hippo-memory 1.71.0 → 1.72.0

package/dist/util/anthropic-messages.js

@@ -1,19 +1,36 @@
 /** The one Anthropic Messages client: sends one user prompt and returns the reply text or a typed failure the caller reacts to. */
-import { fetchWithRetry, llmTimeoutMs } from './http-retry.js';
+import { fetchWithRetry, llmTimeoutMs, llmTotalMs } from './http-retry.js';
 import { errorMessage } from './log.js';
-import { readCappedJson } from './capped-json.js';
+import { readCappedJson, readCappedText } from './capped-json.js';
 import { isJsonObject, isJsonString } from './json.js';
+import { redactSecretsStrict } from './secret-detect.js';
 const MESSAGES_URL = 'https://api.anthropic.com/v1/messages';
 const API_VERSION = '2023-06-01';
 const DEFAULT_MODEL = 'claude-sonnet-4-6';
 // Callers ask for at most 1,200 tokens, a reply of a few KB; 1 MiB leaves room for a verbose envelope.
 const MAX_REPLY_BYTES = 1024 * 1024;
+// The error body names the cause (bad key, no credit, unknown model) in its first line or two.
+const ERROR_SNIPPET_CHARS = 256;
+const UTF8_MAX_BYTES_PER_CHAR = 4;
+// A bad or missing key, no credit, no permission, an unknown model: every later call gets the same answer.
+const PERMANENT_STATUSES = new Set([401, 402, 403, 404]);
 /** The first content block's text, trimmed; empty when the reply has no such block. */
 function firstText(reply) {
     const first = Array.isArray(reply.content) ? reply.content[0] : undefined;
     const text = isJsonObject(first) ? first.text : undefined;
     return isJsonString(text) ? text.trim() : '';
 }
+/** True for a failure the next call would repeat, so a caller looping over items should stop rather than retry. */
+export function isPermanentFailure(failure) {
+    return failure.kind === 'http' && PERMANENT_STATUSES.has(failure.status);
+}
+/** The start of a failed reply's body, on one line with any key-shaped text masked; empty when the body cannot be read. */
+async function errorSnippet(res) {
+    // The status is the failure reported; a body that cannot be read only costs its snippet.
+    const body = await readCappedText(res, ERROR_SNIPPET_CHARS * UTF8_MAX_BYTES_PER_CHAR).catch(() => '');
+    // Masked before the cut, so a key that straddles the cut is never left half shown.
+    return redactSecretsStrict(body.replace(/\s+/g, ' ').trim()).slice(0, ERROR_SNIPPET_CHARS);
+}
 /** The reply's first text block, trimmed (empty when the reply has none); never throws. */
 export async function sendAnthropicMessage(req) {
     let res;
@@ -30,13 +47,13 @@ export async function sendAnthropicMessage(req) {
                 max_tokens: req.maxTokens,
                 messages: [{ role: 'user', content: req.prompt }],
             }),
-        }, { timeoutMs: llmTimeoutMs(), fetchFn: req.fetcher ?? fetch });
+        }, { timeoutMs: llmTimeoutMs(), totalMs: llmTotalMs(), fetchFn: req.fetcher ?? fetch });
     }
     catch (err) {
         return { ok: false, failure: { kind: 'request', message: errorMessage(err) } };
     }
     if (!res.ok)
-        return { ok: false, failure: { kind: 'http', status: res.status } };
+        return { ok: false, failure: { kind: 'http', status: res.status, detail: await errorSnippet(res) } };
     try {
         const data = await readCappedJson(res, MAX_REPLY_BYTES);
         if (!isJsonObject(data))
@@ -51,7 +68,7 @@ export async function sendAnthropicMessage(req) {
 export function describeMessageFailure(failure) {
     switch (failure.kind) {
         case 'request': return `request failed: ${failure.message}`;
-        case 'http': return `HTTP ${failure.status}`;
+        case 'http': return failure.detail ? `HTTP ${failure.status}: ${failure.detail}` : `HTTP ${failure.status}`;
         case 'unreadable': return `unparseable response: ${failure.message}`;
     }
 }

package/dist/util/chunked.d.ts

@@ -0,0 +1,3 @@
+/** `items` in consecutive slices of at most `size`. */
+export declare function chunked<T>(items: readonly T[], size?: number): T[][];
+//# sourceMappingURL=chunked.d.ts.map

