hippo-memory 1.68.0 → 1.70.0

package/dist/{session-digest.js → capture/session-digest.js}

@@ -2,23 +2,23 @@
 import { createHash } from 'crypto';
 import * as fs from 'fs';
 import * as path from 'path';
-import { collectSessionTurns } from './capture/transcript.js';
-import { isObjectLike, isStringValue } from './capture-contract.js';
+import { collectSessionTurns } from './transcript.js';
+import { isObjectLike, isStringValue } from '../core/capture-contract.js';
 import { PATCH_SUCCESS_LINE, patchPaths, shellPatch } from './codex-patch.js';
-import { loadConfig } from './config.js';
-import { USER_SEGMENT } from './home-path.js';
-import { errorMessage } from './log.js';
-import { createMemory, Layer } from './memory.js';
-import { RejectedValueError } from './rejection.js';
-import { maskEmails, redactSecretsStrict } from './secret-detect.js';
-import { isInitialized } from './store/open.js';
-import { writeEntry } from './store/entry-writes.js';
-import { loadAllEntries } from './store/entry-reads.js';
-import { SNAPSHOT_AMBIENT_MAX_AGE_MS } from './store/sessions.js';
-import { loadLatestHandoff } from './store/handoffs.js';
-import { isSyntheticMessage } from './token-ledger.js';
-import { readTranscriptTail } from './transcript-tail.js';
-export const SESSION_DIGEST_TAG = 'session-digest';
+import { loadConfig } from '../core/config.js';
+import { USER_SEGMENT } from '../util/home-path.js';
+import { errorMessage } from '../util/log.js';
+import { SESSION_DIGEST_TAG } from '../core/session-digest-row.js';
+import { createMemory, Layer } from '../core/memory.js';
+import { RejectedValueError } from '../store/rejection.js';
+import { maskEmails, redactSecretsStrict } from '../util/secret-detect.js';
+import { isInitialized } from '../store/open.js';
+import { writeEntry } from '../store/entry-writes.js';
+import { loadLiveContentsBySourceAndTag } from '../store/entry-reads.js';
+import { SNAPSHOT_AMBIENT_MAX_AGE_MS } from '../store/sessions.js';
+import { loadLatestHandoff } from '../store/handoffs.js';
+import { isSyntheticMessage } from '../store/token-ledger.js';
+import { readTranscriptTail } from '../util/transcript-tail.js';
 /** Five-word runs are stock phrases; six in a row is a copied clause. */
 export const ECHO_WINDOW = 6;
 /** Five sentences of about 150 chars leave room for the Changed line inside the total cap. */
@@ -430,19 +430,13 @@ export function buildSessionDigest(sources) {
         return content ? { content, sentences: kept.length, files: files.length } : null;
     }
 }
-/** Facts extracted from a digest and DAG summaries over one inherit its tag, but they are not the digest itself. */
-export function isSessionDigestRow(entry) {
-    return entry.source === SESSION_DIGEST_TAG && entry.tags.includes(SESSION_DIGEST_TAG) && !entry.extracted_from;
-}
 /** Same session, same row: a second worker for one session updates the digest instead of adding one. */
 export function sessionDigestId(tenantId, key) {
     return `mem_${createHash('sha256').update(`${SESSION_DIGEST_TAG}\n${tenantId}\n${key}`).digest('hex').slice(0, 12)}`;
 }
 /** What hippo could have injected into the session: any live digest (prompt recall reaches old ones) and the ambient handoff, never this session's own. */
 function injectedTexts(hippoRoot, opts) {
-    const digests = loadAllEntries(hippoRoot, opts.tenantId)
-        .filter((e) => isSessionDigestRow(e) && !e.superseded_by && e.source_session_id !== opts.key)
-        .map((e) => e.content);
+    const digests = loadLiveContentsBySourceAndTag(hippoRoot, opts.tenantId, SESSION_DIGEST_TAG, SESSION_DIGEST_TAG, opts.key);
     const handoff = loadLatestHandoff(hippoRoot, opts.tenantId, undefined, {
         unfinishedOnly: true,
         maxAgeMs: SNAPSHOT_AMBIENT_MAX_AGE_MS,

