hippo-memory 1.68.0 → 1.70.0

package/dist/hooks/copilot.js

@@ -1,14 +1,33 @@
-// GitHub Copilot: hippo's hooks file, one MCP server key and an instructions block, all under the Copilot home folder.
+// GitHub Copilot: hippo's hooks file, one MCP server key and an instructions block under the Copilot home folder,
+// plus the MCP server and an instructions file in each VS Code User folder.
 import * as fs from 'fs';
 import * as path from 'path';
 import { isDeepStrictEqual } from 'node:util';
-import { readJsonFile } from '../json.js';
-import { HOOK_MARKERS, hippoBlock } from '../cli/hook-blocks.js';
-import { copilotHomeDir, isJsonObject } from './shared.js';
+import { readJsonFile, isJsonObjectLiteral } from '../util/json.js';
+import { HOOK_MARKERS, hippoBlock } from './hook-blocks.js';
+import { copilotHomeDir, vscodeUserDirs } from './shared.js';
+import { writeFileAtomic } from '../util/atomic-write.js';
 import { installJsonHooks, resolveJsonHookPaths, uninstallJsonHooks, writeSettingsFile } from './json-hooks.js';
 const MCP_KEY = 'hippo';
 /** Copilot drops what a per-prompt hook prints, so per-task recall goes through the MCP tool the block names. */
-export const COPILOT_INSTRUCTIONS = `
+const COPILOT_INSTRUCTIONS = `
+## Project Memory (Hippo)
+
+At the start of each task, call the \`hippo_recall\` tool with a short query that
+names the task. Read the memories it returns before you write any code.
+
+When you learn something that should outlive this session (a decision and its
+reason, a user preference, why something failed), call the \`hippo_remember\`
+tool right then, while you work, never as a closing step. Set \`error\` to true
+for a failure. Leave out secrets and personal details.
+
+The installed hooks load pinned memories when a session starts and capture
+the session as you work, so there is nothing to run before you finish.
+`.trim();
+/** Every Copilot text a release has written, so install upgrades an old block and uninstall still removes it; add the old text when the text changes. */
+const SHIPPED_COPILOT_INSTRUCTIONS = [
+    COPILOT_INSTRUCTIONS,
+    `
 ## Project Memory (Hippo)
 
 At the start of each task, call the \`hippo_recall\` tool with a short query that
@@ -22,29 +41,55 @@ for a failure. Leave out secrets and personal details.
 The installed hooks load pinned memories when a session starts, store failed
 tool calls and capture the session when it ends, so there is nothing to run
 before you finish.
-`.trim();
+`.trim(),
+];
+/** VS Code attaches a User `*.instructions.md` file to every chat request its `applyTo` glob matches. */
+const withApplyToAll = (text) => `---\napplyTo: "**"\n---\n${text}\n`;
+const VSCODE_INSTRUCTIONS = withApplyToAll(COPILOT_INSTRUCTIONS);
+function isHipposVscodeInstructions(text) {
+    return SHIPPED_COPILOT_INSTRUCTIONS.some((shipped) => text === withApplyToAll(shipped));
+}
+function profileDirs(userDir) {
+    const dir = path.join(userDir, 'profiles');
+    if (!fs.existsSync(dir))
+        return [];
+    return fs.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => path.join(dir, e.name)).sort();
+}
 export function copilotPaths() {
     const home = copilotHomeDir();
     return {
         hooks: resolveJsonHookPaths('copilot').settings,
         mcpConfig: path.join(home, 'mcp-config.json'),
         instructions: path.join(home, 'copilot-instructions.md'),
+        vscode: vscodeUserDirs().map((userDir) => ({
+            userDir,
+            mcpConfig: path.join(userDir, 'mcp.json'),
+            instructions: path.join(userDir, 'prompts', 'hippo.instructions.md'),
+            profiles: profileDirs(userDir),
+        })),
     };
 }
 /** Windows gets npm's .cmd shim, as the Codex hooks do, since a PowerShell execution policy can block hippo.ps1. */
-function hippoMcpServer() {
-    return { type: 'local', command: process.platform === 'win32' ? 'hippo.cmd' : 'hippo', args: ['mcp'], env: {}, tools: ['*'] };
+function hippoCommand() {
+    return process.platform === 'win32' ? 'hippo.cmd' : 'hippo';
 }
