hippo-memory 1.68.0 → 1.70.0

package/dist/cli/session-hooks.js

@@ -8,30 +8,37 @@ import { resolveJsonHookPaths } from '../hooks/json-hooks.js';
 import { isInitialized } from '../store/open.js';
 import { loadActiveTaskSnapshot, loadFreshActiveTaskSnapshot, closeTaskSnapshotsForSession, listSessionEvents, } from '../store/sessions.js';
 import { writeSessionEndHandoff } from '../store/handoffs.js';
-import { readSessionScan, recordSessionDigest } from '../session-digest.js';
-import { openHippoDb, closeHippoDb } from '../db.js';
-import { captureToolFailure } from '../capture-error.js';
-import { estimateTokens, isSubagentPayload, readApiCalls, recordRereads, recordTokenUse, } from '../token-ledger.js';
+import { readSessionScan, recordSessionDigest } from '../capture/session-digest.js';
+import { openHippoDb, closeHippoDb } from '../db/index.js';
+import { captureToolFailure } from '../capture/capture-error.js';
+import { readApiCalls, recordRereads, } from '../store/token-ledger.js';
+import { estimateTokens } from '../util/token-text.js';
 import { currentMachine, importSessionFolder } from '../agent-memories/sync.js';
 import { summaryLine } from '../agent-memories/report.js';
-import { resolveProjectIdentity } from '../project-identity.js';
-import { getGlobalRoot } from '../shared.js';
+import { resolveProjectIdentity } from '../core/project-identity.js';
+import { getGlobalRoot } from '../sharing/shared.js';
 import { cmdCapture } from '../capture/command.js';
 import { cmdPreCompact, cmdPostCompact } from '../capture/compact.js';
 import { transcriptWorkingState } from '../capture/working-state.js';
-import { collectHandoffEvidence } from '../handoff-evidence.js';
-import { resolveLastSessionTranscript } from '../capture/transcript.js';
-import { copilotTranscriptFor } from '../capture/copilot-transcript.js';
-import { truncateCodePointSafe } from '../transcript-tail.js';
-import { COMPACTION_DB_WAIT_MS } from '../compaction-record.js';
-import { COMPACT_RESUME_EVENT_CONTENT_CAP, COMPACT_RESUME_MAX_AGE_MS, compactResumeText } from '../context-render.js';
-import { readHookStdin } from '../stdin.js';
-import { resolveTenantId } from '../tenant.js';
-import { errorMessage, log } from '../log.js';
-import { withLedgerDb } from '../ledger-db.js';
+import { collectHandoffEvidence } from '../capture/handoff-evidence.js';
+import { copilotTranscriptFor, SESSION_ID_RE } from '../capture/copilot-transcript.js';
+import { loadTurnPosition, runSessionWorker, saveTurnPosition, turnsAfter } from '../capture/session-worker.js';
+import { isStringValue, readSessionEnd, readVscodeStop } from '../core/capture-contract.js';
+import { loadConfig } from '../core/config.js';
+import { autoSleepDue } from '../api/auto-sleep.js';
+import { truncateCodePointSafe } from '../util/transcript-tail.js';
+import { COMPACTION_DB_WAIT_MS } from '../capture/compaction-record.js';
+import { COMPACT_RESUME_EVENT_CONTENT_CAP, COMPACT_RESUME_MAX_AGE_MS, compactResumeText } from '../api/context-render.js';
+import { normaliseHookPayload, readHookStdin, readStdinBounded } from './stdin.js';
+import { resolveTenantId } from '../store/tenant.js';
+import { errorMessage, log } from '../util/log.js';
+import { bookLedgerTurn } from '../api/ledger-db.js';
+import { flushDeliveryRecorder } from '../api/prompt-hook.js';
 import { printError } from './output.js';
 import { cmdLastSleep } from './last-sleep.js';
-import { logSessionEndImport, appendSessionEndCloseLog, resetHookInjection, hookStoreRoot, hookRuntime, payloadCwdRoot, runHookWithStores, inPilotHoldout, } from './shared.js';
+import { readCompactResumePayload } from './compact-resume-payload.js';
+import { boolFlag, flagIsTrue, stringFlag } from './flag-values.js';
+import { logSessionEndImport, appendSessionEndCloseLog, resetHookInjection, hookStoreRoot, hookRuntime, payloadCwdRoot, runHookWithStores, inPilotHoldout, startDeliveryRecorder } from './hook-runtime.js';
 /**
  * SessionStart(compact) injector. Prints the active task snapshot + recent
  * session trail so working state that would otherwise be lost to
@@ -45,61 +52,35 @@ import { logSessionEndImport, appendSessionEndCloseLog, resetHookInjection, hook
  * hook must not pollute session startup.
