hippo-memory 1.70.0 → 1.72.0

package/dist/cli/setup.d.ts

@@ -1,5 +1,5 @@
-import { type CliFlags } from './flag-values.js';
-export declare function cmdHook(args: string[]): void;
-export declare function cmdSetup(flags: CliFlags): void;
-export declare function cmdDailyRunner(): void;
+import { type CommandContext } from './flag-values.js';
+export declare function handleHook({ args }: CommandContext): void;
+export declare function handleSetup({ flags }: CommandContext): void;
+export declare function handleDailyRunner({ tenantId }: CommandContext): void;
 //# sourceMappingURL=setup.d.ts.map

package/dist/cli/setup.js

@@ -1,4 +1,5 @@
 // `hippo hook`, `hippo setup` and `hippo daily-runner`: install and run the agent and machine integrations.
+import { MINUTE_MS } from '../util/time.js';
 import * as path from 'path';
 import * as fs from 'fs';
 import { execFileSync } from 'child_process';
@@ -7,12 +8,12 @@ import { detectInstalledTools } from '../hooks/shared.js';
 import { ensureCodexWrapperInstalled, installCodexWrapper, detectRealCodexPath, uninstallCodexWrapper, } from '../hooks/codex-wrapper.js';
 import { installOpencodePlugin, uninstallOpencodePlugin, resolveOpencodePluginPath } from '../hooks/opencode.js';
 import { COPILOT_CLI_MCP, VSCODE_MCP, copilotMcpSnippet, copilotPaths, installCopilot, isCopilotCliPresent, isMcpFailure, uninstallCopilot, } from '../hooks/copilot.js';
-import { isInitialized } from '../store/open.js';
+import { isInitialized } from '../core/project-identity.js';
 import { currentMachine, importUserMemories } from '../agent-memories/sync.js';
-import { getGlobalRoot } from '../sharing/shared.js';
+import { getGlobalRoot } from '../sharing/global-store.js';
 import { listRegisteredWorkspaces, runDailyMaintenance } from './scheduler.js';
 import { replayCompactionsAt } from '../capture/compaction-record.js';
-import { errorMessage, log } from '../util/log.js';
+import { errorFields, errorMessage, log } from '../util/log.js';
 import { envDailyStepTimeoutMs } from '../util/env.js';
 import { writeFileAtomic } from '../util/atomic-write.js';
 import { printError } from './output.js';
@@ -22,10 +23,9 @@ import { installCodexMemoryHooks, setupDailySchedule, warnClaudeSettingsUnusable
 import { repairQualityOnceAt } from './quality-repair-once.js';
 import { HOOK_MARKERS, HOOKS, hippoBlock, withoutHookBlock } from '../hooks/hook-blocks.js';
 import { escapeRegex } from '../util/escape.js';
-// ---------------------------------------------------------------------------
+import { CliExit } from './exit.js';
 // Hook install/uninstall
-// ---------------------------------------------------------------------------
-export function cmdHook(args) {
+export function handleHook({ args }) {
     const subcommand = args[0];
     const target = args[1];
     if (subcommand === 'list')
@@ -35,7 +35,7 @@ export function cmdHook(args) {
     if (subcommand === 'uninstall')
         return hookUninstall(target);
     printError('Usage: hippo hook <install|uninstall|list> [target]');
-    process.exit(1);
+    throw new CliExit(1);
 }
 // Cursor has no init row, so the AGENTS.md block is usually another agent's, and Cursor reads that one as it is.
 function othersBlock(target, text) {
@@ -57,7 +57,7 @@ function hookInstall(target) {
     if (!target || !HOOKS[target]) {
         printError(`Unknown hook target: ${target ?? '(none)'}`);
         printError(`   Available: ${[...Object.keys(HOOKS), 'copilot'].join(', ')}`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     const hook = HOOKS[target];
     patchAgentFile(hook, target);
@@ -103,9 +103,8 @@ function patchAgentFile(hook, target) {
         }
     }
     else {
-        // Do not create a new agent-instructions file (CLAUDE.md, AGENTS.md, etc.) in directories that don't already have one —
-        // avoids polluting cwd with files the user didn't ask for. The settings.json hook below is still installed for
-        // claude-code, so the consolidation hook still runs.
+        // Do not create an agent-instructions file (CLAUDE.md, AGENTS.md, etc.) in directories without one, to avoid polluting cwd;
+        // the settings.json hook below is still installed for claude-code.
         console.log(`${hook.file} not found in ${process.cwd()} — skipping agent-instructions patch.`);
