hippo-memory 1.70.0 → 1.71.0

package/dist/cli/init.js

@@ -13,7 +13,7 @@ import { loadAllEntries } from '../store/entry-reads.js';
 import { isGitRepo } from '../learn/autolearn.js';
 import { currentMachine, importForStore, importProjectMemories, importUserMemories } from '../agent-memories/sync.js';
 import { emptyReport, mergeReports } from '../agent-memories/report.js';
-import { getGlobalRoot, initGlobal } from '../sharing/shared.js';
+import { getGlobalRoot, initGlobal } from '../sharing/global-store.js';
 import { registerWorkspace } from './scheduler.js';
 import { stringFlag } from './flag-values.js';
 import { printAgentImport } from './print.js';
@@ -104,10 +104,7 @@ function cmdInitScan(scanDir, flags) {
     console.log(`Found ${repos.length} repositories:\n`);
     const globalRoot = initGlobalFirst();
     let totalLessons = 0;
-    // Rolled up so the cross-repo summary reports the gate too. Each repo
-    // already prints its own count inside learnFromRepo, but the aggregate
-    // line showed only what was ADDED - and the point of this change is
-    // that a dropped subject is never invisible.
+    // Rolled up so the cross-repo summary reports the gate too: a dropped subject is never invisible.
     let totalLowInfo = 0;
     const seedDays = parseInt(String(flags['days'] ?? '365'), 10);
     const machine = currentMachine();
@@ -160,7 +157,7 @@ function seedFromGitHistory(hippoRoot) {
         console.log(`   No matching commits found in git history.`);
     }
 }
-export function cmdInit(hippoRoot, flags) {
+export function handleInit({ hippoRoot, flags }) {
     // Handle --scan mode
     if (flags['scan']) {
         const scanDir = stringFlag(flags, 'scan') ?? os.homedir();
@@ -304,9 +301,7 @@ function installClaudeCodeSettingsHooks(hook) {
     }
 }
 function installOpencodeUserPlugin() {
-    // opencode uses a TS plugin, not Claude Code's JSON-hook schema.
-    // See OPENCODE_PLUGIN_SOURCE in src/hooks.ts for the plugin file
-    // content + design rationale.
+    // opencode uses a TS plugin, not Claude Code's JSON-hook schema (see OPENCODE_PLUGIN_SOURCE in src/hooks/opencode.ts).
     const result = installOpencodePlugin();
     if (result.installed) {
         console.log(`   Auto-installed hippo opencode plugin -> ${result.pluginPath}`);
@@ -328,9 +323,8 @@ function installUserLevelHooks(agents, codexHint) {
         // Checked first so init never creates ~/.codex on a machine without Codex.
         if (hook === 'codex' && isCodexPresent())
             installCodexMemoryHooks('   ');
-        // For Claude Code, also install SessionEnd+SessionStart entries in its
-        // settings.json. Keeps `hippo init` in lockstep with `hippo hook install
-        // claude-code` and `hippo setup`.
+        // For Claude Code, also install SessionEnd+SessionStart entries in settings.json, keeping `hippo init` in lockstep with
+        // `hippo hook install claude-code` and `hippo setup`.
         if (hook === 'claude-code')
             installClaudeCodeSettingsHooks(hook);
         else if (hook === 'opencode')