package/dist/capture/session-end-caller.d.ts

@@ -1,6 +1,6 @@
 import type { Context } from '../api/types.js';
-import type { HandoffEvidence } from '../handoff.js';
-import type { CallerProject } from '../prompt-hook.js';
+import type { HandoffEvidence } from '../core/handoff.js';
+import type { CallerProject } from '../api/prompt-hook.js';
 import type { WorkingState } from './working-state.js';
 export type CallerEvidence = Pick<HandoffEvidence, 'gitRef' | 'dirtyTree' | 'testStatus'>;
 export interface CallerSessionEndRequest {

package/dist/capture/session-end-caller.js

@@ -1,5 +1,5 @@
 // SessionEnd for a caller on another machine: the owner's handoff, then the owner's snapshot for the session closed, both under its tenant and project.
-import { BadRequestError } from '../api-errors.js';
+import { BadRequestError } from '../core/api-errors.js';
 import { writeSessionEndHandoff } from '../store/handoffs.js';
 import { closeTaskSnapshotsForSession } from '../store/sessions.js';
 import { bindCaller, checkedWorkingState } from './caller-session.js';

package/dist/capture/session-texts.d.ts

@@ -1,5 +1,5 @@
 import type { Context } from '../api/types.js';
-import { type CallerProject } from '../prompt-hook.js';
+import { type CallerProject } from '../api/prompt-hook.js';
 import { type CaptureTally } from './command.js';
 export interface SessionCaptureRequest {
     readonly sessionId: string;

package/dist/capture/session-texts.js

@@ -1,9 +1,9 @@
 // `hippo capture --last-session` for a caller whose transcript was read on another machine: its project names the rows, never the store's folder.
-import { BadRequestError } from '../api-errors.js';
-import { assertCallerIds } from '../prompt-hook.js';
-import { assertCallerProject, projectNames } from '../project-identity.js';
-import { longestWord, storedTextKeys } from '../same-text.js';
-import { scrubForSharing } from '../share-scrub.js';
+import { BadRequestError } from '../core/api-errors.js';
+import { assertCallerIds } from '../api/prompt-hook.js';
+import { assertCallerProject, projectNames } from '../core/project-identity.js';
+import { longestWord, storedTextKeys } from '../util/same-text.js';
+import { scrubForSharing } from './share-scrub.js';
 import { loadTextsHoldingWords } from '../store/candidates.js';
 import { captureExtractedItems } from './command.js';
 import { extractFromTexts } from './extract.js';

package/dist/capture/session-worker.d.ts

@@ -0,0 +1,13 @@
+import type { SessionTurn } from './transcript.js';
+/** A turn close runs after each reply; a full close runs once, when the session ends. */
+export type WorkerMode = 'turn' | 'full';
+/** Runs `work` unless a live worker holds this session, which then runs the request after its own so the last reply is never dropped. */
+export declare function runSessionWorker(sessionId: string | null, mode: WorkerMode, work: (mode: WorkerMode) => Promise<void>): Promise<void>;
+/** The cursor position after `turns`: how many there were and a hash of the last. */
+export declare function turnPosition(turns: readonly SessionTurn[]): string;
+/** The turns after `position`; all of them when it is null or its last turn is no longer in view. */
+export declare function turnsAfter(turns: readonly SessionTurn[], position: string | null): readonly SessionTurn[];
+/** The saved position for this session's transcript; null when none was saved, it names another file, or it is unreadable. */
+export declare function loadTurnPosition(sessionId: string, transcriptPath: string): string | null;
+export declare function saveTurnPosition(sessionId: string, transcriptPath: string, turns: readonly SessionTurn[], log: (message: string) => void): void;
+//# sourceMappingURL=session-worker.d.ts.map

