hippo-memory 1.70.0 → 1.71.0

package/dist/cli/curate.js

@@ -1,39 +1,37 @@
 // Verbs that weaken, suppress or retire memories: outcome, forget, conflicts, reject, dormant, quarantine, invalidate.
 import * as path from 'path';
-import { readEntry } from '../store/entry-reads.js';
 import { listMemoryConflicts, resolveConflict } from '../store/conflicts.js';
 import { rejectValue, unrejectValue, listRejectionsForTenant } from '../trust/reject-flow.js';
 import { RejectedValueError } from '../store/rejection.js';
 import { loadConfig } from '../core/config.js';
+import { RawAppendOnlyError } from '../core/raw-append-only.js';
 import { isGitRepo } from '../learn/autolearn.js';
 import { invalidateMatching } from '../learn/invalidation.js';
 import * as api from '../api/index.js';
+import { getMemory } from '../api/memories.js';
 import * as client from './client.js';
-import { resolveTenantId } from '../store/tenant.js';
+import { cliApiContext } from './api-context.js';
 import { printError } from './output.js';
-import { parseCountFlag, boolFlag, flagIsTrue, stringFlag } from './flag-values.js';
+import { parseCountFlag, boolFlag, flagIsTrue, nonEmptyStringFlag, stringFlag } from './flag-values.js';
 import { requireInit, runChurnStaleForRepo, runViaServerIfAvailable, resolveAuthRoot } from './shared.js';
 import { fmt } from './print.js';
 import { errorMessage } from '../util/log.js';
 import { DIGEST_DISPLAY_CHARS, CONTENT_PREVIEW_CHARS, DATE_PREFIX_CHARS } from '../util/token-text.js';
+import { CliExit } from './exit.js';
 const CONFLICT_PREVIEW_CHARS = 120;
 const REJECTED_DIGEST_LIST_CHARS = 16;
 const DORMANT_PREVIEW_CHARS = 100;
 const STRENGTH_DECIMALS = 3;
-export function cmdOutcome(hippoRoot, flags) {
+export function handleOutcome({ hippoRoot, tenantId, flags }) {
     requireInit(hippoRoot);
     const good = boolFlag(flags, 'good');
     const bad = boolFlag(flags, 'bad');
     if (!good && !bad) {
         printError('Specify --good or --bad');
-        process.exit(1);
+        throw new CliExit(1);
     }
     // Through api.outcome so every CLI outcome writes one audit_log row per id, as the MCP path does.
-    const ctx = {
-        hippoRoot,
-        tenantId: resolveTenantId({}),
-        actor: api.adminActor('cli'),
-    };
+    const ctx = cliApiContext(hippoRoot, tenantId);
     const specificId = flags['id'] ? String(flags['id']) : null;
     let updated;
     if (specificId) {
@@ -51,16 +49,11 @@ export function cmdOutcome(hippoRoot, flags) {
 }
 // Shared between the forget dispatch and cmdForget so the message can't drift.
 const ARCHIVE_REASON_REQUIRED = 'hippo forget --archive requires --reason "<why>" (recorded on the archive).';
-function cmdForget(hippoRoot, id, flags) {
+function cmdForget(hippoRoot, tenantId, id, flags) {
     requireInit(hippoRoot);
-    const ctx = {
-        hippoRoot,
-        tenantId: resolveTenantId({}),
-        actor: api.adminActor('cli'),
-    };
-    // Raw memories (Slack / GitHub connector ingestion) are append-only: a
-    // BEFORE-DELETE trigger aborts any delete. archiveRaw is the sanctioned
-    // removal path; it records ctx.actor as the archiver for provenance.
+    const ctx = cliApiContext(hippoRoot, tenantId);
+    // Raw memories (connector ingestion) are append-only: a BEFORE-DELETE trigger aborts any delete,
+    // so archiveRaw is the sanctioned removal path and records ctx.actor as the archiver.