         console.log(`   Create ${hook.file} and re-run \`hippo hook install ${target}\` if you want the agent prompt.`);
     }
@@ -144,7 +143,7 @@ function printClaudeHookInstall(result) {
     }
 }
 function installOpencodeHook() {
-    // opencode uses a TS plugin, not JSON hooks. See src/hooks.ts.
+    // opencode uses a TS plugin, not JSON hooks. See src/hooks/opencode.ts.
     const result = installOpencodePlugin();
     if (result.installed) {
         console.log(`Installed hippo opencode plugin at ${result.pluginPath}`);
@@ -190,7 +189,8 @@ const VSCODE_INSTRUCTIONS_REMOVE_LINES = {
     absent: () => '',
     kept: (file) => `Left ${file}: it is not the text hippo wrote. Delete it by hand if no agent needs it.`,
 };
-const VSCODE_HOOKS_LINE = 'VS Code: hooks need VS Code 1.109.3 or later with chat.useHooks on (the default); older versions get the MCP server and the instructions file only.';
+const VSCODE_HOOKS_LINE = 'VS Code: hooks need VS Code 1.109.3 or later with chat.useHooks on (the default); older versions get the MCP server and the ' +
+    'instructions file only.';
 function mcpInstallLine(file, mcp, host) {
     return isMcpFailure(mcp) ? mcpFailureLine(file, mcp, addByHand(host)) : MCP_MERGE_LINES[mcp](file, host);
 }
@@ -200,7 +200,8 @@ function printVscodeInstall(result, indent) {
     console.log(`${indent}${VSCODE_INSTRUCTIONS_INSTALL_LINES[result.instructions](paths.instructions)}`);
     if (paths.profiles.length > 0) {
         const names = paths.profiles.map((dir) => path.basename(dir)).join(', ');
-        console.log(`${indent}Found VS Code profiles (${names}) under ${path.join(paths.userDir, 'profiles')}: hippo set up the default profile only; copy the "hippo" server and prompts/hippo.instructions.md into a profile to use hippo there.`);
+        console.log(`${indent}Found VS Code profiles (${names}) under ${path.join(paths.userDir, 'profiles')}: ` +
+            'hippo set up the default profile only; copy the "hippo" server and prompts/hippo.instructions.md into a profile to use hippo there.');
     }
 }
 function printCopilotInstall(result, indent) {
@@ -208,7 +209,8 @@ function printCopilotInstall(result, indent) {
     const hooks = result.hooks ? `Installed hippo's Copilot hooks (${copilotHookEvents().join(', ')}) ->` : "hippo's Copilot hooks are already in";
     console.log(`${indent}${hooks} ${paths.hooks}`);
     if (result.mcp === null || result.instructions === null) {
-        console.log(`${indent}No Copilot CLI files in ${path.dirname(paths.mcpConfig)}, so hippo skipped mcp-config.json and copilot-instructions.md, which only the Copilot CLI reads`);
+        console.log(`${indent}No Copilot CLI files in ${path.dirname(paths.mcpConfig)}, ` +
+            'so hippo skipped mcp-config.json and copilot-instructions.md, which only the Copilot CLI reads');
     }
     else {
         console.log(`${indent}${mcpInstallLine(paths.mcpConfig, result.mcp, COPILOT_CLI_MCP)}`);
@@ -228,8 +230,10 @@ function mcpRemoveLines(file, mcp) {
         return [`Removed the "hippo" MCP server from ${file}`];
     if (mcp === 'user-owned')
         return [`Left the "hippo" MCP server in ${file}: hippo did not write it`];
-    if (mcp === 'unreadable')
-        return [`WARNING: ${file} has comments or is not a JSON object hippo can edit, so it was left unchanged; remove the "hippo" server by hand if hippo added it`];
+    if (mcp === 'unreadable') {
+        return [`WARNING: ${file} has comments or is not a JSON object hippo can edit, so it was left unchanged; ` +
+                'remove the "hippo" server by hand if hippo added it'];
+    }
     return [];
 }
 function printCopilotUninstall(result) {
@@ -254,7 +258,7 @@ function hookUninstall(target) {
         return printCopilotUninstall(uninstallCopilot());
     if (!target || !HOOKS[target]) {
         printError(`Unknown hook target: ${target ?? '(none)'}`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     unpatchAgentFile(HOOKS[target], target);
     // For Claude Code, also strip its SessionEnd/SessionStart entries.
@@ -267,9 +271,7 @@ function hookUninstall(target) {
         }
     }
     else if (target === 'opencode') {
-        // opencode uses a TS plugin; uninstall removes the plugin file AND