  */
 function cmdCompactResume(hippoRoot, stdinText, stdinTimedOut) {
+    let rec = null;
     try {
         // Gate on the non-exiting isInitialized check first: the store reads below call initStore, which would
         // silently create a store in a project that never ran `hippo init`, and this hook fires globally.
         if (!isInitialized(hippoRoot)) {
             process.exit(0);
         }
-        // The matcher is an optimization, not a dependency: older Claude Code
-        // that ignores `matcher: 'compact'` would run this on every SessionStart,
-        // so we also gate on payload.source here. A payload that parses but
-        // carries a different source (e.g. 'startup') means the matcher-based
-        // gate failed to apply — stay silent rather than print stale state.
-        const nonEmptyStdin = !!stdinText && stdinText.trim() !== '';
-        // Without a payload session_id the cross-restore guard below can
-        // never fire, so a timed-out empty read must not reach the print path.
-        let suppressOutput = stdinTimedOut && !nonEmptyStdin;
-        let payloadSessionId = null;
-        if (nonEmptyStdin) {
-            let payload = null;
-            try {
-                payload = JSON.parse(stdinText.trim());
-            }
-            catch {
-                // Malformed JSON is handled as a null payload by the fail-closed check below.
-                payload = null;
-            }
-            if (!payload || typeof payload !== 'object') {
-                // Fail closed on malformed non-empty stdin; only a TTY/no-stdin manual run, which never reaches here, prints.
-                suppressOutput = true;
-            }
-            else {
-                // Fail closed on structurally incomplete payloads too ({}, [], source missing/non-string): real
-                // SessionStart payloads always carry source, so a parsed one must say 'compact' to print.
-                // A sub-agent's payload carries its parent's session id, so the mismatch guard would pass and restore the parent's snapshot into it.
-                if (payload.source !== 'compact' || isSubagentPayload(stdinText)) {
-                    suppressOutput = true;
-                }
-                if (typeof payload.session_id === 'string') {
-                    payloadSessionId = payload.session_id;
-                }
-            }
-        }
+        const payloadState = readCompactResumePayload(stdinText, stdinTimedOut);
+        let suppressOutput = payloadState.suppressOutput;
+        const payloadSessionId = payloadState.payloadSessionId;
+        if (payloadState.boundary)
+            rec = startDeliveryRecorder(hippoRoot, stdinText, 'claude-code', 'compact-resume');
         // A compaction follows a prompt or SessionStart that booked the arm, so this only reads it.
         if (!suppressOutput && payloadSessionId !== null && inPilotHoldout(hippoRoot, resolveTenantId({}), payloadSessionId, false)) {
             suppressOutput = true;
+            rec?.disabled();
         }
         if (!suppressOutput)
-            restoreCompactSnapshot(hippoRoot, payloadSessionId);
+            restoreCompactSnapshot(hippoRoot, payloadSessionId, rec);
     }
     catch (err) {
         // Empty stdout on any store error, never a crashed SessionStart; the reason goes to stderr, which the model never sees.
-        log.warn(`hippo compact-resume: skipped: ${err instanceof Error ? err.message : String(err)}`);
+        log.warn(`hippo compact-resume: skipped: ${errorMessage(err)}`);
     }
+    // A no-op when the token ledger's handle already wrote the row; exit would drop it otherwise.
+    flushDeliveryRecorder(rec);
     process.exit(0);
 }
-function restoreCompactSnapshot(hippoRoot, payloadSessionId) {
+function restoreCompactSnapshot(hippoRoot, payloadSessionId, rec) {
     const tenantId = resolveTenantId({});
     const snapshot = loadFreshActiveTaskSnapshot(hippoRoot, tenantId, { maxAgeMs: COMPACT_RESUME_MAX_AGE_MS });
     // Concurrent sessions must not cross-restore. Only suppress when BOTH ids are present and differ;
@@ -121,14 +102,18 @@ function restoreCompactSnapshot(hippoRoot, payloadSessionId) {
         }
     }
     catch (err) {
-        log.warn(`hippo compact-resume: trail skipped: ${err instanceof Error ? err.message : String(err)}`);
+        log.warn(`hippo compact-resume: trail skipped: ${errorMessage(err)}`);
     }
     // Printed in one write so the ledger books exactly the text the model is handed.
