hippo-memory 1.69.0 → 1.70.0

package/dist/cli/flags.js

@@ -0,0 +1,169 @@
+// Each verb's flags as data, keyed like the command table: parseArgs needs a flag's kind before the verb's module loads.
+// The entry point reads these for every verb, so no verb declares them.
+const GLOBAL_FLAGS = { switches: ['help', 'version'] };
+export const VERB_FLAGS = {
+    init: { switches: ['global', 'no-hooks', 'no-learn', 'no-schedule'], values: ['scan'], numbers: ['days'] },
+    remember: {
+        switches: ['error', 'extract', 'force', 'global', 'inferred', 'observed', 'pin', 'verified'],
+        values: ['artifact-ref', 'kind', 'layer', 'owner', 'scope'],
+        lists: ['tag'],
+    },
+    recall: {
+        switches: ['classic', 'continuity', 'equal-sources', 'evc-adaptive', 'filter-conflicts', 'graph-stream',
+            'include-superseded', 'json', 'multihop', 'no-mmr', 'physics', 'rerank-utility', 'value-aware', 'why'],
+        values: ['as-of', 'budget', 'goal', 'graph-hops', 'graph-seeds', 'hops', 'layer', 'max-neighbors', 'outcome',
+            'reranker', 'salience-threshold', 'scope', 'session-id'],
+        numbers: ['limit', 'local-bump', 'min-results', 'mmr-lambda', 'reranker-top-k'],
+    },
+    drill: { switches: ['json'], values: ['budget', 'depth'], numbers: ['limit'] },
+    assemble: { switches: ['json', 'no-summarize-older'], values: ['budget', 'fresh-tail', 'scope', 'session'] },
+    supersede: { switches: ['pin'], values: ['layer'], lists: ['tag'] },
+    explain: {
+        switches: ['classic', 'equal-sources', 'include-superseded', 'json', 'no-mmr', 'physics'],
+        values: ['as-of', 'budget', 'scope'],
+        numbers: ['limit', 'local-bump', 'mmr-lambda'],
+    },
+    eval: {
+        switches: ['bootstrap', 'equal-sources', 'json', 'no-mmr', 'save-baseline', 'show-cases', 'suite'],
+        values: ['baseline', 'compare', 'out'],
+        numbers: ['embedding-weight', 'local-bump', 'max-cases', 'min-mrr', 'mmr-lambda'],
+    },
+    trace: { switches: ['json'], values: ['outcome', 'session', 'source', 'steps', 'task'], lists: ['tag'] },
+    refine: { switches: ['all', 'dry-run', 'json'], values: ['model'], numbers: ['limit'] },
+    sleep: { switches: ['dry-run', 'no-learn', 'no-share'], values: ['log-file'] },
+    'last-sleep': { switches: ['keep'], values: ['path'] },
+    'session-end': {
+        switches: ['dry-run', 'no-learn', 'no-share', 'turn'],
+        values: ['format', 'log-file', 'runtime', 'session-id', 'transcript'],
+    },
+    '__session-end-worker': {
+        switches: ['dry-run', 'no-learn', 'no-share', 'turn'],
+        values: ['log-file', 'session-id', 'transcript'],
+    },
+    'pre-compact': { values: ['format', 'log-file', 'runtime'] },
+    'post-compact': { values: ['log-file'] },
+    'capture-error': { values: ['format', 'runtime'] },
+    'compact-resume': {},
+    'codex-run': {},
+    '__codex-session-end-worker': { values: ['codex-home', 'history-path', 'log-file', 'start-offset', 'started-at'] },
+    dedup: { switches: ['dry-run'], numbers: ['threshold'] },
+    dag: { switches: ['stats'] },
+    auth: { switches: ['all', 'global', 'json'], values: ['label', 'role', 'tenant'] },
+    goal: {
