hippo-memory 1.71.0 → 1.72.0

package/dist/capture/failure-caller.js

@@ -1,14 +1,21 @@
-// PostToolUseFailure for a caller on another machine: the lesson and its log row carry the caller's owner and project, and a retried request id gets the first answer.
+// PostToolUseFailure for a caller on another machine: the lesson and its log row carry the caller's owner and project, and a retried
+// request id gets the first answer.
 import { BadRequestError } from '../core/api-errors.js';
 import { storeLesson } from './capture-error.js';
-import { recordFailure, requestOutcome, settleFailureOutcome } from '../store/failure-log.js';
+import { recordFailureAt, requestOutcomeAt, settleFailureOutcomeAt } from '../store/failure-log-at.js';
 import { errorMessage, log } from '../util/log.js';
 import { scrubForSharing } from './share-scrub.js';
 import { truncateCodePointSafe } from '../util/transcript-tail.js';
-import { assertRequestId, bindCaller, withCallerDb } from './caller-session.js';
+import { assertRequestId, bindCaller } from './caller-session.js';
 import { FAILURE_TEXT_MAX_CHARS, failureHash } from './failure-reading.js';
 const SKIPS = { 'skipped-interrupt': true, 'skipped-routine': true, 'skipped-invalid': true };
-const ROUTINE_RULES = { declined: true, 'os-permission': true, 'no-match': true, 'search-tool': true, 'quiet-exit': true };
+const ROUTINE_RULES = {
+    declined: true,
+    'os-permission': true,
+    'no-match': true,
+    'search-tool': true,
+    'quiet-exit': true,
+};
 /** The shapes lessonFromFailure gives: text for a lesson or a routine skip, none for an interrupt or an unreadable payload, a rule only on a routine skip. */
 function checkedFailure(req) {
     assertRequestId(req.requestId);
@@ -35,7 +42,7 @@ function checkedFailure(req) {
 export function captureFailureForCaller(ctx, req) {
     const failure = checkedFailure(req);
     const key = bindCaller(ctx, req.sessionId, req.project);
-    const earlier = withCallerDb(ctx, (db) => requestOutcome(db, ctx.tenantId, req.requestId, req.sessionId));
+    const earlier = requestOutcomeAt(ctx.hippoRoot, ctx.tenantId, req.requestId, req.sessionId);
     // A retry after a lost reply gets the first answer and writes nothing; one whose store failed tries the store again.
     if (earlier !== null && earlier !== 'store-failed')
         return { outcome: earlier };
@@ -54,17 +61,15 @@ export function captureFailureForCaller(ctx, req) {
 /** Runs after the outcome in its own try, so a log error never hides the store's error or its outcome. */
 function logOutcome(ctx, req, key, outcome, retried) {
     try {
-        withCallerDb(ctx, (db) => {
-            // The request id allows one row, so a retry rewrites the first try's outcome.
-            if (retried) {
-                settleFailureOutcome(db, ctx.tenantId, req.requestId, outcome);
-                return;
-            }
-            recordFailure(db, {
-                tenantId: ctx.tenantId, sessionId: req.sessionId, tool: req.tool, outcome, rule: req.rule,
-                sigHash: req.text?.trim() ? failureHash(req.text) : null, detailHash: req.detailHash,
-                ownerSubject: key.owner, originProject: req.project.name, requestId: req.requestId,
-            });
+        // The request id allows one row, so a retry rewrites the first try's outcome.
+        if (retried) {
+            settleFailureOutcomeAt(ctx.hippoRoot, ctx.tenantId, req.requestId, outcome);
+            return;
+        }
+        recordFailureAt(ctx.hippoRoot, {
+            tenantId: ctx.tenantId, sessionId: req.sessionId, tool: req.tool, outcome, rule: req.rule,
+            sigHash: req.text?.trim() ? failureHash(req.text) : null, detailHash: req.detailHash,
+            ownerSubject: key.owner, originProject: req.project.name, requestId: req.requestId,
         });
     }
     catch (err) {

