hippo-memory 1.63.1 → 1.64.0

package/dist/capture-error.js

@@ -7,63 +7,7 @@ import { loadContentsWithTag } from './store/entry-reads.js';
 import { loadConfig } from './config.js';
 import { closeHippoDb, openHippoDb } from './db.js';
 import { recordFailure } from './failure-log.js';
-import { blockHash } from './token-ledger.js';
-import { redactSecretsStrict } from './secret-detect.js';
-const MAX_LEN = 200;
-/** The user, a permission prompt or a hook said no: routine, not a lesson. */
-const DECLINED = /user (?:doesn't|does not) want|denied by (?:the )?user|user (?:rejected|declined|denied)|permission to use|was blocked by (?:a )?hook/i;
-/** The OS or a remote host refused access (EACCES, SSH publickey): routine too, but nobody declined anything. */
-const OS_PERMISSION = /permission denied/i;
-/** Leading `cd` or `pushd` steps say where a command ran, not what it ran. */
-const LEADING_CD = /^\s*(?:(?:cd|pushd)\b[^;&|]*(?:&&|\|\||;)\s*)+/;
-const NO_MATCH = /\bno (?:matches|files|results) found\b/i;
-/** Shell commands whose exit code 1 means "nothing found" or "differs", not an error. */
-const QUIET_EXIT_1 = /^\s*(?:grep|rg|egrep|fgrep|find|test|\[|diff|cmp|git diff|git grep)\b/;
-function isString(v) {
-    return v !== undefined && v !== null && v.constructor === String;
-}
-function isObject(v) {
-    return v !== undefined && v !== null && !Array.isArray(v) && v.constructor === Object;
-}
-function payloadString(payload, key) {
-    if (!isObject(payload))
-        return null;
-    const value = payload[key];
-    return isString(value) && value.trim() !== '' ? value : null;
-}
-/** Normalised form used to spot repeats. The failure log keeps only its hash, so changing it breaks repeat counts. */
-export function failureSignature(text) {
-    return text.toLowerCase().replace(/[0-9a-f]{7,}/g, '#').replace(/\d+/g, '#').replace(/\s+/g, ' ').trim();
-}
-/** The memory text for a failure payload, or why it is not stored; a routine skip keeps its text for the log. Pure. */
-export function lessonFromFailure(payload) {
-    if (!isObject(payload))
-        return { skip: 'skipped-invalid', text: null, detail: null };
-    // SAFETY: isObject narrowed payload to a plain JSON object; the fields read are all optional.
-    const p = payload;
-    if (p.is_interrupt === true)
-        return { skip: 'skipped-interrupt', text: null, detail: null };
-    if (!isString(p.error) || p.error.trim().length < 12)
-        return { skip: 'skipped-invalid', text: null, detail: null };
-    const tool = isString(p.tool_name) ? p.tool_name : 'tool';
-    const error = redactSecretsStrict(p.error.replace(/\s+/g, ' ').trim());
-    const text = `${tool}: ${error}`.slice(0, MAX_LEN);
-    const command = isObject(p.tool_input) && isString(p.tool_input['command']) ? p.tool_input['command'].replace(LEADING_CD, '') : '';
-    const head = command.trim().split(/\s+/).slice(0, 2).join(' ');
-    const detail = `${tool}${head ? ` ${head}` : ''}: ${error}`;
-    const routine = (rule) => ({ skip: 'skipped-routine', rule, text, detail });
-    if (DECLINED.test(error))
-        return routine('declined');
-    if (OS_PERMISSION.test(error))
-        return routine('os-permission');
-    if (NO_MATCH.test(error))
-        return routine('no-match');
-    if (tool === 'Grep' || tool === 'Glob')
-        return routine('search-tool');
-    if (tool === 'Bash' && QUIET_EXIT_1.test(command) && /exit code 1\b/i.test(error))
-        return routine('quiet-exit');
-    return { text, detail };
-}
+import { failureHash, failureSignature, lessonFromFailure, payloadString, } from './capture/failure-reading.js';
 /** Store a failure as an error memory unless it is routine or a repeat, and log it either way, even when storing throws. */
 export function captureToolFailure(hippoRoot, tenantId, payload) {
     const lesson = lessonFromFailure(payload);
@@ -77,7 +21,7 @@ export function captureToolFailure(hippoRoot, tenantId, payload) {
     }
 }
 function logFailure(hippoRoot, tenantId, payload, lesson, outcome) {
-    const hash = (s) => (s === null ? null : blockHash(failureSignature(s)));
+    const hash = (s) => (s === null ? null : failureHash(s));
     const db = openHippoDb(hippoRoot);
     try {
         recordFailure(db, {
@@ -94,9 +38,9 @@ function logFailure(hippoRoot, tenantId, payload, lesson, outcome) {
         closeHippoDb(db);
     }
 }
-function storeLesson(hippoRoot, tenantId, text) {
+export function storeLesson(hippoRoot, tenantId, text, caller) {
     const sig = failureSignature(text);
-    const repeat = loadContentsWithTag(hippoRoot, tenantId, 'auto-captured').some((content) => failureSignature(content) === sig);
+    const repeat = loadContentsWithTag(hippoRoot, tenantId, 'auto-captured', caller?.origins).some((content) => failureSignature(content) === sig);
     if (repeat)
         return 'duplicate';
     const entry = createMemory(text, {
@@ -106,7 +50,11 @@ function storeLesson(hippoRoot, tenantId, text) {
         tenantId,
         baseHalfLifeDays: loadConfig(hippoRoot).defaultHalfLifeDays,
     });
-    writeEntry(hippoRoot, entry);
+    // A caller's project is its checked one; the store's own folder would name the server.
+    if (caller === undefined)
+        writeEntry(hippoRoot, entry);
+    else
+        writeEntry(hippoRoot, { ...entry, origin_project: caller.originProject }, { actor: caller.actor });
     return 'stored';
 }
 //# sourceMappingURL=capture-error.js.map

