hippo-memory 1.66.0 → 1.68.0

package/dist/embeddings.d.ts

@@ -4,8 +4,10 @@
  * Falls back silently if the library is not installed.
  */
 import { MemoryEntry } from './memory.js';
+import { type DatabaseSyncLike } from './db.js';
 import { EMBEDDING_MODEL_META_KEY } from './vector-store.js';
 import { type EmbeddingProvider } from './embedding-provider.js';
+import type { HippoStore } from './store-port.js';
 export { EMBEDDING_MODEL_META_KEY };
 /**
  * Bump whenever `embeddingInputText`'s composition changes in a way that
@@ -73,10 +75,13 @@ export interface EmbeddingIndexState {
 export declare function indexedModel(state: EmbeddingIndexState): string | null;
 /** The one rebuild rule every store applies to its indexed model. */
 export declare function indexNeedsRebuild(indexed: string | null, providerId: string): boolean;
+/** Whether a vector write under the index identity `model` first drops the stored index, which another model built. */
+export declare function replacesIndex(state: EmbeddingIndexState, model: string): boolean;
 export declare function resolveIndexedEmbeddingModel(hippoRoot: string, index?: Record<string, number[]>): string | null;
 export declare function embeddingModelRequiresReindex(hippoRoot: string, model: string, index?: Record<string, number[]>): boolean;
 /** hippo.db's index state, the meta row and the EXISTS on one handle. */
 export declare function embeddingIndexStateAt(hippoRoot: string): EmbeddingIndexState;
+export declare function embeddingIndexStateOn(db: DatabaseSyncLike): EmbeddingIndexState;
 /**
  * Cosine similarity between two vectors. Handles unnormalized vectors.
  * Returns 0 for empty or mismatched vectors.
@@ -88,14 +93,9 @@ export declare function loadEmbeddingIndex(hippoRoot: string): Record<string, nu
 export declare function loadStoredVectors(hippoRoot: string, ids: readonly string[]): Map<string, number[]>;
 /** Replace every stored vector with `index`; `model` defaults to the stored index identity. */
 export declare function saveEmbeddingIndex(hippoRoot: string, index: Record<string, number[]>, model?: string): void;
-/**
- * Embed a single memory entry and cache the result in the embedding index.
- */
-export declare function embedMemory(hippoRoot: string, entry: MemoryEntry, model?: string): Promise<void>;
-/**
- * Embed all entries in hippoRoot that don't already have cached vectors.
- * Prunes orphaned embeddings for memories that no longer exist.
- * Returns the count of newly embedded entries. `provider` defaults to the store's configured one.
- */
-export declare function embedAll(hippoRoot: string, model?: string, provider?: EmbeddingProvider): Promise<number>;
+/** Embed a single memory entry and cache the result in the embedding index; with `store`, through its vectorWrites, never opening hippo.db. */
+export declare function embedMemory(hippoRoot: string, entry: MemoryEntry, model?: string, store?: HippoStore): Promise<void>;
+/** Embeds every entry with no cached vector, prunes vectors of deleted memories, and returns how many it embedded; `provider` defaults to the
+ *  configured one. With `store`, every tenant's memories with no vector for the provider's model go through its `vectorWrites`, never hippo.db. */
+export declare function embedAll(hippoRoot: string, model?: string, provider?: EmbeddingProvider, store?: HippoStore): Promise<number>;
 //# sourceMappingURL=embeddings.d.ts.map