package/dist/capture/failure-reading.d.ts

@@ -22,7 +22,8 @@ export declare function payloadString(payload: JsonValue, key: 'session_id' | 't
 export declare function failureSignature(text: string): string;
 /** The hash the failure log stores for a lesson text or a detail; one function so every writer counts repeats alike. */
 export declare function failureHash(text: string): string;
-/** The memory text for a failure payload, or why it is not stored; a routine skip keeps its text for the log. `scrub` runs before the cap, as a mask can be longer than what it hides. Pure. */
+/** The memory text for a failure payload, or why it is not stored; a routine skip keeps its text for the log. `scrub` runs before the
+ * cap, as a mask can be longer than what it hides. Pure. */
 export declare function lessonFromFailure(payload: JsonValue, scrub?: (text: string) => string): FailureReading;
 /** A failure as it may leave the machine: the capped lesson text and the detail's hash, never the untruncated detail. */
 export interface FailureReport {

package/dist/capture/failure-reading.js

@@ -3,7 +3,7 @@ import { redactSecretsStrict } from '../util/secret-detect.js';
 import { scrubForSharing } from './share-scrub.js';
 import { blockHash } from '../util/token-text.js';
 import { truncateCodePointSafe } from '../util/transcript-tail.js';
-import { isJsonObjectLiteral } from '../util/json.js';
+import { isJsonObjectLiteral, isJsonString } from '../util/json.js';
 const COMMAND_HEAD_WORDS = 2;
 /** The longest lesson text a reading gives, so a check of a sent one imports it instead of copying it. */
 export const FAILURE_TEXT_MAX_CHARS = 200;
@@ -19,15 +19,12 @@ const QUIET_EXIT_1 = /^\s*(?:grep|rg|egrep|fgrep|find|test|\[|diff|cmp|git diff|
 // Claude Code's tool names, then the Copilot CLI's and VS Code's; tests/copilot-failure-reading.test.ts cites where each comes from.
 const SEARCH_TOOLS = new Set(['Grep', 'Glob', 'grep', 'glob', 'rg', 'grep_search', 'file_search', 'semantic_search']);
 const SHELL_TOOLS = new Set(['Bash', 'bash', 'powershell', 'run_in_terminal']);
-function isString(v) {
-    return v !== undefined && v !== null && v.constructor === String;
-}
 /** A non-blank string field of the payload, or null. */
 export function payloadString(payload, key) {
     if (!isJsonObjectLiteral(payload))
         return null;
     const value = payload[key];
-    return isString(value) && value.trim() !== '' ? value : null;
+    return isJsonString(value) && value.trim() !== '' ? value : null;
 }
 /** Normalised form used to spot repeats. The failure log keeps only its hash, so changing it breaks repeat counts. */
 export function failureSignature(text) {
@@ -37,7 +34,8 @@ export function failureSignature(text) {
 export function failureHash(text) {
     return blockHash(failureSignature(text));
 }
-/** The memory text for a failure payload, or why it is not stored; a routine skip keeps its text for the log. `scrub` runs before the cap, as a mask can be longer than what it hides. Pure. */
+/** The memory text for a failure payload, or why it is not stored; a routine skip keeps its text for the log. `scrub` runs before the
+ * cap, as a mask can be longer than what it hides. Pure. */
 export function lessonFromFailure(payload, scrub = (text) => text) {
     if (!isJsonObjectLiteral(payload))
         return { skip: 'skipped-invalid', text: null, detail: null };
@@ -45,12 +43,12 @@ export function lessonFromFailure(payload, scrub = (text) => text) {
     const p = payload;
     if (p.is_interrupt === true)
         return { skip: 'skipped-interrupt', text: null, detail: null };
-    if (!isString(p.error) || p.error.trim().length < 12)
+    if (!isJsonString(p.error) || p.error.trim().length < 12)
         return { skip: 'skipped-invalid', text: null, detail: null };
-    const tool = isString(p.tool_name) ? p.tool_name : 'tool';
+    const tool = isJsonString(p.tool_name) ? p.tool_name : 'tool';
     const error = redactSecretsStrict(p.error.replace(/\s+/g, ' ').trim());
     const text = truncateCodePointSafe(scrub(`${tool}: ${error}`), FAILURE_TEXT_MAX_CHARS);
-    const command = isJsonObjectLiteral(p.tool_input) && isString(p.tool_input['command']) ? p.tool_input['command'].replace(LEADING_CD, '') : '';
+    const command = isJsonObjectLiteral(p.tool_input) && isJsonString(p.tool_input['command']) ? p.tool_input['command'].replace(LEADING_CD, '') : '';
     const head = command.trim().split(/\s+/).slice(0, COMMAND_HEAD_WORDS).join(' ');
     const detail = `${tool}${head ? ` ${head}` : ''}: ${error}`;
     const routine = (rule) => ({ skip: 'skipped-routine', rule, text, detail });

