hippo-memory 1.69.0 → 1.71.0

package/dist/cli/remember.js

@@ -1,28 +1,32 @@
 // The write verbs: `hippo remember`, `hippo supersede` and `hippo trace`.
-import { envAnthropicApiKey } from '../env.js';
-import { evalNow } from '../ablation.js';
+import { envAnthropicApiKey } from '../util/env.js';
+import { evalNow } from '../core/ablation.js';
 import * as fs from 'fs';
-import { createMemory, createSuccessor, calculateStrength, calculateRewardFactor, confidenceFacets, confidenceLabel, computeSchemaFit, Layer, } from '../memory.js';
+import { calculateStrength, calculateRewardFactor, confidenceFacets, confidenceLabel, Layer, } from '../core/memory.js';
+import * as api from '../api/index.js';
+import { getMemory } from '../api/memories.js';
+import { ConflictError, NotFoundError } from '../core/api-errors.js';
 import { isInitialized } from '../store/open.js';
-import { writeEntry } from '../store/entry-writes.js';
-import { readEntry, loadAllEntries } from '../store/entry-reads.js';
-import { updateStats } from '../store/index-and-stats.js';
 import { listMemoryConflicts } from '../store/conflicts.js';
-import { RejectedValueError } from '../rejection.js';
-import { renderTraceContent, parseSteps } from '../trace.js';
-import { embedMemory } from '../embeddings.js';
-import { loadConfig } from '../config.js';
-import { extractPathTags } from '../path-context.js';
-import { detectScope } from '../scope.js';
-import { assertClientScope } from '../recall-scope.js';
-import { getGlobalRoot, initGlobal } from '../shared.js';
-import { vetSecrets } from '../secret-detect.js';
-import * as client from '../client.js';
-import { resolveTenantId } from '../tenant.js';
-import { computeSalience } from '../salience.js';
-import { validateOwner, isStrictOwnerEnv } from '../owner-validation.js';
+import { RejectedValueError } from '../store/rejection.js';
+import { renderTraceContent, parseSteps } from '../consolidate/trace.js';
+import { extractPathTags } from '../search/path-context.js';
+import { detectScope } from '../sharing/scope.js';
+import { assertClientScope } from '../store/recall-scope.js';
+import { getGlobalRoot, initGlobal } from '../sharing/global-store.js';
+import { vetSecrets } from '../util/secret-detect.js';
+import * as client from './client.js';
+import { cliApiContext } from './api-context.js';
+import { validateOwner, isStrictOwnerEnv } from './owner-validation.js';
 import { printError } from './output.js';
-import { emitCliAudit, requireInit, runViaServerIfAvailable, fmt } from './shared.js';
+import { requireInit, runViaServerIfAvailable } from './shared.js';
+import { fmt } from './print.js';
+import { boolFlag, flagIsTrue, isOneOf, stringFlag, stringListFlag } from './flag-values.js';
+import { DAY_MS } from '../util/time.js';
+import { errorMessage } from '../util/log.js';
+import { CliExit } from './exit.js';
+const PARENT_PREVIEW_CHARS = 70;
+const DETAIL_CONTENT_CHARS = 160;
 // Shared by the direct write and the routed request so both store the same tags.
 function rememberTags(flags, cwd) {
     const requested = Array.isArray(flags['tag']) ? [...flags['tag']] : [];
@@ -53,41 +57,37 @@ function rememberConfidence(flags) {
         confidence = 'verified';
     return confidence;
 }
+const USER_VISIBLE_KINDS = ['distilled', 'superseded'];
 function parseKindFlag(flags) {
-    const kindFlagRaw = typeof flags['kind'] === 'string' ? flags['kind'] : undefined;
+    const kindFlagRaw = stringFlag(flags, 'kind');
     const kindFlag = kindFlagRaw === undefined ? undefined : kindFlagRaw.toLowerCase();
-    // CLI surface intentionally restricted: 'raw' is reserved for ingestion connectors
-    // that route deletions through archiveRawMemory. Existing
-    // forget/consolidate/conflict-resolve paths abort on kind='raw' via the append-only
-    // trigger, so exposing --kind raw here would create unforgettable memories.