package/dist/embeddings.js

@@ -16,6 +16,7 @@ import { resolveEmbeddingProvider } from './embedding-provider.js';
 import { DEFAULT_EMBEDDING_MODEL } from './local-embedding.js';
 import { redactSecretsStrict } from './secret-detect.js';
 import { log } from './log.js';
+import { StoreNotPortedError } from './db/sqlite-blocked.js';
 export { EMBEDDING_MODEL_META_KEY };
 /**
  * Bump whenever `embeddingInputText`'s composition changes in a way that
@@ -109,6 +110,11 @@ export function indexedModel(state) {
 export function indexNeedsRebuild(indexed, providerId) {
     return indexed !== null && indexed !== embeddingIndexIdentity(providerId);
 }
+/** Whether a vector write under the index identity `model` first drops the stored index, which another model built. */
+export function replacesIndex(state, model) {
+    const indexed = indexedModel(state);
+    return indexed !== null && indexed !== model;
+}
 export function resolveIndexedEmbeddingModel(hippoRoot, index) {
     const storedModel = loadStoredEmbeddingModel(hippoRoot);
     if (storedModel)
@@ -120,10 +126,13 @@ export function embeddingModelRequiresReindex(hippoRoot, model, index) {
 }
 /** hippo.db's index state, the meta row and the EXISTS on one handle. */
 export function embeddingIndexStateAt(hippoRoot) {
-    return withVectorDb(hippoRoot, (db) => ({
+    return withVectorDb(hippoRoot, embeddingIndexStateOn);
+}
+export function embeddingIndexStateOn(db) {
+    return {
         storedModel: getMeta(db, EMBEDDING_MODEL_META_KEY, '').trim() || null,
         hasVectors: hasStoredVectors(db),
-    }));
+    };
 }
 async function rebuildEmbeddingIndex(entries, provider) {
     const rebuilt = {};
@@ -273,12 +282,7 @@ async function acquireEmbedFileLock(hippoRoot) {
     }
 }
 async function withEmbedLock(hippoRoot, fn) {
-    let resolve;
-    const next = new Promise(r => { resolve = r; });
-    const prev = _embedWriteLock;
-    _embedWriteLock = next;
-    await prev;
-    try {
+    return withProcessEmbedLock(async () => {
         const release = await acquireEmbedFileLock(hippoRoot);
         try {
             return await fn();
@@ -286,6 +290,17 @@ async function withEmbedLock(hippoRoot, fn) {
         finally {
             release();
         }
+    });
+}
+// A store keeps each write whole in its own transaction, and a lock file in hippoRoot would not reach a worker on another host.
+async function withProcessEmbedLock(fn) {
+    let resolve;
+    const next = new Promise(r => { resolve = r; });
+    const prev = _embedWriteLock;
+    _embedWriteLock = next;
+    await prev;
+    try {
+        return await fn();
     }
     finally {
         resolve();
@@ -301,10 +316,79 @@ function warnEmbedFailureOnce(source, rawMessage) {
     const message = redactSecretsStrict(rawMessage).replace(/\s+/g, ' ').replace(/\.+$/, '');
     log.warn(`embedding failed (${source}): ${message}. Memories are stored without embeddings until this is fixed.`);
 }
-/**
- * Embed a single memory entry and cache the result in the embedding index.
- */
-export async function embedMemory(hippoRoot, entry, model) {
+// store-port.ts imports this module, so its requireGroup would close an import cycle.
+function vectorGroups(store) {
+    if (store.vectors === undefined)
+        throw new StoreNotPortedError(store.kind, 'vectors');
+    if (store.vectorWrites === undefined)
+        throw new StoreNotPortedError(store.kind, 'vectorWrites');
+    return [store.vectors, store.vectorWrites];
+}
+/** Writes one page's vectors, one writeVectors per tenant, and stops at the first refused write; `withParticles` seeds each memory's particle. */
+async function writeVectorPage(writes, write, page, vectors, withParticles) {
+    const byTenant = new Map();
+    page.forEach((entry, i) => {
+        const vector = vectors[i];
+        if (!vector || vector.length === 0)
+            return noteSkippedEmbedding(entry.id);
+        const row = withParticles ? { memoryId: entry.id, vector, particle: initializeParticle(entry, vector) } : { memoryId: entry.id, vector };
+        byTenant.set(entry.tenantId, [...(byTenant.get(entry.tenantId) ?? []), row]);
+    });
+    let written = 0;
+    for (const [tenantId, rows] of byTenant) {
+        const result = await writes.writeVectors({ ...write, tenantId, rows });
+        if (result.modelMismatch)
+            return { written, modelMismatch: true };
+        written += result.written;
+    }
+    return { written, modelMismatch: false };
+}
+const STORE_PAGE = 64;
+const OTHER_MODEL_INDEX = "the vector index was built by another embedding model; run 'hippo embed' to rebuild it";