package/dist/util/chunked.js

@@ -0,0 +1,10 @@
+/** Ids per `IN (...)` list: far under SQLite's bound-parameter limit, with room for the tenant filter. */
+const ID_CHUNK = 500;
+/** `items` in consecutive slices of at most `size`. */
+export function chunked(items, size = ID_CHUNK) {
+    const out = [];
+    for (let i = 0; i < items.length; i += size)
+        out.push(items.slice(i, i + size));
+    return out;
+}
+//# sourceMappingURL=chunked.js.map

package/dist/util/ellipsize.d.ts

@@ -0,0 +1,3 @@
+/** `text` cut to `max` characters plus a marker, or unchanged when it already fits. */
+export declare function truncateWithEllipsis(text: string, max: number, marker?: string): string;
+//# sourceMappingURL=ellipsize.d.ts.map

package/dist/util/ellipsize.js

@@ -0,0 +1,5 @@
+/** `text` cut to `max` characters plus a marker, or unchanged when it already fits. */
+export function truncateWithEllipsis(text, max, marker = '...') {
+    return text.length > max ? `${text.slice(0, max)}${marker}` : text;
+}
+//# sourceMappingURL=ellipsize.js.map

package/dist/util/env.d.ts

@@ -34,6 +34,7 @@ export declare const DEFAULT_TENANT_ID = "default";
 export declare function envTenant(): string;
 export declare function envSkipAutoIntegrations(): boolean;
 export declare function envSkipPostinstall(): boolean;
+export declare function envSkipSchedule(): boolean;
 export declare function envMcpStdio(): boolean;
 /** `1` or `true`, so `0` and `false` turn it off; `true` stays on for anyone who set it that way. */
 export declare function envRequireServer(): boolean;
@@ -54,7 +55,7 @@ export declare function envBodyTimeoutMs(): number | undefined;
 /** How long POST /v1/sleep lets its consolidation run; server/sleep-offload.ts holds the default. */
 export declare function envSleepTimeoutMs(): number | undefined;
 /** How long a /v1 or /mcp request may run before the server answers 504, and a stdio MCP
- * request before its timeout error; 0 for no deadline; server/deadline.ts holds the default. */
+ * request before its timeout error; 0 for no deadline; util/request-scope.ts holds the default. */
 export declare function envRequestDeadlineMs(): number | undefined;
 /** How many store calls may wait for one worker thread before the next is refused; store/sqlite/executor.ts holds the default. */
 export declare function envStoreQueueMax(): number | undefined;

package/dist/util/env.js

@@ -80,6 +80,7 @@ export function envTenant() {
 // Install and CLI switches.
 export function envSkipAutoIntegrations() { return isOne('HIPPO_SKIP_AUTO_INTEGRATIONS'); }
 export function envSkipPostinstall() { return isOne('HIPPO_SKIP_POSTINSTALL'); }
+export function envSkipSchedule() { return isOne('HIPPO_SKIP_SCHEDULE'); }
 export function envMcpStdio() { return isOne('HIPPO_MCP_STDIO'); }
 /** `1` or `true`, so `0` and `false` turn it off; `true` stays on for anyone who set it that way. */
 export function envRequireServer() { return isOneOrTrue('HIPPO_REQUIRE_SERVER'); }
@@ -101,7 +102,7 @@ export function envBodyTimeoutMs() { return positiveInt('HIPPO_BODY_TIMEOUT_MS')
 /** How long POST /v1/sleep lets its consolidation run; server/sleep-offload.ts holds the default. */
 export function envSleepTimeoutMs() { return positiveInt('HIPPO_SLEEP_TIMEOUT_MS'); }
 /** How long a /v1 or /mcp request may run before the server answers 504, and a stdio MCP
- * request before its timeout error; 0 for no deadline; server/deadline.ts holds the default. */
+ * request before its timeout error; 0 for no deadline; util/request-scope.ts holds the default. */
 export function envRequestDeadlineMs() { return nonNegativeInt('HIPPO_REQUEST_DEADLINE_MS'); }
 /** How many store calls may wait for one worker thread before the next is refused; store/sqlite/executor.ts holds the default. */
 export function envStoreQueueMax() { return positiveInt('HIPPO_STORE_QUEUE_MAX'); }

package/dist/util/format.d.ts

@@ -0,0 +1,3 @@
+/** A 0..1 fraction as a percentage with one decimal, e.g. 0.256 -> "25.6%". */
+export declare function pct(fraction: number): string;
+//# sourceMappingURL=format.d.ts.map

package/dist/util/format.js

@@ -0,0 +1,6 @@
+// Number-to-text helpers shared by report and eval output.
+/** A 0..1 fraction as a percentage with one decimal, e.g. 0.256 -> "25.6%". */
+export function pct(fraction) {
+    return (fraction * 100).toFixed(1) + '%';
+}
+//# sourceMappingURL=format.js.map