package/dist/capture/session-worker.js

@@ -0,0 +1,196 @@
+// One session-end worker per session at a time, plus how far turn capture has read that session's transcript.
+// Two fast replies would otherwise start two workers that both read the dedupe keys before either writes.
+import * as fs from 'fs';
+import * as path from 'path';
+import { createHash } from 'node:crypto';
+import { homeDir } from '../hooks/shared.js';
+import { errorMessage, log as logger } from '../util/log.js';
+import { isObjectLike, isStringValue } from '../core/capture-contract.js';
+import { SESSION_ID_RE } from './copilot-transcript.js';
+import { FINGERPRINT_HEX_CHARS } from '../util/token-text.js';
+/** Null for a missing id or one that could climb out of the sessions folder. */
+function sessionStateFiles(sessionId) {
+    if (sessionId === null || !SESSION_ID_RE.test(sessionId))
+        return null;
+    const base = path.join(homeDir(), '.hippo', 'sessions', sessionId);
+    return { lock: `${base}.lock`, queued: `${base}.queued`, cursor: `${base}.cursor.json` };
+}
+function pidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        // EPERM means the process exists but belongs to someone else.
+        return err instanceof Error && 'code' in err && err.code === 'EPERM';
+    }
+}
+/** Windows reuses pids, so past this a lock is stale whatever process it names; a worker rarely waits more than minutes on a busy store. */
+const STALE_LOCK_MS = 15 * 60 * 1000;
+/** A dead holder frees its session at once, and any holder at STALE_LOCK_MS. */
+function holderAlive(lock) {
+    let text;
+    let mtimeMs;
+    try {
+        text = fs.readFileSync(lock, 'utf8');
+        mtimeMs = fs.statSync(lock).mtimeMs;
+    }
+    catch (err) {
+        // Gone means released; any other read error is taken as held, so two workers never run on a guess.
+        return !(err instanceof Error && 'code' in err && err.code === 'ENOENT');
+    }
+    const held = /^(\d+):(\d+)$/.exec(text.trim());
+    if (Date.now() - (held ? Number(held[2]) : mtimeMs) > STALE_LOCK_MS)
+        return false;
+    // Empty or torn: its taker is between the create and the write, so it is held.
+    if (!held)
+        return true;
+    const pid = Number(held[1]);
+    return pid !== process.pid && pidAlive(pid);
+}
+// SHORTCUT: two takers racing one stale-lock cleanup can both run, as every worker did before the lock; an atomic link-based take if that shows up.
+function takeSessionLock(lock) {
+    for (let attempt = 0; attempt < 2; attempt++) {
+        try {
+            fs.writeFileSync(lock, `${process.pid}:${Date.now()}`, { flag: 'wx' });
+            return 'taken';
+        }
+        catch (err) {
+            if (!(err instanceof Error && 'code' in err && err.code === 'EEXIST'))
+                return 'unusable';
+            if (holderAlive(lock))
+                return 'held';
+        }
+        try {
+            fs.rmSync(lock, { force: true });
+        }
+        catch {
+            return 'unusable';
+        }
+    }
+    return 'held';
+}
+function releaseSessionLock(lock) {
+    try {
+        fs.rmSync(lock, { force: true });
+    }
+    catch (err) {
+        // A lock left behind names this pid, which is dead once the worker exits, so the next taker clears it.
+        logger.debug(`session lock not removed: ${errorMessage(err)}`);
+    }
+}
+/** False when the sessions folder cannot be written, so the caller runs unlocked as before. */
+function queueRun(files, mode) {
+    try {
+        fs.mkdirSync(path.dirname(files.queued), { recursive: true });
+        // A full close outranks a turn close: it overwrites a queued turn, and a turn never replaces a queued full close.
+        if (mode === 'full')
+            fs.writeFileSync(files.queued, 'full');
+        else
+            fs.writeFileSync(files.queued, 'turn', { flag: 'wx' });
+        return true;
+    }
+    catch (err) {
+        return err instanceof Error && 'code' in err && err.code === 'EEXIST';
+    }
+}
+/** Takes the queued request by renaming it, so one queued while this reads it lands in a fresh file. */
+function takeQueued(queued) {