-        // also runs the legacy-hooks migration so the downgrade/remove path
-        // leaves opencode launchable.
+        // opencode uses a TS plugin; uninstall removes the plugin file and also runs the legacy-hooks migration, so remove leaves opencode launchable.
         if (uninstallOpencodePlugin()) {
             console.log(`Removed hippo opencode plugin (and any legacy hooks block from opencode.json)`);
         }
@@ -351,8 +353,8 @@ function setupDetectedTools(tools, forceAll, dryRun) {
     }
 }
 // `hippo setup` -- one-shot configuration for every AI coding tool on the box.
-// Detection and install logic live in ./hooks.ts.
-export function cmdSetup(flags) {
+// Detection and install logic live in src/hooks/.
+export function handleSetup({ flags }) {
     const dryRun = boolFlag(flags, 'dry-run');
     const forceAll = boolFlag(flags, 'all');
     const tools = detectInstalledTools();
@@ -389,14 +391,16 @@ function setupCopilot(dryRun) {
 function setupJsonTool(tool, dryRun) {
     if (tool.name === 'copilot')
         return setupCopilot(dryRun);
+    // SAFETY: detectInstalledTools gives kind 'json-hook' only to claude-code and copilot (hooks/shared.ts), and copilot returned above.
+    const target = tool.name;
     if (dryRun) {
         // Resolve the real settings path so the filename is right for each tool
         // (claude-code -> settings.json, opencode -> opencode.json).
-        const { settings } = resolveJsonHookPaths(tool.name);
+        const { settings } = resolveJsonHookPaths(target);
         console.log(`[dry-run] would install hooks in ${settings}`);
         return;
     }
-    const result = installJsonHooks(tool.name);
+    const result = installJsonHooks(target);
     if (warnClaudeSettingsUnusable(result, `  ${tool.name.padEnd(14)} `))
         return;
     const bits = [];
@@ -475,21 +479,21 @@ function setupPluginTool(tool, dryRun) {
     }
 }
 // Three times the 10 minutes POST /v1/sleep allows a consolidation, so a slow real sleep fits and a hung child cannot stall every later workspace.
-const DAILY_STEP_TIMEOUT_MS = 30 * 60_000;
+const DAILY_STEP_TIMEOUT_MS = 30 * MINUTE_MS;
 /** Why a child step failed; a child killed at the deadline says so, since its own message is only the spawn error code. */
 function dailyStepFailure(err, timeoutMs) {
     if (err instanceof Error && 'code' in err && err.code === 'ETIMEDOUT')
         return `timed out after ${timeoutMs} ms and was stopped`;
     return errorMessage(err);
 }
-export function cmdDailyRunner() {
+export function handleDailyRunner({ tenantId }) {
     const globalRoot = getGlobalRoot();
     // No workspace sleep ever opens the global store, yet hooks in folders without a store compact into it.
     if (isInitialized(globalRoot)) {
         const finished = replayCompactionsAt(globalRoot, (message) => log.warn(`compaction replay: ${message}`));
         if (finished > 0)
             console.log(`Finished saving ${finished} compaction${finished === 1 ? '' : 's'} left over in the global store.`);
-        repairQualityOnceAt(globalRoot);
+        repairQualityOnceAt(globalRoot, tenantId);
     }
     printAgentImport(importUserMemories(globalRoot, { machine: currentMachine() }), '');
     const workspaces = listRegisteredWorkspaces(globalRoot);
@@ -515,10 +519,11 @@ export function cmdDailyRunner() {
         catch (err) {
             failed++;
             const action = args.join(' ');
-            log.error(`daily-runner failed in ${cwd} during \`${action}\`: ${dailyStepFailure(err, timeout)}`, { workspace: cwd });
+            log.error(`daily-runner failed in ${cwd} during \`${action}\`: ${dailyStepFailure(err, timeout)}`, { workspace: cwd, ...errorFields(err) });
         }
     });
-    console.log(`Daily maintenance complete: ${processed} workspace${processed === 1 ? '' : 's'} processed, ${failed} command failure${failed === 1 ? '' : 's'}.`);
+    console.log(`Daily maintenance complete: ${processed} workspace${processed === 1 ? '' : 's'} processed, ` +
+        `${failed} command failure${failed === 1 ? '' : 's'}.`);
     // The scheduler that runs this only sees the exit code, so a failed workspace must not read as a clean run.
     if (failed > 0)
         process.exitCode = 1;