package/dist/util/hook-payload.d.ts

@@ -0,0 +1,8 @@
+/** A hook payload's non-empty `session_id`, or null; with `requiredSource`, also null when its `source` differs. */
+export declare function hookPayloadSessionId(stdinText: string | undefined, requiredSource?: string | null): string | null;
+/** A hook payload's string `field` as sent, or null when the payload or the field is missing or not a string. */
+export declare function hookPayloadString(stdinText: string | undefined, field: string): string | null;
+/** Whether a hook fired inside a sub-agent, the only payload with `agent_id` (https://code.claude.com/docs/en/hooks#common-input-fields).
+ *  Its `session_id` is the parent's, so a sub-agent's blocks and compactions must not count as the parent's. */
+export declare function isSubagentPayload(stdinText: string | undefined): boolean;
+//# sourceMappingURL=hook-payload.d.ts.map

package/dist/util/hook-payload.js

@@ -0,0 +1,37 @@
+import { isJsonObjectLiteral, isJsonString } from './json.js';
+/** A Claude Code hook payload on stdin as a JSON object; null when empty, malformed or not an object. */
+function parseHookPayload(stdinText) {
+    if (!stdinText || stdinText.trim() === '')
+        return null;
+    try {
+        // SAFETY: JSON.parse returns a JSON value by definition.
+        const payload = JSON.parse(stdinText.trim());
+        return isJsonObjectLiteral(payload) ? payload : null;
+    }
+    catch {
+        // Malformed is one of the null cases the docblock names.
+        return null;
+    }
+}
+/** A hook payload's non-empty `session_id`, or null; with `requiredSource`, also null when its `source` differs. */
+export function hookPayloadSessionId(stdinText, requiredSource = null) {
+    const payload = parseHookPayload(stdinText);
+    const sessionId = payload?.session_id;
+    if (!payload || !isJsonString(sessionId) || sessionId.trim() === '')
+        return null;
+    if (requiredSource !== null && payload.source !== requiredSource)
+        return null;
+    return sessionId;
+}
+/** A hook payload's string `field` as sent, or null when the payload or the field is missing or not a string. */
+export function hookPayloadString(stdinText, field) {
+    const value = parseHookPayload(stdinText)?.[field];
+    return isJsonString(value) ? value : null;
+}
+/** Whether a hook fired inside a sub-agent, the only payload with `agent_id` (https://code.claude.com/docs/en/hooks#common-input-fields).
+ *  Its `session_id` is the parent's, so a sub-agent's blocks and compactions must not count as the parent's. */
+export function isSubagentPayload(stdinText) {
+    const agentId = parseHookPayload(stdinText)?.agent_id;
+    return isJsonString(agentId) && agentId.trim() !== '';
+}
+//# sourceMappingURL=hook-payload.js.map

package/dist/util/http-retry.d.ts

@@ -4,6 +4,8 @@ export interface RetryPolicy {
     timeoutMs: number;
     /** Total attempts including the first. */
     attempts?: number;
+    /** Limit on the whole call, waits included: an attempt is cut short at it and no retry starts whose wait would reach it. */
+    totalMs?: number;
     baseDelayMs?: number;
     /** A Retry-After longer than this hands the response back, so a caller with its own long pause keeps it. */
     maxDelayMs?: number;
@@ -15,9 +17,13 @@ export interface RetryPolicy {
     /** Replaces the timer between attempts. A caller `signal` that aborts still ends the wait at once. */
     sleep?: (ms: number) => Promise<void>;
     random?: () => number;
+    /** Replaces the clock `totalMs` is measured on. */
+    now?: () => number;
 }
 /** LLM calls (consolidation refine, DAG summaries, fact extraction) share one budget; `HIPPO_LLM_TIMEOUT_MS` overrides it. */
 export declare function llmTimeoutMs(): number;
+/** One LLM call with its retries: two full attempts and the longest wait between them, where three slow failures would hold a sleep for 3x the timeout. */
+export declare function llmTotalMs(): number;
 export declare function isRetryableStatus(status: number): boolean;
 /** Retry-After as milliseconds: delta-seconds or an HTTP date; null when absent or unreadable. */
 export declare function parseRetryAfterMs(header: string | null, now?: number): number | null;