     if (flagIsTrue(flags, 'archive')) {
         archiveForgottenRaw(ctx, id, stringFlag(flags, 'reason') ?? null);
         return;
@@ -70,14 +63,14 @@ function cmdForget(hippoRoot, id, flags) {
         console.log(`Forgot ${id}`);
     }
     catch (err) {
-        reportForgetFailure(ctx, id, errorMessage(err));
-        process.exit(1);
+        reportForgetFailure(ctx, id, err);
+        throw new CliExit(1);
     }
 }
 function archiveForgottenRaw(ctx, id, reason) {
     if (!reason) {
         printError(ARCHIVE_REASON_REQUIRED);
-        process.exit(1);
+        throw new CliExit(1);
     }
     try {
         api.archiveRaw(ctx, id, reason);
@@ -85,11 +78,11 @@ function archiveForgottenRaw(ctx, id, reason) {
     }
     catch (err) {
         printError(`Could not archive ${id}: ${errorMessage(err)}`);
-        process.exit(1);
+        throw new CliExit(1);
     }
 }
-function reportForgetFailure(ctx, id, msg) {
-    if (/append-only/i.test(msg)) {
+function reportForgetFailure(ctx, id, cause) {
+    if (cause instanceof RawAppendOnlyError) {
         // The delete was refused by the append-only trigger — this is a raw
         // memory, not a missing one. Point the user at the archive path.
         printError(rawForgetRefusal(id));
@@ -108,25 +101,25 @@ function rawForgetRefusal(id) {
     return `Cannot forget ${id}: it is a raw, append-only memory. Archive it instead: hippo forget ${id} --archive --reason "<why>"`;
 }
 // Refuses exactly where the real run would, so "Would forget" is a promise, not a guess.
-function previewForget(hippoRoot, id, archive) {
+async function previewForget(hippoRoot, tenantId, id, archive) {
     requireInit(hippoRoot);
-    const entry = readEntry(hippoRoot, id, resolveTenantId({}));
+    const entry = await getMemory(cliApiContext(hippoRoot, tenantId), id);
     if (!entry) {
         printError(`Memory not found: ${id}`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     if (!archive && entry.kind === 'raw') {
         printError(rawForgetRefusal(id));
-        process.exit(1);
+        throw new CliExit(1);
     }
     if (archive && entry.kind !== 'raw') {
         printError(`Could not archive ${id}: memory ${id} is not raw (kind=${entry.kind})`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     const snippet = entry.content.length > CONTENT_PREVIEW_CHARS ? `${entry.content.slice(0, CONTENT_PREVIEW_CHARS)}...` : entry.content;
     console.log(`Would ${archive ? 'archive' : 'forget'} ${id} (dry run, nothing changed): "${snippet}"`);
 }
-export function cmdConflicts(hippoRoot, flags) {
+export function handleConflicts({ hippoRoot, flags }) {
     requireInit(hippoRoot);
     const conflicts = listMemoryConflicts(hippoRoot, String(flags['status'] ?? 'open'));
     if (flags['json']) {
@@ -146,19 +139,20 @@ export function cmdConflicts(hippoRoot, flags) {
     }
 }
 /** Shown when --keep is missing, to help the user decide. */
-function showConflictForResolve(hippoRoot, conflictId, tenantId) {
+async function showConflictForResolve(hippoRoot, conflictId, tenantId) {
     const conflicts = listMemoryConflicts(hippoRoot, 'open', tenantId);
     const conflict = conflicts.find((c) => c.id === conflictId);
     if (!conflict) {
         printError(`Conflict ${conflictId} not found or already resolved.`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     console.log(`Conflict ${conflictId}:`);
     console.log(`  ${conflict.memory_a_id} <-> ${conflict.memory_b_id}`);
     console.log(`  Reason: ${conflict.reason}`);
     console.log('');
-    const entryA = readEntry(hippoRoot, conflict.memory_a_id, tenantId);
-    const entryB = readEntry(hippoRoot, conflict.memory_b_id, tenantId);
+    const ctx = cliApiContext(hippoRoot, tenantId);
+    const entryA = await getMemory(ctx, conflict.memory_a_id);
+    const entryB = await getMemory(ctx, conflict.memory_b_id);
     if (entryA) {
         console.log(`  [A] ${conflict.memory_a_id}:`);
         console.log(`      ${entryA.content.slice(0, CONFLICT_PREVIEW_CHARS)}${entryA.content.length > CONFLICT_PREVIEW_CHARS ? '...' : ''}`);
@@ -170,19 +164,18 @@ function showConflictForResolve(hippoRoot, conflictId, tenantId) {
     console.log('');
     console.log(`Resolve with: hippo resolve ${conflictId} --keep <memory_id> [--forget] [--reject-loser [--reason "<why>"]]`);
 }
-export function cmdResolve(hippoRoot, args, flags) {
+export async function handleResolve({ hippoRoot, tenantId, args, flags }) {
     requireInit(hippoRoot);
     const rawId = args[0] ?? '';
     // Accept "42" or "conflict_42"
     const conflictId = parseInt(rawId.replace(/^conflict_/, ''), 10);
     if (isNaN(conflictId)) {
         printError('Usage: hippo resolve <conflict_id> --keep <memory_id> [--forget]');
-        process.exit(1);
+        throw new CliExit(1);