package/dist/capture/pre-compact-caller.js

@@ -1,7 +1,8 @@
-import { markSnapshotSaved, PRE_COMPACT_INSTRUCTION, startCompaction } from './compaction-record.js';
+import { PRE_COMPACT_INSTRUCTION } from './compaction-record.js';
+import { markSnapshotSavedAt, startCompactionAt } from '../store/compaction-caller.js';
 import { errorMessage, log } from '../util/log.js';
 import { loadActiveTaskSnapshot, saveActiveTaskSnapshot } from '../store/sessions.js';
-import { assertTrigger, bindCaller, callerInHoldout, checkedWorkingState, withCallerDb } from './caller-session.js';
+import { assertTrigger, bindCaller, callerInHoldout, checkedWorkingState } from './caller-session.js';
 import { mergeWorkingState } from './working-state.js';
 /** A failed step is logged and the instruction still goes out, as the local hook prints it before any store work. */
 function logged(what, fn) {
@@ -20,10 +21,10 @@ export function preCompactForCaller(ctx, req) {
     if (callerInHoldout(ctx, req.sessionId))
         return { stdout: '' };
     const start = { sessionId: req.sessionId, originProject: req.project.name, trigger: req.trigger, cwd: null, transcriptPath: null };
-    const recordId = logged('compaction record not started', () => withCallerDb(ctx, (db) => startCompaction(db, ctx.tenantId, start)));
+    const recordId = logged('compaction record not started', () => startCompactionAt(ctx.hippoRoot, ctx.tenantId, start));
     if (state !== null && saveOwnerSnapshot(ctx, req.sessionId, key, state) && recordId !== null) {
         // Marked under ctx.tenantId, which the environment's tenant may not be.
-        logged('compaction record not marked with its snapshot', () => withCallerDb(ctx, (db) => markSnapshotSaved(db, ctx.tenantId, recordId)));
+        logged('compaction record not marked with its snapshot', () => markSnapshotSavedAt(ctx.hippoRoot, ctx.tenantId, recordId));
     }
     return { stdout: PRE_COMPACT_INSTRUCTION };
 }

package/dist/capture/session-digest.js

@@ -10,9 +10,9 @@ import { USER_SEGMENT } from '../util/home-path.js';
 import { errorMessage } from '../util/log.js';
 import { SESSION_DIGEST_TAG } from '../core/session-digest-row.js';
 import { createMemory, Layer } from '../core/memory.js';
-import { RejectedValueError } from '../store/rejection.js';
+import { RejectedValueError } from '../core/api-errors.js';
 import { maskEmails, redactSecretsStrict } from '../util/secret-detect.js';
-import { isInitialized } from '../store/open.js';
+import { isInitialized } from '../core/project-identity.js';
 import { writeEntry } from '../store/entry-writes.js';
 import { loadLiveContentsBySourceAndTag } from '../store/entry-reads.js';
 import { SNAPSHOT_AMBIENT_MAX_AGE_MS } from '../store/sessions.js';
@@ -336,7 +336,8 @@ const ANCHORS = [
     /(?:^|\s)#\d+\b/,
 ];
 /** Each marker states a cause or a choice, the part of a lesson that transfers. */
-const MARKERS = /\b(?:because|caused by|due to|root cause|the (?:bug|issue|problem) was|fail(?:s|ed) when|so that|otherwise|instead of|rather than|switched to|decided|chose|must|never|always|do not)\b/i;
+const MARKERS = new RegExp('\\b(?:because|caused by|due to|root cause|the (?:bug|issue|problem) was|fail(?:s|ed) when|so that|otherwise|' +
+    'instead of|rather than|switched to|decided|chose|must|never|always|do not)\\b', 'i');
 const FENCE = /^\s*(`{3,}|~{3,})/;
 const STRUCTURE_LINE = /^\s*(?:#{1,6}\s|\||>|([-*_])(?:\s*\1){2,}\s*$)/;
 const PROTECTED = /`[^`\n]+`|\b(?:e\.g|i\.e)\./gi;

package/dist/capture/session-end-caller.js

@@ -11,7 +11,8 @@ function checkedEvidence(evidence) {
     const { gitRef = null, dirtyTree = null, testStatus = null } = evidence;
     // `git rev-parse HEAD` gives 40 hex, or 64 in a SHA-256 repository.
     if (gitRef !== null && !/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/.test(gitRef))
-        throw new BadRequestError('evidence gitRef: 40 or 64 lowercase hex characters or null');
+        throw new BadRequestError('evidence gitRef: 40 or 64 lowercase hex characters or ' +
+            'null');
     if (dirtyTree !== null && dirtyTree !== true && dirtyTree !== false)
         throw new BadRequestError('evidence dirtyTree: true, false or null');
     if (testStatus !== null && !TEST_STATUSES.has(testStatus))