+    const taken = `${queued}.${process.pid}`;
+    try {
+        fs.renameSync(queued, taken);
+    }
+    catch {
+        // Nothing queued, or a rename refused for a moment; the request stays queued for the next round.
+        return null;
+    }
+    try {
+        return fs.readFileSync(taken, 'utf8') === 'full' ? 'full' : 'turn';
+    }
+    finally {
+        fs.rmSync(taken, { force: true });
+    }
+}
+/** Runs `work` unless a live worker holds this session, which then runs the request after its own so the last reply is never dropped. */
+export async function runSessionWorker(sessionId, mode, work) {
+    const files = sessionStateFiles(sessionId);
+    if (files === null || !queueRun(files, mode))
+        return work(mode);
+    for (let take = takeSessionLock(files.lock); take !== 'held'; take = takeSessionLock(files.lock)) {
+        if (take === 'unusable')
+            return work(mode);
+        let ran = false;
+        try {
+            for (let next = takeQueued(files.queued); next !== null; next = takeQueued(files.queued)) {
+                ran = true;
+                await work(next);
+            }
+        }
+        finally {
+            releaseSessionLock(files.lock);
+        }
+        // A request queued after the last take found the lock still held and left, so it runs here.
+        if (!ran || !fs.existsSync(files.queued))
+            return;
+    }
+}
+function turnKey(turn) {
+    return createHash('sha256').update(`${turn.role}\n${turn.text}`).digest('hex').slice(0, FINGERPRINT_HEX_CHARS);
+}
+/** The cursor position after `turns`: how many there were and a hash of the last. */
+export function turnPosition(turns) {
+    return turns.length === 0 ? '0:' : `${turns.length}:${turnKey(turns[turns.length - 1])}`;
+}
+/** The turns after `position`; all of them when it is null or its last turn is no longer in view. */
+export function turnsAfter(turns, position) {
+    if (position === null)
+        return turns;
+    const [countText, key] = position.split(':');
+    const count = Number(countText);
+    if (!Number.isInteger(count) || count <= 0)
+        return turns;
+    if (count <= turns.length && turnKey(turns[count - 1]) === key)
+        return turns.slice(count);
+    // A transcript too big to read whole is read from its tail, so the count shifts; the last turn's text still marks the place.
+    for (let i = turns.length - 1; i >= 0; i--) {
+        if (turnKey(turns[i]) === key)
+            return turns.slice(i + 1);
+    }
+    return turns;
+}
+/** The saved position for this session's transcript; null when none was saved, it names another file, or it is unreadable. */
+export function loadTurnPosition(sessionId, transcriptPath) {
+    const file = sessionStateFiles(sessionId)?.cursor;
+    if (!file || !fs.existsSync(file))
+        return null;
+    try {
+        const cursor = JSON.parse(fs.readFileSync(file, 'utf8'));
+        if (!isObjectLike(cursor) || !('source' in cursor) || cursor.source !== transcriptPath)
+            return null;
+        return 'position' in cursor && isStringValue(cursor.position) ? cursor.position : null;
+    }
+    catch {
+        // A torn cursor means the next capture reads every turn, which the dedupe keys absorb.
+        return null;
+    }
+}
+// SHORTCUT: one small cursor file per chat is never pruned; prune by age at sleep if the folder grows.
+export function saveTurnPosition(sessionId, transcriptPath, turns, log) {
+    const file = sessionStateFiles(sessionId)?.cursor;
+    if (!file)
+        return;
+    const cursor = {
+        runtime: 'vscode', sessionId, source: transcriptPath, position: turnPosition(turns), updatedAt: new Date().toISOString(),
+    };
+    const tmp = `${file}.${process.pid}.tmp`;
+    try {
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(tmp, JSON.stringify(cursor));
+        fs.renameSync(tmp, file);
+    }
+    catch (err) {
+        // Windows refuses the rename (EPERM) while another process has the cursor open; the next reply re-reads these turns, which the dedupe keys absorb.
+        log(`cursor not saved: ${errorMessage(err)}`);
+    }
+}
+//# sourceMappingURL=session-worker.js.map