     }
-    const tenantId = resolveTenantId({});
     const keepId = String(flags['keep'] ?? '').trim();
     if (!keepId) {
-        showConflictForResolve(hippoRoot, conflictId, tenantId);
+        await showConflictForResolve(hippoRoot, conflictId, tenantId);
         return;
     }
     const forgetLoser = boolFlag(flags, 'forget');
@@ -196,7 +189,7 @@ export function cmdResolve(hippoRoot, args, flags) {
     });
     if (!result) {
         printError(`Could not resolve conflict ${conflictId}. Check the ID and --keep value.`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     const action = rejectLoser
         ? 'rejected (tombstoned) and removed'
@@ -205,31 +198,28 @@ export function cmdResolve(hippoRoot, args, flags) {
             : 'weakened (half-life halved)';
     console.log(`Resolved conflict ${conflictId}: kept ${keepId}, ${action} ${result.loserId}`);
 }
-// ---------------------------------------------------------------------------
 // reject / rejections / unreject
-// ---------------------------------------------------------------------------
-export function cmdReject(hippoRoot, args, flags) {
+export function handleReject({ hippoRoot, tenantId, args, flags }) {
     // Store resolution mirrors `hippo remember`: --global writes to the
     // global store, otherwise the local store (requireInit'd via resolveAuthRoot).
     const root = resolveAuthRoot(hippoRoot, flags);
-    const tenantId = resolveTenantId({});
     // --reason is REQUIRED: the tombstone stores no content, so reason is its only human-readable identity.
     const reason = (stringFlag(flags, 'reason') ?? '').trim();
     if (!reason) {
         printError('hippo reject requires --reason "<why>" (the tombstone stores no content; reason is its only identity).');
-        process.exit(1);
+        throw new CliExit(1);
     }
     const valueFlag = stringFlag(flags, 'value');
     const memoryId = args[0];
     if (!memoryId && valueFlag === undefined) {
         printError('Usage: hippo reject <memory-id> --reason "<why>"');
         printError('   or: hippo reject --value "<text>" --reason "<why>"');
-        process.exit(1);
+        throw new CliExit(1);
     }
     if (memoryId && valueFlag !== undefined) {
         // Ambiguous ask: silently preferring one form would ignore the other without feedback.
         printError('hippo reject takes EITHER a memory id OR --value, not both.');
-        process.exit(1);
+        throw new CliExit(1);
     }
     try {
         const result = rejectValue({
@@ -244,7 +234,7 @@ export function cmdReject(hippoRoot, args, flags) {
     }
     catch (err) {
         printError(`Could not reject: ${errorMessage(err)}`);
-        process.exit(1);
+        throw new CliExit(1);
     }
 }
 function printRejected(result, reason) {
@@ -265,9 +255,8 @@ function printRejected(result, reason) {
         console.log('  No live rows matched (pre-emptive tombstone).');
     }
 }
-export function cmdRejections(hippoRoot, flags) {
+export function handleRejections({ hippoRoot, tenantId, flags }) {
     const root = resolveAuthRoot(hippoRoot, flags);
-    const tenantId = resolveTenantId({});
     const rows = listRejectionsForTenant(root, tenantId);
     if (flags['json']) {
         console.log(JSON.stringify({ rejections: rows }, null, 2));
@@ -290,41 +279,32 @@ export function cmdRejections(hippoRoot, flags) {
         console.log('');
     }
 }
-export function cmdUnreject(hippoRoot, args, flags) {
+export function handleUnreject({ hippoRoot, tenantId, args, flags }) {
     const root = resolveAuthRoot(hippoRoot, flags);
-    const tenantId = resolveTenantId({});
     const digestOrPrefix = (args[0] ?? '').trim();
     if (!digestOrPrefix) {
         printError('Usage: hippo unreject <digest-or-prefix>');
-        process.exit(1);
+        throw new CliExit(1);
     }
     const outcome = unrejectValue(root, tenantId, digestOrPrefix, 'cli');
     if (outcome.status === 'not_found') {
         printError(`No rejected value matches "${digestOrPrefix}". Run \`hippo rejections\` to list tombstones.`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     if (outcome.status === 'ambiguous') {
         printError(`"${digestOrPrefix}" matches ${outcome.candidates.length} tombstones. Use a longer prefix:`);
         for (const c of outcome.candidates) {
             printError(`  ${c.digest.slice(0, REJECTED_DIGEST_LIST_CHARS)}...  ${c.reason ?? 'none given'}`);
         }
-        process.exit(1);
+        throw new CliExit(1);
     }
     console.log(`Unrejected [${outcome.digest.slice(0, DIGEST_DISPLAY_CHARS)}...] (was: ${outcome.reason ?? 'none given'})`);
 }
-/**
- * `hippo dormant [list] [<query>...] [--limit <n>] [--json] [--global]`,
- * `hippo dormant restore <id>`, `hippo dormant forget <id>`.