package/dist/cli/install-steps.js

@@ -3,7 +3,7 @@ import * as path from 'path';
 import { execFileSync, execSync } from 'child_process';
 import { installJsonHooks } from '../hooks/json-hooks.js';
 import { CODEX_TRUST_LINE } from '../hooks/shared.js';
-import { DAILY_TASK_NAME, buildDailyRunnerCommand, buildSchtasksCreateArgs, buildWindowsTaskRun, quoteInsideWindowsArg } from './scheduler.js';
+import { DAILY_TASK_NAME, buildDailyRunnerCommand, hasUnsafeRunnerPathChars, buildSchtasksCreateArgs, buildWindowsTaskRun, quoteInsideWindowsArg } from './scheduler.js';
 /** Adds hippo's two Codex hooks and says what changed; each install ends on the trust reminder, since Codex skips an untrusted hook. */
 export function installCodexMemoryHooks(indent) {
     const result = installJsonHooks('codex');
@@ -27,13 +27,7 @@ export function warnClaudeSettingsUnusable(result, indent, action = 'install') {
     console.log(`${indent}WARNING: ${result.settingsPath} is not a JSON object hippo can merge into, so it was left unchanged; fix it, then run \`hippo hook ${action} claude-code\`.`);
     return true;
 }
-/**
- * Set up a machine-level daily runner that sweeps all registered Hippo
- * workspaces.
- * Linux/macOS: writes to user crontab.
- * Windows: creates a scheduled task.
- * Skips if already installed.
- */
+/** Machine-level daily runner sweeping all registered workspaces: user crontab on Linux/macOS, a scheduled task on Windows; skips if installed. */
 /** Bound on each schtasks and crontab call, so a scheduler that never answers cannot hang `hippo init` or `hippo setup`. */
 const SCHEDULER_CALL_TIMEOUT_MS = 30_000;
 /** Node kills a child at its timeout and reports ETIMEDOUT; every other failure here means the scheduler refused or is missing. */
@@ -45,10 +39,7 @@ function warnSchedulerTimedOut(command) {
 }
 export function setupDailySchedule(globalRoot) {
     const runnerDir = path.resolve(globalRoot);
-    // Reject paths with characters that could break shell/crontab quoting
-    // (backslash is normal on Windows, only dangerous in Unix shell/crontab)
-    const unsafeChars = process.platform === 'win32' ? /["`$%\n\r]/ : /["`$\n\r\\]/;
-    if (unsafeChars.test(runnerDir)) {
+    if (hasUnsafeRunnerPathChars(runnerDir, process.platform)) {
         console.log(`   Skipping schedule: runner path contains unsafe characters.`);
         return;
     }

package/dist/cli/last-sleep.d.ts

@@ -1,7 +1,8 @@
-import { type CliFlags } from './flag-values.js';
+import { type CliFlags, type CommandContext } from './flag-values.js';
 /** The line the user sees when the last sleep failed, a spool step hit an unexpected error, or the spool holds `.bad` files; null when none did. */
 export declare function sleepProblems(logText: string, bad: number): string | null;
 /** Prints the SessionEnd sleep log on stderr, then clears it. In a hook, stdout carries only `systemMessage`,
  *  because Claude Code shows that to the user and adds any other SessionStart stdout to the model's context. */
 export declare function cmdLastSleep(hippoRoot: string, flags: CliFlags, out?: 'hook' | 'terminal'): void;
+export declare function handleLastSleep({ hippoRoot, flags }: CommandContext): void;
 //# sourceMappingURL=last-sleep.d.ts.map

package/dist/cli/last-sleep.js

@@ -67,4 +67,7 @@ export function cmdLastSleep(hippoRoot, flags, out = process.stdout.isTTY ? 'ter
         }
     }
 }
+export function handleLastSleep({ hippoRoot, flags }) {
+    return cmdLastSleep(hippoRoot, flags);
+}
 //# sourceMappingURL=last-sleep.js.map

package/dist/cli/maintenance.d.ts

@@ -1,6 +1,6 @@
 import { type EmbeddingProvider } from '../store/embeddings/provider.js';
-import { type CliFlags } from './flag-values.js';
-export declare function cmdRefine(hippoRoot: string, flags: CliFlags): Promise<void>;
-export declare function cmdDedup(hippoRoot: string, flags: CliFlags): void;
-export declare function cmdEmbed(hippoRoot: string, flags: CliFlags, given?: EmbeddingProvider): Promise<void>;
+import { type CommandContext } from './flag-values.js';
+export declare function handleRefine({ hippoRoot, tenantId, flags }: CommandContext): Promise<void>;
+export declare function handleDedup({ hippoRoot, flags }: CommandContext): void;
+export declare function handleEmbed({ hippoRoot, flags }: CommandContext, given?: EmbeddingProvider): Promise<void>;
 //# sourceMappingURL=maintenance.d.ts.map