+/** Embeds every memory with no vector under `model`, page by page, so a provider failure keeps the pages written; a rebuild reseeds the particles it drops. */
+async function backfillInStore(writes, provider, model, rebuild) {
+    let count = 0;
+    let afterId;
+    for (;;) {
+        const page = await writes.entriesWithoutVector({ model, afterId, limit: STORE_PAGE });
+        if (page.length === 0)
+            return count;
+        afterId = page[page.length - 1].id;
+        const vectors = await provider.embed(page.map((e) => embeddingInputText(e)), 'passage');
+        const result = await writeVectorPage(writes, { model, replaceIndex: rebuild }, page, vectors, rebuild);
+        // Another process rebuilt the index mid-run; every later page would be refused too, after paying the provider for it.
+        if (result.modelMismatch)
+            throw new Error(OTHER_MODEL_INDEX);
+        count += result.written;
+    }
+}
+/** embedAll on a store: a model change re-embeds every memory, and the first page written drops the old index. */
+async function embedAllInStore(store, provider) {
+    const [reads, writes] = vectorGroups(store);
+    const rebuild = indexNeedsRebuild(indexedModel(await reads.embeddingIndexState()), provider.id);
+    return backfillInStore(writes, provider, embeddingIndexIdentity(provider.id), rebuild);
+}
+/** embedMemory on a store; like the hippo.db path it resolves whatever fails. Unlike it, it leaves a model change to embedAll, so a stale
+ *  read here never drops another process's rebuild; the read only saves a paid embed call, as the write refuses another model itself. */
+function embedMemoryInStore(store, provider, entry) {
+    return withProcessEmbedLock(async () => {
+        const [reads, writes] = vectorGroups(store);
+        const model = embeddingIndexIdentity(provider.id);
+        try {
+            const refused = replacesIndex(await reads.embeddingIndexState(), model)
+                || (await writeVectorPage(writes, { model, replaceIndex: false }, [entry], await provider.embed([embeddingInputText(entry)], 'passage'), true)).modelMismatch;
+            if (refused)
+                warnEmbedFailureOnce('index', OTHER_MODEL_INDEX);
+        }
+        catch (err) {
+            warnEmbedFailureOnce(provider.kind, err instanceof Error ? err.message : String(err));
+        }
+    }).catch((err) => {
+        log.warn(`skipped embedding ${entry.id} (${err instanceof Error ? err.message : String(err)})`);
+    });
+}
+/** Embed a single memory entry and cache the result in the embedding index; with `store`, through its vectorWrites, never opening hippo.db. */
+export async function embedMemory(hippoRoot, entry, model, store) {
     let provider;
     try {
         provider = resolveEmbeddingProvider(hippoRoot, { model });
@@ -316,6 +400,8 @@ export async function embedMemory(hippoRoot, entry, model) {
     }
     if (!provider.isAvailable())
         return;
+    if (store)
+        return embedMemoryInStore(store, provider, entry);
     return withEmbedLock(hippoRoot, async () => {
         // embedMemory is best-effort: an embedding failure (API down / bad key / 5xx)
         // must not reject the caller's write — `getEmbedding` historically swallowed
@@ -418,16 +504,15 @@ async function backfillPending(hippoRoot, provider, pending, model) {
     }
     return { count, backfillError };
 }
-/**
- * Embed all entries in hippoRoot that don't already have cached vectors.
- * Prunes orphaned embeddings for memories that no longer exist.
- * Returns the count of newly embedded entries. `provider` defaults to the store's configured one.
- */
-export async function embedAll(hippoRoot, model, provider = resolveEmbeddingProvider(hippoRoot, { model })) {
+/** Embeds every entry with no cached vector, prunes vectors of deleted memories, and returns how many it embedded; `provider` defaults to the
+ *  configured one. With `store`, every tenant's memories with no vector for the provider's model go through its `vectorWrites`, never hippo.db. */
+export async function embedAll(hippoRoot, model, provider = resolveEmbeddingProvider(hippoRoot, { model }), store) {
     if (!provider.isAvailable()) {
         throwIfProviderKeyMissing(hippoRoot, provider);
         return 0;
     }
+    if (store)
+        return withProcessEmbedLock(() => embedAllInStore(store, provider));
     return withEmbedLock(hippoRoot, async () => {
         const identity = provider.id;
         // Host-wide by design. embedAll backfills vectors for all tenants'