- * Dormant memories are what sleep keeps instead of deleting (on by default;
- * `"dormant": { "enabled": false }` in .hippo/config.json deletes instead).
- */
-export function cmdDormant(hippoRoot, args, flags) {
+/** `hippo dormant [list|restore <id>|forget <id>]`: dormant memories are what sleep keeps instead of deleting
+ * (on by default; `"dormant": { "enabled": false }` in .hippo/config.json deletes instead). */
+export function handleDormant({ hippoRoot, tenantId, args, flags }) {
     const root = resolveAuthRoot(hippoRoot, flags);
-    const ctx = {
-        hippoRoot: root,
-        tenantId: resolveTenantId({}),
-        actor: api.adminActor('cli'),
-    };
+    const ctx = cliApiContext(root, tenantId);
     const sub = args[0];
     if (sub === 'restore' || sub === 'forget') {
         changeDormant(ctx, sub, (args[1] ?? '').trim());
@@ -345,7 +325,7 @@ export function cmdDormant(hippoRoot, args, flags) {
 function changeDormant(ctx, sub, id) {
     if (!id) {
         printError(`Usage: hippo dormant ${sub} <id>`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     try {
         if (sub === 'restore') {
@@ -364,7 +344,7 @@ function changeDormant(ctx, sub, id) {
         else {
             printError(`Could not ${sub} ${id}: ${errorMessage(err)}`);
         }
-        process.exit(1);
+        throw new CliExit(1);
     }
 }
 function printDormantRows(rows, hasQuery, root) {
@@ -386,13 +366,9 @@ function printDormantRows(rows, hasQuery, root) {
     console.log('Bring one back: hippo dormant restore <id>   Delete for good: hippo dormant forget <id>');
 }
 /** `hippo quarantine [list] [--all] [--json] [--global]`, `quarantine approve <id>`, `quarantine reject <id>` (poisoning defence). */
-export async function cmdQuarantine(hippoRoot, args, flags) {
+export async function handleQuarantine({ hippoRoot, tenantId, args, flags }) {
     const root = resolveAuthRoot(hippoRoot, flags);
-    const ctx = {
-        hippoRoot: root,
-        tenantId: resolveTenantId({}),
-        actor: api.adminActor('cli'),
-    };
+    const ctx = cliApiContext(root, tenantId);
     const sub = args[0];
     if (sub === 'approve' || sub === 'reject') {
         await decideQuarantined(ctx, sub, (args[1] ?? '').trim());
@@ -413,7 +389,7 @@ export async function cmdQuarantine(hippoRoot, args, flags) {
 async function decideQuarantined(ctx, sub, id) {
     if (!id) {
         printError(`Usage: hippo quarantine ${sub} <id>`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     try {
         if (sub === 'approve') {
@@ -427,7 +403,7 @@ async function decideQuarantined(ctx, sub, id) {
     }
     catch (err) {
         printError(`Could not ${sub} ${id}: ${errorMessage(err)}`);
-        process.exit(1);
+        throw new CliExit(1);
     }
 }
 function printQuarantineRows(rows) {
@@ -440,11 +416,11 @@ function printQuarantineRows(rows) {
     }
     console.log('Approve: hippo quarantine approve <id>   Reject: hippo quarantine reject <id>');
 }
-export async function handleForget({ hippoRoot, args, flags }) {
+export async function handleForget({ hippoRoot, tenantId, args, flags }) {
     const id = args[0];
     if (!id) {
         printError('Please provide a memory ID.');
-        process.exit(1);
+        throw new CliExit(1);
     }
     // Archive has its own HTTP route (POST /v1/memories/:id/archive); route
     // both branches the same way the direct path does.