package/dist/cli/shared.d.ts

@@ -1,41 +1,23 @@
 import { type ChurnStaleResult } from '../learn/invalidation.js';
-import { type AuditOp } from '../store/audit.js';
 import { type ServerInfo } from '../server/server-detect.js';
 import type { CliFlags } from './flag-values.js';
-/**
- * Emit an audit event against `hippoRoot`'s db. Opens its own short-lived
- * connection so callers don't have to thread a db handle. Swallows all errors
- * — audit must never crash a CLI command.
- */
-export declare function emitCliAudit(hippoRoot: string, op: AuditOp, targetId?: string, metadata?: Record<string, unknown>): void;
 export declare function requireInit(hippoRoot: string): void;
 /** Runs detectChurnStale against every store this repo's memories can live in. */
-export declare function runChurnStaleForRepo(hippoRoot: string, dryRun: boolean): {
+export declare function runChurnStaleForRepo(hippoRoot: string, tenantId: string, dryRun: boolean): {
     root: string;
     result: ChurnStaleResult;
 }[];
-/**
- * Run an HTTP-routed command if a `hippo serve` instance is detected for
- * `hippoRoot`. Returns:
- *   - true  if the HTTP path ran (success OR a structured server error that
- *           was already surfaced to stdout/stderr by `httpFn`),
- *   - false if no server was detected, or if the detected pidfile turned out
- *           to be stale (connection refused). On stale, the pidfile is removed
- *           if it still names that dead server (a newer one may have replaced
- *           it) and the caller should fall back to the direct path.
- *
- * Stale pidfiles must self-heal, not crash.
- * When HIPPO_REQUIRE_SERVER is set, both fallback paths throw instead of
- * returning false, so a missing server fails loudly rather than silently
- * degrading to direct mode.
- */
+/** Run an HTTP-routed command if a `hippo serve` is detected: true if it ran, false on no server or a stale pidfile (removed if it names the dead server).
+ * With HIPPO_REQUIRE_SERVER set both fallbacks throw; a stale pidfile must self-heal, not crash. */
 export declare function runViaServerIfAvailable(hippoRoot: string, httpFn: (info: ServerInfo, apiKey: string | undefined) => Promise<void>): Promise<boolean>;
 /** True, after one line, on a shared store: this account's commits and agent notes are not its members' memories. */
 export declare function skipLearnOnSharedStore(hippoRoot: string): boolean;
-export declare function learnFromRepo(hippoRoot: string, repoPath: string, days: number, label?: string): {
+interface LearnFromRepoResult {
     added: number;
     skipped: number;
     lowInfo: number;
-};
+}
+export declare function learnFromRepo(hippoRoot: string, tenantId: string, repoPath: string, days: number, label?: string): LearnFromRepoResult;
 export declare function resolveAuthRoot(hippoRoot: string, flags: CliFlags): string;
+export {};
 //# sourceMappingURL=shared.d.ts.map