package/dist/util/http-retry.js

@@ -1,13 +1,19 @@
 /** One retry policy for outbound HTTP: a timeout on every attempt, backoff on 429 and 5xx, and on a dropped connection where a replay is safe. */
+import { MINUTE_MS } from './time.js';
 import { envLlmTimeoutMs } from './env.js';
+import { errorCode, errorFields, log } from './log.js';
 const DEFAULT_ATTEMPTS = 3;
 const DEFAULT_BASE_DELAY_MS = 250;
 const DEFAULT_MAX_DELAY_MS = 8_000;
-const DEFAULT_LLM_TIMEOUT_MS = 60_000;
+const DEFAULT_LLM_TIMEOUT_MS = MINUTE_MS;
 /** LLM calls (consolidation refine, DAG summaries, fact extraction) share one budget; `HIPPO_LLM_TIMEOUT_MS` overrides it. */
 export function llmTimeoutMs() {
     return envLlmTimeoutMs() ?? DEFAULT_LLM_TIMEOUT_MS;
 }
+/** One LLM call with its retries: two full attempts and the longest wait between them, where three slow failures would hold a sleep for 3x the timeout. */
+export function llmTotalMs() {
+    return 2 * llmTimeoutMs() + DEFAULT_MAX_DELAY_MS;
+}
 export function isRetryableStatus(status) {
     return status === 429 || (status >= 500 && status <= 599);
 }
@@ -39,6 +45,22 @@ function isIdempotent(method) {
     const verb = (method ?? 'GET').toUpperCase();
     return verb === 'GET' || verb === 'HEAD';
 }
+/** Host plus pathname only: a query string can carry a key. */
+function redactedTarget(url) {
+    try {
+        const u = new URL(url);
+        return `${u.host}${u.pathname}`;
+    }
+    catch {
+        return 'unparseable-url';
+    }
+}
+function logRetry(init, url, reason, attempt, attempts, delayMs) {
+    // Debug: an attempt that may still succeed is not a warning, and the caller reports the final failure.
+    log.debug('http retry', {
+        method: (init.method ?? 'GET').toUpperCase(), target: redactedTarget(url), reason, attempt: `${attempt}/${attempts}`, delayMs: Math.round(delayMs),
+    });
+}
 // `cancel` clears the timer, so a wait the caller left does not keep the process alive.
 const timerSleep = (ms, cancel) => new Promise((resolve) => {
     const timer = setTimeout(resolve, ms);
@@ -71,13 +93,16 @@ export async function fetchWithRetry(url, init, policy) {
     const random = policy.random ?? Math.random;
     const retryOn = policy.retryOn ?? ((res) => isRetryableStatus(res.status));
     const retryTransport = policy.retryTransport ?? isIdempotent(init.method);
+    const now = policy.now ?? Date.now;
+    const deadline = policy.totalMs === undefined ? Infinity : now() + policy.totalMs;
+    const fitsBudget = (delayMs) => now() + delayMs < deadline;
     // Jitter over the upper half keeps parallel callers from retrying in lockstep.
     const backoffMs = (attempt) => {
         const ceiling = Math.min(maxDelayMs, baseDelayMs * 2 ** (attempt - 1));
         return ceiling / 2 + random() * (ceiling / 2);
     };
     for (let attempt = 1;; attempt++) {
-        const timeout = AbortSignal.timeout(policy.timeoutMs);
+        const timeout = AbortSignal.timeout(Math.max(1, Math.min(policy.timeoutMs, deadline - now())));
         const signal = init.signal ? AbortSignal.any([init.signal, timeout]) : timeout;
         let res;
         try {
@@ -87,7 +112,11 @@ export async function fetchWithRetry(url, init, policy) {
             // The caller's own abort is a decision, not a fault, so it ends the call.
             if (!retryTransport || attempt >= attempts || init.signal?.aborted || !isTransientTransportError(err))
                 throw err;
-            await backoffWait(backoffMs(attempt), policy.sleep, init.signal);
+            const delay = backoffMs(attempt);
+            if (!fitsBudget(delay))
+                throw err;
+            logRetry(init, url, errorCode(err) || (err instanceof Error ? err.name : 'transport'), attempt, attempts, delay);
+            await backoffWait(delay, policy.sleep, init.signal);
             continue;
         }
         if (!retryOn(res) || attempt >= attempts)
@@ -95,9 +124,18 @@ export async function fetchWithRetry(url, init, policy) {
         const retryAfter = parseRetryAfterMs(res.headers.get('retry-after'));
         if (retryAfter !== null && retryAfter > maxDelayMs)
             return res;
+        const delay = retryAfter ?? backoffMs(attempt);
+        if (!fitsBudget(delay))
+            return res;
         // Frees the pooled socket before the next attempt.
-        await res.body?.cancel();
-        await backoffWait(retryAfter ?? backoffMs(attempt), policy.sleep, init.signal);
+        try {
+            await res.body?.cancel();
+        }
+        catch (err) {
+            log.debug('http retry: body cancel failed', errorFields(err));
+        }
+        logRetry(init, url, `status ${res.status}`, attempt, attempts, delay);
+        await backoffWait(delay, policy.sleep, init.signal);
     }
 }
 //# sourceMappingURL=http-retry.js.map

