hippo-memory 1.70.0 → 1.71.0

package/dist/cli/briefs.js

@@ -6,12 +6,12 @@ import * as briefsModule from '../objects/project-briefs.js';
 import * as customerNotesModule from '../objects/customer-notes.js';
 import { extractGraph } from '../graph/extract.js';
 import { buildGraphModel, renderGraphHtml, renderGraphCanvas, DEFAULT_VIEW_LIMIT } from '../graph/view.js';
-import { resolveTenantId } from '../store/tenant.js';
 import { errorMessage, log } from '../util/log.js';
 import { printError } from './output.js';
 import { nonEmptyStringFlag, boolFlag, stringFlag } from './flag-values.js';
 import { requireInit } from './shared.js';
 import { closeObject, foundOrExit, idArgOrExit, listObjects, printLifecycleTail } from './object-verbs.js';
+import { CliExit } from './exit.js';
 const BRIEF = { cmd: 'brief', noun: 'Project brief', idLabel: 'brief' };
 const NOTE = { cmd: 'note', noun: 'Customer note', idLabel: 'note' };
 function printBriefRow(b) {
@@ -40,7 +40,7 @@ function briefRefresh(hippoRoot, tenantId, args, flags) {
     const repoRaw = args[1];
     if (!repoRaw) {
         printError('Usage: hippo brief refresh "<repo>" [--dry-run]');
-        process.exit(1);
+        throw new CliExit(1);
     }
     const dryRun = boolFlag(flags, 'dry-run');
     try {
@@ -59,7 +59,7 @@ function briefRefresh(hippoRoot, tenantId, args, flags) {
     }
     catch (e) {
         printError(errorMessage(e));
-        process.exit(1);
+        throw new CliExit(1);
     }
 }
 function briefGet(hippoRoot, tenantId, args) {
@@ -77,7 +77,7 @@ function briefSupersede(hippoRoot, tenantId, args, flags) {
     const summaryRaw = stringFlag(flags, 'summary');
     if (!summaryRaw?.trim()) {
         printError('hippo brief supersede requires --summary "<text>" for the new version.');
-        process.exit(1);
+        throw new CliExit(1);
     }
     const existing = foundOrExit(briefsModule.loadProjectBriefById(hippoRoot, tenantId, id), BRIEF.noun, id);
     try {
@@ -94,7 +94,7 @@ function briefSupersede(hippoRoot, tenantId, args, flags) {
     }
     catch (e) {
         printError(errorMessage(e));
-        process.exit(1);
+        throw new CliExit(1);
     }
 }
 function briefClose(hippoRoot, tenantId, args) {
@@ -108,7 +108,7 @@ function briefCreate(hippoRoot, tenantId, args, flags) {
     const summaryRaw = stringFlag(flags, 'summary');
     if (!repo || !summaryRaw?.trim()) {
         briefUsage();
-        process.exit(1);
+        throw new CliExit(1);
     }
     try {
         const created = briefsModule.saveProjectBrief(hippoRoot, tenantId, {
@@ -122,12 +122,11 @@ function briefCreate(hippoRoot, tenantId, args, flags) {
     }
     catch (e) {
         printError(errorMessage(e));
-        process.exit(1);
+        throw new CliExit(1);
     }
 }
-export function cmdProjectBrief(hippoRoot, args, flags) {
+export function handleProjectBrief({ hippoRoot, tenantId, args, flags }) {
     requireInit(hippoRoot);
-    const tenantId = resolveTenantId({});
     const subcommand = args[0] ?? '';
     if (subcommand === 'list')
         return briefList(hippoRoot, tenantId, flags);
@@ -203,9 +202,8 @@ function openInBrowser(out) {
                 ? ['open', [out]]
                 : ['xdg-open', [out]];
         const child = spawn(cmd, cmdArgs, { detached: true, stdio: 'ignore', windowsHide: true });
-        // A missing launcher (e.g. xdg-open absent) emits 'error' asynchronously;
-        // an unhandled 'error' event would throw, so swallow it — the file is
-        // already written and its path printed above.