     const text = compactResumeText(snapshot, events);
     console.log(text);
-    withLedgerDb(hippoRoot, (db) => recordTokenUse(db, {
-        tenantId, sessionId: payloadSessionId, surface: 'compact_resume', event: 'inject', items: 1, tokens: estimateTokens(text),
-    }));
+    rec?.delivered({ state: 'sent', emittedText: `${text}\n` });
+    bookLedgerTurn(hippoRoot, {
+        uses: [{
+                tenantId, sessionId: payloadSessionId, surface: 'compact_resume', event: 'inject', items: 1, tokens: estimateTokens(text),
+            }],
+        delivery: (write) => flushDeliveryRecorder(rec, write),
+    });
 }
 /**
  * SessionEnd entry point. Claude Code / OpenCode fire this on /exit while
@@ -143,47 +128,31 @@ function restoreCompactSnapshot(hippoRoot, payloadSessionId) {
  */
 export async function cmdSessionEnd(hippoRoot, flags) {
     const runtime = hookRuntime(flags);
+    const turn = flagIsTrue(flags, 'turn');
     // Copilot's hook command carries no path, since one quoted into it would need escaping for each shell; the log goes where the hook table used to point.
-    const logFile = typeof flags['log-file'] === 'string' ? flags['log-file'] : runtime === 'copilot' ? resolveJsonHookPaths('copilot').logFile : null;
+    const logFile = stringFlag(flags, 'log-file') ?? (runtime === 'copilot' ? resolveJsonHookPaths('copilot').logFile : null);
     // Bounded read: extracts transcript_path + session_id for the detached worker's argv.
-    let sessionId = null;
-    const { text: stdinText } = await readHookStdin();
+    const raw = await readStdinBounded();
+    // Read before normalising: the Copilot CLI's agentStop shares this hook line, and camelCase keys would pass as VS Code's.
+    const stop = turn ? vscodeStopInput(raw) : null;
+    if (turn && !stop)
+        return;
+    const stdinText = normaliseHookPayload(raw.text);
     // Before the spawn, since the worker finds its store from the folder it inherits.
     const root = payloadCwdRoot(hippoRoot, stdinText, runtime);
-    try {
-        if (stdinText && stdinText.trim().startsWith('{')) {
-            const payload = JSON.parse(stdinText);
-            if (typeof payload.session_id === 'string') {
-                sessionId = payload.session_id;
-            }
-        }
-    }
-    catch {
-        // No stdin, not JSON, or read failure: the snapshot close below will no-op.
-    }
+    const input = stop ?? sessionEndInput(stdinText, raw.timedOut, runtime);
+    const sessionId = input?.sessionId ?? null;
     // Resolved here because only this process saw the payload; the worker captures just the path it is handed.
     // Always a hook, so never scan: an empty stdin here is not a manual run. The Copilot CLI's sessionEnd names no transcript, so its log is found by id.
-    const transcriptPath = resolveLastSessionTranscript(undefined, stdinText, { mayScan: false })
+    const named = input?.transcriptPath ?? null;
+    const transcriptPath = (named !== null && fs.existsSync(named) ? named : null)
         ?? (runtime === 'copilot' && sessionId ? copilotTranscriptFor(sessionId) : null);
-    const workerArgs = [process.argv[1], '__session-end-worker'];
-    if (logFile)
-        workerArgs.push('--log-file', logFile);
-    if (transcriptPath)
-        workerArgs.push('--transcript', transcriptPath);
-    if (sessionId)
-        workerArgs.push('--session-id', sessionId);
     try {
-        const child = spawn(process.execPath, workerArgs, {
-            detached: true,
-            stdio: 'ignore',
-            windowsHide: true,
-        });
-        // An async spawn failure arrives as an 'error' event, which with no listener is an uncaught exception.
-        child.on('error', (err) => log.warn(`hippo session-end: the worker did not start: ${errorMessage(err)}`));
-        child.unref();
+        spawnSessionEndWorker(sessionEndWorkerArgs(logFile, transcriptPath, sessionId, turn));
     }
-    catch {
-        // If spawn fails, run inline as a last resort, handed what the child's argv would have carried.