-    // 'archived' is an internal sentinel set only inside archiveRawMemory's transaction.
-    const userVisibleKinds = ['distilled', 'superseded'];
-    if (kindFlag !== undefined && !userVisibleKinds.includes(kindFlag)) {
-        printError(`Invalid --kind: "${kindFlagRaw}". Must be one of: ${userVisibleKinds.join(', ')}`);
+    // 'raw' is reserved for ingestion connectors (deletions go through archiveRawMemory); the append-only trigger aborts forget/consolidate on raw rows,
+    // so exposing --kind raw would create unforgettable memories. 'archived' is an internal sentinel set only in that transaction.
+    if (kindFlag !== undefined && !isOneOf(USER_VISIBLE_KINDS, kindFlag)) {
+        printError(`Invalid --kind: "${kindFlagRaw}". Must be one of: ${USER_VISIBLE_KINDS.join(', ')}`);
         printError(`(kind='raw' is reserved for ingestion connectors; kind='archived' is internal.)`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     return kindFlag;
 }
 function parseRememberEnvelope(flags) {
     const kind = parseKindFlag(flags);
-    const ownerRaw = typeof flags['owner'] === 'string' ? flags['owner'] : null;
+    const ownerRaw = stringFlag(flags, 'owner') ?? null;
     const ownerCheck = validateOwner(ownerRaw, { strict: isStrictOwnerEnv() });
     if (!ownerCheck.ok) {
         printError(ownerCheck.message);
-        process.exit(1);
+        throw new CliExit(1);
     }
     if (ownerCheck.message)
         printError(ownerCheck.message);
     const owner = ownerCheck.value ?? null;
-    const artifactRef = typeof flags['artifact-ref'] === 'string' ? flags['artifact-ref'] : null;
-    const scope = typeof flags['scope'] === 'string' ? flags['scope'].trim() || null : null;
+    const artifactRef = stringFlag(flags, 'artifact-ref') ?? null;
+    const scope = stringFlag(flags, 'scope')?.trim() || null;
     assertClientScope(scope);
     return { kind, owner, artifactRef, scope };
 }
-/** @internal Exported so tests/remember-origin-parity.test.ts runs the real direct write; not a stable public API. */
-export async function cmdRemember(hippoRoot, text, flags) {
-    const useGlobal = Boolean(flags['global']);
+async function cmdRemember(hippoRoot, tenantId, text, flags) {
+    const useGlobal = boolFlag(flags, 'global');
     const targetRoot = useGlobal ? getGlobalRoot() : hippoRoot;
     if (useGlobal) {
         initGlobal();
@@ -96,56 +96,33 @@ export async function cmdRemember(hippoRoot, text, flags) {
         requireInit(hippoRoot);
     }
     const { requested: requestedTags, all: allTags } = rememberTags(flags, process.cwd());
-    const confidence = rememberConfidence(flags);
-    // Schema fit needs the store, which the routed request has no access to, so it stays here.
-    const existing = loadAllEntries(targetRoot, resolveTenantId({}));
-    const schemaFit = computeSchemaFit(text, requestedTags, existing);
     const envelope = parseRememberEnvelope(flags);
-    // Stamp tenant_id from env (HIPPO_TENANT) so recall isolation can filter on this row; unauthenticated CLI gets 'default'.
-    const tenantId = resolveTenantId({});
-    const rememberConfig = loadConfig(targetRoot);
-    const entry = createMemory(text, {
-        layer: Layer.Episodic,
+    const ctx = cliApiContext(targetRoot, tenantId);
+    const outcome = api.rememberLocally(ctx, {
+        content: text,
+        kind: envelope.kind,
+        scope: envelope.scope ?? undefined,
+        owner: envelope.owner ?? undefined,
+        artifactRef: envelope.artifactRef ?? undefined,
         tags: allTags,
-        pinned: Boolean(flags['pin']),
+        // Schema fit is scored on the tags the caller typed, without the path and scope tags added from this process.