package/dist/cli/shared.js

@@ -1,40 +1,17 @@
-// Store and server helpers the CLI verbs share: audit events, init checks, server routing, git learning and the auth root.
+// Store and server helpers the CLI verbs share: init checks, server routing, git learning and the auth root.
 // This module must never import cli.ts.
 import { envApiKey, envRequireServer } from '../util/env.js';
 import { execFileSync } from 'child_process';
 import { isSharedStore } from '../core/config.js';
-import { isInitialized } from '../store/open.js';
 import { detectChurnStale } from '../learn/invalidation.js';
-import { resolveProjectIdentity } from '../core/project-identity.js';
-import { getGlobalRoot, initGlobal } from '../sharing/shared.js';
-import { reportAuditWriteFailure } from '../store/audit.js';
-import { sqliteSyncStore } from '../store/sqlite/store.js';
+import { resolveProjectIdentity, isInitialized } from '../core/project-identity.js';
+import { getGlobalRoot, initGlobal } from '../sharing/global-store.js';
 import * as client from './client.js';
 import { detectServer, removePidfileIfOwned } from '../server/server-detect.js';
-import { resolveTenantId } from '../store/tenant.js';
-import { adminActor, learn, CLI_LEARN } from '../api/index.js';
+import { learn, CLI_LEARN } from '../api/index.js';
+import { cliApiContext } from './api-context.js';
 import { errorMessage, log } from '../util/log.js';
 import { printError } from './output.js';
-/**
- * Emit an audit event against `hippoRoot`'s db. Opens its own short-lived
- * connection so callers don't have to thread a db handle. Swallows all errors
- * — audit must never crash a CLI command.
- */
-export function emitCliAudit(hippoRoot, op, targetId, metadata) {
-    try {
-        sqliteSyncStore(hippoRoot).appendAuditEvents([{
-                tenantId: resolveTenantId({}),
-                actor: 'cli',
-                op,
-                targetId,
-                metadata,
-            }]);
-    }
-    catch (error) {
-        // Best effort: the command already did its work.
-        reportAuditWriteFailure(op, String(error), targetId);
-    }
-}
 export function requireInit(hippoRoot) {
     if (!isInitialized(hippoRoot)) {
         printError(`No hippo store at ${hippoRoot} (searched ${process.cwd()} and its parents up to your home directory). Run \`hippo init\` first.`);
@@ -42,12 +19,11 @@ export function requireInit(hippoRoot) {
     }
 }
 /** Runs detectChurnStale against every store this repo's memories can live in. */
-export function runChurnStaleForRepo(hippoRoot, dryRun) {
+export function runChurnStaleForRepo(hippoRoot, tenantId, dryRun) {
     const repoRoot = execFileSync('git', ['rev-parse', '--show-toplevel'], { cwd: process.cwd(), encoding: 'utf8', timeout: 10_000, windowsHide: true }).trim();
     const { name: projectName, legacyName } = resolveProjectIdentity(process.cwd());
     const globalRoot = getGlobalRoot();
     const roots = globalRoot !== hippoRoot && isInitialized(globalRoot) ? [hippoRoot, globalRoot] : [hippoRoot];
-    const tenantId = resolveTenantId({});
     return roots.map((root) => {
         // One store failing must not abort sleep's later phases or skip the other store.
         try {
@@ -59,34 +35,16 @@ export function runChurnStaleForRepo(hippoRoot, dryRun) {
         }
     });
 }
-/**
- * When HIPPO_REQUIRE_SERVER is set, the CLI must not silently fall back to
- * direct DB mode — a missing server then masks a real misconfiguration (the
- * configured HIPPO_API_KEY is also silently discarded on fallback). Throws a
- * clear error then. It guards only the routed writes (remember, forget, archive,
- * promote); every other command opens the store directly, knob or not.
- */
+/** With HIPPO_REQUIRE_SERVER set, throw rather than fall back to direct DB mode, which would mask a misconfiguration and discard HIPPO_API_KEY.
+ * Guards only the routed writes (remember, forget, archive, promote). */