+        // A missing launcher (e.g. xdg-open absent) emits 'error' asynchronously; unhandled, it would throw,
+        // so swallow it: the file is already written and its path printed above.
         child.on('error', () => { });
         child.unref();
     }
@@ -218,7 +216,7 @@ function graphView(hippoRoot, tenantId, entity, flags) {
     const format = stringFlag(flags, 'format') ?? 'html';
     if (format !== 'html' && format !== 'canvas') {
         printError("graph view: --format must be 'html' or 'canvas'");
-        process.exit(1);
+        throw new CliExit(1);
     }
     const model = buildGraphModel(hippoRoot, tenantId, { entity, limit: DEFAULT_VIEW_LIMIT });
     const content = format === 'canvas' ? renderGraphCanvas(model) : renderGraphHtml(model);
@@ -229,9 +227,8 @@ function graphView(hippoRoot, tenantId, entity, flags) {
     if (flags['open'] && format === 'html')
         openInBrowser(out);
 }
-export function cmdGraph(hippoRoot, args, flags) {
+export function handleGraph({ hippoRoot, tenantId, args, flags }) {
     requireInit(hippoRoot);
-    const tenantId = resolveTenantId({});
     const subcommand = args[0] ?? '';
     if (subcommand === 'extract')
         return graphExtract(hippoRoot, tenantId);
@@ -244,7 +241,7 @@ export function cmdGraph(hippoRoot, args, flags) {
         '  hippo graph extract                     Rebuild the entity/relation graph from consolidated objects\n' +
         '  hippo graph show [--entity NAME] [--json]   Inspect entities + their edges (text or JSON)\n' +
         '  hippo graph view [--out FILE] [--open] [--format html|canvas] [--entity NAME]   Generate an interactive node-link diagram');
-    process.exit(1);
+    throw new CliExit(1);
 }
 function noteList(hippoRoot, tenantId, flags) {
     const customer = stringFlag(flags, 'customer')?.trim() || undefined;
@@ -270,7 +267,7 @@ function noteSupersede(hippoRoot, tenantId, args, flags) {
     const textRaw = stringFlag(flags, 'text');
     if (!textRaw?.trim()) {
         printError('hippo note supersede requires --text "<note>" for the new version.');
-        process.exit(1);
+        throw new CliExit(1);
     }
     const existing = foundOrExit(customerNotesModule.loadCustomerNoteById(hippoRoot, tenantId, id), NOTE.noun, id);
     try {
@@ -287,15 +284,14 @@ function noteSupersede(hippoRoot, tenantId, args, flags) {
     }
     catch (e) {
         printError(errorMessage(e));
-        process.exit(1);
+        throw new CliExit(1);
     }
 }
 function noteClose(hippoRoot, tenantId, args) {
     closeObject(args, NOTE, (id) => customerNotesModule.closeCustomerNote(hippoRoot, tenantId, id));
 }
-export function cmdCustomerNote(hippoRoot, args, flags) {
+export function handleCustomerNote({ hippoRoot, tenantId, args, flags }) {
     requireInit(hippoRoot);
-    const tenantId = resolveTenantId({});
     const subcommand = args[0] ?? '';
     if (subcommand === 'list')
         return noteList(hippoRoot, tenantId, flags);
@@ -311,7 +307,7 @@ export function cmdCustomerNote(hippoRoot, args, flags) {
     const textRaw = stringFlag(flags, 'text');
     if (!customer || !textRaw?.trim()) {
         noteUsage();
-        process.exit(1);
+        throw new CliExit(1);
     }
     try {
         const created = customerNotesModule.saveCustomerNote(hippoRoot, tenantId, {
@@ -325,7 +321,7 @@ export function cmdCustomerNote(hippoRoot, args, flags) {
     }
     catch (e) {
         printError(errorMessage(e));
-        process.exit(1);
+        throw new CliExit(1);
     }
 }
 //# sourceMappingURL=briefs.js.map