package/dist/capture/session-worker.js

@@ -2,12 +2,11 @@
 // Two fast replies would otherwise start two workers that both read the dedupe keys before either writes.
 import * as fs from 'fs';
 import * as path from 'path';
-import { createHash } from 'node:crypto';
-import { homeDir } from '../hooks/shared.js';
+import { homeDir } from '../util/agent-homes.js';
 import { errorMessage, log as logger } from '../util/log.js';
 import { isObjectLike, isStringValue } from '../core/capture-contract.js';
 import { SESSION_ID_RE } from './copilot-transcript.js';
-import { FINGERPRINT_HEX_CHARS } from '../util/token-text.js';
+import { blockHash } from '../util/token-text.js';
 /** Null for a missing id or one that could climb out of the sessions folder. */
 function sessionStateFiles(sessionId) {
     if (sessionId === null || !SESSION_ID_RE.test(sessionId))
@@ -135,7 +134,7 @@ export async function runSessionWorker(sessionId, mode, work) {
     }
 }
 function turnKey(turn) {
-    return createHash('sha256').update(`${turn.role}\n${turn.text}`).digest('hex').slice(0, FINGERPRINT_HEX_CHARS);
+    return blockHash(`${turn.role}\n${turn.text}`);
 }
 /** The cursor position after `turns`: how many there were and a hash of the last. */
 export function turnPosition(turns) {

package/dist/capture/transcript.d.ts

@@ -9,7 +9,8 @@ interface TranscriptLineFlags {
 interface TranscriptMessage {
     content?: unknown;
 }
-/** The human's words on a Claude Code user line, '' when none; VS Code stores prompts as text blocks, beside its own open-file, selection and interrupt blocks. */
+/** The human's words on a Claude Code user line, '' when none; VS Code stores prompts as text blocks, beside its own open-file, selection
+ * and interrupt blocks. */
 export declare function humanUserText(entry: TranscriptLineFlags, message: TranscriptMessage): string;
 export interface SessionTurn {
     role: 'user' | 'assistant';

package/dist/capture/transcript.js

@@ -1,5 +1,5 @@
 import { envHomeDir, processEnv } from '../util/env.js';
-import { claudeConfigDir } from '../hooks/shared.js';
+import { claudeConfigDir } from '../util/agent-homes.js';
 import * as fs from 'fs';
 import * as path from 'path';
 import { isObjectLike, isStringValue, readSessionEnd } from '../core/capture-contract.js';
@@ -17,7 +17,8 @@ function isNonHumanUserLine(entry, content) {
     return CLAUDE_CODE_COMMAND_PREFIXES.some((p) => head.startsWith(p));
 }
 const NON_HUMAN_BLOCK_PREFIXES = ['<ide_', '[Request interrupted by user'];
-/** The human's words on a Claude Code user line, '' when none; VS Code stores prompts as text blocks, beside its own open-file, selection and interrupt blocks. */
+/** The human's words on a Claude Code user line, '' when none; VS Code stores prompts as text blocks, beside its own open-file, selection
+ * and interrupt blocks. */
 export function humanUserText(entry, message) {
     const content = message.content;
     let text = '';
@@ -82,6 +83,8 @@ function claudeCodeTurn(entry) {
     }
     return chunks.length > 0 ? { role: 'assistant', text: chunks.join('\n') } : null;
 }
+// Codex stores its own context as user messages: the AGENTS.md text, and one tagged block each for the environment and app state.
+const CODEX_INJECTED_USER_TEXT = /^(?:# AGENTS\.md instructions\b|<([A-Za-z][\w-]*)(?:\s[^>]*)?>[\s\S]*<\/\1>$)/;
 // Codex rollout transcript shape: response_item -> payload.message
 function codexTurn(entry) {
     if (entry.type !== 'response_item')
@@ -99,7 +102,7 @@ function codexTurn(entry) {
             continue;
         const blockType = 'type' in block ? block.type : undefined;
         const blockText = 'text' in block ? block.text : undefined;
-        if (role === 'user' && blockType === 'input_text' && isStringValue(blockText) && blockText.trim()) {
+        if (role === 'user' && blockType === 'input_text' && isStringValue(blockText) && blockText.trim() && !CODEX_INJECTED_USER_TEXT.test(blockText.trim())) {
             chunks.push(blockText.trim());
         }
         if (role === 'assistant' && blockType === 'output_text' && isStringValue(blockText) && blockText.trim()) {

