hippo-memory 1.71.0 → 2.0.0

package/dist/cli/session-hooks.js

@@ -5,17 +5,12 @@ import { spawn } from 'child_process';
 import { resolveCodexSessionTranscript } from '../hooks/codex-session.js';
 import { resolveCodexWrapperPaths } from '../hooks/codex-wrapper.js';
 import { resolveJsonHookPaths } from '../hooks/json-hooks.js';
-import { isInitialized } from '../store/open.js';
-import { loadActiveTaskSnapshot, loadFreshActiveTaskSnapshot, closeTaskSnapshotsForSession, listSessionEvents, } from '../store/sessions.js';
-import { writeSessionEndHandoff } from '../store/handoffs.js';
 import { readSessionScan, recordSessionDigest } from '../capture/session-digest.js';
 import { captureToolFailure } from '../capture/capture-error.js';
-import { readApiCalls, recordRereads, } from '../store/token-ledger.js';
 import { estimateTokens } from '../util/token-text.js';
 import { currentMachine, importSessionFolder } from '../agent-memories/sync.js';
 import { summaryLine } from '../agent-memories/report.js';
-import { resolveProjectIdentity } from '../core/project-identity.js';
-import { getGlobalRoot } from '../sharing/global-store.js';
+import { resolveProjectIdentity, isInitialized } from '../core/project-identity.js';
 import { cmdCapture } from '../capture/command.js';
 import { cmdPreCompact, cmdPostCompact } from '../capture/compact.js';
 import { transcriptWorkingState } from '../capture/working-state.js';
@@ -25,18 +20,19 @@ import { loadTurnPosition, runSessionWorker, saveTurnPosition, turnsAfter } from
 import { isStringValue, readSessionEnd, readVscodeStop } from '../core/capture-contract.js';
 import { loadConfig } from '../core/config.js';
 import { autoSleepDue } from '../api/auto-sleep.js';
-import { truncateCodePointSafe } from '../util/transcript-tail.js';
-import { COMPACTION_DB_WAIT_MS } from '../capture/compaction-record.js';
-import { COMPACT_RESUME_EVENT_CONTENT_CAP, COMPACT_RESUME_MAX_AGE_MS, compactResumeText } from '../api/context-render.js';
+import { COMPACTION_DB_WAIT_MS } from '../core/compaction-timing.js';
+import { compactResumeBlock, sessionEndWork as runSessionEnd } from '../api/session-end.js';
 import { normaliseHookPayload, readHookStdin, readStdinBounded } from './stdin.js';
 import { errorMessage, log } from '../util/log.js';
+import { cmdShimArgs } from '../util/spawn-argv.js';
 import { bookLedgerTurn } from '../api/ledger-db.js';
-import { flushDeliveryRecorder } from '../api/prompt-hook.js';
+import { flushDeliveryRecorder, startDeliveryRecorder, startToolFailureRecorder } from '../api/prompt-hook.js';
 import { printError } from './output.js';
 import { cmdLastSleep } from './last-sleep.js';
 import { readCompactResumePayload } from './compact-resume-payload.js';
+import { cliApiContext } from './api-context.js';
 import { boolFlag, flagIsTrue, stringFlag } from './flag-values.js';
-import { logSessionEndImport, appendSessionEndCloseLog, reportSessionEndFailure, resetHookInjection, hookStoreRoot, hookRuntime, payloadCwdRoot, runHookWithStores, inPilotHoldout, startDeliveryRecorder, } from './hook-runtime.js';
+import { logSessionEndImport, appendSessionEndCloseLog, reportSessionEndFailure, resetHookInjection, hookStoreRoot, hookRuntime, payloadCwdRoot, runHookWithStores, inPilotHoldout, hostSessionId, } from './hook-runtime.js';
 import { CliExit } from './exit.js';
 /** SessionStart(compact) injector: prints the task snapshot and session trail lost to compaction; no pinned memories (UserPromptSubmit re-injects them).
  * Every path exits 0: a malformed payload or store read failure degrades to empty stdout, never a throw. */
@@ -51,10 +47,13 @@ function cmdCompactResume(hippoRoot, tenantId, stdinText, stdinTimedOut) {
         const payloadState = readCompactResumePayload(stdinText, stdinTimedOut);
         let suppressOutput = payloadState.suppressOutput;
         const payloadSessionId = payloadState.payloadSessionId;
-        if (payloadState.boundary)
-            rec = startDeliveryRecorder(hippoRoot, stdinText, 'claude-code', 'compact-resume');
+        if (payloadState.boundary) {
+            rec = startDeliveryRecorder(cliApiContext(hippoRoot, tenantId), {
+                stdinText, runtime: 'claude-code', eventType: 'compact-resume', envSessionId: hostSessionId(),
+            });
+        }
         // A compaction follows a prompt or SessionStart that booked the arm, so this only reads it.