package/dist/cli/card.d.ts

@@ -1,4 +1,4 @@
-import { type CliFlags } from './flag-values.js';
+import { type CommandContext } from './flag-values.js';
 /** Runs `hippo card <subcommand>`: rejects flags the subcommand never reads, then hands off to its handler. */
-export declare function cmdCard(hippoRoot: string, args: string[], flags: CliFlags): void;
+export declare function handleCard({ hippoRoot, tenantId, args, flags }: CommandContext): void;
 //# sourceMappingURL=card.d.ts.map

package/dist/cli/card.js

@@ -3,11 +3,11 @@ import { createCard, loadCard, listCards, loadCardRuns, claimCard, heartbeatCard
 import { isHandoffOutcome } from '../core/handoff.js';
 import { isCardStatus } from '../core/card.js';
 import { loadCardDetail } from '../store/card-detail.js';
-import { resolveTenantId } from '../store/tenant.js';
 import { printError } from './output.js';
 import { stringFlagOrExit } from './flag-values.js';
 import { requireInit } from './shared.js';
 import { errorMessage } from '../util/log.js';
+import { CliExit } from './exit.js';
 // Mirrors ARCHIVE_REASON_REQUIRED so the block message can't drift from its usage line.
 const CARD_BLOCK_REASON_REQUIRED = 'hippo card block <id> requires --reason "<why>" (recorded as a comment).';
 function printCard(detail) {
@@ -59,7 +59,7 @@ function cardRunFlag(flags) {
     const n = Number(raw);
     if (!/^\d+$/.test(raw) || !Number.isSafeInteger(n) || n <= 0) {
         printError(`Invalid --run: "${raw}" (expected a positive integer).`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     return n;
 }
@@ -82,13 +82,12 @@ const CARD_SUBCOMMAND_FLAGS = {
     comment: ['body', 'author'],
 };
 /** Runs `hippo card <subcommand>`: rejects flags the subcommand never reads, then hands off to its handler. */
-export function cmdCard(hippoRoot, args, flags) {
+export function handleCard({ hippoRoot, tenantId, args, flags }) {
     requireInit(hippoRoot);
-    const tenantId = resolveTenantId({});
     const subcommand = args[0] ?? '';
     if (!Object.hasOwn(CARD_SUBCOMMAND_FLAGS, subcommand)) {
         printError('Usage: hippo card <create|show|list|claim|heartbeat|block|review|complete|reclaim|comment>');
-        process.exit(1);
+        throw new CliExit(1);
     }
     // SAFETY: hasOwn, unlike `in`, skips inherited keys such as constructor, so subcommand is a real key.
     const known = subcommand;
@@ -97,7 +96,7 @@ export function cmdCard(hippoRoot, args, flags) {
         if (!allowedFlags.includes(key)) {
             const valid = allowedFlags.length > 0 ? allowedFlags.map((f) => `--${f}`).join(', ') : '(none)';
             printError(`Unknown flag --${key} for hippo card ${subcommand}. Valid flags: ${valid}`);
-            process.exit(1);
+            throw new CliExit(1);
         }
     }
     CARD_HANDLERS[known](hippoRoot, tenantId, args, flags);
@@ -106,7 +105,7 @@ function cardCreate(hippoRoot, tenantId, _args, flags) {
     const title = stringFlagOrExit(flags, 'title') ?? '';
     if (!title) {
         printError('Usage: hippo card create --title "..." [--repo <name>] [--contract <text>] [--budget <n>] [--depends-on <id>...]');
-        process.exit(1);
+        throw new CliExit(1);
     }
     const repo = stringFlagOrExit(flags, 'repo') || undefined;
     const contract = stringFlagOrExit(flags, 'contract') || undefined;
@@ -115,14 +114,14 @@ function cardCreate(hippoRoot, tenantId, _args, flags) {
     if (budgetRaw !== undefined) {
         if (!/^\d+$/.test(budgetRaw)) {
             printError(`Invalid budget: "${budgetRaw}" (expected a positive integer)`);
-            process.exit(1);
+            throw new CliExit(1);
         }
         budget = Number(budgetRaw);
     }
     const dependsOnFlag = flags['depends-on'];
     if (dependsOnFlag === true) {
         printError('--depends-on requires a value');
-        process.exit(1);
+        throw new CliExit(1);
     }
     const dependsOn = Array.isArray(dependsOnFlag) ? dependsOnFlag : [];
     let card;
@@ -131,7 +130,7 @@ function cardCreate(hippoRoot, tenantId, _args, flags) {
     }
     catch (error) {
         printError(errorMessage(error));
-        process.exit(1);
+        throw new CliExit(1);
     }
     console.log(`Created card ${card.id} (status: ${card.status})`);
 }
@@ -139,12 +138,12 @@ function cardShow(hippoRoot, tenantId, args, flags) {
     const id = args[1];
     if (!id) {
         printError('Usage: hippo card show <id> [--json]');
-        process.exit(1);
+        throw new CliExit(1);
     }
     const detail = loadCardDetail(hippoRoot, tenantId, id);
     if (!detail) {
         printError(`No card found with id ${id}.`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     if (flags['json']) {
         console.log(JSON.stringify(detail, null, 2));
@@ -156,7 +155,7 @@ function cardList(hippoRoot, tenantId, _args, flags) {
     const status = stringFlagOrExit(flags, 'status');
     if (status !== undefined && !isCardStatus(status)) {
         printError(`Invalid status: "${status}".`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     const cards = listCards(hippoRoot, tenantId, { status });
     if (flags['json']) {
@@ -176,7 +175,7 @@ function cardClaim(hippoRoot, tenantId, args, flags) {
     const runtime = stringFlagOrExit(flags, 'runtime') ?? '';
     if (!id || !runtime) {
         printError('Usage: hippo card claim <id> --runtime <name> [--session <id>]');