-/** Only a server hippo wrote counts as hippo's: a user's own "hippo" key with another command or args is never touched. */
-function isHipposServer(entry) {
-    return isJsonObject(entry) && (entry.command === 'hippo' || entry.command === 'hippo.cmd') && isDeepStrictEqual(entry.args, ['mcp']);
+/** The Copilot CLI's mcp-config.json keeps servers under "mcpServers", each with an env and a tool list. */
+export const COPILOT_CLI_MCP = { key: 'mcpServers', server: () => ({ type: 'local', command: hippoCommand(), args: ['mcp'], env: {}, tools: ['*'] }) };
+/** VS Code's mcp.json keeps stdio servers under "servers"; it has no "mcpServers" key. */
+export const VSCODE_MCP = { key: 'servers', server: () => ({ type: 'stdio', command: hippoCommand(), args: ['mcp'] }) };
+/** Only a server hippo wrote counts as hippo's: another command, other args, or any key or value setup does not write (an env you added) makes it the user's. */
+function isHipposServer(entry, host) {
+    if (!isJsonObjectLiteral(entry) || !('command' in entry) || !('args' in entry))
+        return false;
+    const ours = host.server();
+    return Object.entries(entry).every(([key, value]) => (key === 'command' ? value === 'hippo' || value === 'hippo.cmd' : isDeepStrictEqual(value, ours[key])));
 }
-/** What to paste under "mcpServers" when hippo cannot edit the file itself. */
-export function copilotMcpSnippet() {
-    return `"${MCP_KEY}": ${JSON.stringify(hippoMcpServer())}`;
+/** What to paste under the host's key when hippo cannot edit the file itself. */
+export function copilotMcpSnippet(host = COPILOT_CLI_MCP) {
+    return `"${MCP_KEY}": ${JSON.stringify(host.server())}`;
 }
 /** Null for a file with comments, one that is not JSON, or one whose shape a merge would overwrite; a missing file reads as empty. */
-function readMcpConfig(file) {
+function readMcpConfig(file, host) {
     let config = {};
     if (fs.existsSync(file)) {
         try {
@@ -52,45 +97,47 @@ function readMcpConfig(file) {
         }
         catch (err) {
             // Only a parse failure means the text is not JSON hippo can merge; EACCES or EISDIR is thrown with its own message.
-            if (err instanceof SyntaxError)
+            if (!(err instanceof SyntaxError))
+                throw err;
+            // An empty file is a new one with no servers yet, not one with comments.
+            if (fs.readFileSync(file, 'utf8').trim() !== '')
                 return null;
-            throw err;
         }
     }
-    if (!isJsonObject(config))
+    if (!isJsonObjectLiteral(config))
         return null;
-    if (config.mcpServers === undefined)
-        config.mcpServers = {};
-    const servers = config.mcpServers;
-    return isJsonObject(servers) ? { config, servers } : null;
+    if (config[host.key] === undefined)
+        config[host.key] = {};
+    const servers = config[host.key];
+    return isJsonObjectLiteral(servers) ? { config, servers } : null;
 }
 /** Adds hippo's server and keeps every other key; a file hippo cannot parse, or a "hippo" key it did not write, stays as it is. */
-export function mergeMcpServer(file) {
-    const read = readMcpConfig(file);
+function mergeMcpServer(file, host = COPILOT_CLI_MCP) {
+    const read = readMcpConfig(file, host);
     if (read === null)
         return 'unreadable';
     const existing = read.servers[MCP_KEY];
     if (existing !== undefined)
-        return isHipposServer(existing) ? 'present' : 'user-owned';
-    read.servers[MCP_KEY] = hippoMcpServer();
+        return isHipposServer(existing, host) ? 'present' : 'user-owned';
+    read.servers[MCP_KEY] = host.server();
     writeSettingsFile(file, read.config);
     return 'added';
 }
 /** Removes the "hippo" key only when hippo wrote it. */
-export function removeMcpServer(file) {
+export function removeMcpServer(file, host = COPILOT_CLI_MCP) {
     if (!fs.existsSync(file))
         return 'absent';
-    const read = readMcpConfig(file);
+    const read = readMcpConfig(file, host);
     if (read === null)
         return 'unreadable';