package/dist/util/http-util.d.ts

@@ -1,7 +1,6 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 export declare function isHeaderString(value: string | string[] | undefined): value is string;
 export declare const MAX_BODY_BYTES: number;
-export declare const MAX_ID_LEN = 256;
 export declare const JSON_HEADERS: {
     readonly 'content-type': "application/json";
 };
@@ -21,16 +20,9 @@ export declare class BodyTooLargeError extends Error {
 /** The body did not arrive in time. Its own class so mapApiError answers 408 and the server drops the socket. */
 export declare class BodyTimeoutError extends Error {
 }
-/** The status and client-facing message for one failed request. */
-export interface ApiErrorReply {
-    status: number;
-    message: string;
-}
 export declare const INTERNAL_ERROR_MESSAGE = "internal server error";
 /** The reply when a request under another store reaches code that still opens hippo.db. */
 export declare const STORE_NOT_PORTED_MESSAGE = "store_not_ported";
-/** Maps by class so rewording a message never moves a status; an untyped error is a 500 whose text stays in the server log. */
-export declare function mapApiError<E>(err: E): ApiErrorReply;
 /** Serialises before the head goes out, so a body that is not JSON still reaches the caller's error reply. */
 export declare function sendJson<T>(res: ServerResponse, status: number, body: T): void;
 /** How long any route waits for a request body, so a client that sends headers and then stalls cannot hold a request open: 30 s, or HIPPO_BODY_TIMEOUT_MS. */

package/dist/util/http-util.js

@@ -1,5 +1,3 @@
-import { ApiError } from '../core/api-errors.js';
-import { SqliteBlockedError } from './sqlite-blocked.js';
 import { envBodyTimeoutMs } from './env.js';
 // Leaf module shared by server.ts and the connector webhook receivers; it must not import either.
 // node:http header values are `string | string[] | undefined` (never a bare
@@ -15,8 +13,6 @@ function sizeLabel(bytes) {
 }
 // How long a refused upload is still read and discarded after its reply, so a client that never stops cannot hold the socket.
 const REFUSED_UPLOAD_LINGER_MS = 2000;
-// Cap for id-shaped request fields (ids, tenant, session, scope, class): far above real values, small enough to bound logs and indexes.
-export const MAX_ID_LEN = 256;
 export const JSON_HEADERS = { 'content-type': 'application/json' };
 export class HttpError extends Error {
     status;
@@ -43,22 +39,6 @@ export class BodyTimeoutError extends Error {
 export const INTERNAL_ERROR_MESSAGE = 'internal server error';
 /** The reply when a request under another store reaches code that still opens hippo.db. */
 export const STORE_NOT_PORTED_MESSAGE = 'store_not_ported';
-/** Maps by class so rewording a message never moves a status; an untyped error is a 500 whose text stays in the server log. */
-export function mapApiError(err) {
-    // An add-on can build an HttpError from any number, and writeHead throws on one outside 100-999.
-    if (err instanceof HttpError && !(Number.isInteger(err.status) && err.status >= 100 && err.status <= 999)) {
-        return { status: 500, message: INTERNAL_ERROR_MESSAGE };
-    }
-    if (err instanceof HttpError || err instanceof ApiError)
-        return { status: err.status, message: err.message };
-    if (err instanceof BodyTooLargeError)
-        return { status: 413, message: err.message };
-    if (err instanceof BodyTimeoutError)
-        return { status: 408, message: err.message };
-    if (err instanceof SqliteBlockedError)
-        return { status: 501, message: STORE_NOT_PORTED_MESSAGE };
-    return { status: 500, message: INTERNAL_ERROR_MESSAGE };
-}
 /** Serialises before the head goes out, so a body that is not JSON still reaches the caller's error reply. */
 export function sendJson(res, status, body) {
     const text = JSON.stringify(body);
@@ -121,7 +101,16 @@ export function isCrossSite(req) {
     if (site !== undefined && site !== 'same-origin' && site !== 'none')
         return true;
     const origin = req.headers.origin;
-    return origin !== undefined && origin !== `http://${req.headers.host}`;
+    return origin !== undefined && originHost(origin) !== req.headers.host;
+}
+// Scheme is ignored so an https page behind a TLS-terminating proxy still matches its own Host.
+function originHost(origin) {
+    try {
+        return new URL(origin).host;
+    }
+    catch {
+        return null;
+    }
 }
 // A webhook route takes no key, so anyone holding a signature header could otherwise keep a socket open with a body that never ends.
 const WEBHOOK_BODY_DEADLINE_MS = 10_000;