+        switches: ['all', 'no-propagate'],
+        values: ['level', 'outcome', 'parent', 'policy', 'session-id', 'success', 'tenant-id'],
+    },
+    slack: { switches: ['force'], values: ['channel', 'since', 'team', 'tenant'] },
+    github: { switches: ['force'], values: ['max', 'repo', 'since'] },
+    audit: {
+        switches: ['apply', 'dry-run', 'fix', 'global', 'json'],
+        values: ['older-than', 'op', 'since', 'tenant'],
+        numbers: ['limit'],
+    },
+    'correction-latency': { switches: ['json'] },
+    provenance: { switches: ['json', 'strict'] },
+    status: {},
+    outcome: { switches: ['bad', 'good'], values: ['id'] },
+    conflicts: { switches: ['json'], values: ['status'] },
+    resolve: { switches: ['forget', 'reject-loser'], values: ['keep', 'reason'] },
+    reject: { switches: ['global'], values: ['reason', 'value'] },
+    rejections: { switches: ['global', 'json'] },
+    unreject: { switches: ['global'] },
+    dormant: { switches: ['global', 'json'], numbers: ['limit'] },
+    projects: { switches: ['apply', 'global', 'json'] },
+    quarantine: { switches: ['all', 'global', 'json'] },
+    tokens: { switches: ['global', 'json'], numbers: ['days'] },
+    failures: { switches: ['global', 'json'], numbers: ['days'] },
+    doctor: { switches: ['json'] },
+    'support-bundle': { switches: ['include-logs'], values: ['out'] },
+    snapshot: { switches: ['json'], values: ['id', 'next-step', 'session', 'source', 'status', 'summary', 'task'] },
+    session: {
+        switches: ['json'],
+        values: ['content', 'id', 'outcome', 'session', 'source', 'summary', 'task', 'type'],
+        numbers: ['limit'],
+    },
+    handoff: {
+        switches: ['json'],
+        values: ['card-id', 'id', 'next', 'outcome', 'session', 'summary', 'target-runtime', 'task', 'tests'],
+        lists: ['artifact', 'constraint'],
+    },
+    // Every card subcommand's flags together; card.ts then refuses the ones its subcommand does not read.
+    card: {
+        switches: ['json'],
+        values: ['author', 'body', 'budget', 'contract', 'outcome', 'reason', 'repo', 'run', 'runtime', 'session',
+            'status', 'title'],
+        lists: ['depends-on'],
+    },
+    predict: {
+        values: ['actual', 'class', 'estimate', 'note', 'state', 'status', 'target', 'unit'],
+        numbers: ['limit'],
+    },
+    current: { switches: ['json'] },
+    forget: { switches: ['archive', 'dry-run'], values: ['reason'] },
+    inspect: {},
+    context: {
+        switches: ['auto', 'cross-project', 'pinned-only'],
+        values: ['budget', 'format', 'framing', 'include-recent', 'runtime', 'scope'],
+        numbers: ['limit'],
+    },
+    hook: {},
+    setup: { switches: ['all', 'dry-run', 'no-learn', 'no-schedule'] },
+    'daily-runner': {},
+    embed: { switches: ['global', 'reset-physics', 'status'] },
+    watch: {},
+    learn: { switches: ['git'], values: ['repos'], numbers: ['days'] },
+    promote: {},
+    sync: { switches: ['cross-project'] },
+    share: { switches: ['auto', 'dry-run', 'force'], numbers: ['min-score'] },
+    peers: { switches: ['all-tenants'] },
+    import: {
+        switches: ['agents', 'dry-run', 'global'],