+        fitTags: requestedTags,
+        layer: Layer.Episodic,
+        pinned: boolFlag(flags, 'pin'),
         source: useGlobal ? 'cli-global' : 'cli',
-        confidence,
-        schema_fit: schemaFit,
-        kind: envelope.kind,
-        scope: envelope.scope,
-        owner: envelope.owner,
-        artifact_ref: envelope.artifactRef,
-        tenantId,
-        baseHalfLifeDays: rememberConfig.defaultHalfLifeDays,
+        confidence: rememberConfidence(flags),
+        force: boolFlag(flags, 'force'),
     });
-    if (!passesSalienceGate(entry, text, existing, rememberConfig, flags))
+    if (outcome.status === 'skipped') {
+        console.log(`Skipped (salience: ${outcome.reason}, score ${outcome.score.toFixed(2)})`);
         return;
-    writeEntry(targetRoot, entry);
-    updateStats(targetRoot, { remembered: 1 });
-    printRemembered(entry, useGlobal);
-    void embedMemory(targetRoot, entry);
-    await extractRememberFacts(targetRoot, entry, flags);
-}
-/** False when the gate skips the write; a start_weak verdict weakens `entry` in place. */
-function passesSalienceGate(entry, text, existing, rememberConfig, flags) {
-    if (!rememberConfig.salience.enabled || Boolean(flags['pin']) || Boolean(flags['force']))
-        return true;
-    const salienceResult = computeSalience(text, entry.tags, existing, {
-        recentWindow: rememberConfig.salience.recentWindow,
-        overlapThreshold: rememberConfig.salience.overlapThreshold,
-        minContentLength: rememberConfig.salience.minContentLength,
-        maxRepeatErrors: rememberConfig.salience.maxRepeatErrors,
-    });
-    if (salienceResult.decision === 'skip') {
-        console.log(`Skipped (salience: ${salienceResult.reason}, score ${salienceResult.score.toFixed(2)})`);
-        return false;
-    }
-    if (salienceResult.decision === 'start_weak') {
-        entry.strength = salienceResult.score;
-        entry.half_life_days = Math.max(1, entry.half_life_days * 0.5);
-        console.log(`Weakened (salience: ${salienceResult.reason}, strength ${salienceResult.score.toFixed(2)})`);
     }
-    return true;
+    const weak = outcome.startedWeak;
+    if (weak)
+        console.log(`Weakened (salience: ${weak.reason}, strength ${weak.strength.toFixed(2)})`);
+    printRemembered(outcome.entry, useGlobal);
+    const request = { requested: boolFlag(flags, 'extract'), apiKey: envAnthropicApiKey() };
+    printExtraction(await api.extractRememberedFacts(ctx, outcome.entry, request));
 }
 function printRemembered(entry, useGlobal) {
     const prefix = useGlobal ? '[global] ' : '';
@@ -158,76 +135,78 @@ function printRemembered(entry, useGlobal) {
     for (const w of vetSecrets(entry.content, entry.tags, false).warnings)
         printError(`Warning: ${w}`);
 }
-async function extractRememberFacts(targetRoot, entry, flags) {
-    const config = loadConfig(targetRoot);
-    const shouldExtract = flags['extract'] || config.extraction.enabled === true;
-    const apiKey = envAnthropicApiKey() ?? '';
-    if (shouldExtract && apiKey) {
-        try {
-            const { extractFacts, storeExtractedFacts } = await import('../extract.js');
-            const facts = await extractFacts(entry.content, {
-                apiKey,
-                model: config.extraction.model,
-                onError: (msg) => printError(`  (extraction failed: ${msg})`),
-            });
-            if (facts.length > 0) {
-                storeExtractedFacts(targetRoot, entry, facts);
-                printError(`  extracted ${facts.length} fact(s)`);
-            }
-        }
-        catch (err) {
-            // Extraction is best-effort: report it, never block remember.