     const existing = read.servers[MCP_KEY];
     if (existing === undefined)
         return 'absent';
-    if (!isHipposServer(existing))
+    if (!isHipposServer(existing, host))
         return 'user-owned';
     delete read.servers[MCP_KEY];
     if (Object.keys(read.servers).length === 0)
-        delete read.config.mcpServers;
+        delete read.config[host.key];
     writeSettingsFile(file, read.config);
     return 'removed';
 }
@@ -100,7 +147,7 @@ export function isMcpFailure(status) {
 function hasErrnoCode(err) {
     return 'code' in err && typeof err.code === 'string';
 }
-/** One mcp-config.json step; a filesystem error comes back as a failure, so the hooks file and the block still install. */
+/** One MCP config step; a filesystem error comes back as a failure, so the hooks file and the instructions still install. */
 function mcpStep(step) {
     try {
         return step();
@@ -111,9 +158,8 @@ function mcpStep(step) {
         throw err;
     }
 }
-// A later release adds the hash of each earlier Copilot text here, as SHIPPED_HOOK_HASHES does for the other agents.
 function isCopilotBlock(inner) {
-    return inner === COPILOT_INSTRUCTIONS;
+    return SHIPPED_COPILOT_INSTRUCTIONS.includes(inner);
 }
 /** Replaces only the text between the markers, in the file's own line ending, or appends a block after the user's text. */
 function withCopilotBlock(text, found) {
@@ -127,7 +173,7 @@ function withCopilotBlock(text, found) {
     return `${text}${text.endsWith('\n') ? '\n' : '\n\n'}${block}`;
 }
 /** Creates the file when missing; any block but hippo's own Copilot one, and a start marker with no end, leave the file as it is. */
-export function ensureInstructionsBlock(file) {
+function ensureInstructionsBlock(file) {
     const old = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : '';
     const found = hippoBlock(old);
     if (found === null && old.includes(HOOK_MARKERS.start))
@@ -137,8 +183,7 @@ export function ensureInstructionsBlock(file) {
     const next = withCopilotBlock(old, found);
     if (next === old)
         return 'present';
-    fs.mkdirSync(path.dirname(file), { recursive: true });
-    fs.writeFileSync(file, next, 'utf8');
+    writeFileAtomic(file, next);
     return 'written';
 }
 /** `text` without the block and its markers, plus the line break after the end marker, else the one before the start marker. */
@@ -163,16 +208,51 @@ export function removeInstructionsBlock(file) {
     if (left.trim() === '')
         fs.rmSync(file);
     else
-        fs.writeFileSync(file, left, 'utf8');
+        writeFileAtomic(file, left);
+    return 'removed';
+}
+/** The file is hippo's alone, so it is written whole; an earlier hippo text is upgraded, and any other text already there stays. */
+export function ensureVscodeInstructions(file) {
+    if (fs.existsSync(file)) {
+        const old = fs.readFileSync(file, 'utf8');
+        if (old === VSCODE_INSTRUCTIONS)
+            return 'present';
+        if (!isHipposVscodeInstructions(old))
+            return 'kept';
+    }
+    writeFileAtomic(file, VSCODE_INSTRUCTIONS);
+    return 'written';
+}
+/** Deletes the file only when it still holds exactly what a hippo release wrote. */
+export function removeVscodeInstructions(file) {
+    if (!fs.existsSync(file))
+        return 'absent';
+    if (!isHipposVscodeInstructions(fs.readFileSync(file, 'utf8')))
+        return 'kept';
+    fs.rmSync(file);
     return 'removed';
 }
+/** The CLI's folder holds more than the hooks folder setup makes for VS Code, so a rerun on a VS Code-only machine still finds no CLI. */
+export function isCopilotCliPresent(home = copilotHomeDir()) {
+    if (fs.statSync(home, { throwIfNoEntry: false })?.isDirectory() !== true)
+        return false;
+    const entries = fs.readdirSync(home);
+    return entries.length !== 1 || entries[0] !== 'hooks';
+}
 export function installCopilot() {
     const paths = copilotPaths();
+    // Read before the hooks install, which makes the folder on a machine with only VS Code.