@@ -452,10 +428,10 @@ export async function handleForget({ hippoRoot, args, flags }) {
     const reason = stringFlag(flags, 'reason') ?? null;
     if (archive && !reason) {
         printError(ARCHIVE_REASON_REQUIRED);
-        process.exit(1);
+        throw new CliExit(1);
     }
     if (flagIsTrue(flags, 'dry-run')) {
-        previewForget(hippoRoot, id, archive);
+        await previewForget(hippoRoot, tenantId, id, archive);
         return;
     }
     const routed = await runViaServerIfAvailable(hippoRoot, async (info, apiKey) => {
@@ -472,26 +448,26 @@ export async function handleForget({ hippoRoot, args, flags }) {
         catch (err) {
             // A server that died after the health probe is the caller's transport
             // fallback to handle, not an error to report to the user.
-            if (client.classifyTransportFailure(err) !== 'none')
+            if (err instanceof Error && client.classifyTransportFailure(err) !== 'none')
                 throw err;
             const msg = errorMessage(err);
             printError(archive ? `Could not archive ${id}: ${msg}` : msg);
-            process.exit(1);
+            throw new CliExit(1);
         }
     });
     if (routed)
         return;
-    cmdForget(hippoRoot, id, flags);
+    cmdForget(hippoRoot, tenantId, id, flags);
 }
 function invalidateChurn(hippoRoot, args, flags) {
     if (args[0] || flags['id'] !== undefined) {
         printError('Usage: hippo invalidate --churn [--dry-run]');
         printError('--churn takes no pattern or --id.');
-        process.exit(1);
+        throw new CliExit(1);
     }
     if (!isGitRepo(process.cwd())) {
         printError('hippo invalidate --churn must run inside a git repository.');
-        process.exit(1);
+        throw new CliExit(1);
     }
     const churnDryRun = flagIsTrue(flags, 'dry-run');
     let churnFailed = false;
@@ -516,9 +492,9 @@ function invalidateChurn(hippoRoot, args, flags) {
         }
     }
     if (churnFailed)
-        process.exit(1);
+        throw new CliExit(1);
 }
-export function handleInvalidate({ hippoRoot, args, flags }) {
+export function handleInvalidate({ hippoRoot, tenantId, args, flags }) {
     requireInit(hippoRoot);
     if (flagIsTrue(flags, 'churn'))
         return invalidateChurn(hippoRoot, args, flags);
@@ -527,7 +503,7 @@ export function handleInvalidate({ hippoRoot, args, flags }) {
         // Value-less --id must never silently fall through to pattern mode
         // (pattern mode writes broadly; an ignored --id reverses user intent).
         printError('--id requires a memory id');
-        process.exit(1);
+        throw new CliExit(1);
     }
     const onlyId = stringFlag(flags, 'id');
     const dryRun = flagIsTrue(flags, 'dry-run');
@@ -535,15 +511,15 @@ export function handleInvalidate({ hippoRoot, args, flags }) {
         printError('Usage: hippo invalidate "<old pattern>" [--dry-run] [--reason "<why>"]');
         printError('       hippo invalidate --id <memory-id> [--dry-run] [--reason "<why>"]');
         printError('Pass a pattern OR --id, not both. Tag matching is EXACT: the full pattern must equal a tag.');
-        process.exit(1);
+        throw new CliExit(1);
     }
-    const reason = (flags['reason'] || null);
+    const reason = nonEmptyStringFlag(flags, 'reason') ?? null;
     const invTarget = {
         from: target ?? `id:${onlyId}`,
         to: reason,
         type: 'migration',
     };
-    const result = invalidateMatching(hippoRoot, invTarget, resolveTenantId({}), { dryRun, onlyId });
+    const result = invalidateMatching(hippoRoot, invTarget, tenantId, { dryRun, onlyId });
     const label = target ? `"${target}"` : `--id ${onlyId}`;
     if (result.dryRun) {
         if (result.invalidated === 0) {

package/dist/cli/dag.d.ts

@@ -1,5 +1,5 @@
-import { type CliFlags, type CommandContext } from './flag-values.js';
-export declare function cmdDag(hippoRoot: string, flags: CliFlags): void;
-export declare function handleDrill({ hippoRoot, args, flags }: CommandContext): Promise<void>;
-export declare function handleAssemble({ hippoRoot, args, flags }: CommandContext): Promise<void>;
+import { type CommandContext } from './flag-values.js';
+export declare function handleDag({ hippoRoot, flags }: CommandContext): void;
+export declare function handleDrill({ hippoRoot, tenantId, args, flags }: CommandContext): Promise<void>;
+export declare function handleAssemble({ hippoRoot, tenantId, args, flags }: CommandContext): Promise<void>;
 //# sourceMappingURL=dag.d.ts.map

package/dist/cli/dag.js

@@ -1,19 +1,19 @@
 // DAG summary verbs: `hippo dag`, `hippo assemble` and `hippo drill`.