package/dist/hooks/copilot.d.ts

@@ -0,0 +1,45 @@
+/** Copilot drops what a per-prompt hook prints, so per-task recall goes through the MCP tool the block names. */
+export declare const COPILOT_INSTRUCTIONS: string;
+/** The three files hippo writes for Copilot. */
+export interface CopilotPaths {
+    readonly hooks: string;
+    readonly mcpConfig: string;
+    readonly instructions: string;
+}
+export declare function copilotPaths(): CopilotPaths;
+/** What to paste under "mcpServers" when hippo cannot edit the file itself. */
+export declare function copilotMcpSnippet(): string;
+export type McpMergeStatus = 'added' | 'present' | 'user-owned' | 'unreadable';
+/** Adds hippo's server and keeps every other key; a file hippo cannot parse, or a "hippo" key it did not write, stays as it is. */
+export declare function mergeMcpServer(file: string): McpMergeStatus;
+export type McpRemoveStatus = 'removed' | 'absent' | 'user-owned' | 'unreadable';
+/** Removes the "hippo" key only when hippo wrote it. */
+export declare function removeMcpServer(file: string): McpRemoveStatus;
+/** A filesystem error on mcp-config.json (EACCES, EISDIR, EBUSY), kept as its own message so setup can report it and go on. */
+export interface McpFailure {
+    readonly failed: string;
+}
+export declare function isMcpFailure(status: string | McpFailure): status is McpFailure;
+/** `kept`: a hippo block that is not the Copilot text (edited, or another agent's in a shared file); `unclosed`: a start marker with no end. */
+export type InstructionsInstallStatus = 'written' | 'present' | 'kept' | 'unclosed';
+/** Creates the file when missing; any block but hippo's own Copilot one, and a start marker with no end, leave the file as it is. */
+export declare function ensureInstructionsBlock(file: string): InstructionsInstallStatus;
+export type InstructionsRemoveStatus = 'removed' | 'absent' | 'kept' | 'unclosed';
+/** Splices out only hippo's own Copilot block and keeps every other byte; a file left with nothing but whitespace goes. */
+export declare function removeInstructionsBlock(file: string): InstructionsRemoveStatus;
+export interface CopilotInstallResult {
+    readonly paths: CopilotPaths;
+    /** True when the hooks file was written; false when it already held hippo's current table. */
+    readonly hooks: boolean;
+    readonly mcp: McpMergeStatus | McpFailure;
+    readonly instructions: InstructionsInstallStatus;
+}
+export declare function installCopilot(): CopilotInstallResult;
+export interface CopilotUninstallResult {
+    readonly paths: CopilotPaths;
+    readonly hooks: boolean;
+    readonly mcp: McpRemoveStatus | McpFailure;
+    readonly instructions: InstructionsRemoveStatus;
+}
+export declare function uninstallCopilot(): CopilotUninstallResult;
+//# sourceMappingURL=copilot.d.ts.map