 function failIfServerRequired(reason) {
     if (envRequireServer()) {
         throw new Error(`hippo: HIPPO_REQUIRE_SERVER is set but ${reason}. ` +
             `Start \`hippo serve\`, or unset HIPPO_REQUIRE_SERVER to allow direct-mode fallback.`);
     }
 }
-/**
- * Run an HTTP-routed command if a `hippo serve` instance is detected for
- * `hippoRoot`. Returns:
- *   - true  if the HTTP path ran (success OR a structured server error that
- *           was already surfaced to stdout/stderr by `httpFn`),
- *   - false if no server was detected, or if the detected pidfile turned out
- *           to be stale (connection refused). On stale, the pidfile is removed
- *           if it still names that dead server (a newer one may have replaced
- *           it) and the caller should fall back to the direct path.
- *
- * Stale pidfiles must self-heal, not crash.
- * When HIPPO_REQUIRE_SERVER is set, both fallback paths throw instead of
- * returning false, so a missing server fails loudly rather than silently
- * degrading to direct mode.
- */
+/** Run an HTTP-routed command if a `hippo serve` is detected: true if it ran, false on no server or a stale pidfile (removed if it names the dead server).
+ * With HIPPO_REQUIRE_SERVER set both fallbacks throw; a stale pidfile must self-heal, not crash. */
 export async function runViaServerIfAvailable(hippoRoot, httpFn) {
     const info = await detectServer(hippoRoot);
     if (!info) {
@@ -99,7 +57,7 @@ export async function runViaServerIfAvailable(hippoRoot, httpFn) {
         return true;
     }
     catch (err) {
-        const failure = client.classifyTransportFailure(err);
+        const failure = err instanceof Error ? client.classifyTransportFailure(err) : 'none';
         if (failure === 'never-sent') {
             failIfServerRequired('the server pidfile was stale (connection refused)');
             log.warn('stale server pidfile detected, falling back to direct mode');
@@ -109,10 +67,10 @@ export async function runViaServerIfAvailable(hippoRoot, httpFn) {
             return false;
         }
         if (failure === 'delivery-unknown') {
-            // Every caller of this helper is a non-idempotent write, so replaying on
-            // the direct path would store a row the server may already have committed.
-            // Leave the pidfile alone: the next command's connect-phase failure heals it.
-            printError(`hippo: the connection to ${info.url} dropped or timed out mid-request, so the write may already have been applied. Not retrying locally. Check with \`hippo recall\` before running this again.`);
+            // Every caller is a non-idempotent write, so replaying on the direct path would store a row the server may already have committed;
+            // leave the pidfile alone: the next command's connect-phase failure heals it.
+            printError(`hippo: the connection to ${info.url} dropped or timed out mid-request, so the write may already have been applied. ` +
+                'Not retrying locally. Check with `hippo recall` before running this again.');
             process.exit(1);
         }
         throw err;
@@ -125,10 +83,9 @@ export function skipLearnOnSharedStore(hippoRoot) {
     console.log("Shared store: skipped learning from this account's git commits and coding agents' own memories.");
     return true;
 }
-export function learnFromRepo(hippoRoot, repoPath, days, label) {
+export function learnFromRepo(hippoRoot, tenantId, repoPath, days, label) {
     const prefix = label ? `[${label}] ` : '';
-    const ctx = { hippoRoot, tenantId: resolveTenantId({}), actor: adminActor('cli') };
-    const result = learn(ctx, { repoPath, days, profile: CLI_LEARN });
+    const result = learn(cliApiContext(hippoRoot, tenantId), { repoPath, days, profile: CLI_LEARN });
     if (result.status === 'not-a-repo') {
         console.log(`${prefix}No git history found (or not a git repository).`);
         return { added: 0, skipped: 0, lowInfo: 0 };