package/dist/util/limits.d.ts

@@ -0,0 +1,7 @@
+export declare const MAX_ID_LEN = 256;
+export declare const DEFAULT_LIST_LIMIT = 100;
+export declare const MAX_LIST_LIMIT = 1000;
+/** The one list-limit rule: absent means the default; a positive integer up to the ceiling passes.
+ * Anything else returns undefined, so each surface words its own error. */
+export declare function resolveListLimit(requested: number | undefined, defaultLimit?: number, maxLimit?: number): number | undefined;
+//# sourceMappingURL=limits.d.ts.map

package/dist/util/limits.js

@@ -0,0 +1,14 @@
+// Cap for id-shaped request fields (ids, tenant, session, scope, class): far above real values, small enough to bound logs and indexes.
+export const MAX_ID_LEN = 256;
+// Page size every list surface (CLI, HTTP, store) falls back to when the caller names none.
+export const DEFAULT_LIST_LIMIT = 100;
+// Ceiling for a caller-named list page; SQLite `LIMIT ?` and one response's size bound it, and every list surface shares it.
+export const MAX_LIST_LIMIT = 1000;
+/** The one list-limit rule: absent means the default; a positive integer up to the ceiling passes.
+ * Anything else returns undefined, so each surface words its own error. */
+export function resolveListLimit(requested, defaultLimit = DEFAULT_LIST_LIMIT, maxLimit = Infinity) {
+    if (requested === undefined)
+        return defaultLimit;
+    return Number.isInteger(requested) && requested > 0 && requested <= maxLimit ? requested : undefined;
+}
+//# sourceMappingURL=limits.js.map

package/dist/util/log.d.ts

@@ -30,6 +30,10 @@ export declare const log: {
 };
 /** Message for a caught value of unknown shape. `cause` names the sanctioned unknown-input case (error-cause enrichment). */
 export declare function errorMessage(cause: unknown): string;
+/** One post-compact failure, told once to the hook's output (`say`) and once to the structured log. */
+export declare function reportCompactionFailure(say: (message: string) => void, step: string, reason: string): void;
+/** The string `code` of a caught value (an errno name such as EACCES), or '' when it has none. */
+export declare function errorCode(cause: unknown): string;
 /** Test hook: forget which once-keys have fired. */
 export declare function resetLogOnce(): void;
 export {};

package/dist/util/log.js

@@ -83,6 +83,15 @@ export const log = {
 export function errorMessage(cause) {
     return cause instanceof Error ? cause.message : String(cause);
 }
+/** One post-compact failure, told once to the hook's output (`say`) and once to the structured log. */
+export function reportCompactionFailure(say, step, reason) {
+    say(`${step} failed: ${reason}`);
+    log.error(`post-compact: ${step} failed: ${reason}`);
+}
+/** The string `code` of a caught value (an errno name such as EACCES), or '' when it has none. */
+export function errorCode(cause) {
+    return cause instanceof Error && 'code' in cause ? String(cause.code) : '';
+}
 /** Test hook: forget which once-keys have fired. */
 export function resetLogOnce() {
     onceKeys.clear();

package/dist/util/request-scope.d.ts

@@ -6,6 +6,8 @@ export interface RequestScope {
     /** Set for a served request that must be answered by a given time. */
     readonly deadline?: RequestDeadline | undefined;
 }
+/** How long a request may run: 120 s, or HIPPO_REQUEST_DEADLINE_MS, where 0 turns the deadline off. */
+export declare function requestDeadlineMs(): number;
 /** When a request must be answered, and the store calls it still waits on: the store ends each of those soon after `at`, with the outcome only it knows. */
 export declare class RequestDeadline {
     #private;
@@ -14,7 +16,7 @@ export declare class RequestDeadline {
     constructor(at: number);
     /** Counts `call` as one the request waits on until it settles. */
     track<T>(call: Promise<T>): Promise<T>;
-    /** Runs `fn` now, or once the last store call the request waits on has settled. */
+    /** Runs `fn` now, or once the last store call the request waits on has settled; every function registered meanwhile runs, in order. */
     onceIdle(fn: () => void): void;
 }
 export declare const requestScopes: AsyncLocalStorage<RequestScope>;

