last-session --log-file` second entry
-    // All of these get collapsed into the single `hippo session-end` entry.
+}
+/** Swaps the file in with one rename, so a crash mid-write cannot leave a truncated settings.json that Claude Code cannot parse. */
+export function writeSettingsFile(file, settings) {
+    const target = writeTarget(file);
+    const text = JSON.stringify(settings, null, 2) + '\n';
+    const old = fs.statSync(target, { throwIfNoEntry: false });
+    if (old === undefined) {
+        fs.mkdirSync(path.dirname(target), { recursive: true });
+    }
+    else {
+        // A rename replaces a read-only file that the in-place write refused, and Windows would retry that refusal for a second.
+        fs.accessSync(target, fs.constants.W_OK);
+    }
+    if (old !== undefined && old.nlink > 1) {
+        // A rename gives the file a new inode, which would leave the other hard links on the old content.
+        writeInPlace(target, text);
+        return;
+    }
+    try {
+        replaceViaTemp(target, text, old);
+    }
+    catch (err) {
+        if (!(err instanceof Error) || !REPLACE_REFUSALS.includes(errnoCode(err)))
+            throw err;
+        writeInPlace(target, text);
+    }
+}
+function migrateLegacyClaudeHooks(hooks) {
+    const migratedFromStop = stripHandlers(hooks, 'Stop', runsHippo(HIPPO_SLEEP_MARKER));
+    // The legacy SessionEnd forms in the file header collapse into `hippo session-end`, but only while that entry is absent.
     let migratedLegacySessionEnd = false;
     let migratedSplitSessionEnd = false;
-    if (Array.isArray(hooks.SessionEnd) && hasLegacySplitSessionEnd(hooks.SessionEnd)) {
-        const before = hooks.SessionEnd.length;
-        hooks.SessionEnd = hooks.SessionEnd.filter((entry) => {
-            const s = JSON.stringify(entry);
-            return !s.includes(HIPPO_SLEEP_MARKER) && !s.includes(HIPPO_CAPTURE_MARKER);
-        });
-        if (hooks.SessionEnd.length === 0)
-            delete hooks.SessionEnd;
-        // If the removed entries used the log-file pattern (0.21.x-0.22.x) we
-        // call it a "split" migration; otherwise it was the older bare form.
-        migratedSplitSessionEnd = true;
-        migratedLegacySessionEnd = before > 1;
+    if (Array.isArray(hooks.SessionEnd) && !hookArrayContains(hooks.SessionEnd, HIPPO_SESSION_END_MARKER)) {
+        const kept = withoutHandlers(hooks.SessionEnd, runsHippo(HIPPO_SLEEP_MARKER, HIPPO_CAPTURE_MARKER));
+        if (kept !== null) {
+            // Whatever form was removed reports as the split migration; the legacy flag also marks a SessionEnd that held several groups.
+            migratedSplitSessionEnd = true;
+            migratedLegacySessionEnd = hooks.SessionEnd.length > 1;
+            if (kept.length === 0)
+                delete hooks.SessionEnd;
+            else
+                hooks.SessionEnd = kept;
+        }
     }
     return { migratedFromStop, migratedLegacySessionEnd, migratedSplitSessionEnd };
 }
@@ -216,13 +351,24 @@ function appendHookIfMissing(hooks, event, marker, group) {
     hooks[event].push(group);
     return true;
 }
+/** Every command hippo has written to Claude Code's settings per event, the legacy forms included; uninstall removes only handlers that run one. */
+const CLAUDE_HOOK_MARKERS = [
+    ['SessionEnd', [HIPPO_SESSION_END_MARKER, HIPPO_SLEEP_MARKER, HIPPO_CAPTURE_MARKER]],
+    ['SessionStart', [HIPPO_LAST_SLEEP_MARKER, HIPPO_COMPACT_RESUME_MARKER]],
+    ['UserPromptSubmit', [HIPPO_PINNED_INJECT_MARKER]],
+    ['PreCompact', [HIPPO_PRE_COMPACT_MARKER]],
+    ['PostCompact', [HIPPO_POST_COMPACT_MARKER]],
+    ['PostToolUseFailure', [HIPPO_CAPTURE_ERROR_MARKER]],
+    ['Stop', [HIPPO_SLEEP_MARKER]],
+];
+// Stop is only ever migrated away, so install never appends to it and a Stop that is not a list does not block the install.
+const CLAUDE_APPENDED_EVENTS = CLAUDE_HOOK_MARKERS.map(([event]) => event).filter((event) => event !== 'Stop');
 function installClaudeCodeHooks(settingsPath, settings, logFile) {
-    if (!settings.hooks)
-        settings.hooks = {};
-    // SAFETY: settings.hooks is either freshly initialised to {} on the line above, or an
-    // existing value from settings.json — Claude Code's own schema always writes an object
-    // there; each event key below is still re-validated with Array.isArray before use.
-    const hooks = settings.hooks;
+    const merge = ensureHooksObject(settings, CLAUDE_APPENDED_EVENTS);
+    if (merge === null)
+        return { ...nothingInstalled('claude-code', settingsPath), invalidJson: true };
+    // SAFETY: ensureHooksObject left every event hippo appends to absent or an array.
+    const hooks = merge;
     const migration = migrateLegacyClaudeHooks(hooks);
     const installedSessionEnd = appendHookIfMissing(hooks, 'SessionEnd', HIPPO_SESSION_END_MARKER, claudeCommandGroup(`hippo session-end --log-file "${logFile}"`, 5));
     const installedSessionStart = appendHookIfMissing(hooks, 'SessionStart', HIPPO_LAST_SLEEP_MARKER, claudeCommandGroup(`hippo last-sleep --path "${logFile}"`, 5));
@@ -266,9 +412,8 @@ function installClaudeCodeHooks(settingsPath, settings, logFile) {
         ...migration,
         invalidJson: false,
     };
-    if (Object.values(result).some((v) => v === true)) {
-        fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf8');
-    }
+    if (Object.values(result).some((v) => v === true))
+        writeSettingsFile(settingsPath, settings);
     return result;
 }
 /** The exact command hippo writes for each Codex event; uninstall removes only these handlers. */