package/dist/cli/maintenance.js

@@ -1,26 +1,26 @@
 // Store upkeep verbs: `hippo refine`, `hippo dedup` and `hippo embed`.
 import { envAnthropicApiKey } from '../util/env.js';
-import { loadAllEntries } from '../store/entry-reads.js';
+import { loadAllEntries, loadAllEntryIds } from '../store/entry-reads.js';
 import { deduplicateStore } from '../consolidate/dedupe.js';
-import { embedAll, loadEmbeddingIndex } from '../store/embeddings/index.js';
+import { embedAll } from '../store/embeddings/index.js';
 import { resolveEmbeddingProvider } from '../store/embeddings/provider.js';
-import { resetStoredParticles } from '../store/vector-writes.js';
+import { loadEmbeddingIndex, resetStoredParticles } from '../store/vector-index.js';
 import { loadConfig } from '../core/config.js';
-import { resolveTenantId } from '../store/tenant.js';
 import { refineStore } from './refine-llm.js';
 import { printError } from './output.js';
 import { boolFlag } from './flag-values.js';
 import { requireInit, resolveAuthRoot } from './shared.js';
 import { errorMessage } from '../util/log.js';
+import { CliExit } from './exit.js';
 const MAX_FAILED_SHOWN = 5;
 const MAX_PAIRS_SHOWN = 15;
 const PAIR_PREVIEW_CHARS = 90;
-export async function cmdRefine(hippoRoot, flags) {
+export async function handleRefine({ hippoRoot, tenantId, flags }) {
     requireInit(hippoRoot);
     const apiKey = envAnthropicApiKey();
     if (!apiKey) {
         printError('hippo refine needs ANTHROPIC_API_KEY in the environment.');
-        process.exit(1);
+        throw new CliExit(1);
     }
     const dryRun = boolFlag(flags, 'dry-run');
     const all = boolFlag(flags, 'all');
@@ -33,7 +33,7 @@ export async function cmdRefine(hippoRoot, flags) {
         limit,
         dryRun,
         all,
-        tenantId: resolveTenantId({}),
+        tenantId,
     });
     if (asJson) {
         console.log(JSON.stringify(result, null, 2));
@@ -50,7 +50,7 @@ export async function cmdRefine(hippoRoot, flags) {
         }
     }
 }
-export function cmdDedup(hippoRoot, flags) {
+export function handleDedup({ hippoRoot, flags }) {
     requireInit(hippoRoot);
     const dryRun = boolFlag(flags, 'dry-run');
     if (flags['threshold'] !== undefined) {
@@ -99,17 +99,13 @@ function printDedupPairs(result, dryRun) {
         console.log(`  ... and ${result.pairs.length - 15} more (run with --dry-run to see all)`);
     }
 }
-// ---------------------------------------------------------------------------
 // Embed command
-// ---------------------------------------------------------------------------
-export async function cmdEmbed(hippoRoot, flags, given) {
-    // --global mirrors resolveAuthRoot (cli.ts:6900): initGlobal() + the global
-    // root, skipping the local requireInit entirely, so this is the healing
-    // path for pre-1.27.0 global stores from a directory with no local .hippo.
+export async function handleEmbed({ hippoRoot, flags }, given) {
+    // --global mirrors resolveAuthRoot: initGlobal() + the global root, skipping the local requireInit,
+    // so it heals pre-1.27.0 global stores from a directory with no local .hippo.
     const root = resolveAuthRoot(hippoRoot, flags);
-    // --status and --reset-physics only read cached state, so they must work even
-    // when no provider key is present (e.g. embedded earlier with a key that was
-    // later removed). The provider-availability gate is deferred to the embed path.
+    // --status and --reset-physics only read cached state, so they must work with no provider key (e.g. removed after an earlier embed);
+    // the provider-availability gate is deferred to the embed path.
     if (flags['reset-physics']) {
         resetPhysics(root);
         return;
@@ -143,9 +139,8 @@ export async function cmdEmbed(hippoRoot, flags, given) {
     }
 }
 function resetPhysics(root) {
-    const entries = loadAllEntries(root);
     const embIndex = loadEmbeddingIndex(root);
-    const count = resetStoredParticles(root, entries, embIndex);
+    const count = resetStoredParticles(root, loadAllEntryIds(root), embIndex);
     console.log(`Reset physics state: ${count} particles re-initialized from embeddings.`);
 }
 function printEmbedStatus(root) {

package/dist/cli/object-verbs.js

@@ -1,12 +1,13 @@
 // The status, list, id and not-found paths the typed-object verbs (process, policy, skill, brief, note, decide, incident, predict) share.
 import { printError } from './output.js';
 import { parseListLimit, parsePositiveId, stringFlag } from './flag-values.js';
+import { CliExit } from './exit.js';
 /** The member of `states` named by `status`, or exit 1 with the message that lists every allowed value. */
 export function requireStatus(status, states) {
     const found = [...states].find((s) => s === status);
     if (found === undefined) {
         printError(`Invalid --status: "${status}". Must be one of: ${[...states, 'all'].join(' | ')}.`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     return found;
 }
@@ -32,14 +33,14 @@ export function idArgOrExit(args, usage, label, parseId = parsePositiveId) {
     const idRaw = args[1];
     if (!idRaw) {
         printError(usage);
-        process.exit(1);
+        throw new CliExit(1);
     }
     return parseId(idRaw, label);
 }
 export function foundOrExit(found, noun, id) {
     if (!found) {
         printError(`${noun} ${id} not found.`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     return found;
 }