+    const cli = isCopilotCliPresent();
     return {
         paths,
         hooks: installJsonHooks('copilot').installedSessionStart,
-        mcp: mcpStep(() => mergeMcpServer(paths.mcpConfig)),
-        instructions: ensureInstructionsBlock(paths.instructions),
+        mcp: cli ? mcpStep(() => mergeMcpServer(paths.mcpConfig)) : null,
+        instructions: cli ? ensureInstructionsBlock(paths.instructions) : null,
+        vscode: paths.vscode.map((dir) => ({
+            paths: dir,
+            mcp: mcpStep(() => mergeMcpServer(dir.mcpConfig, VSCODE_MCP)),
+            instructions: ensureVscodeInstructions(dir.instructions),
+        })),
     };
 }
 export function uninstallCopilot() {
@@ -182,6 +262,11 @@ export function uninstallCopilot() {
         hooks: uninstallJsonHooks('copilot'),
         mcp: mcpStep(() => removeMcpServer(paths.mcpConfig)),
         instructions: removeInstructionsBlock(paths.instructions),
+        vscode: paths.vscode.map((dir) => ({
+            paths: dir,
+            mcp: mcpStep(() => removeMcpServer(dir.mcpConfig, VSCODE_MCP)),
+            instructions: removeVscodeInstructions(dir.instructions),
+        })),
     };
 }
 //# sourceMappingURL=copilot.js.map

package/dist/{cli → hooks}/hook-blocks.js

@@ -1,6 +1,6 @@
 // The hippo block each agent's instruction file carries, and how init recognises one it wrote earlier.
 import { createHash } from 'node:crypto';
-import { escapeRegex } from '../escape.js';
+import { escapeRegex } from '../util/escape.js';
 export const HOOK_MARKERS = {
     start: '<!-- hippo:start -->',
     end: '<!-- hippo:end -->',

package/dist/hooks/json-hooks.d.ts

@@ -34,7 +34,7 @@
  *    `hooks` block from opencode.json.
  */
 import { type JsonHookTarget } from './shared.js';
-import { type JsonValue } from '../json.js';
+import { type JsonValue } from '../util/json.js';
 /** A target's hook settings file, the log its SessionEnd hook writes, and the tool's display name. */
 export interface JsonHookPaths {
     settings: string;
@@ -63,6 +63,8 @@ export interface InstallResult {
 }
 /** The paths for `target` under the current home directory; reads and writes nothing. */
 export declare function resolveJsonHookPaths(target: JsonHookTarget): JsonHookPaths;
+/** The events in hippo's Copilot hooks file, in file order, for setup to name. */
+export declare function copilotHookEvents(): string[];
 /** Adds hippo's hooks to `target`'s settings file and migrates older hippo entries; a file that is not JSON stays untouched. */
 export declare function installJsonHooks(target: JsonHookTarget): InstallResult;
 /** Swaps the file in with one rename, so a crash mid-write cannot leave a truncated settings.json that Claude Code cannot parse. */

package/dist/hooks/json-hooks.js

@@ -35,10 +35,10 @@
  */
 import * as fs from 'fs';
 import * as path from 'path';
-import { isJsonObject, HIPPO_SLEEP_MARKER, HIPPO_LAST_SLEEP_MARKER, HIPPO_CAPTURE_MARKER, HIPPO_SESSION_END_MARKER, HIPPO_PINNED_INJECT_MARKER, HIPPO_PINNED_INJECT_COMMAND, HIPPO_PRE_COMPACT_MARKER, HIPPO_COMPACT_RESUME_MARKER, HIPPO_CAPTURE_ERROR_MARKER, HIPPO_POST_COMPACT_MARKER, homeDir, claudeConfigDir, codexHomeDir, copilotHomeDir, defaultPreCompactLogPath } from './shared.js';
-import { isJsonString, readJsonFile } from '../json.js';
-import { escapeRegex } from '../escape.js';
-import { errorMessage, log } from '../log.js';
+import { HIPPO_SLEEP_MARKER, HIPPO_LAST_SLEEP_MARKER, HIPPO_CAPTURE_MARKER, HIPPO_SESSION_END_MARKER, HIPPO_PINNED_INJECT_MARKER, HIPPO_PINNED_INJECT_COMMAND, HIPPO_PRE_COMPACT_MARKER, HIPPO_COMPACT_RESUME_MARKER, HIPPO_CAPTURE_ERROR_MARKER, HIPPO_POST_COMPACT_MARKER, homeDir, claudeConfigDir, codexHomeDir, copilotHooksFile, defaultPreCompactLogPath } from './shared.js';
+import { isJsonString, readJsonFile, isJsonObjectLiteral } from '../util/json.js';
+import { escapeRegex } from '../util/escape.js';
+import { writeFileAtomic } from '../util/atomic-write.js';
 /** The paths for `target` under the current home directory; reads and writes nothing. */