-        process.exit(1);
+        throw new CliExit(1);
     }
     const sessionId = stringFlagOrExit(flags, 'session') || undefined;
     let card;
@@ -185,11 +184,11 @@ function cardClaim(hippoRoot, tenantId, args, flags) {
     }
     catch (error) {
         printError(errorMessage(error));
-        process.exit(1);
+        throw new CliExit(1);
     }
     if (!card) {
         printError(`Could not claim card ${id} (not ready/blocked, or already claimed).`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     console.log(`Claimed card ${card.id} for ${runtime} (run ${card.runId}, lease until ${card.leaseUntil})`);
 }
@@ -198,7 +197,7 @@ function cardHeartbeat(hippoRoot, tenantId, args, flags) {
     const runId = cardRunFlag(flags);
     if (!id || runId === undefined) {
         printError('Usage: hippo card heartbeat <id> --run <n>');
-        process.exit(1);
+        throw new CliExit(1);
     }
     let card;
     try {
@@ -206,11 +205,11 @@ function cardHeartbeat(hippoRoot, tenantId, args, flags) {
     }
     catch (error) {
         printError(errorMessage(error));
-        process.exit(1);
+        throw new CliExit(1);
     }
     if (!card) {
         printError(`Could not heartbeat card ${id} (${cardRefusal(hippoRoot, tenantId, id)}).`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     console.log(`Heartbeat card ${card.id}: lease until ${card.leaseUntil}`);
 }
@@ -219,7 +218,7 @@ function cardBlock(hippoRoot, tenantId, args, flags) {
     const reason = stringFlagOrExit(flags, 'reason') ?? '';
     if (!id || !reason) {
         printError(CARD_BLOCK_REASON_REQUIRED);
-        process.exit(1);
+        throw new CliExit(1);
     }
     const runId = cardRunFlag(flags);
     let card;
@@ -228,12 +227,12 @@ function cardBlock(hippoRoot, tenantId, args, flags) {
     }
     catch (error) {
         printError(errorMessage(error));
-        process.exit(1);
+        throw new CliExit(1);
     }
     if (!card) {
         const why = runId === undefined ? 'not running' : cardRefusal(hippoRoot, tenantId, id);
         printError(`Could not block card ${id} (${why}).`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     console.log(`Blocked card ${card.id}`);
 }
@@ -241,7 +240,7 @@ function cardReview(hippoRoot, tenantId, args, flags) {
     const id = args[1];
     if (!id) {
         printError('Usage: hippo card review <id> [--run <n>]');
-        process.exit(1);
+        throw new CliExit(1);
     }
     const runId = cardRunFlag(flags);
     let card;
@@ -250,12 +249,12 @@ function cardReview(hippoRoot, tenantId, args, flags) {
     }
     catch (error) {
         printError(errorMessage(error));
-        process.exit(1);
+        throw new CliExit(1);
     }
     if (!card) {
         const why = runId === undefined ? 'not running' : cardRefusal(hippoRoot, tenantId, id);
         printError(`Could not move card ${id} to review (${why}).`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     console.log(`Card ${card.id} moved to review`);
 }
@@ -264,7 +263,7 @@ function cardComplete(hippoRoot, tenantId, args, flags) {
     const outcomeRaw = flags['outcome'];
     if (!id || !isHandoffOutcome(outcomeRaw)) {
         printError('Usage: hippo card complete <id> --outcome <success|failure|partial> [--run <n>]');
-        process.exit(1);
+        throw new CliExit(1);
     }
     const runId = cardRunFlag(flags);
     let result;
@@ -273,12 +272,12 @@ function cardComplete(hippoRoot, tenantId, args, flags) {
     }
     catch (error) {
         printError(errorMessage(error));
-        process.exit(1);
+        throw new CliExit(1);
     }
     if (!result) {
         const why = runId === undefined ? 'not in review' : cardRefusal(hippoRoot, tenantId, id);
         printError(`Could not complete card ${id} (${why}).`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     console.log(`Completed card ${result.card.id} (status: ${result.card.status})`);
     if (result.promotedChildren.length > 0) {
@@ -288,7 +287,7 @@ function cardComplete(hippoRoot, tenantId, args, flags) {
 function cardReclaim(hippoRoot, tenantId, args) {
     if (args.length > 1) {
         printError('Usage: hippo card reclaim (sweeps every expired lease; use hippo card block <id> for one card)');
-        process.exit(1);
+        throw new CliExit(1);
     }
     const ids = reclaimExpiredCards(hippoRoot, tenantId);
     if (ids.length === 0) {
@@ -303,18 +302,18 @@ function cardComment(hippoRoot, tenantId, args, flags) {
     const id = args[1];
     if (!id) {
         printError('Usage: hippo card comment <id> --body "..." [--author <name>]');
-        process.exit(1);
+        throw new CliExit(1);
     }
     // Only show and comment look the card up directly; claim/heartbeat/block/review/complete throw from the store instead.
     const card = loadCard(hippoRoot, tenantId, id);
     if (!card) {
         printError(`No card found with id ${id}.`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     const body = stringFlagOrExit(flags, 'body') ?? '';
     if (!body) {
         printError('Usage: hippo card comment <id> --body "..." [--author <name>]');
-        process.exit(1);
+        throw new CliExit(1);
     }
     const author = stringFlagOrExit(flags, 'author') || 'cli';
     const comment = addCardComment(hippoRoot, tenantId, id, author, body);