+        values: ['chatgpt', 'claude', 'cursor', 'file', 'markdown', 'name', 'scope', 'vault'],
+        lists: ['tag'],
+    },
+    export: { values: ['format'] },
+    capture: { switches: ['dry-run', 'global', 'last-session', 'stdin'], values: ['file', 'log-file', 'transcript'] },
+    dashboard: { numbers: ['port'] },
+    wm: { switches: ['json'], values: ['content', 'importance', 'scope', 'session', 'task'], numbers: ['limit'] },
+    mcp: {},
+    serve: { values: ['host', 'tls-cert', 'tls-key'], numbers: ['port'] },
+    invalidate: { switches: ['churn', 'dry-run'], values: ['id', 'reason'] },
+    decide: { values: ['context', 'status', 'supersedes'], numbers: ['limit'] },
+    incident: { values: ['context', 'resolution', 'status'], numbers: ['limit'], lists: ['link'] },
+    process: { values: ['change', 'description', 'status'], numbers: ['limit'], lists: ['step'] },
+    policy: { values: ['change', 'from', 'name', 'status', 'text', 'to'], numbers: ['limit'] },
+    skill: { values: ['change', 'instructions', 'status', 'trigger'], numbers: ['limit'] },
+    brief: { switches: ['dry-run'], values: ['change', 'repo', 'status', 'summary'], numbers: ['limit'] },
+    note: { values: ['change', 'customer', 'status', 'text'], numbers: ['limit'] },
+    graph: { switches: ['json', 'open'], values: ['entity', 'format', 'out'] },
+};
+const FIELD_KINDS = [['switches', 'switch'], ['values', 'value'], ['numbers', 'number'], ['lists', 'list']];
+const DECLARED = new Map([GLOBAL_FLAGS, ...Object.values(VERB_FLAGS)].map((verb) => [
+    verb,
+    new Map(FIELD_KINDS.flatMap(([field, kind]) => (verb[field] ?? []).map((name) => [name, kind]))),
+]));
+// A flag typed on a verb that does not declare it still has to parse: it takes the kind its
+// declaring verbs agree on, and where they differ it is a plain value.
+const SHARED_KIND = (() => {
+    const shared = new Map();
+    for (const kinds of DECLARED.values()) {
+        for (const [name, kind] of kinds)
+            shared.set(name, (shared.get(name) ?? kind) === kind ? kind : 'value');
+    }
+    return shared;
+})();
+/** How parseArgs reads `--name` on the verb with these flags; `undefined` is a command the table lacks. */
+export function flagKind(verb, name) {
+    return (verb ? DECLARED.get(verb)?.get(name) : undefined) ?? SHARED_KIND.get(name) ?? 'value';
+}
+/** Whether any verb, or the entry point, reads `--name`. */
+export function isKnownFlag(name) {
+    return SHARED_KIND.has(name);
+}
+/** The typed flags this verb does not read, in the order typed. */
+export function undeclaredFlags(verb, typed) {
+    const declared = DECLARED.get(verb);
+    const global = DECLARED.get(GLOBAL_FLAGS);
+    return typed.filter((name) => !declared?.has(name) && !global?.has(name));
+}
+//# sourceMappingURL=flags.js.map

package/dist/cli/goals.d.ts

@@ -1,2 +1,3 @@
-export declare function cmdGoal(hippoRoot: string, args: string[], flags: Record<string, string | boolean | string[]>): void;
+import { type CliFlags } from './flag-values.js';
+export declare function cmdGoal(hippoRoot: string, args: string[], flags: CliFlags): void;
 //# sourceMappingURL=goals.d.ts.map

package/dist/cli/goals.js

@@ -1,8 +1,9 @@
 // `hippo goal`: the per-session goal stack that recall boosts.
