hippo-memory 1.69.0 → 1.71.0

package/dist/{scheduler.js → cli/scheduler.js}

@@ -1,18 +1,8 @@
 import * as fs from 'fs';
 import * as path from 'path';
-import { log } from './log.js';
+import { errorMessage, log } from '../util/log.js';
+import { writeFileAtomic } from '../util/atomic-write.js';
 export const DAILY_TASK_NAME = 'hippo-daily-runner';
-let fsDeps = {
-    existsSync: fs.existsSync,
-    readFileSync: fs.readFileSync,
-    mkdirSync: fs.mkdirSync,
-    writeFileSync: fs.writeFileSync,
-    renameSync: fs.renameSync,
-};
-/** Test-only override. Not part of this module's public API surface. */
-export function __setSchedulerFsDeps(overrides) {
-    fsDeps = { ...fsDeps, ...overrides };
-}
 function defaultRegistry() {
     return {
         version: 1,
@@ -27,14 +17,14 @@ function normalizeWorkspace(projectDir) {
 }
 export function loadWorkspaceRegistry(globalRoot) {
     const registryPath = workspaceRegistryPath(globalRoot);
-    if (!fsDeps.existsSync(registryPath))
+    if (!fs.existsSync(registryPath))
         return defaultRegistry();
     let text;
     try {
-        text = fsDeps.readFileSync(registryPath, 'utf8');
+        text = fs.readFileSync(registryPath, 'utf8');
     }
     catch (err) {
-        log.warn(`workspace registry ${registryPath} could not be read (${err instanceof Error ? err.message : String(err)}); starting with no workspaces`);
+        log.warn(`workspace registry ${registryPath} could not be read (${errorMessage(err)}); starting with no workspaces`);
         return defaultRegistry();
     }
     try {
@@ -54,22 +44,22 @@ export function loadWorkspaceRegistry(globalRoot) {
     }
 }
 function setAsideCorruptRegistry(registryPath, err) {
-    const reason = err instanceof Error ? err.message : String(err);
+    const reason = errorMessage(err);
     const aside = `${registryPath}.corrupt-${new Date().toISOString().replace(/[:.]/g, '-')}`;
     try {
-        fsDeps.renameSync(registryPath, aside);
+        fs.renameSync(registryPath, aside);
         log.warn(`workspace registry ${registryPath} is corrupt (${reason}); moved it to ${aside} and starting with no workspaces`);
     }
     catch (renameErr) {
-        log.warn(`workspace registry ${registryPath} is corrupt (${reason}) and could not be moved aside (${renameErr instanceof Error ? renameErr.message : String(renameErr)}); starting with no workspaces`);
+        log.warn(`workspace registry ${registryPath} is corrupt (${reason}) and could not be moved aside (${errorMessage(renameErr)}); starting with no workspaces`);
     }
 }
 export function saveWorkspaceRegistry(globalRoot, registry) {
-    fsDeps.mkdirSync(globalRoot, { recursive: true, mode: 0o700 });
-    fsDeps.writeFileSync(workspaceRegistryPath(globalRoot), JSON.stringify({
+    fs.mkdirSync(globalRoot, { recursive: true, mode: 0o700 });
+    writeFileAtomic(workspaceRegistryPath(globalRoot), JSON.stringify({
         version: 1,
         workspaces: [...new Set(registry.workspaces.map(normalizeWorkspace))].sort(),
-    }, null, 2) + '\n', 'utf8');
+    }, null, 2) + '\n');
 }
 export function registerWorkspace(globalRoot, projectDir) {
     const registry = loadWorkspaceRegistry(globalRoot);
@@ -80,6 +70,12 @@ export function registerWorkspace(globalRoot, projectDir) {
 export function listRegisteredWorkspaces(globalRoot) {
     return loadWorkspaceRegistry(globalRoot).workspaces;
 }
+// Crontab reads % as a newline and both shells expand $ and backtick; a backslash is a path separator on Windows only.
+const UNSAFE_RUNNER_PATH_CHARS = /["`$%\n\r]/;
+/** True when a runner path holds a character that would break the quoted command or split the crontab line. */
+export function hasUnsafeRunnerPathChars(runnerDir, platform) {
+    return UNSAFE_RUNNER_PATH_CHARS.test(runnerDir) || (platform !== 'win32' && runnerDir.includes('\\'));
+}
 export function buildDailyRunnerCommand(projectDir, platform = process.platform) {
     if (platform === 'win32') {
         const resolved = path.win32.resolve(projectDir).replace(/\\/g, '/');
@@ -92,6 +88,10 @@ export function buildDailyRunnerCommand(projectDir, platform = process.platform)
 export function buildWindowsTaskRun(cmd) {
     return `conhost.exe --headless cmd /c ${cmd}`;
 }
+/** `text` for the inside of one double-quoted Windows argument: a backslash run before a quote or the end doubles, so no quote ends the argument early. */
+export function quoteInsideWindowsArg(text) {
+    return text.replace(/(\\*)"/g, '$1$1\\"').replace(/\\+$/, '$&$&');
+}
 /** Argv for `schtasks`, passed without a shell: through cmd.exe the `&&` in /tr split the command. */
 export function buildSchtasksCreateArgs(taskName, cmd) {
     return ['/create', '/tn', taskName, '/tr', buildWindowsTaskRun(cmd), '/sc', 'daily', '/st', '06:15', '/f'];
@@ -99,7 +99,7 @@ export function buildSchtasksCreateArgs(taskName, cmd) {
 export function runDailyMaintenance(workspaces, runCommand) {
     for (const workspace of workspaces) {
         const resolved = normalizeWorkspace(workspace);
-        if (!fsDeps.existsSync(path.join(resolved, '.hippo')))
+        if (!fs.existsSync(path.join(resolved, '.hippo')))
             continue;
         runCommand(resolved, ['learn', '--git', '--days', '1']);
         runCommand(resolved, ['sleep']);