package/dist/{share-scrub.js → capture/share-scrub.js}

@@ -1,6 +1,6 @@
 // The scrub for transcript text that leaves the machine it was typed on.
-import { maskHomePaths } from './home-path.js';
-import { maskEmails, redactSecretsStrict } from './secret-detect.js';
+import { maskHomePaths } from '../util/home-path.js';
+import { maskEmails, redactSecretsStrict } from '../util/secret-detect.js';
 /** Secrets first, then emails, then home paths: a home-path mask could split a secret so that no pattern matches it. */
 export function scrubForSharing(text) {
     return maskHomePaths(maskEmails(redactSecretsStrict(text)));

package/dist/capture/transcript.js

@@ -1,9 +1,11 @@
-import { envHomeDir, processEnv } from '../env.js';
+import { envHomeDir, processEnv } from '../util/env.js';
 import { claudeConfigDir } from '../hooks/shared.js';
 import * as fs from 'fs';
 import * as path from 'path';
-import { isObjectLike, isStringValue } from '../capture-contract.js';
+import { isObjectLike, isStringValue, readSessionEnd } from '../core/capture-contract.js';
 import { copilotTurn } from './copilot-transcript.js';
+const RECENT_USER_TURNS = 20;
+const RECENT_ASSISTANT_TURNS = 10;
 /**
  * Build a compact text summary from a Claude Code / OpenCode / Copilot JSONL transcript.
  * Keeps plain user messages and the final chunk of assistant text, drops
@@ -54,69 +56,69 @@ export function collectSessionTurns(jsonl, visit) {
         if (!isObjectLike(entry) || !('type' in entry))
             continue;
         visit?.(entry);
-        const copilot = copilotTurn(entry);
-        if (copilot !== null) {
-            turns.push(copilot);
-            continue;
-        }
-        if (entry.type === 'user' || entry.type === 'assistant') {
-            const message = 'message' in entry && isObjectLike(entry.message) ? entry.message : undefined;
-            if (!message)
-                continue;
-            const content = 'content' in message ? message.content : undefined;
-            if (entry.type === 'user') {
-                const text = humanUserText(entry, message);
-                if (text)
-                    turns.push({ role: 'user', text });
-            }
-            else if (Array.isArray(content)) {
-                // Keep assistant text blocks; drop thinking + tool_use
-                const chunks = [];
-                for (const block of content) {
-                    if (isObjectLike(block)) {
-                        const blockText = 'type' in block && block.type === 'text' && 'text' in block ? block.text : undefined;
-                        if (isStringValue(blockText) && blockText.trim()) {
-                            chunks.push(blockText.trim());
-                        }
-                    }
-                }
-                if (chunks.length > 0) {
-                    turns.push({ role: 'assistant', text: chunks.join('\n') });
-                }
+        const turn = copilotTurn(entry) ?? claudeCodeTurn(entry) ?? codexTurn(entry);
+        if (turn !== null)
+            turns.push(turn);
+    }
+    return turns;
+}
+/** The turn a Claude Code `user` or `assistant` line carries; null for any other line or one with no human or reply text. */
+function claudeCodeTurn(entry) {
+    if (entry.type !== 'user' && entry.type !== 'assistant')
+        return null;
+    const message = 'message' in entry && isObjectLike(entry.message) ? entry.message : undefined;
+    if (!message)
+        return null;
+    const content = 'content' in message ? message.content : undefined;
+    if (entry.type === 'user') {
+        const text = humanUserText(entry, message);
+        return text ? { role: 'user', text } : null;
+    }
+    if (!Array.isArray(content))
+        return null;
+    // Keep assistant text blocks; drop thinking + tool_use
+    const chunks = [];
+    for (const block of content) {
+        if (isObjectLike(block)) {
+            const blockText = 'type' in block && block.type === 'text' && 'text' in block ? block.text : undefined;
+            if (isStringValue(blockText) && blockText.trim()) {
+                chunks.push(blockText.trim());
             }
+        }
+    }
+    return chunks.length > 0 ? { role: 'assistant', text: chunks.join('\n') } : null;
+}
+// Codex rollout transcript shape: response_item -> payload.message
+function codexTurn(entry) {
+    if (entry.type !== 'response_item')
+        return null;
+    const payload = 'payload' in entry && isObjectLike(entry.payload) ? entry.payload : undefined;