package/dist/hooks/copilot.js

@@ -0,0 +1,187 @@
+// GitHub Copilot: hippo's hooks file, one MCP server key and an instructions block, all under the Copilot home folder.
+import * as fs from 'fs';
+import * as path from 'path';
+import { isDeepStrictEqual } from 'node:util';
+import { readJsonFile } from '../json.js';
+import { HOOK_MARKERS, hippoBlock } from '../cli/hook-blocks.js';
+import { copilotHomeDir, isJsonObject } from './shared.js';
+import { installJsonHooks, resolveJsonHookPaths, uninstallJsonHooks, writeSettingsFile } from './json-hooks.js';
+const MCP_KEY = 'hippo';
+/** Copilot drops what a per-prompt hook prints, so per-task recall goes through the MCP tool the block names. */
+export const COPILOT_INSTRUCTIONS = `
+## Project Memory (Hippo)
+
+At the start of each task, call the \`hippo_recall\` tool with a short query that
+names the task. Read the memories it returns before you write any code.
+
+When you learn something that should outlive this session (a decision and its
+reason, a user preference, why something failed), call the \`hippo_remember\`
+tool right then, while you work, never as a closing step. Set \`error\` to true
+for a failure. Leave out secrets and personal details.
+
+The installed hooks load pinned memories when a session starts, store failed
+tool calls and capture the session when it ends, so there is nothing to run
+before you finish.
+`.trim();
+export function copilotPaths() {
+    const home = copilotHomeDir();
+    return {
+        hooks: resolveJsonHookPaths('copilot').settings,
+        mcpConfig: path.join(home, 'mcp-config.json'),
+        instructions: path.join(home, 'copilot-instructions.md'),
+    };
+}
+/** Windows gets npm's .cmd shim, as the Codex hooks do, since a PowerShell execution policy can block hippo.ps1. */
+function hippoMcpServer() {
+    return { type: 'local', command: process.platform === 'win32' ? 'hippo.cmd' : 'hippo', args: ['mcp'], env: {}, tools: ['*'] };
+}
+/** Only a server hippo wrote counts as hippo's: a user's own "hippo" key with another command or args is never touched. */
+function isHipposServer(entry) {
+    return isJsonObject(entry) && (entry.command === 'hippo' || entry.command === 'hippo.cmd') && isDeepStrictEqual(entry.args, ['mcp']);
+}
+/** What to paste under "mcpServers" when hippo cannot edit the file itself. */
+export function copilotMcpSnippet() {
+    return `"${MCP_KEY}": ${JSON.stringify(hippoMcpServer())}`;
+}
+/** Null for a file with comments, one that is not JSON, or one whose shape a merge would overwrite; a missing file reads as empty. */
+function readMcpConfig(file) {
+    let config = {};
+    if (fs.existsSync(file)) {
+        try {
+            config = readJsonFile(file);
+        }
+        catch (err) {
+            // Only a parse failure means the text is not JSON hippo can merge; EACCES or EISDIR is thrown with its own message.
+            if (err instanceof SyntaxError)
+                return null;
+            throw err;
+        }
+    }
+    if (!isJsonObject(config))
+        return null;
+    if (config.mcpServers === undefined)
+        config.mcpServers = {};
+    const servers = config.mcpServers;
+    return isJsonObject(servers) ? { config, servers } : null;
+}
+/** Adds hippo's server and keeps every other key; a file hippo cannot parse, or a "hippo" key it did not write, stays as it is. */
+export function mergeMcpServer(file) {
+    const read = readMcpConfig(file);
+    if (read === null)
+        return 'unreadable';
+    const existing = read.servers[MCP_KEY];
+    if (existing !== undefined)
+        return isHipposServer(existing) ? 'present' : 'user-owned';
+    read.servers[MCP_KEY] = hippoMcpServer();
+    writeSettingsFile(file, read.config);
+    return 'added';
+}
+/** Removes the "hippo" key only when hippo wrote it. */
+export function removeMcpServer(file) {
+    if (!fs.existsSync(file))
+        return 'absent';
+    const read = readMcpConfig(file);
+    if (read === null)
+        return 'unreadable';
+    const existing = read.servers[MCP_KEY];
+    if (existing === undefined)