-            printError(`  (extraction failed: ${err instanceof Error ? err.message : String(err)})`);
-        }
-    }
-    else if (shouldExtract && !apiKey) {
+function printExtraction(extraction) {
+    if (extraction.status === 'no_key')
         printError('  (extraction skipped: ANTHROPIC_API_KEY not set)');
+    if (extraction.status !== 'ran')
+        return;
+    for (const failure of extraction.failures)
+        printError(`  (extraction failed: ${failure})`);
+    if (extraction.facts > 0)
+        printError(`  extracted ${extraction.facts} fact(s)`);
+}
+function supersedeTags(flags) {
+    return stringListFlag(flags, 'tag');
+}
+/** The api's conflict text differs by which writer lost; the row itself names its successor either way. */
+async function alreadySupersededLine(hippoRoot, oldId, tenantId, conflict) {
+    const by = (await getMemory(cliApiContext(hippoRoot, tenantId), oldId))?.superseded_by;
+    return by ? `Error: memory ${oldId} is already superseded by ${by}. Supersede that one instead.` : `Error: ${conflict.message}`;
+}
+function parseLayerFlag(flags) {
+    const raw = stringFlag(flags, 'layer');
+    if (raw === undefined)
+        return undefined;
+    const layer = Object.values(Layer).find((l) => l === raw);
+    if (layer === undefined) {
+        printError(`Invalid --layer: "${raw}". Must be one of: ${Object.values(Layer).join(', ')}`);
+        throw new CliExit(1);
     }
+    return layer;
 }
-function cmdSupersede(hippoRoot, oldId, newContent, flags) {
+async function cmdSupersede(hippoRoot, tenantId, oldId, newContent, flags) {
     requireInit(hippoRoot);
-    const old = readEntry(hippoRoot, oldId, resolveTenantId({}));
-    if (!old) {
-        printError(`Error: memory ${oldId} not found.`);
-        process.exit(1);
+    const overrides = {
+        layer: parseLayerFlag(flags),
+        tags: supersedeTags(flags),
+        // Without --pin the successor keeps the old row's pin.
+        pinned: flagIsTrue(flags, 'pin') ? true : undefined,
+    };
+    let newId;
+    try {
+        ({ newId } = api.supersede(cliApiContext(hippoRoot, tenantId), oldId, newContent, overrides));
     }
-    if (old.superseded_by) {
-        printError(`Error: memory ${oldId} is already superseded by ${old.superseded_by}. Supersede that one instead.`);
-        process.exit(1);
+    catch (err) {
+        if (err instanceof NotFoundError)
+            printError(`Error: memory ${oldId} not found.`);
+        else if (err instanceof RejectedValueError)
+            printError(`Error: ${err.message}`);
+        else if (err instanceof ConflictError)
+            printError(await alreadySupersededLine(hippoRoot, oldId, tenantId, err));
+        else
+            throw err;
+        throw new CliExit(1);
     }
-    const layer = typeof flags['layer'] === 'string' ? flags['layer'] : undefined;
-    const rawTags = flags['tag'];
-    const tags = Array.isArray(rawTags)
-        ? rawTags.map((t) => String(t))
-        : typeof rawTags === 'string'
-            ? rawTags.split(',').map((t) => t.trim()).filter(Boolean)
-            : undefined;
-    const pinned = flags['pin'] === true || old.pinned;
-    const newEntry = createSuccessor(old, newContent, {
-        tenantId: old.tenantId,
-        baseHalfLifeDays: loadConfig(hippoRoot).defaultHalfLifeDays,
-        layer,
-        tags,
-        pinned,
-    });
-    // Write the SUCCESSOR first: a rejection-guard refusal then mutates nothing, and an old-row failure leaves an
-    // orphan successor rather than a dangling pointer. Unlike api.supersede this path is two non-atomic writes.