package/dist/cli/client.d.ts

@@ -1,22 +1,8 @@
-/**
- * HTTP client wrapper for `hippo serve`.
- *
- * Only the writes the CLI routes (remember, forget, archive, promote), which are
- * also all HIPPO_REQUIRE_SERVER covers; every other command opens the store
- * directly. Each call returns the same shape that api.ts would.
- *
- * Errors from the server (4xx/5xx) are mapped back into thrown Errors with
- * the server's `error` message preserved verbatim so existing CLI handlers
- * that match on substrings (e.g. "not found", "already superseded") still
- * work unchanged.
- *
- * Network errors (ECONNREFUSED on a stale pidfile, etc.) propagate as the
- * native fetch failure so the caller can detect them and self-heal.
- */
+/** HTTP client wrapper for `hippo serve`: only the routed writes (remember, forget, archive, promote); every other command opens the store directly.
+ * Server errors rethrow with the message verbatim so CLI substring matches still work; network errors propagate as the native fetch failure. */
 import type { RememberOpts, RememberResult } from '../api/index.js';
-/** An error the server answered with, not one the transport raised. The
- *  refused-connection classifier sniffs message text, and a server message
- *  quotes the caller's own id or content back verbatim. */
+/** An error the server answered with, not one the transport raised: the refused-connection classifier sniffs message text,
+ *  and a server message quotes the caller's own id or content back verbatim. */
 export declare class HttpResponseError extends Error {
     readonly status: number;
     constructor(message: string, status: number);
@@ -35,14 +21,8 @@ export declare function archiveRaw(serverUrl: string, apiKey: string | undefined
     ok: true;
     archivedAt: string;
 }>;
-/**
- * How far a request got before the transport failed.
- *
- * 'never-sent' means the connection never opened, so the caller may safely
- * replay the call locally. 'delivery-unknown' means the socket broke with the
- * request already on the wire: the server may have committed it, so replaying a
- * write would store it twice. 'none' means this was not a transport failure.
- */
+/** 'never-sent': connection never opened, safe to replay locally. 'delivery-unknown': the request was on the wire and may have
+ * committed, so never replay a write. 'none': not a transport failure. */
 export type TransportFailure = 'none' | 'never-sent' | 'delivery-unknown';
-export declare function classifyTransportFailure(err: unknown): TransportFailure;
+export declare function classifyTransportFailure(err: Error): TransportFailure;
 //# sourceMappingURL=client.d.ts.map