package/dist/capture/working-state.d.ts

@@ -11,8 +11,10 @@ export declare function fitWorkingState(state: WorkingState): WorkingState;
 /** Each empty field falls back to `existing`'s, since a tool-heavy tail derives no task; null when all are empty, so blanks never replace a snapshot.
  *  Never across sessions: another session's task saved under this id would pass compact-resume's session check. */
 export declare function mergeWorkingState(derived: WorkingState, existing: TaskSnapshot | null, sessionId: string | null): WorkingState | null;
-/** Keeps the LAST maxChars behind a trim marker, aligned to a nearby line start: the summary runs oldest first, so a head cap would drop the newest working state. */
+/** Keeps the LAST maxChars behind a trim marker, aligned to a nearby line start: the summary runs oldest first, so a head cap would drop
+ * the newest working state. */
 export declare function truncateKeepNewest(text: string, maxChars: number): string;
-/** A session's task, summary and next step from its transcript tail, secrets scrubbed and capped, '' where none; null with a logged reason when nothing is derivable. */
+/** A session's task, summary and next step from its transcript tail, secrets scrubbed and capped, '' where none; null with a logged
+ * reason when nothing is derivable. */
 export declare function transcriptWorkingState(transcriptPath: string, log: (message: string) => void): Pick<TaskSnapshot, 'task' | 'summary' | 'next_step'> | null;
 //# sourceMappingURL=working-state.d.ts.map

package/dist/capture/working-state.js

@@ -36,7 +36,8 @@ export function mergeWorkingState(derived, existing, sessionId) {
     };
     return merged.task || merged.summary || merged.next_step ? merged : null;
 }
-/** Keeps the LAST maxChars behind a trim marker, aligned to a nearby line start: the summary runs oldest first, so a head cap would drop the newest working state. */
+/** Keeps the LAST maxChars behind a trim marker, aligned to a nearby line start: the summary runs oldest first, so a head cap would drop
+ * the newest working state. */
 export function truncateKeepNewest(text, maxChars) {
     if (text.length <= maxChars)
         return text;
@@ -123,7 +124,8 @@ function lastAssistantTextBlock(jsonl) {
     }
     return '';
 }
-/** A session's task, summary and next step from its transcript tail, secrets scrubbed and capped, '' where none; null with a logged reason when nothing is derivable. */
+/** A session's task, summary and next step from its transcript tail, secrets scrubbed and capped, '' where none; null with a logged
+ * reason when nothing is derivable. */
 export function transcriptWorkingState(transcriptPath, log) {
     let tail = '';
     let rawTask = '';

package/dist/cli/audit-prune.d.ts

@@ -1,28 +1,3 @@
-/** Audit log retention pruning: opt-in per tenant because retention floors (HIPAA, SOX, GDPR) apply.
- * The audit_prune row is written after the DELETE, so a call never prunes its own record. */
-export interface PruneAuditOpts {
-    /** Cutoff in days. Rows with `ts < (now - N days)` are deleted. */
-    olderThanDays: number;
-    /** Tenant scope. Required: prune is always tenant-scoped. */
-    tenantId: string;
-    /** When true, count matching rows but do NOT delete. Default false. */
-    dryRun?: boolean;
-    /** Actor recording the prune in the audit trail. Default 'cli'. */
-    actor?: string;
-}
-export interface PruneAuditResult {
-    /** ISO timestamp of the cutoff. Rows with ts strictly less than this were deleted. */
-    cutoff: string;
-    /** Number of audit_log rows deleted (or that would be deleted, if dryRun). */
-    count: number;
-    /** Echo back whether this was a dry run. */
-    dryRun: boolean;
-}
-/** Cutoff ISO timestamp for N days ago; exported so tests can pin "now" without mocking Date. */
-export declare function computeCutoff(days: number, now?: Date): string;
-/** Delete audit_log rows older than `olderThanDays` for `tenantId`, emitting an `audit_prune` event.
- * Throws on non-positive days or a missing tenantId. */
-export declare function pruneAuditLog(hippoRoot: string, opts: PruneAuditOpts): PruneAuditResult;
 /** Parse `--older-than`: bare integer days (`30`) or with a `d` suffix (`30d`); throws on any other format. */
 export declare function parseOlderThanFlag(raw: string): number;
 //# sourceMappingURL=audit-prune.d.ts.map