package/dist/cli/audit.js

@@ -8,6 +8,8 @@ import { resolveTenantId } from '../tenant.js';
 import { pruneAuditLog, parseOlderThanFlag } from '../audit-prune.js';
 import { printError } from './output.js';
 import { requireInit, resolveAuthRoot } from './shared.js';
+import { repairAutomaticMemories } from '../quality-repair.js';
+import { getGlobalRoot } from '../shared.js';
 // ---------------------------------------------------------------------------
 // Audit log subcommands (`hippo audit list`)
 // ---------------------------------------------------------------------------
@@ -114,6 +116,29 @@ function cmdAuditLog(hippoRoot, args, flags) {
     process.exit(1);
 }
 export function handleAudit({ hippoRoot, args, flags }) {
+    if (args[0] === 'repair') {
+        const apply = flags['apply'] === true && flags['dry-run'] !== true;
+        const result = repairAutomaticMemories(flags['global'] ? getGlobalRoot() : hippoRoot, { tenantId: resolveTenantId({}), apply });
+        if (flags['json']) {
+            console.log(JSON.stringify(result));
+            return;
+        }
+        console.log(`Quality repair ${apply ? 'apply' : 'preview'}: ${result.issues.length} issue(s) across ${result.total} memories.`);
+        for (const issue of result.issues)
+            console.log(`  [${issue.disposition}] ${issue.id}: ${issue.reason}${issue.protection ? ` (${issue.protection})` : ''}`);
+        for (const blocker of result.blockers)
+            console.log(`  Blocked: ${blocker}. Repair never upgrades a store; any other hippo command does, then run repair again.`);
+        const restore = `hippo dormant restore <id>${flags['global'] ? ' --global' : ''}`;
+        if (result.backup)
+            console.log(`Backup: ${result.backup}\nMoved ${result.appliedIds.length} memories to dormant storage. Recovery: ${restore}.`);
+        else if (apply && result.supported)
+            console.log('Nothing moved: no unprotected memory has a certain defect.');
+        for (const warning of result.warnings)
+            console.log(`Warning: ${warning}`);
+        if (!apply)
+            console.log('Preview only. Add --apply to move set-aside memories to dormant storage. Pin a review memory to keep it.');
+        return;
+    }
     // `audit list` and `audit prune` -> audit-log subcommands.
     // Other forms (no sub, --fix) keep the existing memory-quality auditor
     // for backwards compatibility.