+    console.log(`Superseded ${oldId} → ${newId}`);
+}
+function parseStepsOrExit(stepsJson) {
     try {
-        writeEntry(hippoRoot, newEntry);
+        return parseSteps(stepsJson);
     }
     catch (err) {
-        if (err instanceof RejectedValueError) {
-            printError(`Error: ${err.message}`);
-            process.exit(1);
-        }
-        throw err;
+        printError(errorMessage(err));
+        throw new CliExit(1);
     }
-    old.superseded_by = newEntry.id;
-    writeEntry(hippoRoot, old);
-    emitCliAudit(hippoRoot, 'supersede', oldId, { newId: newEntry.id });
-    console.log(`Superseded ${oldId} → ${newEntry.id}`);
 }
-function cmdTraceRecord(hippoRoot, flags) {
+function traceTags(flags) {
+    const rawTags = flags['tag'];
+    return Array.isArray(rawTags)
+        ? rawTags.map((t) => String(t))
+        : rawTags !== undefined
+            ? [String(rawTags)]
+            : [];
+}
+function cmdTraceRecord(hippoRoot, tenantId, flags) {
     requireInit(hippoRoot);
     const task = String(flags['task'] ?? '').trim();
     const stepsJson = String(flags['steps'] ?? '').trim();
@@ -235,64 +214,51 @@ function cmdTraceRecord(hippoRoot, flags) {
     const validOutcomes = ['success', 'failure', 'partial'];
     if (!task || !stepsJson || !outcome) {
         printError('Usage: hippo trace record --task <t> --steps <json> --outcome <success|failure|partial> [--session <id>] [--tag <t>]');
-        process.exit(1);
+        throw new CliExit(1);
     }
-    if (!validOutcomes.includes(outcome)) {
+    if (!isOneOf(validOutcomes, outcome)) {
         printError(`Invalid outcome: "${outcome}". Must be one of: ${validOutcomes.join(', ')}.`);
-        process.exit(1);
-    }
-    let steps;
-    try {
-        steps = parseSteps(stepsJson);
-    }
-    catch (err) {
-        printError(String(err instanceof Error ? err.message : err));
-        process.exit(1);
+        throw new CliExit(1);
     }
+    const steps = parseStepsOrExit(stepsJson);
     const sessionId = String(flags['session'] ?? '').trim() || null;
-    const rawTags = flags['tag'];
-    const tags = Array.isArray(rawTags)
-        ? rawTags.map((t) => String(t))
-        : rawTags !== undefined
-            ? [String(rawTags)]
-            : [];
+    const tags = traceTags(flags);
     const content = renderTraceContent({
         task,
         steps,
-        outcome: outcome,
+        outcome,
     });
-    const entry = createMemory(content, {
-        layer: Layer.Trace,
+    const { id } = api.remember(cliApiContext(hippoRoot, tenantId), {
+        content,
         tags,
-        source: String(flags['source'] ?? 'cli'),
-        trace_outcome: outcome,
-        source_session_id: sessionId,
-        tenantId: resolveTenantId({}),
-        baseHalfLifeDays: loadConfig(hippoRoot).defaultHalfLifeDays,
+        local: {
+            layer: Layer.Trace,
+            source: String(flags['source'] ?? 'cli'),
+            traceOutcome: outcome,
+            sourceSessionId: sessionId,
+        },
     });
-    writeEntry(hippoRoot, entry);
-    console.log(`Recorded trace ${entry.id} (outcome=${outcome}, ${steps.length} steps)`);
+    console.log(`Recorded trace ${id} (outcome=${outcome}, ${steps.length} steps)`);
 }
-function cmdTrace(hippoRoot, id, flags) {
+async function cmdTrace(hippoRoot, tenantId, id, flags) {
     requireInit(hippoRoot);
-    const asJson = Boolean(flags['json']);
-    const tenantId = resolveTenantId({});
+    const asJson = boolFlag(flags, 'json');
     // Look in local store first, then global.
-    let entry = readEntry(hippoRoot, id, tenantId);
+    let entry = await getMemory(cliApiContext(hippoRoot, tenantId), id);
     let sourceLabel = 'local';
     const globalRoot = getGlobalRoot();
     if (!entry && isInitialized(globalRoot)) {
-        entry = readEntry(globalRoot, id, tenantId);
+        entry = await getMemory(cliApiContext(globalRoot, tenantId), id);
         sourceLabel = 'global';
     }
     if (!entry) {
         printError(`Memory not found: ${id}`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     const t = {
         entry, id, sourceLabel,
         ...traceStats(entry),
-        ...traceLineage(hippoRoot, globalRoot, entry, id, tenantId),
+        ...(await traceLineage(hippoRoot, globalRoot, entry, id, tenantId)),
     };
     if (asJson) {
         printTraceJson(t);
@@ -307,22 +273,24 @@ function traceStats(entry) {
     const rewardFactor = calculateRewardFactor(entry);
     const effHalfLife = halfLife * rewardFactor;
     const createdMs = new Date(entry.created).getTime();
-    const ageDays = (now.getTime() - createdMs) / 86_400_000;
+    const ageDays = (now.getTime() - createdMs) / DAY_MS;
     const lastMs = new Date(entry.last_retrieved).getTime();
-    const sinceLast = (now.getTime() - lastMs) / 86_400_000;
+    const sinceLast = (now.getTime() - lastMs) / DAY_MS;
     const facets = confidenceFacets(entry, now);
     const conf = confidenceLabel(entry, now).text;
     // Projected strength: same decay curve, just push `now` out.