package/dist/cli/serve.d.ts

@@ -1,4 +1,4 @@
-import { type CommandContext } from './shared.js';
+import { type CommandContext } from './flag-values.js';
 export declare function handleDashboard({ hippoRoot, flags }: CommandContext): Promise<void>;
 export declare function handleMcp(): Promise<void>;
 export declare function handleServe({ hippoRoot, flags }: CommandContext): Promise<void>;

package/dist/cli/serve.js

@@ -1,13 +1,21 @@
 // Long-running verbs: `hippo dashboard`, `hippo mcp` and `hippo serve`.
-import { envPort } from '../env.js';
+import { installCrashHandlers } from '../util/crash-handlers.js';
+import { envAllowKeylessLocal, envPort, envRequireAuth, envTlsCert, envTlsKey } from '../util/env.js';
+import * as fs from 'fs';
 import * as path from 'path';
 import { printError } from './output.js';
+import { stringFlagOrExit, stringFlag } from './flag-values.js';
 import { requireInit } from './shared.js';
+import { errorMessage } from '../util/log.js';
+import { CliExit } from './exit.js';
+import { DEFAULT_SERVER_HOST, DEFAULT_SERVER_PORT } from '../server/defaults.js';
 export async function handleDashboard({ hippoRoot, flags }) {
     requireInit(hippoRoot);
     const port = parseInt(String(flags['port'] ?? '3333'), 10);
-    const { serveDashboard } = await import('../dashboard.js');
-    serveDashboard(hippoRoot, port);
+    const { serveDashboard } = await import('../dashboard/dashboard.js');
+    serveDashboard(hippoRoot, port, undefined, { handleSignals: true });
+    // A later throw ends in one log line and exit 1, as it does for serve and mcp; a busy port is reported by the dashboard itself.
+    installCrashHandlers('dashboard');
     await new Promise(() => { }); // run until Ctrl+C
 }
 export async function handleMcp() {
@@ -20,18 +28,49 @@ export async function handleMcp() {
     // Server runs until stdin closes, so we never reach here
     await new Promise(() => { }); // hang forever
 }
+/** The certificate and key for HTTPS, from --tls-cert and --tls-key or HIPPO_TLS_CERT and HIPPO_TLS_KEY; undefined when neither is set. */
+function readTlsFiles(flags) {
+    // A flag with no value exits here; falling back to cleartext would hide the mistake.
+    const certPath = stringFlagOrExit(flags, 'tls-cert') ?? envTlsCert();
+    const keyPath = stringFlagOrExit(flags, 'tls-key') ?? envTlsKey();
+    if (certPath === undefined && keyPath === undefined)
+        return undefined;
+    if (certPath === undefined || keyPath === undefined) {
+        printError('hippo serve: TLS needs both a certificate and a key: --tls-cert and --tls-key, or HIPPO_TLS_CERT and HIPPO_TLS_KEY.');
+        throw new CliExit(1);
+    }
+    try {
+        return { cert: fs.readFileSync(certPath), key: fs.readFileSync(keyPath) };
+    }
+    catch (err) {
+        printError(`hippo serve: cannot read the TLS files: ${errorMessage(err)}`);
+        throw new CliExit(1);
+    }
+}
+/** Said at every start, so the key rule is a choice an operator sees, and an upgrade that changed it explains itself. */
+function keyRuleLine() {
+    if (envRequireAuth())
+        return 'every request needs an API key (HIPPO_REQUIRE_AUTH=1)';
+    if (envAllowKeylessLocal()) {
+        return 'requests from this machine need no API key and act as host admin (HIPPO_ALLOW_KEYLESS_LOCAL=1); unset it to require a key on every request';
+    }
+    return 'every request needs an API key: mint one with `hippo auth create` and send it as "Authorization: Bearer <key>" ' +
+        '(the hippo CLI reads HIPPO_API_KEY). To let requests from this machine in without a key, start with HIPPO_ALLOW_KEYLESS_LOCAL=1';
+}
 export async function handleServe({ hippoRoot, flags }) {
     requireInit(hippoRoot);
-    const portRaw = flags['port'] ?? envPort() ?? '6789';
+    const portRaw = flags['port'] ?? envPort() ?? DEFAULT_SERVER_PORT;
     const port = Number(portRaw);
     if (!Number.isFinite(port) || port < 0) {
         printError(`Invalid --port: ${String(portRaw)}`);
-        process.exit(1);
+        throw new CliExit(1);
     }
-    const host = typeof flags['host'] === 'string' ? flags['host'] : '127.0.0.1';
+    const host = stringFlag(flags, 'host') ?? DEFAULT_SERVER_HOST;
+    const tls = readTlsFiles(flags);
     const { serve } = await import('../server.js');
-    const handle = await serve({ hippoRoot, port, host, handleSignals: true });
+    const handle = await serve({ hippoRoot, port, host, handleSignals: true, tls });
     console.log(`hippo serve listening on ${handle.url} (pid ${process.pid})`);
+    console.log(keyRuleLine());
     console.log(`pidfile: ${path.join(hippoRoot, 'server.pid')}`);
     console.log('press Ctrl+C to stop');
     // The SIGINT/SIGTERM handlers stop the server and exit. Hang until then.