package/dist/cli/auth.js

@@ -54,8 +54,9 @@ function cmdAuthCreate(hippoRoot, flags) {
 function formatKeyRow(item) {
     const label = item.label ?? '-';
     const created = item.createdAt;
+    const expires = item.expiresAt ?? '-';
     const revoked = item.revokedAt ?? '-';
-    return `${item.keyId}  ${item.tenantId}  ${item.role}  ${label}  ${created}  ${revoked}`;
+    return `${item.keyId}  ${item.tenantId}  ${item.role}  ${label}  ${created}  ${expires}  ${revoked}`;
 }
 function cmdAuthList(hippoRoot, flags) {
     const root = resolveAuthRoot(hippoRoot, flags);
@@ -74,10 +75,10 @@ function cmdAuthList(hippoRoot, flags) {
         return;
     }
     if (items.length === 0) {
-        console.log(includeRevoked ? 'No API keys.' : 'No active API keys. (Use --all to include revoked.)');
+        console.log(includeRevoked ? 'No API keys.' : 'No active API keys. (Use --all to include revoked and expired.)');
         return;
     }
-    console.log('key_id  tenant  role  label  created  revoked');
+    console.log('key_id  tenant  role  label  created  expires  revoked');
     for (const item of items) {
         console.log(formatKeyRow(item));
     }