package/dist/cli/audit-prune.js

@@ -1,30 +1,4 @@
-/** Audit log retention pruning: opt-in per tenant because retention floors (HIPAA, SOX, GDPR) apply.
- * The audit_prune row is written after the DELETE, so a call never prunes its own record. */
-import { pruneAuditRows } from '../store/audit.js';
-import { DAY_MS } from '../util/time.js';
-/** Cutoff ISO timestamp for N days ago; exported so tests can pin "now" without mocking Date. */
-export function computeCutoff(days, now = new Date()) {
-    const cutoff = new Date(now.getTime() - days * DAY_MS);
-    return cutoff.toISOString();
-}
-function isTenantIdString(value) {
-    return typeof value === 'string';
-}
-/** Delete audit_log rows older than `olderThanDays` for `tenantId`, emitting an `audit_prune` event.
- * Throws on non-positive days or a missing tenantId. */
-export function pruneAuditLog(hippoRoot, opts) {
-    if (!Number.isFinite(opts.olderThanDays) || opts.olderThanDays <= 0) {
-        throw new Error(`pruneAuditLog: olderThanDays must be a positive number, got ${opts.olderThanDays}`);
-    }
-    if (!opts.tenantId || !isTenantIdString(opts.tenantId)) {
-        throw new Error('pruneAuditLog: tenantId is required');
-    }
-    const dryRun = opts.dryRun === true;
-    const actor = opts.actor ?? 'cli';
-    const cutoff = computeCutoff(opts.olderThanDays);
-    const count = pruneAuditRows(hippoRoot, { tenantId: opts.tenantId, cutoff, actor, olderThanDays: opts.olderThanDays, dryRun });
-    return { cutoff, count, dryRun };
-}
+// The `--older-than` flag of `hippo audit prune`; the prune itself is api.pruneAuditLog.
 /** Parse `--older-than`: bare integer days (`30`) or with a `d` suffix (`30d`); throws on any other format. */
 export function parseOlderThanFlag(raw) {
     const m = raw.match(/^(\d+)(d)?$/i);