package/dist/cli/session-hooks.d.ts

@@ -1,26 +1,18 @@
-import { type CommandContext } from './shared.js';
-/**
- * SessionEnd entry point. Claude Code / OpenCode fire this on /exit while
- * tearing down the TUI, which kills any child that is still running when
- * the parent returns. Running sleep + capture synchronously here means both
- * get SIGTERM'd mid-consolidation.
- *
- * So we do the minimum inline (read stdin for transcript_path), then spawn
- * a fully detached Node child that runs sleep → capture and exit the parent
- * immediately. The child writes to the log file and survives TUI teardown;
- * the next SessionStart reads the log via `hippo last-sleep`.
- */
-export declare function cmdSessionEnd(hippoRoot: string, flags: Record<string, string | boolean | string[]>): Promise<void>;
-export declare function cmdSessionEndWorker(hippoRoot: string, flags: Record<string, string | boolean | string[]>): Promise<void>;
+import { type CliFlags, type CommandContext } from './flag-values.js';
+/** SessionEnd entry: TUI teardown kills children still running, so read stdin inline, spawn a detached child that runs sleep then capture, and exit.
+ * The child logs to a file that the next SessionStart reads via `hippo last-sleep`. */
+export declare function handleSessionEnd({ hippoRoot, tenantId, flags }: CommandContext): Promise<void>;
+export declare function handleSessionEndWorker({ hippoRoot, tenantId, flags }: CommandContext): Promise<void>;
 /** Quotes one cmd.exe argument; each `%` leaves the quotes as `^%`, so no %NAME% pair can expand. */
 export declare function quoteCmdArg(arg: string): string;
 /** cmd.exe arguments that run a .cmd or .bat shim with every forwarded argument delivered verbatim. */
 export declare function cmdShimArgs(shimPath: string, forwardArgs: readonly string[]): string[];
-export declare function cmdCodexRun(hippoRoot: string, args: string[]): void;
-export declare function cmdCodexSessionEndWorker(hippoRoot: string, flags: Record<string, string | boolean | string[]>): Promise<void>;
+export declare function handleCodexRun({ hippoRoot, tenantId, args }: CommandContext): void;
+export declare function cmdCodexSessionEndWorker(hippoRoot: string, tenantId: string, flags: CliFlags): Promise<void>;
+export declare function handleCodexSessionEndWorker({ hippoRoot, tenantId, flags }: CommandContext): Promise<void>;
 export declare function handlePreCompact({ hippoRoot, flags }: CommandContext): Promise<void>;
 export declare function handlePostCompact({ hippoRoot, flags }: CommandContext): Promise<void>;
-export declare function handleCaptureError({ hippoRoot, flags }: CommandContext): Promise<void>;
-export declare function handleCompactResume({ hippoRoot }: CommandContext): Promise<void>;
-export declare function handleCapture({ hippoRoot, flags }: CommandContext): Promise<void>;
+export declare function handleCaptureError({ hippoRoot, tenantId, flags }: CommandContext): Promise<void>;
+export declare function handleCompactResume({ hippoRoot, tenantId }: CommandContext): Promise<void>;
+export declare function handleCapture({ hippoRoot, tenantId, flags }: CommandContext): Promise<void>;
 //# sourceMappingURL=session-hooks.d.ts.map