-import { envHippoSessionId } from '../env.js';
-import * as api from '../api.js';
-import { resolveTenantId } from '../tenant.js';
+import { envHippoSessionId } from '../util/env.js';
+import * as api from '../api/index.js';
+import { resolveTenantId } from '../store/tenant.js';
 import { printError } from './output.js';
+import { boolFlag, flagIsTrue, stringFlag } from './flag-values.js';
 // ---------------------------------------------------------------------------
 // `hippo goal <push|list|complete|suspend|resume>`
 // ---------------------------------------------------------------------------
@@ -29,6 +30,35 @@ function resolveGoalSession(flags) {
         : resolveTenantId({})).trim() || 'default';
     return { sessionId, tenantId };
 }
+function readGoalPolicy(flags) {
+    const policyRaw = flags['policy'];
+    if (policyRaw === true) {
+        printError('--policy requires a value (e.g., --policy error-prioritized)');
+        process.exit(1);
+    }
+    if (typeof policyRaw !== 'string')
+        return undefined;
+    if (!GOAL_POLICY_TYPES.includes(policyRaw)) {
+        printError(`Unknown --policy '${policyRaw}'. Expected one of: ${GOAL_POLICY_TYPES.join(' | ')}.`);
+        process.exit(1);
+    }
+    return { policyType: policyRaw };
+}
+function readGoalLevel(flags) {
+    const levelRaw = flags['level'];
+    if (levelRaw === true) {
+        printError('--level requires a value (e.g., --level 1)');
+        process.exit(1);
+    }
+    if (levelRaw === undefined)
+        return undefined;
+    const parsed = Number(levelRaw);
+    if (!Number.isFinite(parsed) || parsed < 0 || parsed > 2 || !Number.isInteger(parsed)) {
+        printError('--level must be an integer in [0, 2]');
+        process.exit(1);
+    }
+    return parsed;
+}
 function cmdGoalPush(hippoRoot, args, flags) {
     const rawName = args.join(' ').trim();
     if (!rawName) {
@@ -41,45 +71,20 @@ function cmdGoalPush(hippoRoot, args, flags) {
         printError('note: stripped control characters from goal name');
     }
     const { sessionId, tenantId } = resolveGoalSession(flags);
-    let policy;
-    const policyRaw = flags['policy'];
-    if (policyRaw === true) {
-        printError('--policy requires a value (e.g., --policy error-prioritized)');
-        process.exit(1);
-    }
-    if (typeof policyRaw === 'string') {
-        if (!GOAL_POLICY_TYPES.includes(policyRaw)) {
-            printError(`Unknown --policy '${policyRaw}'. Expected one of: ${GOAL_POLICY_TYPES.join(' | ')}.`);
-            process.exit(1);
-        }
-        policy = { policyType: policyRaw };
-    }
+    const policy = readGoalPolicy(flags);
     const successRaw = flags['success'];
     if (successRaw === true) {
         printError('--success requires a value (e.g., --success "<condition>")');
         process.exit(1);
     }
-    const successCondition = typeof successRaw === 'string' ? successRaw : undefined;
-    const levelRaw = flags['level'];
-    let level;
-    if (levelRaw === true) {
-        printError('--level requires a value (e.g., --level 1)');
-        process.exit(1);
-    }
-    if (levelRaw !== undefined) {
-        const parsed = Number(levelRaw);
-        if (!Number.isFinite(parsed) || parsed < 0 || parsed > 2 || !Number.isInteger(parsed)) {
-            printError('--level must be an integer in [0, 2]');
-            process.exit(1);
-        }
-        level = parsed;
-    }
+    const successCondition = stringFlag(flags, 'success');
+    const level = readGoalLevel(flags);
     const parentRaw = flags['parent'];
     if (parentRaw === true) {
         printError('--parent requires a value (e.g., --parent <goalId>)');
         process.exit(1);
     }
-    const parentGoalId = typeof parentRaw === 'string' ? parentRaw : undefined;
+    const parentGoalId = stringFlag(flags, 'parent');
     const goal = api.goalPush(goalContext(hippoRoot, tenantId), {
         sessionId,
         goalName: name,
@@ -95,7 +100,7 @@ function goalContext(hippoRoot, tenantId = resolveTenantId({})) {
 }
 function cmdGoalList(hippoRoot, flags) {
     const { sessionId, tenantId } = resolveGoalSession(flags);
-    const showAll = Boolean(flags['all']);
+    const showAll = boolFlag(flags, 'all');
     const goals = api.goalList(goalContext(hippoRoot, tenantId), { sessionId, all: showAll });
     if (goals.length === 0) {
         console.log('(no goals)');
@@ -143,7 +148,7 @@ function cmdGoalComplete(hippoRoot, args, flags) {
         }
         outcomeScore = parsed;
     }
-    const noPropagate = flags['no-propagate'] === true;
+    const noPropagate = flagIsTrue(flags, 'no-propagate');
     api.goalComplete(goalContext(hippoRoot), id, { outcomeScore, noPropagate });
     console.log('ok');
 }

package/dist/cli/hook-runtime.d.ts

@@ -0,0 +1,49 @@
+import type { HookRuntime } from '../core/capture-contract.js';
+import { type DeliveryEventType, type DeliveryRecorder } from '../store/delivery-recorder.js';
+import type { CliFlags } from './flag-values.js';
+/**
+ * Detached worker that counts re-reads, runs sleep, then capture. Invoked via the internal
+ * `__session-end-worker` subcommand (not user-facing). Failures in one stage
+ * do not block the other.