+    catch (err) {
+        log.debug(`session-end: the worker did not spawn, running inline: ${errorMessage(err)}`);
+        // Inline is the last resort, handed what the child's argv would have carried.
         if (logFile)
             flags['log-file'] = logFile;
         if (transcriptPath)
@@ -194,12 +163,51 @@ export async function cmdSessionEnd(hippoRoot, flags) {
         return;
     }
 }
+/** What the session-end payload named; null for one hippo refuses or one that never arrived, and the worker then runs with neither value. */
+function sessionEndInput(stdinText, timedOut, runtime) {
+    const receipt = readSessionEnd(stdinText, timedOut, runtime);
+    if (receipt.status === 'received')
+        return receipt.input;
+    log.debug(`session-end: ${receipt.reason}`);
+    return null;
+}
+function sessionEndWorkerArgs(logFile, transcriptPath, sessionId, turn) {
+    const workerArgs = [process.argv[1], '__session-end-worker'];
+    if (logFile)
+        workerArgs.push('--log-file', logFile);
+    if (transcriptPath)
+        workerArgs.push('--transcript', transcriptPath);
+    if (sessionId)
+        workerArgs.push('--session-id', sessionId);
+    if (turn)
+        workerArgs.push('--turn');
+    return workerArgs;
+}
+function spawnSessionEndWorker(workerArgs) {
+    const child = spawn(process.execPath, workerArgs, {
+        detached: true,
+        stdio: 'ignore',
+        windowsHide: true,
+    });
+    // An async spawn failure arrives as an 'error' event, which with no listener is an uncaught exception.
+    child.on('error', (err) => log.warn(`hippo session-end: the worker did not start: ${errorMessage(err)}`));
+    child.unref();
+}
+/** The input of a VS Code Stop payload with a session id that can name the lock file; null makes turn mode a silent no-op. */
+function vscodeStopInput(raw) {
+    const receipt = readVscodeStop(raw.text, raw.timedOut);
+    return receipt.status === 'received' && receipt.input.sessionId !== null && SESSION_ID_RE.test(receipt.input.sessionId) ? receipt.input : null;
+}
 export async function cmdSessionEndWorker(hippoRoot, flags) {
-    const transcriptPath = typeof flags['transcript'] === 'string' ? flags['transcript'] : undefined;
-    const closeLogFile = typeof flags['log-file'] === 'string' ? flags['log-file'] : null;
-    const closeSessionId = typeof flags['session-id'] === 'string' ? flags['session-id'] : null;
+    const sessionId = flags['session-id'];
+    await runSessionWorker(isStringValue(sessionId) ? sessionId : null, flagIsTrue(flags, 'turn') ? 'turn' : 'full', (mode) => sessionEndWork(hippoRoot, flags, mode));
+}
+async function sessionEndWork(hippoRoot, flags, mode) {
+    const transcriptPath = stringFlag(flags, 'transcript');
+    const closeLogFile = stringFlag(flags, 'log-file') ?? null;
+    const closeSessionId = stringFlag(flags, 'session-id') ?? null;
     const rereadLog = await bookSessionRereads(hippoRoot, transcriptPath, closeSessionId)
-        .catch((err) => [`re-read count failed: ${err instanceof Error ? err.message : String(err)}`]);
+        .catch((err) => [`re-read count failed: ${errorMessage(err)}`]);
     // Sleep starts the log file afresh, so the lines go in after it; on exit too, in case sleep exits the process.
     const flushRereadLog = () => { for (const line of rereadLog.splice(0))
         appendSessionEndCloseLog(closeLogFile, line); };
@@ -211,11 +219,18 @@ export async function cmdSessionEndWorker(hippoRoot, flags) {
         flushRereadLog();
         return;
     }
-    await sleepProjectStore(hippoRoot, flags, closeLogFile, transcriptPath);
+    if (mode === 'turn' && closeSessionId)
+        await sleepIfDue(hippoRoot, flags, closeLogFile, transcriptPath, closeSessionId);
+    else
+        await sleepProjectStore(hippoRoot, flags, closeLogFile, transcriptPath);
     flushRereadLog();
     const digestLog = (message) => appendSessionEndCloseLog(closeLogFile, message);
     const scan = transcriptPath ? readSessionScan(transcriptPath, digestLog) : null;
-    captureEndedSession(hippoRoot, store, flags, transcriptPath, scan);
+    const capture = (turns) => captureEndedSession(hippoRoot, store, flags, transcriptPath, turns);
+    if (mode === 'turn')
+        captureNewTurns(transcriptPath, closeSessionId, scan, capture, digestLog);
+    else
+        capture(scan?.turns);
     recordSessionDigest(hippoRoot, scan, {
         key: closeSessionId || path.basename(transcriptPath ?? '', '.jsonl'),
         tenantId: resolveTenantId({}),
@@ -225,7 +240,15 @@ export async function cmdSessionEndWorker(hippoRoot, flags) {
     // session-end may never fire (crash, kill -9) the freshness bound in loadFreshActiveTaskSnapshot is the backstop.