 import { loadAllEntries } from '../store/entry-reads.js';
 import * as api from '../api/index.js';
-import { resolveTenantId } from '../store/tenant.js';
 import { assembleCost, assembleHeading, drillCost, settleTokens } from '../api/context-render.js';
 import { printError } from './output.js';
 import { parseBudgetFlag, flagIsTrue, stringFlag, numberFlag } from './flag-values.js';
 import { requireInit } from './shared.js';
 import { captureConsole } from './print.js';
 import { CONTENT_PREVIEW_CHARS } from '../util/token-text.js';
+import { CliExit } from './exit.js';
 const TREE_CHILD_PREVIEW_CHARS = 70;
 const TREE_LEAF_PREVIEW_CHARS = 60;
 const DAG_HEAD_CHARS = 120;
 const DAG_SUMMARY_PREVIEW_CHARS = 200;
 const DAG_CHILD_PREVIEW_CHARS = 100;
-export function cmdDag(hippoRoot, flags) {
+export function handleDag({ hippoRoot, flags }) {
     requireInit(hippoRoot);
     const entries = loadAllEntries(hippoRoot);
     const isStats = flagIsTrue(flags, 'stats');
@@ -86,7 +86,7 @@ function printDagTree(entries) {
         }
     }
 }
-async function cmdAssemble(hippoRoot, sessionId, flags) {
+async function cmdAssemble(hippoRoot, tenantId, sessionId, flags) {
     requireInit(hippoRoot);
     // Absent stays undefined so the api default applies; the 0 fallback is unreachable.
     const budget = flags['budget'] === undefined ? undefined : parseBudgetFlag(flags['budget'], 0);
@@ -95,16 +95,19 @@ async function cmdAssemble(hippoRoot, sessionId, flags) {
     const scope = stringFlag(flags, 'scope') || undefined;
     const ctx = {
         hippoRoot,
-        tenantId: resolveTenantId({}),
+        tenantId,
         actor: api.adminActor('cli:assemble'),
     };
-    const r = await api.assemble(ctx, sessionId, {
-        ...(Number.isFinite(budget) && budget > 0 ? { budget } : {}),
-        ...(Number.isFinite(freshTailCount) && freshTailCount >= 0 ? { freshTailCount } : {}),
-        summarizeOlder,
-        ...(scope !== undefined ? { scope } : {}),
-        cost: assembleCost(sessionId),
-    });
+    const opts = {};
+    if (Number.isFinite(budget) && budget > 0)
+        opts.budget = budget;
+    if (Number.isFinite(freshTailCount) && freshTailCount >= 0)
+        opts.freshTailCount = freshTailCount;
+    opts.summarizeOlder = summarizeOlder;
+    if (scope !== undefined)
+        opts.scope = scope;
+    opts.cost = assembleCost(sessionId);
+    const r = await api.assemble(ctx, sessionId, opts);
     if (flags['json']) {
         console.log(JSON.stringify(r, null, 2));
         return;
@@ -118,7 +121,7 @@ async function cmdAssemble(hippoRoot, sessionId, flags) {
         }
     })));
 }
-async function cmdDrillDown(hippoRoot, summaryId, flags) {
+async function cmdDrillDown(hippoRoot, tenantId, summaryId, flags) {
     requireInit(hippoRoot);
     const limit = numberFlag(flags, 'limit');
     // Absent stays undefined so the api default applies; the 0 fallback is unreachable.