package/dist/cli/context.js

@@ -1,23 +1,20 @@
 // The `hippo context` verb, which the per-prompt hook also runs; main() loads it lazily from the command table.
-import { evalNow } from '../ablation.js';
 import * as path from 'path';
-import { isInitialized } from '../store/open.js';
-import { writeDeliveryEventAtRoot, writeDeliveryEventOnHandle } from '../recall-trace.js';
 import { createDeliveryRecorder } from '../delivery-recorder.js';
 import { loadConfig } from '../config.js';
-import { isSqliteBusy, noteStoreBusy } from '../db.js';
-import { blockHash, estimateTokens, isSubagentPayload, lastSentState, recordTokenUse, shouldSkipUnchanged, } from '../token-ledger.js';
+import { blockHash, estimateTokens, isSubagentPayload, recordTokenUse } from '../token-ledger.js';
 import { isGlobalStoreRoot } from '../project-identity.js';
 import { autoDetectContext } from '../context-auto.js';
 import { detectScope } from '../scope.js';
-import { getGlobalRoot } from '../shared.js';
+import { ledgerRoot, withLedgerDb } from '../ledger-db.js';
 import { readStdinBounded } from '../stdin.js';
 import * as api from '../api.js';
 import { resolveTenantId } from '../tenant.js';
 import { renderAmbientSummary } from '../ambient.js';
-import { contextCost, contextHeading, contextLine, crossProjectHeading, crossProjectLine, settleTokens, } from '../context-render.js';
+import { contextBlockLines, contextCost, crossProjectLines, settleTokens } from '../context-render.js';
+import { additionalContextOutput, flushDeliveryRecorder, hasContextData, toRenderItems, } from '../prompt-hook.js';
 import { printError } from './output.js';
-import { parseLimitFlag, parseCountFlag, parseBudgetFlag, requireInit, printActiveTaskSnapshot, printSessionEvents, printHandoff, hostSessionId, captureConsole, hookStoreRoot, withLedgerDb, runHookWithStores, inPilotHoldout, } from './shared.js';
+import { parseLimitFlag, parseCountFlag, parseBudgetFlag, requireInit, printActiveTaskSnapshot, printSessionEvents, printHandoff, hostSessionId, captureConsole, hookStoreRoot, runHookWithStores, inPilotHoldout, } from './shared.js';
 export async function cmdContext(hippoRoot, args, flags, stdinText) {
     const rec = startDeliveryRecorder(hippoRoot, flags, stdinText);
     // No try/finally: a render throw keeps its own exit code and writes no event.
@@ -30,7 +27,7 @@ function startDeliveryRecorder(hippoRoot, flags, stdinText) {
         return null;
     try {
         // The same store withLedgerDb writes the token ledger to, so its config governs both.
-        const root = isInitialized(hippoRoot) ? hippoRoot : isInitialized(getGlobalRoot()) ? getGlobalRoot() : null;
+        const root = ledgerRoot(hippoRoot);
         if (root === null || !loadConfig(root).deliveryLedger.enabled)
             return null;
         return createDeliveryRecorder({
@@ -48,18 +45,6 @@ function startDeliveryRecorder(hippoRoot, flags, stdinText) {
         return null;
     }
 }
-/** With `db`, writes on the token ledger's handle (same store); without it, opens its own. A second flush is a no-op. */
-function flushDeliveryRecorder(rec, db) {
-    if (rec === null)
-        return;
-    try {
-        rec.flush((input) => (db ? writeDeliveryEventOnHandle(db, input) : writeDeliveryEventAtRoot(rec.root, input)));
-    }
-    catch (error) {
-        // Pinned stderr text, as in the recorder build above.
-        printError(`[hippo] delivery ledger write failed:${error instanceof Error ? error.message : String(error)}`);
-    }
-}
 /** The hook payload's session id and raw prompt; a malformed or empty payload yields neither. */
 function readHookPayload(stdinText) {
     let sessionId;
@@ -122,7 +107,9 @@ async function renderContext(hippoRoot, args, flags, stdinText, rec) {
         renderContextJson(view, query);
     }
     else if (format === 'additional-context') {
-        renderAdditionalContext(view);
+        const stdout = additionalContextOutput(view);
+        if (stdout)
+            process.stdout.write(stdout);
     }
     else {
         renderContextMarkdown(view);
@@ -162,15 +149,6 @@ function buildContextOpts(flags, input) {
         deliveryObserver: input.rec ?? undefined,
     };
 }
-function hasContextData(result) {
-    return Boolean(result.entries.length > 0 ||
-        result.activeSnapshot ||
-        result.sessionHandoff ||
-        (result.recentEvents && result.recentEvents.length > 0));
-}
-function toRenderItems(entries) {
-    return entries.map((r) => ({ entry: r.entry, score: r.score, tokens: r.tokens, isGlobal: r.isGlobal ?? false }));
-}
 function renderContextJson(view, query) {
     const { result, rec } = view;
     const output = result.entries.map((r) => ({
@@ -202,122 +180,6 @@ function renderContextJson(view, query) {
         flushDeliveryRecorder(rec, db);
     });
 }
-/** The hook format: a skippable static block (snapshot, handoff, events, pins, recent-N) and a never-skipped recall block. */
-function renderAdditionalContext(view) {
-    const { result, rec, framing } = view;
-    const staticEntries = result.entries.filter((r) => r.category !== 'cross-project' && !r.promptRecall);
-    const staticCrossEntries = result.entries.filter((r) => r.category === 'cross-project' && !r.promptRecall);
-    const staticItems = toRenderItems(staticEntries);
-    const recallItems = toRenderItems(result.entries.filter((r) => r.promptRecall));
-    const staticBlock = settleTokens((t) => captureConsole(() => {
-        if (result.activeSnapshot)
-            printActiveTaskSnapshot(result.activeSnapshot);
-        if (result.sessionHandoff)
-            printHandoff(result.sessionHandoff);
-        if (result.recentEvents && result.recentEvents.length > 0) {
-            printSessionEvents(result.recentEvents);
-        }
-        // No live strength percentage, so an unchanged set of memories renders byte-identically turn after turn.
-        if (staticItems.length > 0)
-            printContextMarkdown(staticItems, t, framing, { showStrength: false });
-        printCrossProjectSection(staticCrossEntries);