package/dist/cli/owner-validation.d.ts

@@ -1,14 +1,5 @@
-/**
- * --owner format validation.
- *
- * Documented MEMORY_ENVELOPE.md contract: owner = `user:<id>` | `agent:<id>`
- * with id ∈ `[A-Za-z0-9_-]+`.
- *
- * Default: WARN-ONLY (log + accept) to preserve back-compat with existing
- * scripted callers passing legacy owner strings. Set `HIPPO_STRICT_OWNER=1`
- * to reject + exit. Strict mode will become the default once real auth replaces
- * the stub (see `TODOS.md` for the migration path).
- */
+/** --owner validation per MEMORY_ENVELOPE.md: `user:<id>` | `agent:<id>`, id in `[A-Za-z0-9_-]+`.
+ * Warn-only by default for legacy scripted callers; `HIPPO_STRICT_OWNER=1` rejects and exits. */
 export declare const OWNER_CONTRACT_HINT = "Must match ^(user|agent):[A-Za-z0-9_-]+$ (e.g. user:alice, agent:capture-bot).";
 export interface OwnerValidation {
     ok: boolean;
@@ -17,25 +8,11 @@ export interface OwnerValidation {
     /** Human-readable message (warn or error). Empty when ok = true. */
     message: string;
 }
-/**
- * Pure validator. Returns `{ ok, value, message }`. Does NOT print or
- * `process.exit`. The CLI wrapper below handles side effects so this is
- * unit-testable.
- *
- * Behaviour:
- *   - owner undefined → ok=true, value=undefined, no message.
- *   - owner matches OWNER_RE → ok=true, value=owner.
- *   - owner doesn't match + strict=false → ok=true, value=owner (accept),
- *     message contains the warning text.
- *   - owner doesn't match + strict=true → ok=false, value=owner (echoed),
- *     message contains the error text.
- */
+/** Pure validator returning `{ ok, value, message }`; never prints or exits, so it is unit-testable.
+ * A non-matching owner is accepted with a warning unless strict, where ok=false with an error message. */
 export declare function validateOwner(owner: string | null | undefined, opts?: {
     strict?: boolean;
 }): OwnerValidation;
-/**
- * Returns true when strict-owner enforcement is enabled via env var.
- * Centralised here so any future bump to default-strict is one edit.
- */
+/** True when strict-owner enforcement is enabled via env var. */
 export declare function isStrictOwnerEnv(env?: NodeJS.ProcessEnv): boolean;
 //# sourceMappingURL=owner-validation.d.ts.map

package/dist/cli/owner-validation.js

@@ -1,30 +1,10 @@
-/**
- * --owner format validation.
- *
- * Documented MEMORY_ENVELOPE.md contract: owner = `user:<id>` | `agent:<id>`
- * with id ∈ `[A-Za-z0-9_-]+`.
- *
- * Default: WARN-ONLY (log + accept) to preserve back-compat with existing
- * scripted callers passing legacy owner strings. Set `HIPPO_STRICT_OWNER=1`
- * to reject + exit. Strict mode will become the default once real auth replaces
- * the stub (see `TODOS.md` for the migration path).
- */
+/** --owner validation per MEMORY_ENVELOPE.md: `user:<id>` | `agent:<id>`, id in `[A-Za-z0-9_-]+`.
+ * Warn-only by default for legacy scripted callers; `HIPPO_STRICT_OWNER=1` rejects and exits. */
 import { processEnv } from '../util/env.js';
 const OWNER_RE = /^(user|agent):[A-Za-z0-9_-]+$/;
 export const OWNER_CONTRACT_HINT = 'Must match ^(user|agent):[A-Za-z0-9_-]+$ (e.g. user:alice, agent:capture-bot).';
-/**
- * Pure validator. Returns `{ ok, value, message }`. Does NOT print or
- * `process.exit`. The CLI wrapper below handles side effects so this is
- * unit-testable.
- *
- * Behaviour:
- *   - owner undefined → ok=true, value=undefined, no message.
- *   - owner matches OWNER_RE → ok=true, value=owner.
- *   - owner doesn't match + strict=false → ok=true, value=owner (accept),
- *     message contains the warning text.
- *   - owner doesn't match + strict=true → ok=false, value=owner (echoed),
- *     message contains the error text.
- */
+/** Pure validator returning `{ ok, value, message }`; never prints or exits, so it is unit-testable.
+ * A non-matching owner is accepted with a warning unless strict, where ok=false with an error message. */
 export function validateOwner(owner, opts = {}) {
     if (owner === undefined || owner === null || owner === '') {
         return { ok: true, value: undefined, message: '' };
@@ -46,10 +26,7 @@ export function validateOwner(owner, opts = {}) {
             `Accepting for back-compat; set HIPPO_STRICT_OWNER=1 to reject.`,
     };
 }
-/**
- * Returns true when strict-owner enforcement is enabled via env var.
- * Centralised here so any future bump to default-strict is one edit.
- */
+/** True when strict-owner enforcement is enabled via env var. */
 export function isStrictOwnerEnv(env = processEnv()) {
     return env.HIPPO_STRICT_OWNER === '1';
 }