+    if (!payload || !('type' in payload) || payload.type !== 'message')
+        return null;
+    const role = 'role' in payload ? payload.role : undefined;
+    const content = 'content' in payload ? payload.content : undefined;
+    if (!Array.isArray(content))
+        return null;
+    const chunks = [];
+    for (const block of content) {
+        if (!isObjectLike(block))
             continue;
+        const blockType = 'type' in block ? block.type : undefined;
+        const blockText = 'text' in block ? block.text : undefined;
+        if (role === 'user' && blockType === 'input_text' && isStringValue(blockText) && blockText.trim()) {
+            chunks.push(blockText.trim());
         }
-        // Codex rollout transcript shape: response_item -> payload.message
-        if (entry.type === 'response_item') {
-            const payload = 'payload' in entry && isObjectLike(entry.payload) ? entry.payload : undefined;
-            if (!payload || !('type' in payload) || payload.type !== 'message')
-                continue;
-            const role = 'role' in payload ? payload.role : undefined;
-            const content = 'content' in payload ? payload.content : undefined;
-            if (!Array.isArray(content))
-                continue;
-            const chunks = [];
-            for (const block of content) {
-                if (!isObjectLike(block))
-                    continue;
-                const blockType = 'type' in block ? block.type : undefined;
-                const blockText = 'text' in block ? block.text : undefined;
-                if (role === 'user' && blockType === 'input_text' && isStringValue(blockText) && blockText.trim()) {
-                    chunks.push(blockText.trim());
-                }
-                if (role === 'assistant' && blockType === 'output_text' && isStringValue(blockText) && blockText.trim()) {
-                    chunks.push(blockText.trim());
-                }
-            }
-            if (chunks.length === 0)
-                continue;
-            if (role === 'user')
-                turns.push({ role: 'user', text: chunks.join('\n') });
-            if (role === 'assistant')
-                turns.push({ role: 'assistant', text: chunks.join('\n') });
+        if (role === 'assistant' && blockType === 'output_text' && isStringValue(blockText) && blockText.trim()) {
+            chunks.push(blockText.trim());
         }
     }
-    return turns;
+    if (chunks.length === 0)
+        return null;
+    if (role === 'user')
+        return { role: 'user', text: chunks.join('\n') };
+    if (role === 'assistant')
+        return { role: 'assistant', text: chunks.join('\n') };
+    return null;
 }
 export function summariseTranscript(jsonl) {
     return summariseSessionTurns(collectSessionTurns(jsonl));
@@ -124,8 +126,8 @@ export function summariseTranscript(jsonl) {
 /** The last 20 user turns and last 10 replies: session-end is about what was decided near the end, not at the start. */
 export function sessionTail(turns) {
     return {
-        users: turns.filter((t) => t.role === 'user').map((t) => t.text).slice(-20),
-        assistants: turns.filter((t) => t.role === 'assistant').map((t) => t.text).slice(-10),
+        users: turns.filter((t) => t.role === 'user').map((t) => t.text).slice(-RECENT_USER_TURNS),
+        assistants: turns.filter((t) => t.role === 'assistant').map((t) => t.text).slice(-RECENT_ASSISTANT_TURNS),
     };
 }
 export function summariseSessionTurns(turns) {
@@ -157,18 +159,10 @@ export function resolveLastSessionTranscript(explicit, stdinText, opts) {
     if (explicit)
         return fs.existsSync(explicit) ? explicit : null;
     if (stdinText && stdinText.trim() !== '') {
-        try {
-            const payload = JSON.parse(stdinText);
-            if (isObjectLike(payload) && 'transcript_path' in payload) {
-                const tp = payload.transcript_path;
-                if (isStringValue(tp) && fs.existsSync(tp))
-                    return tp;
-            }
-        }
-        catch {
-            // not JSON, but still a payload, so no scan
-        }
-        return null;
+        const receipt = readSessionEnd(stdinText, false);
+        // A refused payload is still a payload, so no scan.
+        const tp = receipt.status === 'received' ? receipt.input.transcriptPath : null;
+        return tp !== null && fs.existsSync(tp) ? tp : null;
     }
     if (!opts.mayScan)
         return null;