     // The handoff is written first, while the snapshot writeSessionEndHandoff reads is still active.
     if (closeSessionId)
-        writeEndHandoff(store, closeSessionId, transcriptPath, closeLogFile);
+        writeEndHandoff(store, closeSessionId, transcriptPath, closeLogFile, mode === 'turn');
+    if (mode === 'turn') {
+        // The chat goes on after a reply, so its snapshot stays for the next compaction to restore.
+        appendSessionEndCloseLog(closeLogFile, 'skip snapshot close: turn mode');
+        return;
+    }
+    closeEndedSessionSnapshot(store, closeSessionId, closeLogFile);
+}
+function closeEndedSessionSnapshot(store, closeSessionId, closeLogFile) {
     try {
         if (closeSessionId) {
             const closed = closeTaskSnapshotsForSession(store, resolveTenantId({}), closeSessionId);
@@ -236,7 +259,7 @@ export async function cmdSessionEndWorker(hippoRoot, flags) {
         }
     }
     catch (err) {
-        appendSessionEndCloseLog(closeLogFile, `snapshot close failed: ${err.message}`);
+        appendSessionEndCloseLog(closeLogFile, `snapshot close failed: ${errorMessage(err)}`);
     }
 }
 async function sleepProjectStore(hippoRoot, flags, closeLogFile, transcriptPath) {
@@ -245,9 +268,9 @@ async function sleepProjectStore(hippoRoot, flags, closeLogFile, transcriptPath)
         try {
             await (await import('./sleep.js')).cmdSleep(hippoRoot, flags);
         }
-        catch {
-            // sleep errors are already tee'd to the log file via cmdSleep's
-            // `[hippo] sleep failed: ...` line. Continue to capture regardless.
+        catch (err) {
+            // cmdSleep writes its failure line only when it has a log file, and capture runs regardless.
+            log.debug(`session-end: sleep failed: ${errorMessage(err)}`);
         }
     }
     else {
@@ -255,32 +278,67 @@ async function sleepProjectStore(hippoRoot, flags, closeLogFile, transcriptPath)
         logSessionEndImport(closeLogFile, transcriptPath);
     }
 }
-function captureEndedSession(hippoRoot, store, flags, transcriptPath, scan) {
+/** A close after every reply sleeps only at the MCP server's auto-sleep threshold; each line starts the log afresh, as a sleep does. */
+async function sleepIfDue(hippoRoot, flags, closeLogFile, transcriptPath, sessionId) {
+    if (!isInitialized(hippoRoot))
+        return sleepProjectStore(hippoRoot, flags, closeLogFile, transcriptPath);
+    const prefix = `turn close, session ${sessionId}`;
+    try {
+        const { enabled, count, threshold, due } = autoSleepDue(hippoRoot, resolveTenantId({}), loadConfig(hippoRoot).autoSleep);
+        if (!due) {
+            const why = enabled ? `${count} new memories, threshold ${threshold}` : 'auto-sleep is off';
+            appendSessionEndCloseLog(closeLogFile, `${prefix}: skip sleep, ${why}`, { startFresh: true });
+            return;
+        }
+        await sleepProjectStore(hippoRoot, flags, closeLogFile, transcriptPath);
+        appendSessionEndCloseLog(closeLogFile, `${prefix}: ran sleep at ${count} new memories (threshold ${threshold})`);
+    }
+    catch (err) {
+        appendSessionEndCloseLog(closeLogFile, `${prefix}: sleep check failed: ${errorMessage(err)}`, { startFresh: true });
+    }
+}
+/** Captures only the turns after this session's cursor, then moves the cursor, so each reply is extracted once. */
+function captureNewTurns(transcriptPath, sessionId, scan, capture, log) {
+    if (!transcriptPath || !sessionId || !scan) {
+        log('skip capture: no readable transcript for this session');
+        return;
+    }
+    const fresh = turnsAfter(scan.turns, loadTurnPosition(sessionId, transcriptPath));
+    if (fresh.length === 0) {
+        log('skip capture: no new turns since the last reply');
+        return;
+    }
+    if (capture(fresh))
+        saveTurnPosition(sessionId, transcriptPath, scan.turns, log);
+}
+/** True when capture ran to the end, so a turn close may move its cursor past these turns. */
+function captureEndedSession(hippoRoot, store, flags, transcriptPath, turns) {
     try {
-        const logFile = typeof flags['log-file'] === 'string' ? flags['log-file'] : undefined;
+        const logFile = stringFlag(flags, 'log-file');
         // With no stdin of its own, capture would read this as a manual run and scan every project.
         if (!transcriptPath) {
             appendSessionEndCloseLog(logFile ?? null, 'skip capture: no transcript for this session');
+            return false;
         }
-        else {
-            cmdCapture(store, {
-                source: 'last-session',
-                transcriptPath,
-                logFile,
-                dryRun: false,
-                global: false,
-                tenantId: resolveTenantId({}),
-                // In the global store, rows would otherwise read as user-global and show up in every project.