+ */
+/** A folder without its own store never sleeps at session end, so its project's agent notes go to the global store here. */
+export declare function logSessionEndImport(logFile: string | null, transcriptPath: string | undefined): void;
+/**
+ * Best-effort log line for the snapshot-close step in
+ * `cmdSessionEndWorker`. `cmdSleep`/`cmdCapture` each tee console output to
+ * `logFile` only for their own duration (the tee is restored before this
+ * runs), so a plain `console.log` here would be silently discarded under
+ * the detached worker's `stdio: 'ignore'` — write straight to the file
+ * instead, matching capture.ts's `appendPreCompactLog` convention.
+ */
+export declare function appendSessionEndCloseLog(logFile: string | null, message: string, opts?: {
+    startFresh?: boolean;
+}): void;
+export declare function hostSessionId(): string | undefined;
+/**
+ * Compaction drops the pinned blocks the per-prompt hook injected
+ * earlier, so record a `reset` for the payload's session and the next prompt
+ * injects again even if nothing changed. `requiredSource` limits it to hook
+ * payloads with that `source` (SessionStart fires for other reasons too).
+ * Best-effort and silent: a malformed payload records nothing.
+ */
+export declare function resetHookInjection(hippoRoot: string, stdinText: string | undefined, requiredSource: string | null): void;
+/**
+ * The store a Claude Code hook writes to: the project store when there is
+ * one, else an existing global store, else the project path (which the hook
+ * then skips, since hooks fire in every directory and must not create one).
+ * Pre-compact and compact-resume must agree, or a snapshot saved to one store
+ * is looked for in the other.
+ */
+export declare function hookStoreRoot(hippoRoot: string): string;
+/** `--runtime copilot`, or `--format copilot` on `hippo context`, marks a Copilot hook: the flag decides, never the payload. */
+export declare function hookRuntime(flags: CliFlags): HookRuntime;
+/** A delivery recorder when the ledger store enables one, else null; never throws. */
+export declare function startDeliveryRecorder(hippoRoot: string, stdinText: string | undefined, runtime: HookRuntime, eventType?: DeliveryEventType): DeliveryRecorder | null;
+/** A Copilot hook's project root, from the payload's `cwd`, since VS Code runs user-level hooks in the home folder; other runtimes keep `hippoRoot`. */
+export declare function payloadCwdRoot(hippoRoot: string, stdinText: string | undefined, runtime: HookRuntime): string;
+/** Hook commands share one handle per store and wait at most HOOK_DB_WAIT_MS for a lock; a store still busy after that skips the hook's work with one warning, exit 0. */
+export declare function runHookWithStores<T>(fn: () => T | Promise<T>): Promise<T | undefined>;
+/** Whether this session sits in the pilot's holdout arm; off at rate 0 and with no session id. */
+export declare function inPilotHoldout(hippoRoot: string, tenantId: string, sessionId: string | undefined, write: boolean): boolean;
+//# sourceMappingURL=hook-runtime.d.ts.map

package/dist/cli/hook-runtime.js

@@ -0,0 +1,155 @@
+// What the hook commands share: session id, store choice, delivery recorder, session-end log and store-busy handling.