 export function resolveJsonHookPaths(target) {
     const home = homeDir();
@@ -58,7 +58,7 @@ export function resolveJsonHookPaths(target) {
             };
         case 'copilot':
             return {
-                settings: path.join(copilotHomeDir(), 'hooks', 'hippo.json'),
+                settings: copilotHooksFile(),
                 logFile: path.join(logsDir, 'copilot-sleep.log'),
                 display: 'Copilot',
             };
@@ -73,13 +73,13 @@ function isHippoCommand(command, marker) {
 }
 const runsHippo = (...markers) => (command) => markers.some((m) => isHippoCommand(command, m));
 function handlerCommand(handler) {
-    return isJsonObject(handler) && isJsonString(handler.command) ? handler.command : null;
+    return isJsonObjectLiteral(handler) && isJsonString(handler.command) ? handler.command : null;
 }
 /** `groups` minus the handlers `isOurs` picks; a group goes only once it has no handler left. Null when no handler matched. */
 function withoutHandlers(groups, isOurs) {
     let removed = false;
     const kept = groups.flatMap((group) => {
-        if (!isJsonObject(group) || !Array.isArray(group.hooks))
+        if (!isJsonObjectLiteral(group) || !Array.isArray(group.hooks))
             return [group];
         const handlers = group.hooks.filter((h) => {
             const command = handlerCommand(h);
@@ -108,7 +108,7 @@ function stripHandlers(hooks, event, isOurs) {
 }
 /** Every command string in `groups`; a group or handler of an unexpected shape adds none. */
 function handlerCommands(groups) {
-    return groups.flatMap((group) => (isJsonObject(group) && Array.isArray(group.hooks) ? group.hooks.flatMap((h) => handlerCommand(h) ?? []) : []));
+    return groups.flatMap((group) => (isJsonObjectLiteral(group) && Array.isArray(group.hooks) ? group.hooks.flatMap((h) => handlerCommand(h) ?? []) : []));
 }
 /** The loose "already installed?" test, on purpose weaker than isHippoCommand: a launcher or env prefix still counts, and a false hit only skips an append. */
 function hookArrayContains(hookArray, marker) {
@@ -126,13 +126,13 @@ function migratePinnedInjectRecentCommands(hookArray) {
         return false;
     let changed = false;
     for (const entry of hookArray) {
-        if (!isJsonObject(entry))
+        if (!isJsonObjectLiteral(entry))
             continue;
         const innerHooks = entry.hooks;
         if (!Array.isArray(innerHooks))
             continue;
         for (const hook of innerHooks) {
-            if (!isJsonObject(hook))
+            if (!isJsonObjectLiteral(hook))
                 continue;
             if (!isJsonString(hook.command))
                 continue;
@@ -172,14 +172,14 @@ function ensureHooksObject(settings, events) {
     if (settings.hooks === undefined)
         settings.hooks = {};
     const hooks = settings.hooks;
-    if (!isJsonObject(hooks) || events.some((e) => hooks[e] !== undefined && !Array.isArray(hooks[e])))
+    if (!isJsonObjectLiteral(hooks) || events.some((e) => hooks[e] !== undefined && !Array.isArray(hooks[e])))
         return null;
     return hooks;
 }
 /** Codex keys trust to each hook's position and hash and re-asks for a changed one, so hippo only appends and never edits an entry. */
 function installCodexHooks(settingsPath, settings) {
     const result = nothingInstalled('codex', settingsPath);
-    if (!isJsonObject(settings))
+    if (!isJsonObjectLiteral(settings))
         return { ...result, invalidJson: true };
     const hooks = ensureHooksObject(settings, ['UserPromptSubmit', 'SessionStart']);
     if (hooks === null)
@@ -214,10 +214,19 @@ function copilotHooksTable() {
             sessionStart: copilotCommandHook('context --pinned-only --include-recent 5 --format copilot', 10),
             postToolUseFailure: copilotCommandHook('capture-error --runtime copilot', 10),
             preCompact: copilotCommandHook('pre-compact --runtime copilot', 30),
+            // VS Code maps no camelCase preCompact. The Copilot CLI may run both names, so pre-compact skips a snapshot saved seconds before.