-                originProject: store === hippoRoot ? undefined : resolveProjectIdentity(process.cwd()),
-                sessionTurns: scan?.turns,
-            });
-        }
+        cmdCapture(store, {
+            source: 'last-session',
+            transcriptPath,
+            logFile,
+            dryRun: false,
+            global: false,
+            tenantId: resolveTenantId({}),
+            // In the global store, rows would otherwise read as user-global and show up in every project.
+            originProject: store === hippoRoot ? undefined : resolveProjectIdentity(process.cwd()),
+            sessionTurns: turns,
+        });
+        return true;
     }
-    catch {
-        // Same treatment — the failure line is already in the log.
+    catch (err) {
+        log.debug(`session-end: capture failed: ${errorMessage(err)}`);
+        return false;
     }
 }
-function writeEndHandoff(store, closeSessionId, transcriptPath, closeLogFile) {
+function writeEndHandoff(store, closeSessionId, transcriptPath, closeLogFile, inPlace = false) {
     try {
         const tenantId = resolveTenantId({});
         const ownSnapshot = loadActiveTaskSnapshot(store, tenantId)?.session_id === closeSessionId;
@@ -293,13 +351,13 @@ function writeEndHandoff(store, closeSessionId, transcriptPath, closeLogFile) {
         }
         else {
             const evidence = collectHandoffEvidence(process.cwd(), 'unknown');
-            const handoff = writeSessionEndHandoff(store, tenantId, closeSessionId, evidence, derived);
+            const handoff = writeSessionEndHandoff(store, tenantId, closeSessionId, evidence, derived, undefined, { inPlace });
             appendSessionEndCloseLog(closeLogFile, handoff ? `wrote handoff for session ${closeSessionId}` : `skip: kept the existing handoff for session ${closeSessionId}`);
         }
     }
     catch (err) {
         // SAFETY: catch clauses bind unknown, but Node/V8 always throws an Error here.
-        appendSessionEndCloseLog(closeLogFile, `handoff write failed: ${err.message}`);
+        appendSessionEndCloseLog(closeLogFile, `handoff write failed: ${errorMessage(err)}`);
     }
 }
 /** Books the ending session's re-reads in each store its ledger rows can land in (project and global); returns the log lines. */
@@ -311,7 +369,7 @@ async function bookSessionRereads(hippoRoot, transcriptPath, sessionId) {
         read = await readApiCalls(transcriptPath);
     }
     catch (err) {
-        return [`skip re-read count: cannot read the transcript: ${err instanceof Error ? err.message : String(err)}`];
+        return [`skip re-read count: cannot read the transcript: ${errorMessage(err)}`];
     }
     const roots = new Set([hippoRoot, getGlobalRoot()].filter((root) => isInitialized(root)).map((root) => path.resolve(root)));
     const lines = [];
@@ -327,7 +385,7 @@ async function bookSessionRereads(hippoRoot, transcriptPath, sessionId) {
             }
         }
         catch (err) {
-            lines.push(`re-read count failed: ${err instanceof Error ? err.message : String(err)}`);
+            lines.push(`re-read count failed: ${errorMessage(err)}`);
         }
     }
     const skipped = read.malformed > 0 ? `, ${read.malformed} unparsable transcript lines skipped` : '';
@@ -374,8 +432,8 @@ export function cmdCodexRun(hippoRoot, args) {
     try {
         cmdLastSleep(hippoRoot, { path: metadata.logFile }, 'terminal');
     }
-    catch {
-        // best-effort only
+    catch (err) {
+        log.debug(`codex run: the last sleep summary was not shown: ${errorMessage(err)}`);
     }
     const child = spawnRealCodex(metadata.realCodexPath, args, process.cwd());
     child.on('error', (err) => {
@@ -383,85 +441,93 @@ export function cmdCodexRun(hippoRoot, args) {
         process.exit(1);
     });
     child.on('exit', async (code, signal) => {
-        const workerArgs = [
-            process.argv[1],
-            '__codex-session-end-worker',
-            '--codex-home',
-            path.dirname(historyPath),
-            '--history-path',
-            historyPath,
-            '--start-offset',
-            String(startOffsetBytes),
-            '--started-at',
-            String(startedAtMs),
-            '--log-file',
-            metadata.logFile,
-        ];
+        await launchCodexSessionEndWorker(hippoRoot, historyPath, startOffsetBytes, startedAtMs, metadata.logFile);
+        exitLikeChild(code, signal);
+    });
+}
+async function launchCodexSessionEndWorker(hippoRoot, historyPath, startOffsetBytes, startedAtMs, logFile) {
+    const workerArgs = [
+        process.argv[1],
+        '__codex-session-end-worker',
+        '--codex-home',
+        path.dirname(historyPath),
+        '--history-path',
+        historyPath,
+        '--start-offset',
+        String(startOffsetBytes),
+        '--started-at',
+        String(startedAtMs),
+        '--log-file',
+        logFile,
+    ];
+    try {
+        const worker = spawn(process.execPath, workerArgs, {
+            detached: true,
+            stdio: 'ignore',
+            windowsHide: true,
+        });
+        worker.unref();
+    }
+    catch (err) {
+        log.debug(`codex run: the session-end worker did not spawn, running inline: ${errorMessage(err)}`);
+        // Awaited so the sleep write can't be killed by the exit calls below.