+import { envClaudeCodeSessionId, envHippoSessionId } from '../util/env.js';
+import * as path from 'path';
+import * as fs from 'fs';
+import { getHippoRoot, isInitialized } from '../store/open.js';
+import { loadConfig } from '../core/config.js';
+import { createDeliveryRecorder } from '../store/delivery-recorder.js';
+import { isSqliteBusy, noteStoreBusy, runWithRequestStores, HOOK_DB_WAIT_MS } from '../db/index.js';
+import { bookTokenUse, ledgerRoot } from '../api/ledger-db.js';
+import { sessionPilotArm } from '../api/pilot-arm.js';
+import { hookPayloadSessionId, hookPayloadString, isSubagentPayload } from '../store/token-ledger.js';
+import { blockHash } from '../util/token-text.js';
+import { importAtSessionEnd, currentMachine } from '../agent-memories/sync.js';
+import { summaryLine } from '../agent-memories/report.js';
+import { isGlobalStoreRoot } from '../core/project-identity.js';
+import { getGlobalRoot } from '../sharing/shared.js';
+import { sanitizeLogMessage } from '../capture/compact.js';
+import { resolveTenantId } from '../store/tenant.js';
+import { errorMessage, log } from '../util/log.js';
+import { printError } from './output.js';
+/**
+ * Detached worker that counts re-reads, runs sleep, then capture. Invoked via the internal
+ * `__session-end-worker` subcommand (not user-facing). Failures in one stage
+ * do not block the other.
+ */
+/** A folder without its own store never sleeps at session end, so its project's agent notes go to the global store here. */
+export function logSessionEndImport(logFile, transcriptPath) {
+    try {
+        const report = importAtSessionEnd(process.cwd(), transcriptPath, { machine: currentMachine() });
+        const line = summaryLine(report);
+        if (line !== null)
+            appendSessionEndCloseLog(logFile, line);
+        for (const warning of report.warnings)
+            appendSessionEndCloseLog(logFile, `agent memories: ${warning}`);
+    }
+    catch (err) {
+        appendSessionEndCloseLog(logFile, `agent memory import failed: ${errorMessage(err)}`);
+    }
+}
+/**
+ * Best-effort log line for the snapshot-close step in
+ * `cmdSessionEndWorker`. `cmdSleep`/`cmdCapture` each tee console output to
+ * `logFile` only for their own duration (the tee is restored before this
+ * runs), so a plain `console.log` here would be silently discarded under
+ * the detached worker's `stdio: 'ignore'` — write straight to the file
+ * instead, matching capture.ts's `appendPreCompactLog` convention.
+ */
+export function appendSessionEndCloseLog(logFile, message, opts = {}) {
+    if (!logFile)
+        return;
+    try {
+        fs.mkdirSync(path.dirname(logFile), { recursive: true });
+        // sanitizeLogMessage: `message` interpolates the payload-controlled
+        // session_id — same log-forgery guard appendPreCompactLog applies.
+        const write = opts.startFresh ? fs.writeFileSync : fs.appendFileSync;
+        write(logFile, `[hippo] ${new Date().toISOString()} ${sanitizeLogMessage(message)}\n`, 'utf8');
+    }
+    catch (err) {
+        // Best-effort only: a log-write failure must never fail the hook.
+        log.debug(`session-end log not written: ${errorMessage(err)}`);
+    }
+}
+// Claude Code exports its own session var, not ours; without the fallback agent-run recalls trace with no session.
+export function hostSessionId() {
+    return envHippoSessionId() ?? envClaudeCodeSessionId();
+}
+/**
+ * Compaction drops the pinned blocks the per-prompt hook injected
+ * earlier, so record a `reset` for the payload's session and the next prompt
+ * injects again even if nothing changed. `requiredSource` limits it to hook
+ * payloads with that `source` (SessionStart fires for other reasons too).
+ * Best-effort and silent: a malformed payload records nothing.
+ */
+export function resetHookInjection(hippoRoot, stdinText, requiredSource) {
+    const sessionId = hookPayloadSessionId(stdinText, requiredSource);
+    // A sub-agent's compaction leaves its parent's context, and the blocks in it, as they were.