package/dist/cli/client.js

@@ -1,23 +1,14 @@
-/**
- * HTTP client wrapper for `hippo serve`.
- *
- * Only the writes the CLI routes (remember, forget, archive, promote), which are
- * also all HIPPO_REQUIRE_SERVER covers; every other command opens the store
- * directly. Each call returns the same shape that api.ts would.
- *
- * Errors from the server (4xx/5xx) are mapped back into thrown Errors with
- * the server's `error` message preserved verbatim so existing CLI handlers
- * that match on substrings (e.g. "not found", "already superseded") still
- * work unchanged.
- *
- * Network errors (ECONNREFUSED on a stale pidfile, etc.) propagate as the
- * native fetch failure so the caller can detect them and self-heal.
- */
+/** HTTP client wrapper for `hippo serve`: only the routed writes (remember, forget, archive, promote); every other command opens the store directly.
+ * Server errors rethrow with the message verbatim so CLI substring matches still work; network errors propagate as the native fetch failure. */
 import { fetchWithRetry } from '../util/http-retry.js';
+import { readCappedJson } from '../util/capped-json.js';
+import { isJsonObject, isJsonString } from '../util/json.js';
 /** A write the local server has not answered in this long is stuck; the caller treats it as delivery-unknown. */
 const SERVER_TIMEOUT_MS = 30_000;
 /** Five tries at the server's 1 s Retry-After keeps the roughly 5 s wait the CLI had before the server answered busy with 503. */
 const STORE_BUSY_ATTEMPTS = 5;
+/** Every routed write answers with a few short fields; the pidfile's port may now be another process, so cap what it sends. */
+const MAX_REPLY_BYTES = 1024 * 1024;
 /** The server sets Retry-After on a 503 only for a held write lock (server.ts replyFor); the auth-provider 503 has none. */
 function isStoreBusy(res) {
     return res.status === 503 && res.headers.has('retry-after');
@@ -34,12 +25,8 @@ function buildHeaders(apiKey, withBody) {
         headers['authorization'] = `Bearer ${apiKey}`;
     return headers;
 }
-function isNonEmptyString(value) {
-    return typeof value === 'string' && value.length > 0;
-}
-/** An error the server answered with, not one the transport raised. The
- *  refused-connection classifier sniffs message text, and a server message
- *  quotes the caller's own id or content back verbatim. */
+/** An error the server answered with, not one the transport raised: the refused-connection classifier sniffs message text,
+ *  and a server message quotes the caller's own id or content back verbatim. */
 export class HttpResponseError extends Error {
     status;
     constructor(message, status) {
@@ -48,25 +35,26 @@ export class HttpResponseError extends Error {
         this.name = 'HttpResponseError';
     }
 }
-/**
- * Throw an Error matching the server's error message. Keeps message strings
- * intact so cli.ts handlers can match on the same substrings ("not found",
- * "already superseded", "Unknown key_id") whether the call went through
- * api.ts or client.ts.
- */
+/** Throw an Error carrying the server's message verbatim, so cli.ts handlers can match the same substrings
+ * ("not found", "already superseded") as on the direct path. */
 async function throwForStatus(res) {
     let message = `${res.status} ${res.statusText}`;
     try {
-        const body = await res.json();
-        if (body && isNonEmptyString(body.error)) {
+        const body = await readCappedJson(res, MAX_REPLY_BYTES);
+        if (isJsonObject(body) && isJsonString(body.error) && body.error.length > 0) {
             message = body.error;
         }
     }
     catch {
-        // body wasn't JSON; fall back to status line.
+        // body wasn't JSON or ran past the cap; fall back to status line.
     }
     throw new HttpResponseError(message, res.status);
 }
+/** A 2xx reply's body, read under the cap. */
+async function readReply(res) {
+    // SAFETY: the reply comes from hippo's own server, whose route returns this api result as JSON.
+    return (await readCappedJson(res, MAX_REPLY_BYTES));
+}
 export async function remember(serverUrl, apiKey, opts) {
     const res = await sendWrite(`${serverUrl}/v1/memories`, {
         method: 'POST',
@@ -75,8 +63,7 @@ export async function remember(serverUrl, apiKey, opts) {
     });
     if (!res.ok)
         await throwForStatus(res);
-    const result = await res.json();
-    return result;
+    return readReply(res);
 }
 export async function forget(serverUrl, apiKey, id) {
     const res = await sendWrite(`${serverUrl}/v1/memories/${encodeURIComponent(id)}`, {
@@ -85,8 +72,7 @@ export async function forget(serverUrl, apiKey, id) {
     });
     if (!res.ok)
         await throwForStatus(res);
-    const result = await res.json();
-    return result;
+    return readReply(res);
 }
 export async function promote(serverUrl, apiKey, id) {
     const res = await sendWrite(`${serverUrl}/v1/memories/${encodeURIComponent(id)}/promote`, {
@@ -95,8 +81,7 @@ export async function promote(serverUrl, apiKey, id) {
     });
     if (!res.ok)
         await throwForStatus(res);
-    const result = await res.json();
-    return result;
+    return readReply(res);
 }
 export async function archiveRaw(serverUrl, apiKey, id, reason) {
     const res = await sendWrite(`${serverUrl}/v1/memories/${encodeURIComponent(id)}/archive`, {
@@ -106,18 +91,14 @@ export async function archiveRaw(serverUrl, apiKey, id, reason) {
     });
     if (!res.ok)
         await throwForStatus(res);
-    const result = await res.json();
-    return result;
+    return readReply(res);
 }
 function hasObjectCause(e) {
-    // Node's fs/net system errors (ECONNREFUSED, ECONNRESET) attach the syscall
-    // code on a non-null object `cause`; the strict-equality checks below
-    // validate the code value before it is used for anything.
+    // Node's fs/net system errors (ECONNREFUSED, ECONNRESET) attach the syscall code on a non-null object `cause`;
+    // the strict-equality checks below validate it before use.
     return typeof e.cause === 'object' && e.cause !== null;
 }
 export function classifyTransportFailure(err) {
-    if (!(err instanceof Error))
-        return 'none';
     // The server answered, so the transport worked, whatever the message says.
     if (err instanceof HttpResponseError)
         return 'none';