package/dist/util/request-scope.js

@@ -1,11 +1,17 @@
 // The one ambient scope of a request. A leaf module, so the logger can read the request id without importing the store layer.
 import { AsyncLocalStorage } from 'node:async_hooks';
+import { envRequestDeadlineMs } from './env.js';
+const DEFAULT_REQUEST_DEADLINE_MS = 120_000;
+/** How long a request may run: 120 s, or HIPPO_REQUEST_DEADLINE_MS, where 0 turns the deadline off. */
+export function requestDeadlineMs() {
+    return envRequestDeadlineMs() ?? DEFAULT_REQUEST_DEADLINE_MS;
+}
 /** When a request must be answered, and the store calls it still waits on: the store ends each of those soon after `at`, with the outcome only it knows. */
 export class RequestDeadline {
     /** Epoch milliseconds. */
     at;
     #storeCalls = 0;
-    #whenIdle;
+    #whenIdle = [];
     constructor(at) {
         this.at = at;
     }
@@ -16,19 +22,18 @@ export class RequestDeadline {
             this.#storeCalls -= 1;
             if (this.#storeCalls > 0)
                 return;
-            const idle = this.#whenIdle;
-            this.#whenIdle = undefined;
-            idle?.();
+            for (const idle of this.#whenIdle.splice(0))
+                idle();
         };
         call.then(done, done);
         return call;
     }
-    /** Runs `fn` now, or once the last store call the request waits on has settled. */
+    /** Runs `fn` now, or once the last store call the request waits on has settled; every function registered meanwhile runs, in order. */
     onceIdle(fn) {
         if (this.#storeCalls === 0)
             fn();
         else
-            this.#whenIdle = fn;
+            this.#whenIdle.push(fn);
     }
 }
 export const requestScopes = new AsyncLocalStorage();

package/dist/util/secret-detect.js

@@ -28,7 +28,12 @@ const SECRET_PATTERNS = [
     { name: 'sk-underscore-key', re: /\bsk_[A-Za-z0-9]+_[A-Za-z0-9_]{6,}\b/ },
     // Value needs 12+ token-safe chars and a digit, or `token = estimateTokens(...)` and user:password@ templates would hide code lessons from ambient context.
     // Secret names end in the keyword (dbPassword), so the match opens there, no prefix scan; pwd and pass need a _ (OLDPWD, bypass are not secrets).
-    { name: 'secret-assignment', re: /(?:(?:api[_-]?key|access[_-]?key|private[_-]?key|secret|token|passw(?:or)?d|(?<=_)(?:pwd|pass))(?:[_-]?(?:key(?:[_-]?base)?|value|secret))?['"]?\s*(?::=?|=>?)\s*['"]?|(?<=--)password(?:=|\s+))(?=[A-Za-z0-9_\-+/]*\d)[A-Za-z0-9_\-+/=]{12,}/i },
+    {
+        name: 'secret-assignment',
+        re: new RegExp(String.raw `(?:(?:api[_-]?key|access[_-]?key|private[_-]?key|secret|token|passw(?:or)?d|(?<=_)(?:pwd|pass))` +
+            String.raw `(?:[_-]?(?:key(?:[_-]?base)?|value|secret))?['"]?\s*(?::=?|=>?)\s*['"]?|(?<=--)password(?:=|\s+))` +
+            String.raw `(?=[A-Za-z0-9_\-+/]*\d)[A-Za-z0-9_\-+/=]{12,}`, 'i'),
+    },
     { name: 'url-password', re: /(?<=[A-Za-z0-9]:\/\/)[^\s/:@?#]*:(?=[^\s/@?#]*\d)[^\s/@?#]+(?=@)/ },
 ];
 const KEYISH_CONTEXT_RE = /key|token|secret|credential|bearer|auth|password/i;

package/dist/util/sqlite-blocked.d.ts

@@ -13,4 +13,6 @@ export declare class OtherStoreFolderError extends SqliteBlockedError {
     readonly markerPath: string;
     constructor(storeKind: string, markerPath: string);
 }
+/** First line of a best-effort catch around a hippo.db open: an unported path must fail closed, not fall back silently. */
+export declare function rethrowIfSqliteBlocked<E>(err: E): void;
 //# sourceMappingURL=sqlite-blocked.d.ts.map

package/dist/util/sqlite-blocked.js

@@ -26,4 +26,9 @@ export class OtherStoreFolderError extends SqliteBlockedError {
         this.name = 'OtherStoreFolderError';
     }
 }
+/** First line of a best-effort catch around a hippo.db open: an unported path must fail closed, not fall back silently. */
+export function rethrowIfSqliteBlocked(err) {
+    if (err instanceof SqliteBlockedError)
+        throw err;
+}
 //# sourceMappingURL=sqlite-blocked.js.map