@@ -279,37 +424,28 @@ const CODEX_HOOK_COMMANDS = [
 /** A group loses only hippo's handlers and goes only once empty, so a user's hook beside or like hippo's stays. */
 function uninstallCodexHooks(hooks) {
     let changed = false;
-    for (const [event, command] of CODEX_HOOK_COMMANDS) {
-        const groups = hooks[event];
-        if (!Array.isArray(groups))
-            continue;
-        let removed = false;
-        const kept = groups.flatMap((group) => {
-            if (!isJsonObject(group) || !Array.isArray(group.hooks))
-                return [group];
-            const handlers = group.hooks.filter((h) => !(isJsonObject(h) && h.command === command));
-            if (handlers.length === group.hooks.length)
-                return [group];
-            removed = true;
-            return handlers.length > 0 ? [{ ...group, hooks: handlers }] : [];
-        });
-        if (!removed)
-            continue;
-        changed = true;
-        if (kept.length > 0)
-            hooks[event] = kept;
-        else
-            delete hooks[event];
-    }
+    for (const [event, command] of CODEX_HOOK_COMMANDS)
+        changed = stripHandlers(hooks, event, (c) => c === command) || changed;
     return changed;
 }
+/** One stderr line naming the handlers uninstall kept that still mention a hippo command (`nice hippo sleep`, `pnpm exec hippo ...`), so the user can remove them by hand. */
+function warnKeptHippoHandlers(settingsPath, hooks) {
+    const kept = CLAUDE_HOOK_MARKERS.flatMap(([event, markers]) => {
+        const groups = hooks[event];
+        return Array.isArray(groups) ? handlerCommands(groups).filter((command) => markers.some((m) => command.includes(m))) : [];
+    });
+    if (kept.length === 0)
+        return;
+    process.stderr.write(`hippo kept these hook handlers in ${settingsPath} because they do not start with a hippo command; remove any that are hippo's by hand: ${kept.map((c) => JSON.stringify(c)).join(', ')}\n`);
+}
+/** Removes hippo's own hook handlers from `target`'s settings file and keeps every other handler; true when the file changed. */
 export function uninstallJsonHooks(target) {
     const { settings: settingsPath } = resolveJsonHookPaths(target);
     if (!fs.existsSync(settingsPath))
         return false;
     let settings;
     try {
-        settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
+        settings = readJsonFile(settingsPath);
     }
     catch {
         // Never rewrite a settings file we cannot parse; report nothing uninstalled.
@@ -317,41 +453,34 @@ export function uninstallJsonHooks(target) {
     }
     if (!isJsonObject(settings) || !isJsonObject(settings.hooks))
         return false;
-    const changed = target === 'codex' ? uninstallCodexHooks(settings.hooks) : uninstallClaudeCodeHooks(settings.hooks);
+    const hooks = settings.hooks;
+    const changed = target === 'codex' ? uninstallCodexHooks(hooks) : uninstallClaudeCodeHooks(hooks);
+    if (target === 'claude-code')
+        warnKeptHippoHandlers(settingsPath, hooks);
     if (!changed)
         return false;
-    if (Object.keys(settings.hooks).length === 0)
+    if (Object.keys(hooks).length === 0)
         delete settings.hooks;
-    fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf8');
+    writeSettingsFile(settingsPath, settings);
     return true;
 }
-function uninstallClaudeCodeHooks(settingsHooks) {
-    // SAFETY: each event key below is re-validated with Array.isArray before use.
-    const hooks = settingsHooks;
-    let changed = false;
-    const markersByKey = {
-        SessionEnd: [HIPPO_SESSION_END_MARKER, HIPPO_SLEEP_MARKER, HIPPO_CAPTURE_MARKER],
-        // Both the un-matched last-sleep entry and the matcher:'compact'
-        // compact-resume entry live under the SessionStart key; the matcher
-        // field doesn't affect this substring match, so removal covers both.
-        SessionStart: [HIPPO_LAST_SLEEP_MARKER, HIPPO_COMPACT_RESUME_MARKER],
-        UserPromptSubmit: [HIPPO_PINNED_INJECT_MARKER],
-        PreCompact: [HIPPO_PRE_COMPACT_MARKER],
-        PostCompact: [HIPPO_POST_COMPACT_MARKER],
-        PostToolUseFailure: [HIPPO_CAPTURE_ERROR_MARKER],
-        Stop: [HIPPO_SLEEP_MARKER],
-    };
-    for (const [key, markers] of Object.entries(markersByKey)) {
-        if (!Array.isArray(hooks[key]))
-            continue;
-        const before = hooks[key].length;
-        hooks[key] = hooks[key].filter((entry) => !markers.some((m) => JSON.stringify(entry).includes(m)));
-        if (hooks[key].length !== before) {
-            changed = true;
-            if (hooks[key].length === 0)
-                delete hooks[key];
-        }
+/** Whether uninstall can edit settings.json; `invalidJson` marks a file that exists but is not JSON hippo can edit, which `uninstallJsonHooks` reports only as false. */
+export function checkUninstallable(target) {
+    const { settings: settingsPath } = resolveJsonHookPaths(target);
+    if (!fs.existsSync(settingsPath))
+        return { settingsPath, invalidJson: false };
+    try {
+        const settings = readJsonFile(settingsPath);
+        return { settingsPath, invalidJson: !isJsonObject(settings) || (settings.hooks !== undefined && !isJsonObject(settings.hooks)) };
+    }
+    catch {
+        return { settingsPath, invalidJson: true };
     }
+}
+function uninstallClaudeCodeHooks(hooks) {
+    let changed = false;
+    for (const [event, markers] of CLAUDE_HOOK_MARKERS)
+        changed = stripHandlers(hooks, event, runsHippo(...markers)) || changed;
     return changed;
 }
 //# sourceMappingURL=json-hooks.js.map