         try {
-            const worker = spawn(process.execPath, workerArgs, {
-                detached: true,
-                stdio: 'ignore',
-                windowsHide: true,
+            await cmdCodexSessionEndWorker(hippoRoot, {
+                'codex-home': path.dirname(historyPath),
+                'history-path': historyPath,
+                'start-offset': String(startOffsetBytes),
+                'started-at': String(startedAtMs),
+                'log-file': logFile,
             });
-            worker.unref();
         }
-        catch {
-            // Fall back to the inline path if the detached worker cannot be created.
-            // Awaited so the sleep write can't be killed by the exit calls below.
-            try {
-                await cmdCodexSessionEndWorker(hippoRoot, {
-                    'codex-home': path.dirname(historyPath),
-                    'history-path': historyPath,
-                    'start-offset': String(startOffsetBytes),
-                    'started-at': String(startedAtMs),
-                    'log-file': metadata.logFile,
-                });
-            }
-            catch {
-                // cmdCodexSessionEndWorker already fail-softs internally; this is belt-and-braces.
-            }
+        catch (inlineErr) {
+            log.debug(`codex run: the inline session-end failed: ${errorMessage(inlineErr)}`);
         }
-        if (signal) {
-            try {
-                process.kill(process.pid, signal);
-            }
-            catch {
-                // Cannot re-raise the child's signal on this platform; a non-zero exit still reports the failure.
-                process.exit(1);
-            }
-            return;
+    }
+}
+function exitLikeChild(code, signal) {
+    if (signal) {
+        try {
+            process.kill(process.pid, signal);
         }
-        process.exit(code ?? 0);
-    });
+        catch {
+            // Cannot re-raise the child's signal on this platform; a non-zero exit still reports the failure.
+            process.exit(1);
+        }
+        return;
+    }
+    process.exit(code ?? 0);
 }
 export async function cmdCodexSessionEndWorker(hippoRoot, flags) {
-    const logFile = typeof flags['log-file'] === 'string' ? flags['log-file'] : undefined;
+    const logFile = stringFlag(flags, 'log-file');
     // Like the other hooks: project store, else global; a folder with neither must not get one made.
     const store = hookStoreRoot(hippoRoot);
     if (!isInitialized(store)) {
         appendSessionEndCloseLog(logFile ?? null, 'skip: no hippo store for this folder or globally', { startFresh: true });
         return;
     }
+    await sleepCodexProjectStore(hippoRoot, logFile);
+    captureCodexTranscript(hippoRoot, store, flags, logFile);
+}
+async function sleepCodexProjectStore(hippoRoot, logFile) {
     // Sleeping the global store from here would learn this folder's git commits into it; it has its own daily sleep.