package/dist/cli/playbooks.d.ts

@@ -1,5 +1,5 @@
-import { type CliFlags } from './flag-values.js';
-export declare function cmdProcess(hippoRoot: string, args: string[], flags: CliFlags): void;
-export declare function cmdPolicy(hippoRoot: string, args: string[], flags: CliFlags): void;
-export declare function cmdSkill(hippoRoot: string, args: string[], flags: CliFlags): void;
+import { type CommandContext } from './flag-values.js';
+export declare function handleProcess({ hippoRoot, tenantId, args, flags }: CommandContext): void;
+export declare function handlePolicy({ hippoRoot, tenantId, args, flags }: CommandContext): void;
+export declare function handleSkill({ hippoRoot, tenantId, args, flags }: CommandContext): void;
 //# sourceMappingURL=playbooks.d.ts.map

package/dist/cli/playbooks.js

@@ -3,12 +3,12 @@ import { extractPathTags } from '../search/path-context.js';
 import * as processesModule from '../objects/processes.js';
 import * as policiesModule from '../objects/policies.js';
 import * as skillsModule from '../objects/skills.js';
-import { resolveTenantId } from '../store/tenant.js';
 import { printError } from './output.js';
-import { nonEmptyStringFlag, stringFlag } from './flag-values.js';
+import { isStringFlag, nonEmptyStringFlag, stringFlag } from './flag-values.js';
 import { requireInit } from './shared.js';
 import { closeObject, foundOrExit, idArgOrExit, listObjects, printLifecycleTail } from './object-verbs.js';
 import { errorMessage } from '../util/log.js';
+import { CliExit } from './exit.js';
 const PROCESS = { cmd: 'process', noun: 'Process', idLabel: 'process' };
 const POLICY = { cmd: 'policy', noun: 'Policy', idLabel: 'policy' };
 const SKILL = { cmd: 'skill', noun: 'Skill', idLabel: 'skill' };
@@ -17,11 +17,11 @@ const SKILL = { cmd: 'skill', noun: 'Skill', idLabel: 'skill' };
 function collectProcessSteps(stepRaw) {
     if (Array.isArray(stepRaw))
         return stepRaw;
-    if (typeof stepRaw === 'string')
+    if (isStringFlag(stepRaw))
         return [stepRaw];
     if (stepRaw === true) {
         printError('--step requires a value, e.g. hippo process new "<name>" --step "do X".');
-        process.exit(1);
+        throw new CliExit(1);
     }
     return [];
 }
@@ -59,11 +59,10 @@ function processSupersede(hippoRoot, tenantId, args, flags) {
     const steps = collectProcessSteps(flags['step']);
     if (steps.length === 0) {
         printError('hippo process supersede requires at least one --step "<text>" for the new version.');
-        process.exit(1);
+        throw new CliExit(1);
     }
-    // A supersession is a new version of the SAME process, so the new row reuses the predecessor's name (stable identity
-    // across versions). loadProcessById gives an early not-found before the write; saveProcess's in-SAVEPOINT preflight
-    // is the authoritative active-state check.
+    // A supersession is a new version of the SAME process, so the new row reuses the predecessor's name; loadProcessById gives an early not-found,
+    // and saveProcess's in-SAVEPOINT preflight is the authoritative active-state check.
     const existing = foundOrExit(processesModule.loadProcessById(hippoRoot, tenantId, id), PROCESS.noun, id);
     const changeSummary = nonEmptyStringFlag(flags, 'change');
     const description = nonEmptyStringFlag(flags, 'description');
@@ -83,9 +82,8 @@ function processSupersede(hippoRoot, tenantId, args, flags) {
 function processClose(hippoRoot, tenantId, args) {
     closeObject(args, PROCESS, (id) => processesModule.closeProcess(hippoRoot, tenantId, id));
 }
-export function cmdProcess(hippoRoot, args, flags) {
+export function handleProcess({ hippoRoot, tenantId, args, flags }) {
     requireInit(hippoRoot);
-    const tenantId = resolveTenantId({});
     const subcommand = args[0] ?? '';
     if (subcommand === 'list')
         return processList(hippoRoot, tenantId, flags);
@@ -95,9 +93,8 @@ export function cmdProcess(hippoRoot, args, flags) {
         return processSupersede(hippoRoot, tenantId, args, flags);
     if (subcommand === 'close')
         return processClose(hippoRoot, tenantId, args);
-    // Default subcommand: new (create). Accept both the documented
-    // `process new "<name>"` form and the bare `process "<name>"` form: for the
-    // `new` keyword the name is args[1], otherwise args[0] IS the name.
+    // Default subcommand is new (create): accept both `process new "<name>"` and bare `process "<name>"`;
+    // for the `new` keyword the name is args[1], otherwise args[0] is the name.
     processCreate(hippoRoot, tenantId, subcommand === 'new' ? (args[1] ?? '') : subcommand, flags);
 }
 function processCreate(hippoRoot, tenantId, processName, flags) {
@@ -107,7 +104,7 @@ function processCreate(hippoRoot, tenantId, processName, flags) {