package/dist/cli/audit.js

@@ -1,14 +1,13 @@
 // `hippo audit`: list and prune the audit log.
-import { loadAllEntries } from '../store/entry-reads.js';
-import { memoriesBackingObjects } from '../store/delete-and-batch.js';
-import { auditMemories, AUDIT_OPS } from '../store/audit.js';
+import { truncateWithEllipsis } from '../util/ellipsize.js';
+import { DEFAULT_LIST_LIMIT } from '../util/limits.js';
+import { AUDIT_OPS } from '../store/audit.js';
 import * as api from '../api/index.js';
-import { pruneAuditLog, parseOlderThanFlag } from './audit-prune.js';
+import { parseOlderThanFlag } from './audit-prune.js';
 import { printError } from './output.js';
 import { cliApiContext } from './api-context.js';
 import { boolFlag, flagIsTrue, isBooleanFlag, stringFlag } from './flag-values.js';
 import { requireInit, resolveAuthRoot } from './shared.js';
-import { repairAutomaticMemories } from '../store/quality-repair.js';
 import { getGlobalRoot } from '../sharing/global-store.js';
 import { errorMessage } from '../util/log.js';
 import { CliExit } from './exit.js';
@@ -33,7 +32,7 @@ function readAuditOp(flags) {
 }
 function readAuditLimit(flags) {
     const limitRaw = flags['limit'];
-    let limit = 100;
+    let limit = DEFAULT_LIST_LIMIT;
     if (limitRaw !== undefined && !isBooleanFlag(limitRaw)) {
         const parsed = parseInt(String(limitRaw), 10);
         if (!Number.isFinite(parsed)) {
@@ -90,7 +89,7 @@ function cmdAuditPrune(hippoRoot, ctxTenantId, flags) {
     const tenantId = stringFlag(flags, 'tenant')?.trim() || ctxTenantId;
     const dryRun = flagIsTrue(flags, 'dry-run');
     const asJson = boolFlag(flags, 'json');
-    const result = pruneAuditLog(hippoRoot, { olderThanDays, tenantId, dryRun, actor: 'cli' });
+    const result = api.pruneAuditLog(cliApiContext(hippoRoot, tenantId), { olderThanDays, dryRun });
     if (asJson) {
         console.log(JSON.stringify(result));
         return;
@@ -116,7 +115,7 @@ async function cmdAuditLog(hippoRoot, tenantId, args, flags) {
 }
 function auditRepair(hippoRoot, tenantId, flags) {
     const apply = flagIsTrue(flags, 'apply') && flags['dry-run'] !== true;
-    const result = repairAutomaticMemories(flags['global'] ? getGlobalRoot() : hippoRoot, { tenantId, apply });
+    const result = api.repairMemoryQuality(cliApiContext(flags['global'] ? getGlobalRoot() : hippoRoot, tenantId), apply);
     if (flags['json']) {
         console.log(JSON.stringify(result));
         return;
@@ -124,8 +123,10 @@ function auditRepair(hippoRoot, tenantId, flags) {
     console.log(`Quality repair ${apply ? 'apply' : 'preview'}: ${result.issues.length} issue(s) across ${result.total} memories.`);
     for (const issue of result.issues)
         console.log(`  [${issue.disposition}] ${issue.id}: ${issue.reason}${issue.protection ? ` (${issue.protection})` : ''}`);
-    for (const blocker of result.blockers)
-        console.log(`  Blocked: ${blocker}. Repair never upgrades a store; any other hippo command does, then run repair again.`);
+    for (const blocker of result.blockers) {
+        console.log(`  Blocked: ${blocker}. Repair never upgrades a store; ` +
+            'any other hippo command does, then run repair again.');
+    }
     const restore = `hippo dormant restore <id>${flags['global'] ? ' --global' : ''}`;
     if (result.backup)
         console.log(`Backup: ${result.backup}\nMoved ${result.appliedIds.length} memories to dormant storage. Recovery: ${restore}.`);
@@ -163,8 +164,7 @@ export async function handleAudit({ hippoRoot, tenantId, args, flags }) {
         return;
     }
     requireInit(hippoRoot);
-    const entries = loadAllEntries(hippoRoot, tenantId);
-    const result = auditMemories(entries, memoriesBackingObjects(hippoRoot));
+    const result = api.auditMemoryQuality(cliApiContext(hippoRoot, tenantId));
     const shouldFix = boolFlag(flags, 'fix');
     if (result.issues.length === 0) {
         console.log(`All ${result.total} memories passed quality checks.`);
@@ -174,7 +174,7 @@ export async function handleAudit({ hippoRoot, tenantId, args, flags }) {
         for (const issue of result.issues) {
             const icon = issue.severity === 'error' ? 'ERR' : 'WARN';
             console.log(`  [${icon}] ${issue.memoryId}: ${issue.reason}`);
-            console.log(`         "${issue.content.slice(0, 80)}${issue.content.length > 80 ? '...' : ''}"`);
+            console.log(`         "${truncateWithEllipsis(issue.content, 80)}"`);
         }
         if (shouldFix) {
             fixAuditErrors(hippoRoot, tenantId, result, flags);

package/dist/cli/auth.d.ts

@@ -1,3 +1,3 @@
 import { type CommandContext } from './flag-values.js';
-export declare function handleAuth({ hippoRoot, tenantId, args, flags }: CommandContext): void;
+export declare function handleAuth({ hippoRoot, tenantId, args, flags }: CommandContext): Promise<void>;
 //# sourceMappingURL=auth.d.ts.map