package/dist/capture/working-state.d.ts

@@ -1,7 +1,4 @@
 import type { TaskSnapshot } from '../store/rows.js';
-export declare const PRE_COMPACT_TASK_CAP = 200;
-export declare const PRE_COMPACT_SUMMARY_CAP = 2000;
-export declare const PRE_COMPACT_NEXT_STEP_CAP = 500;
 /** The longest each field of {@link transcriptWorkingState} can be, so a check of a sent working state imports these instead of copying them. */
 export declare const WORKING_STATE_CAPS: {
     readonly task: 200;

package/dist/capture/working-state.js

@@ -1,14 +1,14 @@
 // A session's working state read from its transcript tail, with no store in the imports, so a hook with no store can derive it.
 import * as fs from 'fs';
-import { maskEmails, redactSecretsStrict } from '../secret-detect.js';
-import { isObjectLike, isStringValue } from '../capture-contract.js';
-import { errorMessage } from '../log.js';
-import { PRE_COMPACT_TAIL_BYTES, readTranscriptTail, truncateCodePointSafe } from '../transcript-tail.js';
+import { maskEmails, redactSecretsStrict } from '../util/secret-detect.js';
+import { isObjectLike, isStringValue } from '../core/capture-contract.js';
+import { errorMessage } from '../util/log.js';
+import { PRE_COMPACT_TAIL_BYTES, readTranscriptTail, truncateCodePointSafe } from '../util/transcript-tail.js';
 import { humanUserText, summariseTranscript } from './transcript.js';
 import { copilotTurn } from './copilot-transcript.js';
-export const PRE_COMPACT_TASK_CAP = 200;
-export const PRE_COMPACT_SUMMARY_CAP = 2000;
-export const PRE_COMPACT_NEXT_STEP_CAP = 500;
+const PRE_COMPACT_TASK_CAP = 200;
+const PRE_COMPACT_SUMMARY_CAP = 2000;
+const PRE_COMPACT_NEXT_STEP_CAP = 500;
 const TRIM_MARKER = '[...earlier turns trimmed]\n';
 /** The longest each field of {@link transcriptWorkingState} can be, so a check of a sent working state imports these instead of copying them. */
 export const WORKING_STATE_CAPS = {

package/dist/{audit-prune.d.ts → cli/audit-prune.d.ts}

@@ -23,7 +23,6 @@
  *   - The audit_prune row itself is NEVER pruned by the same call (it's
  *     written AFTER the DELETE WHERE ts < cutoff, so ts > cutoff).
  */
-import type { DatabaseSyncLike } from './db.js';
 export interface PruneAuditOpts {
     /** Cutoff in days. Rows with `ts < (now - N days)` are deleted. */
     olderThanDays: number;
@@ -53,7 +52,7 @@ export declare function computeCutoff(days: number, now?: Date): string;
  *
  * Throws on invalid inputs (non-positive days, missing tenantId).
  */
-export declare function pruneAuditLog(db: DatabaseSyncLike, opts: PruneAuditOpts): PruneAuditResult;
+export declare function pruneAuditLog(hippoRoot: string, opts: PruneAuditOpts): PruneAuditResult;
 /**
  * Parse the `--older-than <value>` flag. Accepts either bare integer days
  * (`30`) or integer with `d` suffix (`30d`). Throws on invalid format.