package/dist/cli/slack.d.ts

@@ -1,3 +1,3 @@
-import { type CliFlags } from './flag-values.js';
-export declare function cmdSlack(hippoRoot: string, args: string[], flags: CliFlags): Promise<void>;
+import { type CommandContext } from './flag-values.js';
+export declare function handleSlack({ hippoRoot, tenantId, args, flags }: CommandContext): Promise<void>;
 //# sourceMappingURL=slack.d.ts.map

package/dist/cli/slack.js

@@ -1,7 +1,6 @@
 // `hippo slack`: backfill, dead-letter queue and workspace registry for the Slack connector.
 import { envSlackBotToken, envSlackSigningSecret, envSlackTeamId } from '../util/env.js';
 import * as api from '../api/index.js';
-import { resolveTenantId } from '../store/tenant.js';
 import { listDlq } from '../connectors/dlq.js';
 import { replayDlqEntry, slackDlq } from '../connectors/slack/dlq.js';
 import { backfillChannel } from '../connectors/slack/backfill.js';
@@ -10,30 +9,27 @@ import { addWorkspace as addSlackWorkspace, listWorkspaces as listSlackWorkspace
 import { printError } from './output.js';
 import { printSlackBackfillUsage, printSlackWorkspacesUsage } from './usage.js';
 import { stringFlag } from './flag-values.js';
-// ---------------------------------------------------------------------------
+import { CliExit } from './exit.js';
 // Slack subcommands (`hippo slack backfill` / `hippo slack dlq list`)
-// ---------------------------------------------------------------------------
-function cmdSlackBackfill(hippoRoot, flags) {
+function cmdSlackBackfill(hippoRoot, tenantId, flags) {
     const channel = stringFlag(flags, 'channel');
     if (!channel) {
         printSlackBackfillUsage();
-        process.exit(1);
+        throw new CliExit(1);
     }
     // Real fetcher requires SLACK_BOT_TOKEN with channels:history scope.
     const token = envSlackBotToken();
     if (!token) {
         printError('SLACK_BOT_TOKEN is not set. Backfill requires a Slack bot token with channels:history scope.');
-        process.exit(2);
+        throw new CliExit(2);
     }
-    // --since is advisory in V1: the slack_cursors row drives resume, so the
-    // backfill loop always picks up where it last left off. Honoured-by-cursor
-    // semantics keep idempotency clean.
+    // --since is advisory in V1: the slack_cursors row drives resume, so the backfill loop always continues where it left off (keeps idempotency clean).
     const sinceIso = stringFlag(flags, 'since');
     void sinceIso;
     const fetcher = slackHistoryFetcher(token);
     const ctx = {
         hippoRoot,
-        tenantId: resolveTenantId({}),
+        tenantId,
         actor: api.adminActor('cli:slack-backfill'),
     };
     backfillChannel(ctx, {
@@ -49,8 +45,8 @@ function cmdSlackBackfill(hippoRoot, flags) {
         process.exit(3);
     });
 }
-function cmdSlackDlqList(hippoRoot, _flags) {
-    const items = listDlq(slackDlq, hippoRoot, { tenantId: resolveTenantId({}) });
+function cmdSlackDlqList(hippoRoot, tenantId, _flags) {
+    const items = listDlq(slackDlq, hippoRoot, { tenantId });
     for (const it of items) {
         console.log(`${it.id}\t${it.receivedAt}\t${it.error}`);
     }
@@ -59,12 +55,12 @@ async function cmdSlackDlqReplay(hippoRoot, args, flags) {
     const idArg = args[2];
     if (!idArg) {
         printError('Usage: hippo slack dlq replay <id> [--force]');
-        process.exit(1);
+        throw new CliExit(1);
     }
     const id = Number(idArg);
     if (!Number.isFinite(id) || !Number.isInteger(id) || id < 1) {
         printError(`replay: invalid id ${idArg}`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     const force = flags.force === true;
     const result = await replayDlqEntry({ hippoRoot }, id, {
@@ -73,7 +69,7 @@ async function cmdSlackDlqReplay(hippoRoot, args, flags) {
     });
     if (!result.ok) {
         printError(`replay failed: status=${result.status} retry_count=${result.retryCount}${result.reason ? ` reason=${result.reason}` : ''}`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     console.log(`replay ok: status=${result.status} memory_id=${result.memoryId ?? '(none)'} retry_count=${result.retryCount}`);
 }
@@ -82,7 +78,7 @@ function cmdSlackWorkspacesAdd(hippoRoot, flags) {
     const tenantId = (stringFlag(flags, 'tenant') ?? '').trim();
     if (!teamId || !tenantId) {
         printError('Usage: hippo slack workspaces add --team <T> --tenant <t>');
-        process.exit(1);
+        throw new CliExit(1);
     }
     const ws = addSlackWorkspace(hippoRoot, { teamId, tenantId });
     console.log(`added: ${ws.teamId} -> ${ws.tenantId} (${ws.addedAt})`);
@@ -101,23 +97,23 @@ function cmdSlackWorkspacesRemove(hippoRoot, flags) {
     const teamId = (stringFlag(flags, 'team') ?? '').trim();
     if (!teamId) {
         printError('Usage: hippo slack workspaces remove --team <T>');
-        process.exit(1);
+        throw new CliExit(1);
     }
     const removed = removeSlackWorkspace(hippoRoot, teamId);
     if (!removed) {
         printError(`no workspace registered for team ${teamId}`);
-        process.exit(1);
+        throw new CliExit(1);
     }
     console.log(`removed: ${teamId}`);
 }
-export async function cmdSlack(hippoRoot, args, flags) {
+export async function handleSlack({ hippoRoot, tenantId, args, flags }) {
     const sub = args[0];
     if (sub === 'backfill') {
-        cmdSlackBackfill(hippoRoot, flags);
+        cmdSlackBackfill(hippoRoot, tenantId, flags);
         return;
     }
     if (sub === 'dlq' && args[1] === 'list') {
-        cmdSlackDlqList(hippoRoot, flags);
+        cmdSlackDlqList(hippoRoot, tenantId, flags);
         return;
     }
     if (sub === 'dlq' && args[1] === 'replay') {
@@ -139,9 +135,9 @@ export async function cmdSlack(hippoRoot, args, flags) {
             return;
         }
         printSlackWorkspacesUsage();
-        process.exit(1);
+        throw new CliExit(1);
     }
     printError('Usage: hippo slack <backfill|dlq list|dlq replay <id> [--force]|workspaces add|workspaces list|workspaces remove> [...]');
-    process.exit(1);
+    throw new CliExit(1);
 }
 //# sourceMappingURL=slack.js.map