package/dist/hooks/opencode.js

@@ -89,7 +89,7 @@ function resolveOpencodeConfigPath() {
  * must NOT lose the user-authored commands. The migration filters the inner
  * array per-hook, then drops the entry only when its inner array is empty.
  */
-const HIPPO_OWNED_COMMAND_RE = /^\s*hippo\s+(session-end|last-sleep|sleep|capture|context)\b/;
+const HIPPO_OWNED_COMMAND_RE = /^\s*hippo\s+(session-end|last-sleep|sleep|capture|context)(?=\s|$)/;
 function hookIsHippoOwned(hook) {
     if (!isJsonObject(hook))
         return false;

package/dist/hooks/shared.d.ts

@@ -24,6 +24,8 @@ export declare const HIPPO_POST_COMPACT_MARKER = "hippo post-compact";
 export declare function homeDir(): string;
 /** Codex's config folder: $CODEX_HOME, else ~/.codex, as the Codex hooks docs describe. */
 export declare function codexHomeDir(home?: string, env?: Readonly<Record<string, string | undefined>>): string;
+/** Claude Code's config folder, where it reads settings.json: $CLAUDE_CONFIG_DIR when set and non-empty, else ~/.claude under os.homedir(), as Claude Code does (a HOME that differs from the profile must not move it). */
+export declare function claudeConfigDir(home?: string, env?: Readonly<Record<string, string | undefined>>): string;
 /** Codex counts as installed only when its config folder exists: Codex itself refuses a CODEX_HOME that is not a folder. */
 export declare function isCodexPresent(home?: string): boolean;
 /** Codex hashes each hook and skips new or changed ones until the user reviews them in `/hooks`, so the reminder says what they would trust. */