+        return 'absent';
+    if (!isHipposServer(existing))
+        return 'user-owned';
+    delete read.servers[MCP_KEY];
+    if (Object.keys(read.servers).length === 0)
+        delete read.config.mcpServers;
+    writeSettingsFile(file, read.config);
+    return 'removed';
+}
+export function isMcpFailure(status) {
+    return typeof status !== 'string';
+}
+function hasErrnoCode(err) {
+    return 'code' in err && typeof err.code === 'string';
+}
+/** One mcp-config.json step; a filesystem error comes back as a failure, so the hooks file and the block still install. */
+function mcpStep(step) {
+    try {
+        return step();
+    }
+    catch (err) {
+        if (err instanceof Error && hasErrnoCode(err))
+            return { failed: err.message };
+        throw err;
+    }
+}
+// A later release adds the hash of each earlier Copilot text here, as SHIPPED_HOOK_HASHES does for the other agents.
+function isCopilotBlock(inner) {
+    return inner === COPILOT_INSTRUCTIONS;
+}
+/** Replaces only the text between the markers, in the file's own line ending, or appends a block after the user's text. */
+function withCopilotBlock(text, found) {
+    if (found !== null) {
+        const { start, end, eol } = found;
+        return `${text.slice(0, start)}${eol}${COPILOT_INSTRUCTIONS.replace(/\n/g, eol)}${eol}${text.slice(end)}`;
+    }
+    const block = `${HOOK_MARKERS.start}\n${COPILOT_INSTRUCTIONS}\n${HOOK_MARKERS.end}\n`;
+    if (text === '')
+        return block;
+    return `${text}${text.endsWith('\n') ? '\n' : '\n\n'}${block}`;
+}
+/** Creates the file when missing; any block but hippo's own Copilot one, and a start marker with no end, leave the file as it is. */
+export function ensureInstructionsBlock(file) {
+    const old = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : '';
+    const found = hippoBlock(old);
+    if (found === null && old.includes(HOOK_MARKERS.start))
+        return 'unclosed';
+    if (found !== null && !isCopilotBlock(found.inner))
+        return 'kept';
+    const next = withCopilotBlock(old, found);
+    if (next === old)
+        return 'present';
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, next, 'utf8');
+    return 'written';
+}
+/** `text` without the block and its markers, plus the line break after the end marker, else the one before the start marker. */
+function withoutCopilotBlock(text, found) {
+    const from = found.start - HOOK_MARKERS.start.length;
+    const to = found.end + HOOK_MARKERS.end.length;
+    const after = text.startsWith('\r\n', to) ? 2 : text.startsWith('\n', to) ? 1 : 0;
+    const before = after > 0 ? 0 : text.endsWith('\r\n', from) ? 2 : text.endsWith('\n', from) ? 1 : 0;
+    return text.slice(0, from - before) + text.slice(to + after);
+}
+/** Splices out only hippo's own Copilot block and keeps every other byte; a file left with nothing but whitespace goes. */
+export function removeInstructionsBlock(file) {
+    if (!fs.existsSync(file))
+        return 'absent';
+    const old = fs.readFileSync(file, 'utf8');
+    const found = hippoBlock(old);
+    if (found === null)
+        return old.includes(HOOK_MARKERS.start) ? 'unclosed' : 'absent';
+    if (!isCopilotBlock(found.inner))
+        return 'kept';
+    const left = withoutCopilotBlock(old, found);
+    if (left.trim() === '')
+        fs.rmSync(file);
+    else
+        fs.writeFileSync(file, left, 'utf8');
+    return 'removed';
+}
+export function installCopilot() {
+    const paths = copilotPaths();
+    return {
+        paths,
+        hooks: installJsonHooks('copilot').installedSessionStart,
+        mcp: mcpStep(() => mergeMcpServer(paths.mcpConfig)),
+        instructions: ensureInstructionsBlock(paths.instructions),
+    };
+}
+export function uninstallCopilot() {
+    const paths = copilotPaths();
+    return {
+        paths,
+        hooks: uninstallJsonHooks('copilot'),
+        mcp: mcpStep(() => removeMcpServer(paths.mcpConfig)),
+        instructions: removeInstructionsBlock(paths.instructions),
+    };
+}
+//# sourceMappingURL=copilot.js.map