+            PreCompact: copilotCommandHook('pre-compact --runtime copilot', 30),
+            // VS Code's per-reply Stop. --turn acts on a VS Code payload only, so the Copilot CLI's agentStop does nothing.
+            agentStop: copilotCommandHook('session-end --runtime copilot --turn', 30),
             sessionEnd: copilotCommandHook('session-end --runtime copilot', 30),
         },
     };
 }
+/** The events in hippo's Copilot hooks file, in file order, for setup to name. */
+export function copilotHookEvents() {
+    const hooks = copilotHooksTable().hooks;
+    return isJsonObjectLiteral(hooks) ? Object.keys(hooks) : [];
+}
 /** Hippo owns this whole file, so install writes the full table and a second install changes no byte. */
 function installCopilotHooks(settingsPath) {
     const result = nothingInstalled('copilot', settingsPath);
@@ -247,112 +256,13 @@ export function installJsonHooks(target) {
     }
     if (target === 'codex')
         return installCodexHooks(settingsPath, settings);
-    if (!isJsonObject(settings))
+    if (!isJsonObjectLiteral(settings))
         return { ...nothingInstalled(target, settingsPath), invalidJson: true };
     return installClaudeCodeHooks(settingsPath, settings, logFile);
 }
-const RENAME_RETRY_MS = 1000;
-const WINDOWS_RENAME_REFUSALS = ['EPERM', 'EACCES', 'EBUSY'];
-// A rename can be refused where an in-place write still works (a bind-mounted file, a read-only folder), so these fall back to one.
-const REPLACE_REFUSALS = ['EBUSY', 'EXDEV', 'EACCES', 'EPERM'];
-// Matches the usual SYMLOOP_MAX, so a link cycle ends in an error instead of a hang.
-const MAX_LINK_HOPS = 40;
-function errnoCode(err) {
-    return 'code' in err ? String(err.code) : '';
-}
-/** Windows refuses a rename onto a file another program has open, usually for a moment, so a refusal is retried before it is reported. */
-function renameOnto(tmp, target) {
-    const deadline = Date.now() + RENAME_RETRY_MS;
-    const idle = new Int32Array(new SharedArrayBuffer(4));
-    for (let pause = 10;; pause = Math.min(pause * 2, 200)) {
-        try {
-            fs.renameSync(tmp, target);
-            return;
-        }
-        catch (err) {
-            const transient = process.platform === 'win32' && err instanceof Error && WINDOWS_RENAME_REFUSALS.includes(errnoCode(err));
-            const left = deadline - Date.now();
-            if (!transient || left <= 0)
-                throw err;
-            Atomics.wait(idle, 0, 0, Math.min(pause, left));
-        }
-    }
-}
-/** Where a write to `file` lands: through any symlink, a dangling one included, so a dotfile manager's link survives. */
-function writeTarget(file) {
-    let target = file;
-    for (let hop = 0; hop < MAX_LINK_HOPS && fs.lstatSync(target, { throwIfNoEntry: false })?.isSymbolicLink(); hop++) {
-        target = path.resolve(path.dirname(target), fs.readlinkSync(target));
-    }
-    return fs.existsSync(target) ? fs.realpathSync(target) : target;
-}
-/** Gives the replacement the old file's exact mode (umask trims the create mode) and, for root, its owner. */
-function keepAccess(tmp, old) {
-    fs.chmodSync(tmp, old.mode & 0o777);
-    if (process.getuid?.() === 0)
-        fs.chownSync(tmp, old.uid, old.gid);
-}