package/dist/hooks/shared.js

@@ -24,6 +24,10 @@ export function homeDir() {
 export function codexHomeDir(home = homeDir(), env = processEnv()) {
     return env.CODEX_HOME || path.join(home, '.codex');
 }
+/** Claude Code's config folder, where it reads settings.json: $CLAUDE_CONFIG_DIR when set and non-empty, else ~/.claude under os.homedir(), as Claude Code does (a HOME that differs from the profile must not move it). */
+export function claudeConfigDir(home = os.homedir(), env = processEnv()) {
+    return env.CLAUDE_CONFIG_DIR || path.join(home, '.claude');
+}
 /** Codex counts as installed only when its config folder exists: Codex itself refuses a CODEX_HOME that is not a folder. */
 export function isCodexPresent(home = homeDir()) {
     return fs.statSync(codexHomeDir(home), { throwIfNoEntry: false })?.isDirectory() === true;
@@ -58,8 +62,9 @@ export function ensureDir(dir) {
 export function detectInstalledTools() {
     const home = homeDir();
     const exists = (...parts) => fs.existsSync(path.join(home, ...parts));
+    const claudeDir = claudeConfigDir();
     return [
-        { name: 'claude-code', configDir: '~/.claude', detected: exists('.claude'), kind: 'json-hook' },
+        { name: 'claude-code', configDir: claudeDir, detected: fs.existsSync(claudeDir), kind: 'json-hook' },
         { name: 'opencode', configDir: '~/.config/opencode', detected: exists('.config', 'opencode'), kind: 'plugin', notes: 'installs a TS plugin at ~/.config/opencode/plugins/hippo.ts' },
         { name: 'openclaw', configDir: '~/.openclaw', detected: exists('.openclaw'), kind: 'plugin', notes: 'install via `openclaw plugins install hippo-memory`' },
         { name: 'codex', configDir: '~/.codex', detected: isCodexPresent(home), kind: 'wrapper', notes: 'memory hooks in hooks.json, and wraps the detected codex launcher for session-end consolidation' },

package/dist/http-util.d.ts

@@ -8,10 +8,15 @@ export declare const JSON_HEADERS: {
 };
 export declare class HttpError extends Error {
     status: number;
-    constructor(status: number, message: string);
+    /** Sent as the Retry-After header, so a refused caller knows when to come back. */
+    readonly retryAfterSec: number | undefined;
+    constructor(status: number, message: string, retryAfterSec?: number);
 }
 export declare class BodyTooLargeError extends Error {
 }
+/** The body did not arrive in time. Its own class so mapApiError answers 408 and the server drops the socket. */
+export declare class BodyTimeoutError extends Error {
+}
 /** The status and client-facing message for one failed request. */
 export interface ApiErrorReply {
     status: number;
@@ -20,13 +25,17 @@ export interface ApiErrorReply {
 export declare const INTERNAL_ERROR_MESSAGE = "internal server error";
 /** Maps by class so rewording a message never moves a status; an untyped error is a 500 whose text stays in the server log. */
 export declare function mapApiError<E>(err: E): ApiErrorReply;
+/** Serialises before the head goes out, so a body that is not JSON still reaches the caller's error reply. */
 export declare function sendJson<T>(res: ServerResponse, status: number, body: T): void;
-/**
- * Read the entire request body into a Buffer. Caps at MAX_BODY_BYTES to keep
- * a malicious or buggy client from exhausting memory. The cap is enforced
- * mid-stream so we don't wait for an attacker to finish before erroring out.
- */
-export declare function readBody(req: IncomingMessage): Promise<string>;
+export interface ReadBodyOpts {
+    /** Defaults to 1 MB. */
+    maxBytes?: number;
+    /** Fails with BodyTimeoutError when the whole body has not arrived by then; unset waits for as long as the socket stays open. */
+    deadlineMs?: number;
+}
+/** The body as text, refused mid-stream past maxBytes and past deadlineMs, so an oversized or slow sender cannot tie up the server. */
+export declare function readBody(req: IncomingMessage, { maxBytes, deadlineMs }?: ReadBodyOpts): Promise<string>;
+export declare function closeAfterReply(req: IncomingMessage): void;
 export declare const LOOPBACK_HOST_HEADER: RegExp;
 /** A browser request sent by another site. Non-browser clients send neither header and pass. */
 export declare function isCrossSite(req: IncomingMessage): boolean;