package/dist/util/stream-tee.d.ts

@@ -0,0 +1,3 @@
+/** Mirrors every stdout and stderr chunk to `logFile` until the returned restore runs; an append failure warns once and never stops the real write. */
+export declare function teeStdStreams(logFile: string): () => void;
+//# sourceMappingURL=stream-tee.d.ts.map

package/dist/util/stream-tee.js

@@ -0,0 +1,35 @@
+import * as fs from 'fs';
+import { errorMessage, log } from './log.js';
+/** Mirrors every stdout and stderr chunk to `logFile` until the returned restore runs; an append failure warns once and never stops the real write. */
+export function teeStdStreams(logFile) {
+    const origStdoutWrite = process.stdout.write.bind(process.stdout);
+    const origStderrWrite = process.stderr.write.bind(process.stderr);
+    let warned = false;
+    const tee = (chunk) => {
+        try {
+            fs.appendFileSync(logFile, chunk instanceof Uint8Array ? Buffer.from(chunk).toString('utf8') : chunk, 'utf8');
+        }
+        catch (err) {
+            if (warned)
+                return;
+            warned = true;
+            log.warn(`log file ${logFile} is no longer writable; output continues without it: ${errorMessage(err)}`);
+        }
+    };
+    const wrapWrite = (origWrite) => {
+        const wrapped = (...args) => {
+            tee(args[0]);
+            // SAFETY: forwarding the exact arguments the real overloaded `write` received is safe; `StreamWriteArgs` is the union of both overloads' parameter lists.
+            return origWrite(...args);
+        };
+        // SAFETY: `wrapped` matches both real `write` overload shapes; TS cannot verify one implementation covers an overloaded type.
+        return wrapped;
+    };
+    process.stdout.write = wrapWrite(origStdoutWrite);
+    process.stderr.write = wrapWrite(origStderrWrite);
+    return () => {
+        process.stdout.write = origStdoutWrite;
+        process.stderr.write = origStderrWrite;
+    };
+}
+//# sourceMappingURL=stream-tee.js.map

package/dist/util/time.d.ts

@@ -1,2 +1,6 @@
 export declare const DAY_MS = 86400000;
+export declare const MINUTE_MS = 60000;
+export declare const HOUR_MS = 3600000;
+/** One 365-day year in seconds. */
+export declare const YEAR_S = 31536000;
 //# sourceMappingURL=time.d.ts.map

package/dist/util/time.js

@@ -1,3 +1,7 @@
 // Durations in the base layer, so no layer imports a higher one for a constant.
 export const DAY_MS = 86_400_000;
+export const MINUTE_MS = 60_000;
+export const HOUR_MS = 3_600_000;
+/** One 365-day year in seconds. */
+export const YEAR_S = 31_536_000;
 //# sourceMappingURL=time.js.map

package/dist/util/version.d.ts

@@ -1,6 +1,6 @@
 /** Single source of truth for the package version, written by scripts/sync-version.mjs; never edit by hand. Read by the db rollback guard, /health, MCP.
  * A constant, not a runtime package.json read: the published bundle may lack package.json on a path ESM can resolve. */
-export declare const PACKAGE_VERSION = "1.71.0";
+export declare const PACKAGE_VERSION = "1.72.0";
 /** The floor a store takes on its first expiring key: the first release with schema
  * v53, set by hand in that release; scripts/check-expiring-keys-floor.mjs gates it. */
 export declare const EXPIRING_KEYS_MIN_BINARY = "1.64.0";

package/dist/util/version.js

@@ -1,6 +1,6 @@
 /** Single source of truth for the package version, written by scripts/sync-version.mjs; never edit by hand. Read by the db rollback guard, /health, MCP.
  * A constant, not a runtime package.json read: the published bundle may lack package.json on a path ESM can resolve. */
-export const PACKAGE_VERSION = '1.71.0';
+export const PACKAGE_VERSION = '1.72.0';
 /** The floor a store takes on its first expiring key: the first release with schema
  * v53, set by hand in that release; scripts/check-expiring-keys-floor.mjs gates it. */
 export const EXPIRING_KEYS_MIN_BINARY = '1.64.0';

package/extensions/openclaw-plugin/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "hippo-memory",
   "name": "Hippo Memory",
   "description": "Make your agent's memory work like a brain. Hippo is long-term memory for coding agents.",
-  "version": "1.71.0",
+  "version": "1.72.0",
 
   "configSchema": {
     "type": "object",