-    }));
-    const recallBlock = recallItems.length > 0
-        ? settleTokens((t) => captureConsole(() => printContextMarkdown(recallItems, t, framing, { showStrength: false, heading: 'Prompt-Relevant Memory' })))
-        : '';
-    if (!staticBlock.trim() && !recallBlock.trim()) {
-        rec?.delivered({ state: 'empty' });
-        return;
-    }
-    const surface = view.pinnedOnly ? 'hook' : 'context';
-    const sendStatic = staticBlock.trim().length > 0 && !skipUnchangedStatic(view, surface, staticBlock, recallBlock, staticItems.length);
-    const finalStatic = sendStatic ? staticBlock : '';
-    const additionalContext = finalStatic && recallBlock
-        ? `${finalStatic}\n\n${recallBlock}`
-        : finalStatic || recallBlock;
-    const staticReused = !sendStatic && staticBlock.trim().length > 0;
-    if (!additionalContext.trim()) {
-        rec?.delivered({ state: 'reused', staticHash: blockHash(staticBlock), staticReused });
-        return;
-    }
-    const payload = {
-        hookSpecificOutput: {
-            hookEventName: 'UserPromptSubmit',
-            additionalContext,
-        },
-    };
-    process.stdout.write(JSON.stringify(payload));
-    rec?.delivered({
-        state: staticReused ? 'reused-recall-sent' : 'sent',
-        staticHash: staticBlock.trim() ? blockHash(staticBlock) : null,
-        recallHash: recallBlock ? blockHash(recallBlock) : null,
-        emittedText: additionalContext,
-        staticReused,
-    });
-    if (finalStatic || recallBlock) {
-        recordAdditionalContextRows(view, surface, { text: finalStatic, items: staticItems.length }, { text: recallBlock, items: recallItems.length });
-    }
-}
-/** True, after booking the skip row, when the hook may omit a static block this session already holds. */
-function skipUnchangedStatic(view, surface, staticBlock, recallBlock, staticCount) {
-    const { hippoRoot, payloadSessionId, rec } = view;
-    if (!view.pinnedOnly || payloadSessionId === undefined)
-        return false;
-    const injectCfg = loadConfig(hippoRoot).pinnedInject;
-    if (injectCfg.skipUnchanged === false)
-        return false;
-    const refreshTurns = Number.isFinite(injectCfg.refreshTurns) && injectCfg.refreshTurns >= 0
-        ? injectCfg.refreshTurns
-        : 10;
-    // Hashed on the static text alone so an unchanged pin set still skips while recall varies.
-    const staticHash = blockHash(staticBlock);
-    const last = withLedgerDb(hippoRoot, (db) => lastSentState(db, view.tenantId, payloadSessionId, surface));
-    if (!shouldSkipUnchanged(last ?? null, staticHash, refreshTurns))
-        return false;
-    withLedgerDb(hippoRoot, (db) => {
-        recordTokenUse(db, {
-            tenantId: view.tenantId, sessionId: payloadSessionId, surface, event: 'skip',
-            items: staticCount, tokens: estimateTokens(staticBlock), hash: staticHash,
-        });
-        if (recallBlock.trim())
-            return;
-        rec?.delivered({ state: 'reused', staticHash, staticReused: true });
-        flushDeliveryRecorder(rec, db);
-    });
-    return true;
-}
-/** One connection for both rows; each insert in its own try so one failing doesn't skip the other. */
-function recordAdditionalContextRows(view, surface, staticPart, recallPart) {
-    withLedgerDb(view.hippoRoot, (db) => {
-        if (staticPart.text) {
-            try {
-                recordTokenUse(db, {
-                    tenantId: view.tenantId, sessionId: view.ledgerSessionId, surface, event: 'inject',
-                    items: staticPart.items, tokens: estimateTokens(staticPart.text), hash: blockHash(staticPart.text),
-                });
-                // Best-effort row: only a busy store is actionable, and a ledger failure must not break the hook.
-            }
-            catch (error) {
-                if (isSqliteBusy(error))
-                    noteStoreBusy('token ledger row skipped');
-            }
-        }
-        if (recallPart.text) {
-            try {
-                recordTokenUse(db, {
-                    tenantId: view.tenantId, sessionId: view.ledgerSessionId, surface: 'hook_recall', event: 'inject',
-                    items: recallPart.items, tokens: estimateTokens(recallPart.text), hash: blockHash(recallPart.text),
-                });
-                // Same best-effort rule as the inject row above.
-            }
-            catch (error) {
-                if (isSqliteBusy(error))
-                    noteStoreBusy('token ledger row skipped');
-            }
-        }
-        flushDeliveryRecorder(view.rec, db);
-    });
-}
 /** The default format; the header figure counts the whole block, sections included, as the ledger does. */
 function renderContextMarkdown(view) {
     const { result, rec, framing } = view;
@@ -352,21 +214,14 @@ function renderContextMarkdown(view) {
         flushDeliveryRecorder(rec, db);
     });
 }
-/** An explicit header lets agents and humans tell borrowed context from project memory. */
 function printCrossProjectSection(items) {
-    if (items.length === 0)
-        return;
-    console.log(crossProjectHeading(items.length));
-    for (const item of items)
-        console.log(crossProjectLine(item));
+    for (const line of crossProjectLines(items))
+        console.log(line);
 }
 /** @internal Exported for the render snapshot test; not a stable public API. */
 export function printContextMarkdown(items, totalTokens, framing = 'observe', opts = {}) {
-    const now = evalNow();
-    const showStrength = opts.showStrength !== false;
-    console.log(contextHeading(opts.heading ?? 'Project Memory', items.length, totalTokens));
-    for (const item of items)
-        console.log(contextLine(item, framing, showStrength, now));
+    for (const line of contextBlockLines(items, totalTokens, framing, opts))
+        console.log(line);
 }
 export async function handleContext({ hippoRoot, args, flags }) {
     // Bounded, not a TTY guard: the hot stdin path and a manual run share this one command.