package/dist/cli/compact-resume-payload.js

@@ -1,5 +1,6 @@
 // The payload gate for `hippo compact-resume`.
 import { isSubagentPayload } from '../store/token-ledger.js';
+import { isJsonObject, isJsonString } from '../util/json.js';
 /** Fail-closed read of the SessionStart payload: only a manual run or a main-session `source: 'compact'` payload may print. */
 export function readCompactResumePayload(stdinText, stdinTimedOut) {
     // An older Claude Code that ignores `matcher: 'compact'` runs this on every SessionStart, so a parsed payload with any other source stays silent.
@@ -18,7 +19,7 @@ export function readCompactResumePayload(stdinText, stdinTimedOut) {
             // Malformed JSON is handled as a null payload by the fail-closed check below.
             payload = null;
         }
-        if (!payload || typeof payload !== 'object') {
+        if (!isJsonObject(payload)) {
             // Fail closed on malformed non-empty stdin; only a TTY/no-stdin manual run, which never reaches here, prints.
             suppressOutput = true;
         }
@@ -29,7 +30,7 @@ export function readCompactResumePayload(stdinText, stdinTimedOut) {
             if (payload.source !== 'compact' || isSubagentPayload(stdinText)) {
                 suppressOutput = true;
             }
-            if (typeof payload.session_id === 'string') {
+            if (isJsonString(payload.session_id)) {
                 payloadSessionId = payload.session_id;
             }
         }

package/dist/cli/context.d.ts

@@ -1,4 +1,3 @@
-import { type CliFlags, type CommandContext } from './flag-values.js';
-export declare function cmdContext(hippoRoot: string, args: string[], flags: CliFlags, stdinText?: string): Promise<void>;
+import { type CommandContext } from './flag-values.js';
 export declare function handleContext({ hippoRoot, args, flags }: CommandContext): Promise<void>;
 //# sourceMappingURL=context.d.ts.map