-    const projectedAt = (days) => calculateStrength(entry, new Date(now.getTime() + days * 86_400_000));
+    const projectedAt = (days) => calculateStrength(entry, new Date(now.getTime() + days * DAY_MS));
     return { strength, halfLife, rewardFactor, effHalfLife, ageDays, sinceLast, facets, conf, projectedAt };
 }
-function traceLineage(hippoRoot, globalRoot, entry, id, tenantId) {
+async function traceLineage(hippoRoot, globalRoot, entry, id, tenantId) {
     // Parents (consolidation lineage) — schema v9 field.
     const parents = Array.isArray(entry.parents) ? entry.parents : [];
-    const parentPreviews = parents.map((pid) => {
-        const p = readEntry(hippoRoot, pid, tenantId) ?? (isInitialized(globalRoot) ? readEntry(globalRoot, pid, tenantId) : null);
-        return { id: pid, content: p ? p.content.replace(/\s+/g, ' ').slice(0, 70) : '(not found)' };
-    });
+    const parentPreviews = [];
+    for (const pid of parents) {
+        const p = (await getMemory(cliApiContext(hippoRoot, tenantId), pid))
+            ?? (isInitialized(globalRoot) ? await getMemory(cliApiContext(globalRoot, tenantId), pid) : null);
+        parentPreviews.push({ id: pid, content: p ? p.content.replace(/\s+/g, ' ').slice(0, PARENT_PREVIEW_CHARS) : '(not found)' });
+    }
     // Open conflicts involving this memory.
     const allConflicts = [
         ...listMemoryConflicts(hippoRoot, 'open', tenantId),
@@ -365,7 +333,7 @@ function printTraceText(t) {
     const { parentPreviews, myConflicts } = t;
     console.log(`Memory: ${entry.id}  [${sourceLabel}]`);
     console.log('='.repeat(50));
-    console.log(`Content:   ${entry.content.replace(/\s+/g, ' ').slice(0, 160)}${entry.content.length > 160 ? '...' : ''}`);
+    console.log(`Content:   ${entry.content.replace(/\s+/g, ' ').slice(0, DETAIL_CONTENT_CHARS)}${entry.content.length > DETAIL_CONTENT_CHARS ? '...' : ''}`);
     console.log(`Layer:     ${entry.layer.padEnd(10)} Confidence: ${conf.padEnd(14)} Pinned: ${entry.pinned ? 'yes' : 'no'}${entry.starred ? '  Starred: yes' : ''}`);
     console.log(`Tags:      ${entry.tags.join(', ') || '(none)'}`);
     console.log(`Created:   ${entry.created}  (${fmt(ageDays, 1)} days ago)`);
@@ -397,7 +365,7 @@ function printTraceText(t) {
         }
     }
 }
-export async function handleRemember({ hippoRoot, args, flags }) {
+export async function handleRemember({ hippoRoot, tenantId, args, flags }) {
     let text;
     if (args.length === 1 && args[0] === '-') {
         text = fs.readFileSync(0, 'utf-8').trim();
@@ -407,70 +375,65 @@ export async function handleRemember({ hippoRoot, args, flags }) {
     }
     if (!text || text.length < 3) {
         printError('Memory content too short (minimum 3 characters).');
-        process.exit(1);
+        throw new CliExit(1);
     }
-    // Thin-client routing. When a server is up, simple `remember` calls go
-    // over HTTP so the daemon stays single-writer (footgun #2). Rich CLI
-    // flags (--pin, --layer, --extract, --global) still need the direct
-    // path; we only intercept the minimal envelope. The salience gate is
-    // NOT in richFlag and the route does not apply it, so a routed remember
-    // stores what a direct one would skip; do not read this list as covering salience.