package/dist/hooks/json-hooks.d.ts

@@ -20,7 +20,7 @@
  *    PreCompact and PostCompact entries go in too: the first records the compaction and
  *    asks the summariser for a "Memories for hippo" list, the second saves that list.
  *    Codex's hooks.json gets only two groups (per-prompt memory and
- *    compact-resume); see installCodexHooks.
+ *    compact-resume); see installCodexHooks. Copilot gets a file of its own; see installCopilotHooks.
  *
  * 2. Plugin install (OpenCode only). OpenCode does NOT share Claude Code's
  *    JSON-hook schema — its config has `additionalProperties: false` and no

package/dist/hooks/json-hooks.js

@@ -20,7 +20,7 @@
  *    PreCompact and PostCompact entries go in too: the first records the compaction and
  *    asks the summariser for a "Memories for hippo" list, the second saves that list.
  *    Codex's hooks.json gets only two groups (per-prompt memory and
- *    compact-resume); see installCodexHooks.
+ *    compact-resume); see installCodexHooks. Copilot gets a file of its own; see installCopilotHooks.
  *
  * 2. Plugin install (OpenCode only). OpenCode does NOT share Claude Code's
  *    JSON-hook schema — its config has `additionalProperties: false` and no
@@ -35,7 +35,7 @@
  */
 import * as fs from 'fs';
 import * as path from 'path';
-import { isJsonObject, HIPPO_SLEEP_MARKER, HIPPO_LAST_SLEEP_MARKER, HIPPO_CAPTURE_MARKER, HIPPO_SESSION_END_MARKER, HIPPO_PINNED_INJECT_MARKER, HIPPO_PINNED_INJECT_COMMAND, HIPPO_PRE_COMPACT_MARKER, HIPPO_COMPACT_RESUME_MARKER, HIPPO_CAPTURE_ERROR_MARKER, HIPPO_POST_COMPACT_MARKER, homeDir, claudeConfigDir, codexHomeDir, defaultPreCompactLogPath } from './shared.js';
+import { isJsonObject, HIPPO_SLEEP_MARKER, HIPPO_LAST_SLEEP_MARKER, HIPPO_CAPTURE_MARKER, HIPPO_SESSION_END_MARKER, HIPPO_PINNED_INJECT_MARKER, HIPPO_PINNED_INJECT_COMMAND, HIPPO_PRE_COMPACT_MARKER, HIPPO_COMPACT_RESUME_MARKER, HIPPO_CAPTURE_ERROR_MARKER, HIPPO_POST_COMPACT_MARKER, homeDir, claudeConfigDir, codexHomeDir, copilotHomeDir, defaultPreCompactLogPath } from './shared.js';
 import { isJsonString, readJsonFile } from '../json.js';
 import { escapeRegex } from '../escape.js';
 import { errorMessage, log } from '../log.js';
@@ -56,6 +56,12 @@ export function resolveJsonHookPaths(target) {
                 logFile: path.join(logsDir, 'codex-sleep.log'),
                 display: 'Codex',
             };
+        case 'copilot':
+            return {
+                settings: path.join(copilotHomeDir(), 'hooks', 'hippo.json'),
+                logFile: path.join(logsDir, 'copilot-sleep.log'),
+                display: 'Copilot',
+            };
     }
 }
 // An unterminated quote runs to the end, as in a shell, which also keeps the scan linear.
@@ -196,12 +202,40 @@ function installCodexHooks(settingsPath, settings) {
         writeSettingsFile(settingsPath, settings);
     return { ...result, installedUserPromptSubmit, installedCompactResume };
 }
+/** One Copilot entry with a PowerShell twin: VS Code runs only `powershell` on Windows, where the execution policy can block npm's hippo.ps1. */
+function copilotCommandHook(args, timeoutSec) {
+    return [{ type: 'command', bash: `hippo ${args}`, powershell: `hippo.cmd ${args}`, timeoutSec }];
+}
+/** No command names a path, so nothing has to be quoted for bash and PowerShell; session-end --runtime copilot picks its own log file. */
+function copilotHooksTable() {
+    return {
+        version: 1,
+        hooks: {
+            sessionStart: copilotCommandHook('context --pinned-only --include-recent 5 --format copilot', 10),
+            postToolUseFailure: copilotCommandHook('capture-error --runtime copilot', 10),
+            preCompact: copilotCommandHook('pre-compact --runtime copilot', 30),
+            sessionEnd: copilotCommandHook('session-end --runtime copilot', 30),
+        },
+    };
+}
+/** Hippo owns this whole file, so install writes the full table and a second install changes no byte. */
+function installCopilotHooks(settingsPath) {
+    const result = nothingInstalled('copilot', settingsPath);
+    const table = copilotHooksTable();
+    const current = fs.existsSync(settingsPath) ? fs.readFileSync(settingsPath, 'utf8') : null;
+    if (current === JSON.stringify(table, null, 2) + '\n')
+        return result;
+    writeSettingsFile(settingsPath, table);
+    return { ...result, installedSessionStart: true, installedCaptureError: true, installedPreCompact: true, installedSessionEnd: true };
+}
 /** Adds hippo's hooks to `target`'s settings file and migrates older hippo entries; a file that is not JSON stays untouched. */
 export function installJsonHooks(target) {
     const { settings: settingsPath, logFile } = resolveJsonHookPaths(target);
     const dir = path.dirname(settingsPath);
     if (!fs.existsSync(dir))
         fs.mkdirSync(dir, { recursive: true });
+    if (target === 'copilot')
+        return installCopilotHooks(settingsPath);
     let settings = {};
     if (fs.existsSync(settingsPath)) {
         try {
@@ -443,6 +477,11 @@ export function uninstallJsonHooks(target) {
     const { settings: settingsPath } = resolveJsonHookPaths(target);
     if (!fs.existsSync(settingsPath))
         return false;
+    if (target === 'copilot') {
+        // Copilot reads every file in its hooks folder, so hippo's own file goes whole and the user's files stay.
+        fs.rmSync(settingsPath, { force: true });
+        return true;
+    }
     let settings;
     try {
         settings = readJsonFile(settingsPath);

package/dist/hooks/shared.d.ts

@@ -2,7 +2,7 @@ import type { JsonObject } from '../working-memory.js';
 import type { JsonValue } from '../json.js';
 /** JSON-value plain-object check (excludes arrays and null); `constructor` avoids the `typeof` tag banned by anti-slop/no-runtime-typeof. */
 export declare function isJsonObject(value: JsonValue | undefined): value is JsonObject;
-export type JsonHookTarget = 'claude-code' | 'codex';
+export type JsonHookTarget = 'claude-code' | 'codex' | 'copilot';
 export interface ToolDetection {
     name: string;
     configDir: string;
@@ -24,10 +24,14 @@ export declare const HIPPO_POST_COMPACT_MARKER = "hippo post-compact";
 export declare function homeDir(): string;
 /** Codex's config folder: $CODEX_HOME, else ~/.codex, as the Codex hooks docs describe. */
 export declare function codexHomeDir(home?: string, env?: Readonly<Record<string, string | undefined>>): string;
+/** Copilot's config folder: $COPILOT_HOME, else ~/.copilot under os.homedir(), as the Copilot apps resolve it (a HOME that differs from the profile must not move it). */
+export declare function copilotHomeDir(home?: string, env?: Readonly<Record<string, string | undefined>>): string;
 /** Claude Code's config folder, where it reads settings.json: $CLAUDE_CONFIG_DIR when set and non-empty, else ~/.claude under os.homedir(), as Claude Code does (a HOME that differs from the profile must not move it). */
 export declare function claudeConfigDir(home?: string, env?: Readonly<Record<string, string | undefined>>): string;
 /** Codex counts as installed only when its config folder exists: Codex itself refuses a CODEX_HOME that is not a folder. */
 export declare function isCodexPresent(home?: string): boolean;
+/** Copilot counts as installed only when its config folder exists, so setup never creates ~/.copilot on a machine without it. */
+export declare function isCopilotPresent(home?: string): boolean;
 /** Codex hashes each hook and skips new or changed ones until the user reviews them in `/hooks`, so the reminder says what they would trust. */
 export declare const CODEX_TRUST_LINE = "The per-prompt hook sends your pinned memories plus up to 5 that match the prompt. Codex runs hippo's hooks only after you trust them once in `/hooks`.";
 /**