package/dist/cli/auth.js

@@ -1,5 +1,4 @@
 // `hippo auth`: create, list, revoke and scope API keys.
-import { listApiKeys } from '../store/auth.js';
 import * as api from '../api/index.js';
 import { cliApiContext } from './api-context.js';
 import { printError } from './output.js';
@@ -81,11 +80,11 @@ function formatKeyRow(item) {
     const revoked = item.revokedAt ?? '-';
     return `${item.keyId}  ${item.tenantId}  ${item.role}  ${label}  ${created}  ${expires}  ${revoked}`;
 }
-function cmdAuthList(hippoRoot, flags) {
+function cmdAuthList(hippoRoot, tenantId, flags) {
     const root = resolveAuthRoot(hippoRoot, flags);
     const includeRevoked = boolFlag(flags, 'all');
     const asJson = boolFlag(flags, 'json');
-    const items = listApiKeys(root, { active: !includeRevoked });
+    const items = api.authListAllTenants(cliApiContext(root, tenantId), !includeRevoked);
     if (asJson) {
         console.log(JSON.stringify(items));
         return;
@@ -100,17 +99,17 @@ function cmdAuthList(hippoRoot, flags) {
     }
 }
 // The local CLI owns every tenant, so revoke and grant run in the key's own tenant.
-function keyContext(root, tenantId, keyId) {
+async function keyContext(root, tenantId, keyId) {
     const hostCtx = cliApiContext(root, tenantId);
-    const keyTenant = api.authKeyTenant(hostCtx, keyId);
+    const keyTenant = await api.authKeyTenant(hostCtx, keyId);
     if (keyTenant === undefined) {
         printError(`Unknown key_id: ${keyId}`);
         throw new CliExit(1);
     }
     return { ...hostCtx, tenantId: keyTenant };
 }
-function cmdAuthRevoke(hippoRoot, tenantId, keyId, flags) {
-    const ctx = keyContext(resolveAuthRoot(hippoRoot, flags), tenantId, keyId);
+async function cmdAuthRevoke(hippoRoot, tenantId, keyId, flags) {
+    const ctx = await keyContext(resolveAuthRoot(hippoRoot, flags), tenantId, keyId);
     let revokedAt;
     try {
         revokedAt = api.authRevoke(ctx, keyId).revokedAt;
@@ -126,8 +125,8 @@ function cmdAuthRevoke(hippoRoot, tenantId, keyId, flags) {
     console.log(`Revoked ${keyId} at ${revokedAt}`);
 }
 /** `hippo auth grant|ungrant <key_id> <scope>`, routed through api so the tenant, restricted-scope and audit checks live in one place. */
-function cmdAuthScopeGrant(hippoRoot, tenantId, keyId, scope, grant, flags) {
-    const ctx = keyContext(resolveAuthRoot(hippoRoot, flags), tenantId, keyId);
+async function cmdAuthScopeGrant(hippoRoot, tenantId, keyId, scope, grant, flags) {
+    const ctx = await keyContext(resolveAuthRoot(hippoRoot, flags), tenantId, keyId);
     try {
         if (grant)
             api.authGrant(ctx, keyId, scope);
@@ -144,7 +143,7 @@ function cmdAuthScopeGrant(hippoRoot, tenantId, keyId, scope, grant, flags) {
     }
     console.log(grant ? `Granted ${keyId} read access to ${scope}` : `Removed ${keyId}'s grant on ${scope}`);
 }
-export function handleAuth({ hippoRoot, tenantId, args, flags }) {
+export async function handleAuth({ hippoRoot, tenantId, args, flags }) {
     const sub = args[0];
     if (!sub) {
         printError('Usage: hippo auth <create|list|revoke|grant|ungrant> [options]');
@@ -156,7 +155,7 @@ export function handleAuth({ hippoRoot, tenantId, args, flags }) {
             cmdAuthCreate(hippoRoot, tenantId, flags);
             return;
         case 'list':
-            cmdAuthList(hippoRoot, flags);
+            cmdAuthList(hippoRoot, tenantId, flags);
             return;
         case 'revoke': {
             const keyId = subArgs[0];
@@ -164,7 +163,7 @@ export function handleAuth({ hippoRoot, tenantId, args, flags }) {
                 printError('Usage: hippo auth revoke <key_id>');
                 throw new CliExit(1);
             }
-            cmdAuthRevoke(hippoRoot, tenantId, keyId, flags);
+            await cmdAuthRevoke(hippoRoot, tenantId, keyId, flags);
             return;
         }
         case 'grant':
@@ -174,7 +173,7 @@ export function handleAuth({ hippoRoot, tenantId, args, flags }) {
                 printError(`Usage: hippo auth ${sub} <key_id> <scope>`);
                 throw new CliExit(1);
             }
-            cmdAuthScopeGrant(hippoRoot, tenantId, keyId, scope, sub === 'grant', flags);
+            await cmdAuthScopeGrant(hippoRoot, tenantId, keyId, scope, sub === 'grant', flags);
             return;
         }
         default:

package/dist/cli/briefs.d.ts

@@ -1,5 +1,2 @@
-import { type CommandContext } from './flag-values.js';
-export declare function handleProjectBrief({ hippoRoot, tenantId, args, flags }: CommandContext): void;
-export declare function handleGraph({ hippoRoot, tenantId, args, flags }: CommandContext): void;
-export declare function handleCustomerNote({ hippoRoot, tenantId, args, flags }: CommandContext): void;
+export declare const handleProjectBrief: (ctx: import("./flag-values.js").CommandContext) => void;
 //# sourceMappingURL=briefs.d.ts.map