     if (isInitialized(hippoRoot)) {
         try {
             await (await import('./sleep.js')).cmdSleep(hippoRoot, logFile ? { 'log-file': logFile } : {});
         }
-        catch {
-            // sleep errors are already written via cmdSleep
+        catch (err) {
+            log.debug(`codex session-end: sleep failed: ${errorMessage(err)}`);
         }
     }
     else {
         appendSessionEndCloseLog(logFile ?? null, 'skip sleep: this folder has no store of its own', { startFresh: true });
         logSessionEndImport(logFile ?? null, undefined);
     }
+}
+function captureCodexTranscript(hippoRoot, store, flags, logFile) {
     try {
-        const codexHome = typeof flags['codex-home'] === 'string'
-            ? flags['codex-home']
-            : resolveCodexWrapperPaths().codexHome;
-        const historyPath = typeof flags['history-path'] === 'string'
-            ? flags['history-path']
-            : path.join(codexHome, 'history.jsonl');
+        const codexHome = stringFlag(flags, 'codex-home') ?? resolveCodexWrapperPaths().codexHome;
+        const historyPath = stringFlag(flags, 'history-path') ?? path.join(codexHome, 'history.jsonl');
         const startOffsetBytes = parseInt(String(flags['start-offset'] ?? '0'), 10) || 0;
         const startedAtMs = parseInt(String(flags['started-at'] ?? Date.now()), 10) || Date.now();
         const transcriptPath = resolveCodexSessionTranscript({
@@ -490,14 +556,14 @@ export async function cmdCodexSessionEndWorker(hippoRoot, flags) {
         try {
             cmdCapture(store, captureOpts);
         }
-        catch {
-            // capture path logs its own failures
+        catch (err) {
+            log.debug(`codex session-end: capture failed: ${errorMessage(err)}`);
         }
         // The Codex wrapper passes no session id, so the rollout file names the session.
         recordSessionDigest(hippoRoot, scan, { key: path.basename(transcriptPath, '.jsonl'), tenantId: resolveTenantId({}), log: digestLog });
     }
-    catch {
-        // capture path logs its own failures
+    catch (err) {
+        log.debug(`codex session-end: transcript scan or digest failed: ${errorMessage(err)}`);
     }
 }
 export async function handlePreCompact({ hippoRoot, flags }) {
@@ -506,22 +572,29 @@ export async function handlePreCompact({ hippoRoot, flags }) {
     const runtime = hookRuntime(flags);
     const root = payloadCwdRoot(hippoRoot, stdinText, runtime);
     await runHookWithStores(async () => {
+        // Started before any store wait, so two fires of one hook carry timestamps close enough to match as duplicates.
+        const rec = startDeliveryRecorder(hookStoreRoot(root), stdinText, runtime, 'pre-compact');
         resetHookInjection(root, stdinText, null);
         await cmdPreCompact(hookStoreRoot(root), {
             stdinText,
             stdinTimedOut,
-            logFile: typeof flags['log-file'] === 'string' ? flags['log-file'] : undefined,
+            logFile: stringFlag(flags, 'log-file'),
             runtime,
+            onBoundary: (printed) => {
+                rec?.delivered(printed === null ? { state: 'empty' } : { state: 'sent', emittedText: printed });
+                flushDeliveryRecorder(rec);
+            },
         });
     });
 }
 export async function handlePostCompact({ hippoRoot, flags }) {
     // PostCompact hook: saves the compaction summary and its memories, then prints one plain line, because Claude Code shows this hook's stdout as-is. Always exits 0.
-    const { text } = await readHookStdin();
+    const { text, timedOut } = await readHookStdin();
     const logFlag = flags['log-file'];
     const store = hookStoreRoot(hippoRoot);
     const line = await runHookWithStores(() => cmdPostCompact(store, {
         stdinText: text,
+        stdinTimedOut: timedOut,
         logFile: logFlag === true || logFlag === false || Array.isArray(logFlag) ? undefined : logFlag,
         // Passed in, since capture.ts importing the sync would close an import cycle.
         afterSave: (transcriptPath, cwd, log) => {
@@ -549,8 +622,9 @@ export async function handleCaptureError({ hippoRoot, flags }) {
             await runHookWithStores(() => captureToolFailure(root, resolveTenantId({}), failure));
         }
     }
-    catch {
-        // A malformed payload or store error must never fail the agent's tool call.
+    catch (err) {
+        // A malformed payload or store error must never fail the agent's tool call, so it is reported and dropped.
+        log.warn(`failure capture skipped: ${errorMessage(err)}`);
     }
 }
 export async function handleCompactResume({ hippoRoot }) {
@@ -594,9 +668,9 @@ export async function handleCapture({ hippoRoot, flags }) {
         transcriptPath,
         stdinText: bounded.text,
         stdinTimedOut: bounded.timedOut,
-        logFile: typeof flags['log-file'] === 'string' ? flags['log-file'] : undefined,
-        dryRun: Boolean(flags['dry-run']),
-        global: Boolean(flags['global']),
+        logFile: stringFlag(flags, 'log-file'),
+        dryRun: boolFlag(flags, 'dry-run'),
+        global: boolFlag(flags, 'global'),
         tenantId: resolveTenantId({}),
     });
 }