         printError('       hippo process get <id>');
         printError('       hippo process supersede <id> --step "<text>" [--change "<summary>"]');
         printError('       hippo process close <id>');
-        process.exit(1);
+        throw new CliExit(1);
     }
     const steps = collectProcessSteps(flags['step']);
     const description = nonEmptyStringFlag(flags, 'description');
@@ -141,7 +138,7 @@ function policyAsOf(hippoRoot, tenantId, args, flags) {
     const dateRaw = args[1];
     if (!dateRaw) {
         printError('Usage: hippo policy asof <iso-date> [--name "<policy>"]');
-        process.exit(1);
+        throw new CliExit(1);
     }
     const name = nonEmptyStringFlag(flags, 'name');
     let results;
@@ -150,7 +147,7 @@ function policyAsOf(hippoRoot, tenantId, args, flags) {
     }
     catch (e) {
         printError(errorMessage(e));
-        process.exit(1);
+        throw new CliExit(1);
     }
     if (results.length === 0) {
         console.log(`No active policies in force at ${dateRaw}${name ? ` for "${name}"` : ''}.`);
@@ -177,7 +174,7 @@ function policySupersede(hippoRoot, tenantId, args, flags) {
     const textRaw = stringFlag(flags, 'text');
     if (!textRaw?.trim()) {
         printError('hippo policy supersede requires --text "<rule>" for the new version.');
-        process.exit(1);
+        throw new CliExit(1);
     }
     const existing = foundOrExit(policiesModule.loadPolicyById(hippoRoot, tenantId, id), POLICY.noun, id);
     try {
@@ -196,15 +193,14 @@ function policySupersede(hippoRoot, tenantId, args, flags) {
     }
     catch (e) {
         printError(errorMessage(e));
-        process.exit(1);
+        throw new CliExit(1);
     }
 }
 function policyClose(hippoRoot, tenantId, args) {
     closeObject(args, POLICY, (id) => policiesModule.closePolicy(hippoRoot, tenantId, id));
 }
-export function cmdPolicy(hippoRoot, args, flags) {
+export function handlePolicy({ hippoRoot, tenantId, args, flags }) {
     requireInit(hippoRoot);
-    const tenantId = resolveTenantId({});
     const subcommand = args[0] ?? '';
     if (subcommand === 'list')
         return policyList(hippoRoot, tenantId, flags);
@@ -231,7 +227,7 @@ function policyCreate(hippoRoot, tenantId, args, flags) {
         printError('       hippo policy asof <iso-date> [--name "<policy>"]');
         printError('       hippo policy supersede <id> --text "<rule>" [--from] [--to] [--change "<summary>"]');
         printError('       hippo policy close <id>');
-        process.exit(1);
+        throw new CliExit(1);
     }
     try {
         const created = policiesModule.savePolicy(hippoRoot, tenantId, {
@@ -248,7 +244,7 @@ function policyCreate(hippoRoot, tenantId, args, flags) {
     }
     catch (e) {
         printError(errorMessage(e));
-        process.exit(1);
+        throw new CliExit(1);
     }
 }
 function printSkillRow(s) {
@@ -291,7 +287,7 @@ function skillSupersede(hippoRoot, tenantId, args, flags) {
     const instrRaw = stringFlag(flags, 'instructions');
     if (!instrRaw?.trim()) {
         printError('hippo skill supersede requires --instructions "<text>" for the new version.');
-        process.exit(1);
+        throw new CliExit(1);
     }
     const existing = foundOrExit(skillsModule.loadSkillById(hippoRoot, tenantId, id), SKILL.noun, id);
     try {
@@ -309,15 +305,14 @@ function skillSupersede(hippoRoot, tenantId, args, flags) {
     }
     catch (e) {
         printError(errorMessage(e));
-        process.exit(1);
+        throw new CliExit(1);
     }
 }
 function skillClose(hippoRoot, tenantId, args) {
     closeObject(args, SKILL, (id) => skillsModule.closeSkill(hippoRoot, tenantId, id));
 }
-export function cmdSkill(hippoRoot, args, flags) {
+export function handleSkill({ hippoRoot, tenantId, args, flags }) {
     requireInit(hippoRoot);
-    const tenantId = resolveTenantId({});
     const subcommand = args[0] ?? '';
     if (subcommand === 'list')
         return skillList(hippoRoot, tenantId, flags);
@@ -344,7 +339,7 @@ function skillCreate(hippoRoot, tenantId, args, flags) {
         printError('       hippo skill export   (render active skills as an AGENTS.md/CLAUDE.md block)');
         printError('       hippo skill supersede <id> --instructions "<text>" [--trigger] [--change "<summary>"]');
         printError('       hippo skill close <id>');
-        process.exit(1);
+        throw new CliExit(1);
     }
     try {
         const created = skillsModule.saveSkill(hippoRoot, tenantId, {
@@ -359,7 +354,7 @@ function skillCreate(hippoRoot, tenantId, args, flags) {
     }
     catch (e) {
         printError(errorMessage(e));
-        process.exit(1);
+        throw new CliExit(1);
     }
 }
 //# sourceMappingURL=playbooks.js.map