+    // Thin-client routing: simple `remember` calls go over HTTP so the daemon stays the single writer; rich flags need the direct path.
+    // The salience gate is not in richFlag and the route does not apply it, so a routed remember stores what a direct one would skip.
     const richFlag = flags['pin'] || flags['global'] || flags['extract'] || flags['force'] ||
         flags['observed'] || flags['inferred'] || flags['verified'] ||
         flags['layer'] !== undefined;
-    if (!richFlag) {
-        const rememberKindRaw = typeof flags['kind'] === 'string' ? flags['kind'].toLowerCase() : undefined;
-        const rememberKindAllowed = ['distilled', 'superseded'];
-        if (rememberKindRaw === undefined || rememberKindAllowed.includes(rememberKindRaw)) {
-            const tags = rememberTags(flags, process.cwd()).all;
-            // Validate --owner on the thin-client path too, so validation is the same whether or not a server is up.
-            const thinOwnerRaw = typeof flags['owner'] === 'string' ? flags['owner'] : undefined;
-            const thinOwnerCheck = validateOwner(thinOwnerRaw, { strict: isStrictOwnerEnv() });
-            if (!thinOwnerCheck.ok) {
-                printError(thinOwnerCheck.message);
-                process.exit(1);
-            }
-            if (thinOwnerCheck.message)
-                printError(thinOwnerCheck.message);
-            const remembered = await runViaServerIfAvailable(hippoRoot, async (info, apiKey) => {
-                const result = await client.remember(info.url, apiKey, {
-                    content: text,
-                    kind: rememberKindRaw,
-                    scope: typeof flags['scope'] === 'string' ? flags['scope'] : undefined,
-                    owner: thinOwnerCheck.value,
-                    artifactRef: typeof flags['artifact-ref'] === 'string' ? flags['artifact-ref'] : undefined,
-                    tags,
-                });
-                console.log(`Remembered [${result.id}] (via ${info.url})`);
-                console.log(`   Kind: ${result.kind} | Tenant: ${result.tenantId}`);
-                for (const w of result.warnings ?? [])
-                    printError(`Warning: ${w}`);
-            });
-            if (remembered)
-                return;
-        }
+    if (!richFlag && await rememberViaThinClient(hippoRoot, text, flags))
+        return;
+    await cmdRemember(hippoRoot, tenantId, text, flags);
+}
+async function rememberViaThinClient(hippoRoot, text, flags) {
+    const rememberKindRaw = stringFlag(flags, 'kind')?.toLowerCase();
+    if (rememberKindRaw !== undefined && !isOneOf(USER_VISIBLE_KINDS, rememberKindRaw))
+        return false;
+    const tags = rememberTags(flags, process.cwd()).all;
+    // Validate --owner on the thin-client path too, so validation is the same whether or not a server is up.