+    if (sessionId === null || isSubagentPayload(stdinText))
+        return;
+    bookTokenUse(hippoRoot, {
+        tenantId: resolveTenantId({}), sessionId, surface: 'hook', event: 'reset', items: 0, tokens: 0,
+    });
+}
+/**
+ * The store a Claude Code hook writes to: the project store when there is
+ * one, else an existing global store, else the project path (which the hook
+ * then skips, since hooks fire in every directory and must not create one).
+ * Pre-compact and compact-resume must agree, or a snapshot saved to one store
+ * is looked for in the other.
+ */
+export function hookStoreRoot(hippoRoot) {
+    if (isInitialized(hippoRoot))
+        return hippoRoot;
+    const globalRoot = getGlobalRoot();
+    return isInitialized(globalRoot) ? globalRoot : hippoRoot;
+}
+/** `--runtime copilot`, or `--format copilot` on `hippo context`, marks a Copilot hook: the flag decides, never the payload. */
+export function hookRuntime(flags) {
+    return flags['runtime'] === 'copilot' || flags['format'] === 'copilot' ? 'copilot' : 'claude-code';
+}
+/** A delivery recorder when the ledger store enables one, else null; never throws. */
+export function startDeliveryRecorder(hippoRoot, stdinText, runtime, eventType) {
+    try {
+        // The same store withLedgerDb writes the token ledger to, so its config governs both.
+        const root = ledgerRoot(hippoRoot);
+        if (root === null || !loadConfig(root).deliveryLedger.enabled)
+            return null;
+        return createDeliveryRecorder({
+            root,
+            storeHash: blockHash(path.resolve(root)),
+            writeStore: isGlobalStoreRoot(root) ? 'global' : 'local',
+            tenantId: resolveTenantId({}),
+            stdinText,
+            envSessionId: hostSessionId(),
+            runtime: runtime === 'copilot' ? 'copilot' : undefined,
+            eventType,
+        });
+    }
+    catch (error) {
+        // The hook's one-line stderr contract pins this exact text, so it bypasses the leveled logger.
+        printError(`[hippo] delivery ledger skipped:${errorMessage(error)}`);
+        return null;
+    }
+}
+/** A Copilot hook's project root, from the payload's `cwd`, since VS Code runs user-level hooks in the home folder; other runtimes keep `hippoRoot`. */
+export function payloadCwdRoot(hippoRoot, stdinText, runtime) {
+    const cwd = runtime === 'copilot' ? hookPayloadString(stdinText, 'cwd') : null;
+    if (cwd === null || cwd.trim() === '')
+        return hippoRoot;
+    try {
+        // Moving, not just re-rooting, keeps project identity, scope, handoff evidence and the session-end worker on that folder too.
+        process.chdir(cwd);
+    }
+    catch (err) {
+        log.warn(`hippo: payload cwd ${cwd} is not usable, so the hook stays in ${process.cwd()}: ${errorMessage(err)}`);
+        return hippoRoot;
+    }
+    return getHippoRoot(process.cwd());
+}
+/** Hook commands share one handle per store and wait at most HOOK_DB_WAIT_MS for a lock; a store still busy after that skips the hook's work with one warning, exit 0. */
+export async function runHookWithStores(fn) {
+    try {
+        return await runWithRequestStores(fn, { busyWaitMs: HOOK_DB_WAIT_MS, failFastWhenBusy: true });
+    }
+    catch (error) {
+        if (!isSqliteBusy(error))
+            throw error;
+        noteStoreBusy('hook skipped');
+        return undefined;
+    }
+}
+/** Whether this session sits in the pilot's holdout arm; off at rate 0 and with no session id. */
+export function inPilotHoldout(hippoRoot, tenantId, sessionId, write) {
+    return sessionPilotArm(hippoRoot, tenantId, sessionId, write) === 'holdout';
+}
+//# sourceMappingURL=hook-runtime.js.map

package/dist/cli/init.d.ts

@@ -1,2 +1,3 @@
-export declare function cmdInit(hippoRoot: string, flags: Record<string, string | boolean | string[]>): void;
+import { type CliFlags } from './flag-values.js';
+export declare function cmdInit(hippoRoot: string, flags: CliFlags): void;
 //# sourceMappingURL=init.d.ts.map