package/dist/cli/continuity.js

@@ -4,8 +4,9 @@ import { saveSessionHandoff, loadLatestHandoff, loadHandoffById, stampHandoffOut
 import { isHandoffOutcome, formatHandoffEvidenceLine } from '../handoff.js';
 import { resolveTenantId } from '../tenant.js';
 import { wmPush, wmRead, wmClear, wmFlush } from '../working-memory.js';
+import { collectHandoffEvidence } from '../handoff-evidence.js';
 import { printError } from './output.js';
-import { requireInit, collectHandoffEvidence, printActiveTaskSnapshot, printSessionEvents, printHandoff, } from './shared.js';
+import { requireInit, printActiveTaskSnapshot, printSessionEvents, printHandoff, } from './shared.js';
 export function cmdSnapshot(hippoRoot, args, flags) {
     requireInit(hippoRoot);
     const subcommand = args[0] ?? 'show';

package/dist/cli/init.js

@@ -14,7 +14,7 @@ import { currentMachine, importForStore, importProjectMemories, importUserMemori
 import { emptyReport, mergeReports } from '../agent-memories/report.js';
 import { getGlobalRoot, initGlobal } from '../shared.js';
 import { registerWorkspace } from '../scheduler.js';
-import { printAgentImport, installCodexMemoryHooks, setupDailySchedule, learnFromRepo } from './shared.js';
+import { printAgentImport, installCodexMemoryHooks, setupDailySchedule, learnFromRepo, skipLearnOnSharedStore, warnClaudeSettingsUnusable } from './shared.js';
 import { HOOK_MARKERS, HOOKS, hippoBlock } from './hook-blocks.js';
 function scanForGitRepos(rootDir, maxDepth = 2) {
     const repos = [];
@@ -150,8 +150,9 @@ export function cmdInit(hippoRoot, flags) {
     if (!flags['no-schedule'] && !flags['global']) {
         setupDailySchedule(globalRoot);
     }
+    const learn = !flags['no-learn'] && !skipLearnOnSharedStore(hippoRoot);
     // Seed with git history on first init (unless --no-learn)
-    if (!alreadyExists && !flags['no-learn'] && !flags['global']) {
+    if (!alreadyExists && learn && !flags['global']) {
         if (isGitRepo(process.cwd())) {
             const seedDays = 30;
             console.log(`\n   Seeding memories from last ${seedDays} days of git history...`);
@@ -165,7 +166,7 @@ export function cmdInit(hippoRoot, flags) {
         }
     }
     // Every run, not only the first: an agent's notes change between inits.
-    if (!flags['no-learn'])
+    if (learn)
         printAgentImport(importForStore(hippoRoot, { machine: currentMachine() }));
 }
 /** Every write init makes into agent config (instruction blocks, hooks, plugins) is an automatic integration, so one switch skips them all. */
@@ -254,6 +255,7 @@ function installUserLevelHooks(agents, codexHint) {
         // claude-code` and `hippo setup`.
         if (hook === 'claude-code') {
             const result = installJsonHooks(hook);
+            warnClaudeSettingsUnusable(result, '   ');
             if (result.installedSessionEnd) {
                 console.log(`   Auto-installed hippo session-end SessionEnd hook in ${hook} settings`);
             }

package/dist/cli/last-sleep.d.ts

@@ -0,0 +1,6 @@
+/** The line the user sees when the last sleep failed, a spool step hit an unexpected error, or the spool holds `.bad` files; null when none did. */
+export declare function sleepProblems(logText: string, bad: number): string | null;
+/** Prints the SessionEnd sleep log on stderr, then clears it. In a hook, stdout carries only `systemMessage`,
+ *  because Claude Code shows that to the user and adds any other SessionStart stdout to the model's context. */
+export declare function cmdLastSleep(hippoRoot: string, flags: Record<string, string | boolean | string[]>, out?: 'hook' | 'terminal'): void;
+//# sourceMappingURL=last-sleep.d.ts.map