-/** Cleanup must not hide the failure that made it necessary, so a cleanup error is logged and the first error stays the one thrown. */
-function removeTemp(tmp) {
-    try {
-        fs.rmSync(tmp, { force: true });
-    }
-    catch (err) {
-        log.warn(`could not remove the temporary file ${tmp}: ${errorMessage(err)}`);
-    }
-}
-function replaceViaTemp(target, text, old) {
-    const tmp = `${target}.${process.pid}.tmp`;
-    try {
-        fs.writeFileSync(tmp, text, { encoding: 'utf8', mode: (old?.mode ?? 0o666) & 0o777 });
-        if (old)
-            keepAccess(tmp, old);
-        renameOnto(tmp, target);
-    }
-    catch (err) {
-        removeTemp(tmp);
-        throw err;
-    }
-}
-/** The pre-rename write: it truncates first, so it is only the fallback, but it needs just a writable file and keeps hard links together. */
-function writeInPlace(target, text) {
-    try {
-        fs.writeFileSync(target, text, 'utf8');
-    }
-    catch (err) {
-        if (!(err instanceof Error))
-            throw err;
-        const reason = errnoCode(err) === 'EBUSY'
-            ? 'is in use by another program, so hippo could not replace it; close that program and run the command again'
-            : `could not be replaced (${errnoCode(err) || err.message})`;
-        throw new Error(`${target} ${reason}`, { cause: err });
-    }
-}
 /** Swaps the file in with one rename, so a crash mid-write cannot leave a truncated settings.json that Claude Code cannot parse. */
 export function writeSettingsFile(file, settings) {
-    const target = writeTarget(file);
-    const text = JSON.stringify(settings, null, 2) + '\n';
-    const old = fs.statSync(target, { throwIfNoEntry: false });
-    if (old === undefined) {
-        fs.mkdirSync(path.dirname(target), { recursive: true });
-    }
-    else {
-        // A rename replaces a read-only file that the in-place write refused, and Windows would retry that refusal for a second.
-        fs.accessSync(target, fs.constants.W_OK);
-    }
-    if (old !== undefined && old.nlink > 1) {
-        // A rename gives the file a new inode, which would leave the other hard links on the old content.
-        writeInPlace(target, text);
-        return;
-    }
-    try {
-        replaceViaTemp(target, text, old);
-    }
-    catch (err) {
-        if (!(err instanceof Error) || !REPLACE_REFUSALS.includes(errnoCode(err)))
-            throw err;
-        writeInPlace(target, text);
-    }
+    writeFileAtomic(file, JSON.stringify(settings, null, 2) + '\n');
 }
 function migrateLegacyClaudeHooks(hooks) {
     const migratedFromStop = stripHandlers(hooks, 'Stop', runsHippo(HIPPO_SLEEP_MARKER));
@@ -397,13 +307,7 @@ const CLAUDE_HOOK_MARKERS = [
 ];
 // Stop is only ever migrated away, so install never appends to it and a Stop that is not a list does not block the install.
 const CLAUDE_APPENDED_EVENTS = CLAUDE_HOOK_MARKERS.map(([event]) => event).filter((event) => event !== 'Stop');
-function installClaudeCodeHooks(settingsPath, settings, logFile) {
-    const merge = ensureHooksObject(settings, CLAUDE_APPENDED_EVENTS);
-    if (merge === null)
-        return { ...nothingInstalled('claude-code', settingsPath), invalidJson: true };
-    // SAFETY: ensureHooksObject left every event hippo appends to absent or an array.