package/dist/cli/print.d.ts

@@ -1,4 +1,4 @@
-import { TaskSnapshot, SessionEvent } from '../store/rows.js';
+import type { TaskSnapshot, SessionEvent } from '../store/rows.js';
 import type { SessionHandoff } from '../core/handoff.js';
 import type { SearchResult } from '../core/search-types.js';
 import { type ImportReport } from '../agent-memories/report.js';
@@ -10,9 +10,6 @@ export declare function printAgentImport(report: ImportReport, indent?: string):
 export declare function printActiveTaskSnapshot(snapshot: TaskSnapshot): void;
 export declare function printSessionEvents(events: SessionEvent[]): void;
 export declare function printHandoff(handoff: SessionHandoff): void;
-/**
- * Run `fn` with console.log captured; returns the captured lines joined by
- * newlines (what the same calls would have printed, minus the final newline).
- */
+/** Run `fn` with console.log captured; returns the captured lines joined by newlines (no final newline). */
 export declare function captureConsole(fn: () => void): string;
 //# sourceMappingURL=print.d.ts.map

package/dist/cli/print.js

@@ -66,10 +66,7 @@ export function printSessionEvents(events) {
 export function printHandoff(handoff) {
     console.log(handoffText(handoff));
 }
-/**
- * Run `fn` with console.log captured; returns the captured lines joined by
- * newlines (what the same calls would have printed, minus the final newline).
- */
+/** Run `fn` with console.log captured; returns the captured lines joined by newlines (no final newline). */
 export function captureConsole(fn) {
     const lines = [];
     const realLog = console.log;

package/dist/cli/projects.d.ts

@@ -1,3 +1,3 @@
-import { type CliFlags } from './flag-values.js';
-export declare function cmdProjects(hippoRoot: string, args: string[], flags: CliFlags): void;
+import { type CommandContext } from './flag-values.js';
+export declare function handleProjects({ hippoRoot, tenantId, args, flags }: CommandContext): void;
 //# sourceMappingURL=projects.d.ts.map