package/dist/cli/last-sleep.js

@@ -0,0 +1,68 @@
+// `hippo last-sleep`: the previous session's sleep log for the debug log, and one problems line for the user.
+import * as fs from 'fs';
+import { isStringValue } from '../capture-contract.js';
+import { REPLAY_AFTER_MS } from '../compaction-record.js';
+import { SPOOL_PROBLEM, spoolCounts } from '../compaction-spool.js';
+import { defaultSleepLogPath } from '../hooks/shared.js';
+import { errorMessage } from '../log.js';
+import { truncateCodePointSafe } from '../transcript-tail.js';
+import { printError } from './output.js';
+import { hookStoreRoot } from './shared.js';
+const SLEEP_FAILED = '[hippo] sleep failed: ';
+const FAILURE_CHARS = 120;
+/** The line the user sees when the last sleep failed, a spool step hit an unexpected error, or the spool holds `.bad` files; null when none did. */
+export function sleepProblems(logText, bad) {
+    const lines = logText.split(/\r?\n/);
+    const failed = lines.find((line) => line.startsWith(SLEEP_FAILED));
+    const errors = lines.filter((line) => line.includes(SPOOL_PROBLEM)).length;
+    const parts = [
+        failed === undefined ? '' : `the last sleep failed (${truncateCodePointSafe(failed.slice(SLEEP_FAILED.length).trim(), FAILURE_CHARS)})`,
+        errors === 0 ? '' : `${errors} error${errors === 1 ? '' : 's'} while saving waiting compaction summaries`,
+        bad === 0 ? '' : `${bad} compaction ${bad === 1 ? 'summary' : 'summaries'} set aside as .bad`,
+    ].filter((part) => part !== '');
+    return parts.length === 0 ? null : `Hippo: ${parts.join('; ')}. Run hippo doctor for details.`;
+}
+function badSpoolFiles(hippoRoot) {
+    try {
+        return spoolCounts(hookStoreRoot(hippoRoot), new Date(), REPLAY_AFTER_MS).bad;
+    }
+    catch (err) {
+        printError(`hippo: spool not counted: ${errorMessage(err)}`);
+        return 0;
+    }
+}
+/** Prints the SessionEnd sleep log on stderr, then clears it. In a hook, stdout carries only `systemMessage`,
+ *  because Claude Code shows that to the user and adds any other SessionStart stdout to the model's context. */
+export function cmdLastSleep(hippoRoot, flags, out = process.stdout.isTTY ? 'terminal' : 'hook') {
+    const pathFlag = flags['path'];
+    const logPath = isStringValue(pathFlag) ? pathFlag : defaultSleepLogPath();
+    if (!fs.existsSync(logPath))
+        return;
+    let content;
+    try {
+        content = fs.readFileSync(logPath, 'utf8');
+    }
+    catch {
+        // Removed or locked since the exists check: there is nothing to show this session.
+        return;
+    }
+    if (content.trim().length > 0) {
+        printError('=== Previous session hippo consolidation ===');
+        process.stderr.write(content);
+        if (!content.endsWith('\n'))
+            printError();
+        printError('===========================================');
+    }
+    const problems = sleepProblems(content, badSpoolFiles(hippoRoot));
+    if (problems !== null && out === 'hook')
+        process.stdout.write(`${JSON.stringify({ systemMessage: problems })}\n`);
+    if (problems !== null && out === 'terminal')
+        printError(problems);
+    if (!flags['keep']) {
+        try {
+            fs.unlinkSync(logPath);
+        }
+        catch { /* non-fatal */ }
+    }
+}
+//# sourceMappingURL=last-sleep.js.map

package/dist/cli/quality-repair-once.d.ts

@@ -0,0 +1,3 @@
+/** Fault-isolated like the project tag repair: a failure warns, leaves the store unmarked and runs again next time. */
+export declare function repairQualityOnceAt(root: string): void;
+//# sourceMappingURL=quality-repair-once.d.ts.map

package/dist/cli/quality-repair-once.js

@@ -0,0 +1,36 @@
+// Sleep and the daily runner clean a store's old automatic memories once, so an upgrade needs no command.
+import * as path from 'path';
+import { errorMessage, log } from '../log.js';
+import { repairQualityOnce } from '../quality-repair.js';
+import { getGlobalRoot } from '../shared.js';
+import { resolveTenantId } from '../tenant.js';
+/** Fault-isolated like the project tag repair: a failure warns, leaves the store unmarked and runs again next time. */
+export function repairQualityOnceAt(root) {
+    try {
+        const result = repairQualityOnce(root, resolveTenantId({}));
+        if (result === null)
+            return;
+        if (!result.supported) {
+            log.warn(`memory quality repair skipped, tried again next time: ${result.blockers.join('; ')}`);
+            return;
+        }
+        // A sleep run from a folder with no project store can resolve to the global store too.
+        const scope = path.resolve(root) === path.resolve(getGlobalRoot()) ? ' --global' : '';
+        const moved = result.appliedIds.length;
+        if (moved > 0) {
+            console.log(`Set aside ${moved} automatic ${moved === 1 ? 'memory' : 'memories'} with a certain defect, once after the upgrade (backup: ${result.backup}).`);
+            console.log(`  List them: hippo dormant${scope}   Bring one back: hippo dormant restore <id>${scope}`);
+        }
+        const review = result.issues.filter((issue) => issue.disposition === 'review').length;
+        if (review > 0) {
+            const lead = moved > 0 ? `  ${review} more` : `Checked old automatic memories once after the upgrade: ${review}`;
+            console.log(`${lead} ${review === 1 ? 'looks' : 'look'} doubtful and ${review === 1 ? 'was' : 'were'} kept; hippo audit repair${scope} lists them.`);
+        }
+        for (const warning of result.warnings)
+            log.warn(warning);
+    }
+    catch (err) {
+        log.warn(`memory quality repair skipped, tried again next time: ${errorMessage(err)}`);
+    }
+}
+//# sourceMappingURL=quality-repair-once.js.map