@@ -129,21 +132,24 @@ async function cmdDrillDown(hippoRoot, summaryId, flags) {
     if (rawDepth !== undefined) {
         if (!Number.isInteger(rawDepth) || rawDepth < 1 || rawDepth > 10) {
             printError(`--depth must be an integer between 1 and 10 (got ${flags['depth']})`);
-            process.exit(2);
+            throw new CliExit(2);
         }
         depth = rawDepth;
     }
     const ctx = {
         hippoRoot,
-        tenantId: resolveTenantId({}),
+        tenantId,
         actor: api.adminActor('cli:drill'),
     };
-    const r = await api.drillDown(ctx, summaryId, {
-        ...(Number.isFinite(limit) && limit > 0 ? { limit } : {}),
-        ...(Number.isFinite(budget) && budget > 0 ? { budget } : {}),
-        ...(depth !== undefined ? { depth } : {}),
-        cost: drillCost,
-    });
+    const opts = {};
+    if (Number.isFinite(limit) && limit > 0)
+        opts.limit = limit;
+    if (Number.isFinite(budget) && budget > 0)
+        opts.budget = budget;
+    if (depth !== undefined)
+        opts.depth = depth;
+    opts.cost = drillCost;
+    const r = await api.drillDown(ctx, summaryId, opts);
     if ('failure' in r) {
         // Only `not_drillable` is caller-actionable. `not_found` collapses cross-tenant, scope-blocked
         // and missing on purpose: telling scope_blocked apart would leak that the row exists.
@@ -153,7 +159,7 @@ async function cmdDrillDown(hippoRoot, summaryId, flags) {
         else {
             printError(`No drillable summary at id=${summaryId}.`);
         }
-        process.exit(1);
+        throw new CliExit(1);
     }
     if (flags['json']) {
         console.log(JSON.stringify(r, null, 2));
@@ -166,20 +172,20 @@ async function cmdDrillDown(hippoRoot, summaryId, flags) {
         console.log(`  [L${c.dagLevel}] ${c.id} — ${c.content.slice(0, DAG_CHILD_PREVIEW_CHARS)}${c.content.length > DAG_CHILD_PREVIEW_CHARS ? '…' : ''}`);
     }
 }
-export async function handleDrill({ hippoRoot, args, flags }) {
+export async function handleDrill({ hippoRoot, tenantId, args, flags }) {
     const summaryId = args[0];
     if (!summaryId) {
         printError('Usage: hippo drill <summary-id> [--limit N] [--budget N]');
-        process.exit(1);
+        throw new CliExit(1);
     }
-    await cmdDrillDown(hippoRoot, summaryId, flags);
+    await cmdDrillDown(hippoRoot, tenantId, summaryId, flags);
 }
-export async function handleAssemble({ hippoRoot, args, flags }) {
+export async function handleAssemble({ hippoRoot, tenantId, args, flags }) {
     const sessionId = stringFlag(flags, 'session') ?? args[0];
     if (!sessionId) {
         printError('Usage: hippo assemble --session <id> [--budget N] [--fresh-tail N] [--no-summarize-older] [--json]');
-        process.exit(1);
+        throw new CliExit(1);
     }
-    await cmdAssemble(hippoRoot, sessionId, flags);
+    await cmdAssemble(hippoRoot, tenantId, sessionId, flags);
 }
 //# sourceMappingURL=dag.js.map

package/dist/cli/decisions.d.ts

@@ -1,5 +1,5 @@
-import { type CliFlags } from './flag-values.js';
-export declare function cmdPredict(hippoRoot: string, args: string[], flags: CliFlags): void;
-export declare function cmdDecide(hippoRoot: string, args: string[], flags: CliFlags): void;
-export declare function cmdIncident(hippoRoot: string, args: string[], flags: CliFlags): void;
+import { type CommandContext } from './flag-values.js';
+export declare function handlePredict({ hippoRoot, tenantId, args, flags }: CommandContext): void;
+export declare function handleDecide({ hippoRoot, tenantId, args, flags }: CommandContext): Promise<void>;
+export declare function handleIncident({ hippoRoot, tenantId, args, flags }: CommandContext): void;
 //# sourceMappingURL=decisions.d.ts.map