package/dist/hooks/shared.js

@@ -24,6 +24,10 @@ export function homeDir() {
 export function codexHomeDir(home = homeDir(), env = processEnv()) {
     return env.CODEX_HOME || path.join(home, '.codex');
 }
+/** Copilot's config folder: $COPILOT_HOME, else ~/.copilot under os.homedir(), as the Copilot apps resolve it (a HOME that differs from the profile must not move it). */
+export function copilotHomeDir(home = os.homedir(), env = processEnv()) {
+    return env.COPILOT_HOME || path.join(home, '.copilot');
+}
 /** Claude Code's config folder, where it reads settings.json: $CLAUDE_CONFIG_DIR when set and non-empty, else ~/.claude under os.homedir(), as Claude Code does (a HOME that differs from the profile must not move it). */
 export function claudeConfigDir(home = os.homedir(), env = processEnv()) {
     return env.CLAUDE_CONFIG_DIR || path.join(home, '.claude');
@@ -32,6 +36,10 @@ export function claudeConfigDir(home = os.homedir(), env = processEnv()) {
 export function isCodexPresent(home = homeDir()) {
     return fs.statSync(codexHomeDir(home), { throwIfNoEntry: false })?.isDirectory() === true;
 }
+/** Copilot counts as installed only when its config folder exists, so setup never creates ~/.copilot on a machine without it. */
+export function isCopilotPresent(home = os.homedir()) {
+    return fs.statSync(copilotHomeDir(home), { throwIfNoEntry: false })?.isDirectory() === true;
+}
 /** Codex hashes each hook and skips new or changed ones until the user reviews them in `/hooks`, so the reminder says what they would trust. */
 export const CODEX_TRUST_LINE = "The per-prompt hook sends your pinned memories plus up to 5 that match the prompt. Codex runs hippo's hooks only after you trust them once in `/hooks`.";
 /**
@@ -68,6 +76,7 @@ export function detectInstalledTools() {
         { name: 'opencode', configDir: '~/.config/opencode', detected: exists('.config', 'opencode'), kind: 'plugin', notes: 'installs a TS plugin at ~/.config/opencode/plugins/hippo.ts' },
         { name: 'openclaw', configDir: '~/.openclaw', detected: exists('.openclaw'), kind: 'plugin', notes: 'install via `openclaw plugins install hippo-memory`' },
         { name: 'codex', configDir: '~/.codex', detected: isCodexPresent(home), kind: 'wrapper', notes: 'memory hooks in hooks.json, and wraps the detected codex launcher for session-end consolidation' },
+        { name: 'copilot', configDir: copilotHomeDir(), detected: isCopilotPresent(), kind: 'json-hook', notes: 'hooks in hooks/hippo.json, the MCP server in mcp-config.json and a block in copilot-instructions.md' },
         { name: 'cursor', configDir: '~/.cursor', detected: exists('.cursor'), kind: 'markdown-instruction', notes: 'no hook API - patches AGENTS.md in the project' },
         { name: 'pi', configDir: '~/.pi', detected: exists('.pi'), kind: 'markdown-instruction', notes: 'no hook API - patches AGENTS.md in the project' },
     ];

package/dist/mcp/request.d.ts

@@ -4,8 +4,6 @@ import { type McpContext, type McpRequest, type McpResponse } from './protocol.j
  * ledger failure never fails the tool call. Other tools are not recorded.
  */
 export declare function recordMcpTokens(toolName: string, output: string, ctx?: McpContext): Promise<void>;
-/** The tools listed and run under a store other than hippo.db. */
-export declare const STORE_READY_TOOLS: ReadonlySet<string>;
 /**
  * Transport-agnostic MCP dispatcher. Both the stdio loop (below) and the
  * HTTP/SSE transport in src/server.ts route every incoming JSON-RPC message