-    const hooks = merge;
-    const migration = migrateLegacyClaudeHooks(hooks);
+function appendSessionHooks(hooks, logFile) {
     const installedSessionEnd = appendHookIfMissing(hooks, 'SessionEnd', HIPPO_SESSION_END_MARKER, claudeCommandGroup(`hippo session-end --log-file "${logFile}"`, 5));
     const installedSessionStart = appendHookIfMissing(hooks, 'SessionStart', HIPPO_LAST_SLEEP_MARKER, claudeCommandGroup(`hippo last-sleep --path "${logFile}"`, 5));
     // Mid-session pinned-rule re-injection: UserPromptSubmit runs every turn,
@@ -413,6 +317,9 @@ function installClaudeCodeHooks(settingsPath, settings, logFile) {
     // before the user pins them explicitly.
     const migratedPinnedInjectRecent = migratePinnedInjectRecentCommands(hooks.UserPromptSubmit);
     const installedUserPromptSubmit = appendHookIfMissing(hooks, 'UserPromptSubmit', HIPPO_PINNED_INJECT_MARKER, claudeCommandGroup(HIPPO_PINNED_INJECT_COMMAND, 5));
+    return { installedSessionEnd, installedSessionStart, migratedPinnedInjectRecent, installedUserPromptSubmit };
+}
+function appendCompactionHooks(hooks) {
     // PreCompact: fires on manual AND auto compaction (no matcher). Records the compaction, asks the
     // summariser for a "Memories for hippo" list and saves a working-state snapshot before the summary drops detail.
     // Exit-0 contract lives in the verb itself (src/capture.ts cmdPreCompact),
@@ -428,6 +335,17 @@ function installClaudeCodeHooks(settingsPath, settings, logFile) {
     // PostCompact: saves the memories the summariser listed and prints one line, which Claude Code only shows.
     // PreCompact stdout, by contrast, is handed to the summariser as instructions, so pre-compact prints just the request.
     const installedPostCompact = appendHookIfMissing(hooks, 'PostCompact', HIPPO_POST_COMPACT_MARKER, claudeCommandGroup(`hippo post-compact --log-file "${defaultPreCompactLogPath()}"`, 10));
+    return { installedPreCompact, installedCompactResume, installedPostCompact };
+}
+function installClaudeCodeHooks(settingsPath, settings, logFile) {
+    const merge = ensureHooksObject(settings, CLAUDE_APPENDED_EVENTS);
+    if (merge === null)
+        return { ...nothingInstalled('claude-code', settingsPath), invalidJson: true };
+    // SAFETY: ensureHooksObject left every event hippo appends to absent or an array.
+    const hooks = merge;
+    const migration = migrateLegacyClaudeHooks(hooks);
+    const { installedSessionEnd, installedSessionStart, migratedPinnedInjectRecent, installedUserPromptSubmit } = appendSessionHooks(hooks, logFile);
+    const { installedPreCompact, installedCompactResume, installedPostCompact } = appendCompactionHooks(hooks);
     // PostToolUseFailure: a failed tool call becomes an error memory, after
     // `hippo capture-error` drops routine failures (interrupts, declined
     // permissions, empty searches) and repeats. Same hook the plugin ships.
@@ -490,7 +408,7 @@ export function uninstallJsonHooks(target) {
         // Never rewrite a settings file we cannot parse; report nothing uninstalled.
         return false;
     }
-    if (!isJsonObject(settings) || !isJsonObject(settings.hooks))
+    if (!isJsonObjectLiteral(settings) || !isJsonObjectLiteral(settings.hooks))
         return false;
     const hooks = settings.hooks;
     const changed = target === 'codex' ? uninstallCodexHooks(hooks) : uninstallClaudeCodeHooks(hooks);
@@ -510,7 +428,7 @@ export function checkUninstallable(target) {
         return { settingsPath, invalidJson: false };
     try {
         const settings = readJsonFile(settingsPath);
-        return { settingsPath, invalidJson: !isJsonObject(settings) || (settings.hooks !== undefined && !isJsonObject(settings.hooks)) };
+        return { settingsPath, invalidJson: !isJsonObjectLiteral(settings) || (settings.hooks !== undefined && !isJsonObjectLiteral(settings.hooks)) };
     }
     catch {
         return { settingsPath, invalidJson: true };