package/dist/cli/recall.js

@@ -32,8 +32,9 @@ import { rankRecall, } from '../recall-pipeline.js';
 import { JEV_DEFAULT_TOP_K } from '../rerankers/jev.js';
 import { isClefModel } from '../rerankers/clef.js';
 import { handoffText, printedTokens, sessionTrailText, settleTokens, snapshotText } from '../context-render.js';
+import { withLedgerDb } from '../ledger-db.js';
 import { printError } from './output.js';
-import { parseLimitFlag, parseBudgetFlag, emitCliAudit, requireInit, recallEntryText, recallHeading, parseAsOfFlag, engineFlags, printActiveTaskSnapshot, printSessionEvents, printHandoff, hostSessionId, captureConsole, hookStoreRoot, withLedgerDb, } from './shared.js';
+import { parseLimitFlag, parseBudgetFlag, emitCliAudit, requireInit, recallEntryText, recallHeading, parseAsOfFlag, engineFlags, printActiveTaskSnapshot, printSessionEvents, printHandoff, hostSessionId, captureConsole, hookStoreRoot, } from './shared.js';
 // Per-process rings: a single-shot `hippo recall` starts empty, so anchoring only accumulates in long-lived
 // hosts (in-process loops, `hippo serve`, the MCP server).
 const sessionRecallHistoryCli = new Map();

package/dist/cli/remember.d.ts

@@ -1,4 +1,6 @@
 import { type CommandContext } from './shared.js';
+/** @internal Exported so tests/remember-origin-parity.test.ts runs the real direct write; not a stable public API. */
+export declare function cmdRemember(hippoRoot: string, text: string, flags: Record<string, string | boolean | string[]>): Promise<void>;
 export declare function handleRemember({ hippoRoot, args, flags }: CommandContext): Promise<void>;
 export declare function handleSupersede({ hippoRoot, args, flags }: CommandContext): void;
 export declare function handleTrace({ hippoRoot, args, flags }: CommandContext): void;

package/dist/cli/remember.js

@@ -14,6 +14,7 @@ import { embedMemory } from '../embeddings.js';
 import { loadConfig } from '../config.js';
 import { extractPathTags } from '../path-context.js';
 import { detectScope } from '../scope.js';
+import { assertClientScope } from '../recall-scope.js';
 import { getGlobalRoot, initGlobal } from '../shared.js';
 import { vetSecrets } from '../secret-detect.js';
 import * as client from '../client.js';
@@ -81,9 +82,11 @@ function parseRememberEnvelope(flags) {
     const owner = ownerCheck.value ?? null;
     const artifactRef = typeof flags['artifact-ref'] === 'string' ? flags['artifact-ref'] : null;
     const scope = typeof flags['scope'] === 'string' ? flags['scope'].trim() || null : null;
+    assertClientScope(scope);
     return { kind, owner, artifactRef, scope };
 }
-async function cmdRemember(hippoRoot, text, flags) {
+/** @internal Exported so tests/remember-origin-parity.test.ts runs the real direct write; not a stable public API. */
+export async function cmdRemember(hippoRoot, text, flags) {
     const useGlobal = Boolean(flags['global']);
     const targetRoot = useGlobal ? getGlobalRoot() : hippoRoot;
     if (useGlobal) {

package/dist/cli/session-hooks.d.ts

@@ -1,7 +1,4 @@
 import { type CommandContext } from './shared.js';
-/** Prints the SessionEnd sleep log, then clears it. Stderr, because Claude Code adds
- *  SessionStart stdout to the model's context and this log is for the user. */
-export declare function cmdLastSleep(flags: Record<string, string | boolean | string[]>): void;
 /**
  * SessionEnd entry point. Claude Code / OpenCode fire this on /exit while
  * tearing down the TUI, which kills any child that is still running when