package/dist/cli/sleep-render.js

@@ -2,10 +2,12 @@
 import { renderAmbientSummary } from '../core/ambient.js';
 /** The lines `hippo sleep` prints for an api.sleep result; pure, so the snapshot tests read them without a console spy. */
 export function sleepResultLines(result) {
-    return [...sleepCountLines(result), ...(result.dryRun ? ['\n(dry run  - nothing written)'] : []), ...sleepDedupeAndAuditLines(result), ...sleepShareAndGraphLines(result)];
+    return [...sleepCountLines(result), ...(result.dryRun ? ['\n(dry run  - nothing ' +
+                'written)'] : []), ...sleepDedupeAndAuditLines(result), ...sleepShareAndGraphLines(result)];
 }
 function sleepCountLines(result) {
-    const lines = [`Running consolidation${result.dryRun ? ' (dry run)' : ''}...`, `\nResults:`, `   Active memories:  ${result.active}`, `   Removed (decayed): ${result.removed}`];
+    const lines = [`Running consolidation${result.dryRun ? ' (dry ' +
+            'run)' : ''}...`, `\nResults:`, `   Active memories:  ${result.active}`, `   Removed (decayed): ${result.removed}`];
     // Only when dormant.enabled moved something, so every other render stays byte-identical.
     if (result.dormant !== undefined && result.dormant > 0) {
         lines.push(`   Kept dormant:      ${result.dormant}  (hippo dormant to list)`);
@@ -29,7 +31,8 @@ function sleepDedupeAndAuditLines(result) {
             parts.push(`${epiDups} duplicate episodic lessons`);
         if (crossDups > 0)
             parts.push(`${crossDups} cross-layer duplicates`);
-        lines.push(`\n${result.dryRun ? 'Would dedupe' : 'Deduped'} ${removed} duplicates (${parts.join(', ')}). ${result.dryRun ? 'Would keep' : 'Kept'} stronger copies.`);
+        lines.push(`\n${result.dryRun ? 'Would ' +
+            'dedupe' : 'Deduped'} ${removed} duplicates (${parts.join(', ')}). ${result.dryRun ? 'Would keep' : 'Kept'} stronger copies.`);
     }
     if (result.audit) {
         if (result.audit.errorsRemoved > 0) {

package/dist/cli/sleep.d.ts

@@ -1,4 +1,5 @@
-import { type CliFlags } from './flag-values.js';
+import { type CliFlags, type CommandContext } from './flag-values.js';
 /** Runs `hippo sleep`; with `--log-file` it also tees its output to that file. */
-export declare function cmdSleep(hippoRoot: string, flags: CliFlags): Promise<void>;
+export declare function cmdSleep(hippoRoot: string, tenantId: string, flags: CliFlags): Promise<void>;
+export declare function handleSleep({ hippoRoot, tenantId, flags }: CommandContext): Promise<void>;
 //# sourceMappingURL=sleep.d.ts.map