+    const thinOwnerRaw = stringFlag(flags, 'owner');
+    const thinOwnerCheck = validateOwner(thinOwnerRaw, { strict: isStrictOwnerEnv() });
+    if (!thinOwnerCheck.ok) {
+        printError(thinOwnerCheck.message);
+        throw new CliExit(1);
     }
-    await cmdRemember(hippoRoot, text, flags);
+    if (thinOwnerCheck.message)
+        printError(thinOwnerCheck.message);
+    return runViaServerIfAvailable(hippoRoot, async (info, apiKey) => {
+        const result = await client.remember(info.url, apiKey, {
+            content: text,
+            kind: rememberKindRaw,
+            scope: stringFlag(flags, 'scope'),
+            owner: thinOwnerCheck.value,
+            artifactRef: stringFlag(flags, 'artifact-ref'),
+            tags,
+        });
+        console.log(`Remembered [${result.id}] (via ${info.url})`);
+        console.log(`   Kind: ${result.kind} | Tenant: ${result.tenantId}`);
+        for (const w of result.warnings ?? [])
+            printError(`Warning: ${w}`);
+    });
 }
-export function handleSupersede({ hippoRoot, args, flags }) {
+export async function handleSupersede({ hippoRoot, tenantId, args, flags }) {
     const oldId = args[0];
     const newContent = args.slice(1).join(' ').trim();
     if (!oldId || !newContent) {
         printError('Usage: hippo supersede <old-id> "<new content>" [--layer L] [--tag T] [--pin]');
-        process.exit(1);
+        throw new CliExit(1);
     }
-    cmdSupersede(hippoRoot, oldId, newContent, flags);
+    await cmdSupersede(hippoRoot, tenantId, oldId, newContent, flags);
 }
-export function handleTrace({ hippoRoot, args, flags }) {
+export async function handleTrace({ hippoRoot, tenantId, args, flags }) {
     const sub = args[0] ? String(args[0]) : '';
     if (sub === 'record') {
-        cmdTraceRecord(hippoRoot, flags);
+        cmdTraceRecord(hippoRoot, tenantId, flags);
         return;
     }
     if (!sub) {
         printError('Usage: hippo trace <memory-id> | hippo trace record --task <t> --steps <json> --outcome <o>');
-        process.exit(1);
+        throw new CliExit(1);
     }
-    cmdTrace(hippoRoot, sub, flags);
+    await cmdTrace(hippoRoot, tenantId, sub, flags);
 }
 //# sourceMappingURL=remember.js.map

package/dist/{scheduler.d.ts → cli/scheduler.d.ts}

@@ -1,33 +1,20 @@
-import * as fs from 'fs';
 export declare const DAILY_TASK_NAME = "hippo-daily-runner";
 interface WorkspaceRegistry {
     version: 1;
     workspaces: string[];
 }
-/**
- * Dependency-injection seam for tests. Production code always uses the real
- * `fs` functions imported above; tests override this via
- * __setSchedulerFsDeps to substitute fakes instead of `vi.mock`ing the
- * built-in `fs` module. Never called outside tests -- this module's public
- * behavior is unaffected when it's never invoked.
- */
-export interface SchedulerFsDeps {
-    existsSync: typeof fs.existsSync;
-    readFileSync: typeof fs.readFileSync;
-    mkdirSync: typeof fs.mkdirSync;
-    writeFileSync: typeof fs.writeFileSync;
-    renameSync: typeof fs.renameSync;
-}
-/** Test-only override. Not part of this module's public API surface. */
-export declare function __setSchedulerFsDeps(overrides: Partial<SchedulerFsDeps>): void;
 export declare function workspaceRegistryPath(globalRoot: string): string;
 export declare function loadWorkspaceRegistry(globalRoot: string): WorkspaceRegistry;
 export declare function saveWorkspaceRegistry(globalRoot: string, registry: WorkspaceRegistry): void;
 export declare function registerWorkspace(globalRoot: string, projectDir: string): WorkspaceRegistry;
 export declare function listRegisteredWorkspaces(globalRoot: string): string[];
+/** True when a runner path holds a character that would break the quoted command or split the crontab line. */
+export declare function hasUnsafeRunnerPathChars(runnerDir: string, platform: NodeJS.Platform): boolean;
 export declare function buildDailyRunnerCommand(projectDir: string, platform?: NodeJS.Platform): string;
 /** What the Windows task runs. A plain `cmd /c` task opens a visible console every morning. */
 export declare function buildWindowsTaskRun(cmd: string): string;
+/** `text` for the inside of one double-quoted Windows argument: a backslash run before a quote or the end doubles, so no quote ends the argument early. */
+export declare function quoteInsideWindowsArg(text: string): string;
 /** Argv for `schtasks`, passed without a shell: through cmd.exe the `&&` in /tr split the command. */
 export declare function buildSchtasksCreateArgs(taskName: string, cmd: string): string[];
 export declare function runDailyMaintenance(workspaces: readonly string[], runCommand: (cwd: string, args: string[]) => void): void;