package/dist/cli/projects.js

@@ -3,7 +3,6 @@ import * as path from 'path';
 import { execFileSync } from 'child_process';
 import { closeHippoDb, openHippoDb } from '../db/index.js';
 import { listProjects, mergeProjects, repairProjects } from '../sharing/project-merge.js';
-import { resolveTenantId } from '../store/tenant.js';
 import { flagIsTrue } from './flag-values.js';
 import { resolveAuthRoot } from './shared.js';
 import { printError } from './output.js';
@@ -76,9 +75,8 @@ function projectsRepair(db, tenantId, root, flags) {
     console.log(`  ${r.untraced.length} left as they are (no parent left to show which project; check them with hippo inspect <id>)`);
     console.log(apply ? `Backup: ${r.backup}\nEvery id is in the audit log: hippo audit list --op project_repair` : 'Nothing written. Add --apply to run it.');
 }
-export function cmdProjects(hippoRoot, args, flags) {
+export function handleProjects({ hippoRoot, tenantId, args, flags }) {
     const root = resolveAuthRoot(hippoRoot, flags);
-    const tenantId = resolveTenantId({});
     const sub = args[0] ?? 'list';
     const db = openHippoDb(root);
     try {

package/dist/cli/provenance-coverage.d.ts

@@ -8,11 +8,7 @@ export interface ProvenanceCoverage {
         missing: ('owner' | 'artifact_ref')[];
     }>;
 }
-/**
- * Provenance coverage gate: every `kind='raw'` row must carry both `owner`
- * and `artifact_ref`. Distilled / superseded / archived rows are excluded —
- * those are derivative or terminal, not source receipts. Coverage of 1.0 on
- * a non-empty raw set is the ship gate from the Company Brain scorecard.
- */
+/** Provenance coverage gate: every `kind='raw'` row must carry `owner` and `artifact_ref`; derivative or terminal rows are excluded.
+ * Coverage 1.0 on a non-empty raw set is the ship gate. */
 export declare function buildProvenanceCoverage(entries: MemoryEntry[]): ProvenanceCoverage;
 //# sourceMappingURL=provenance-coverage.d.ts.map

package/dist/cli/provenance-coverage.js

@@ -1,9 +1,5 @@
-/**
- * Provenance coverage gate: every `kind='raw'` row must carry both `owner`
- * and `artifact_ref`. Distilled / superseded / archived rows are excluded —
- * those are derivative or terminal, not source receipts. Coverage of 1.0 on
- * a non-empty raw set is the ship gate from the Company Brain scorecard.
- */
+/** Provenance coverage gate: every `kind='raw'` row must carry `owner` and `artifact_ref`; derivative or terminal rows are excluded.
+ * Coverage 1.0 on a non-empty raw set is the ship gate. */
 export function buildProvenanceCoverage(entries) {
     const raws = entries.filter((e) => e.kind === 'raw');
     const gaps = [];

package/dist/cli/quality-repair-once.js

@@ -1,8 +1,8 @@
 // Sleep and the daily runner clean a store's old automatic memories once, so an upgrade needs no command.
 import * as path from 'path';
 import { errorMessage, log } from '../util/log.js';
-import { repairQualityOnce } from './quality-repair.js';
-import { getGlobalRoot } from '../sharing/shared.js';
+import { repairQualityOnce } from '../store/quality-repair.js';
+import { getGlobalRoot } from '../sharing/global-store.js';
 import { resolveTenantId } from '../store/tenant.js';
 /** Fault-isolated like the project tag repair: a failure warns, leaves the store unmarked and runs again next time. */
 export function repairQualityOnceAt(root) {

package/dist/cli/recall.d.ts

@@ -1,5 +1,3 @@
-import { type CliFlags, type CommandContext } from './flag-values.js';
-/** Runs `hippo recall`: the flags name the ranking core and this verb's presenter, `retrieve` ranks and records, then the block prints. */
-export declare function cmdRecall(hippoRoot: string, query: string, flags: CliFlags): Promise<void>;
-export declare function handleRecall({ hippoRoot, args, flags }: CommandContext): Promise<void>;
+import { type CommandContext } from './flag-values.js';
+export declare function handleRecall({ hippoRoot, tenantId, args, flags }: CommandContext): Promise<void>;
 //# sourceMappingURL=recall.d.ts.map