package/dist/{audit-prune.js → cli/audit-prune.js}

@@ -23,13 +23,14 @@
  *   - The audit_prune row itself is NEVER pruned by the same call (it's
  *     written AFTER the DELETE WHERE ts < cutoff, so ts > cutoff).
  */
-import { appendAuditEvent } from './audit.js';
+import { pruneAuditRows } from '../store/audit.js';
+import { DAY_MS } from '../util/time.js';
 /**
  * Compute the cutoff ISO timestamp for an N-days-ago cutoff. Exported for
  * testability so tests can pin "now" without mocking Date.
  */
 export function computeCutoff(days, now = new Date()) {
-    const cutoff = new Date(now.getTime() - days * 24 * 60 * 60 * 1000);
+    const cutoff = new Date(now.getTime() - days * DAY_MS);
     return cutoff.toISOString();
 }
 function isTenantIdString(value) {
@@ -41,7 +42,7 @@ function isTenantIdString(value) {
  *
  * Throws on invalid inputs (non-positive days, missing tenantId).
  */
-export function pruneAuditLog(db, opts) {
+export function pruneAuditLog(hippoRoot, opts) {
     if (!Number.isFinite(opts.olderThanDays) || opts.olderThanDays <= 0) {
         throw new Error(`pruneAuditLog: olderThanDays must be a positive number, got ${opts.olderThanDays}`);
     }
@@ -51,42 +52,7 @@ export function pruneAuditLog(db, opts) {
     const dryRun = opts.dryRun === true;
     const actor = opts.actor ?? 'cli';
     const cutoff = computeCutoff(opts.olderThanDays);
-    let count = 0;
-    if (dryRun) {
-        // Dry-run: just count, no DELETE.
-        // SAFETY: row comes from `SELECT COUNT(*) AS c` above; COUNT(*) always
-        // yields exactly one row with a numeric `c` column (number or bigint
-        // depending on the node:sqlite driver's integer handling).
-        const row = db
-            .prepare(`SELECT COUNT(*) AS c FROM audit_log WHERE tenant_id = ? AND ts < ?`)
-            .get(opts.tenantId, cutoff);
-        count = Number(row.c);
-    }
-    else {
-        db.exec('BEGIN IMMEDIATE');
-        try {
-            const result = db
-                .prepare(`DELETE FROM audit_log WHERE tenant_id = ? AND ts < ?`)
-                .run(opts.tenantId, cutoff);
-            count = Number(result.changes ?? 0);
-            // Record the prune itself in the audit trail. This row has ts = now,
-            // so it's not eligible for the cutoff that was just applied.
-            appendAuditEvent(db, {
-                tenantId: opts.tenantId,
-                actor,
-                op: 'audit_prune',
-                metadata: { cutoff, count, dryRun: false, olderThanDays: opts.olderThanDays },
-            });
-            db.exec('COMMIT');
-        }
-        catch (e) {
-            try {
-                db.exec('ROLLBACK');
-            }
-            catch { /* already rolled back; keep the original error */ }
-            throw e;
-        }
-    }
+    const count = pruneAuditRows(hippoRoot, { tenantId: opts.tenantId, cutoff, actor, olderThanDays: opts.olderThanDays, dryRun });
     return { cutoff, count, dryRun };
 }
 /**

package/dist/cli/audit.d.ts

@@ -1,3 +1,3 @@
-import { type CommandContext } from './shared.js';
-export declare function handleAudit({ hippoRoot, args, flags }: CommandContext): void;
+import { type CommandContext } from './flag-values.js';
+export declare function handleAudit({ hippoRoot, args, flags }: CommandContext): Promise<void>;
 //# sourceMappingURL=audit.d.ts.map