-        if (!suppressOutput && payloadSessionId !== null && inPilotHoldout(hippoRoot, tenantId, payloadSessionId, false)) {
+        if (!suppressOutput && payloadSessionId !== null && inPilotHoldout(hippoRoot, tenantId, payloadSessionId, { write: false })) {
             suppressOutput = true;
             rec?.disabled();
         }
@@ -72,30 +71,10 @@ function cmdCompactResume(hippoRoot, tenantId, stdinText, stdinTimedOut) {
     throw new CliExit(0);
 }
 function restoreCompactSnapshot(hippoRoot, tenantId, payloadSessionId, rec) {
-    const snapshot = loadFreshActiveTaskSnapshot(hippoRoot, tenantId, { maxAgeMs: COMPACT_RESUME_MAX_AGE_MS });
-    // Concurrent sessions must not cross-restore. Only suppress when BOTH ids are present and differ;
-    // either side missing, or a manual invocation with no payload session_id, still prints.
-    const sessionMismatch = !!snapshot &&
-        payloadSessionId !== null &&
-        snapshot.session_id !== null &&
-        payloadSessionId !== snapshot.session_id;
-    if (!snapshot || sessionMismatch)
+    const text = compactResumeBlock(cliApiContext(hippoRoot, tenantId), payloadSessionId);
+    if (text === null)
         return;
-    // Loaded before the print so a bad trail row costs the trail, not the snapshot; stderr stays out of the model's context.
-    let events = [];
-    try {
-        if (snapshot.session_id) {
-            events = listSessionEvents(hippoRoot, tenantId, { session_id: snapshot.session_id }).map((e) => ({
-                ...e,
-                content: truncateCodePointSafe(e.content, COMPACT_RESUME_EVENT_CONTENT_CAP),
-            }));
-        }
-    }
-    catch (err) {
-        log.warn(`hippo compact-resume: trail skipped: ${errorMessage(err)}`);
-    }
     // Printed in one write so the ledger books exactly the text the model is handed.
-    const text = compactResumeText(snapshot, events);
     console.log(text);
     rec?.delivered({ state: 'sent', emittedText: `${text}\n` });
     bookLedgerTurn(hippoRoot, {
@@ -123,27 +102,24 @@ export async function handleSessionEnd({ hippoRoot, tenantId, flags }) {
     const root = payloadCwdRoot(hippoRoot, stdinText, runtime);
     const input = stop ?? sessionEndInput(stdinText, raw.timedOut, runtime);
     // Only a host payload ends a session: a manual run and a reply's end (turn mode) are not boundaries.
-    const rec = !turn && input !== null && !input.manual ? startDeliveryRecorder(hookStoreRoot(root), stdinText, runtime, 'session-end') : null;
+    const rec = !turn && input !== null && !input.manual
+        ? startDeliveryRecorder(cliApiContext(hookStoreRoot(root), tenantId), { stdinText, runtime, eventType: 'session-end', envSessionId: hostSessionId() })
+        : null;
     const sessionId = input?.sessionId ?? null;
     // Resolved here because only this process saw the payload; the worker captures just the path it is handed.
     // Always a hook, so never scan: an empty stdin here is not a manual run. The Copilot CLI's sessionEnd names no transcript, so its log is found by id.
     const named = input?.transcriptPath ?? null;
     const transcriptPath = (named !== null && fs.existsSync(named) ? named : null)
         ?? (runtime === 'copilot' && sessionId ? copilotTranscriptFor(sessionId) : null);
+    const worker = { logFile, transcriptPath, sessionId, turn };
     try {
-        spawnSessionEndWorker(sessionEndWorkerArgs(logFile, transcriptPath, sessionId, turn));
+        spawnSessionEndWorker(sessionEndWorkerArgs(worker));
     }
     catch (err) {
         log.debug(`session-end: the worker did not spawn, running inline: ${errorMessage(err)}`);
         // Inline is the last resort, handed what the child's argv would have carried.
-        if (logFile)
-            flags['log-file'] = logFile;
-        if (transcriptPath)
-            flags['transcript'] = transcriptPath;
-        if (sessionId)
-            flags['session-id'] = sessionId;
         try {
-            await cmdSessionEndWorker(root, tenantId, flags);
+            await cmdSessionEndWorker(root, tenantId, inlineWorkerFlags(flags, worker));
         }
         finally {
             await runHookWithStores(() => flushDeliveryRecorder(rec));
@@ -161,7 +137,8 @@ function sessionEndInput(stdinText, timedOut, runtime) {
     log.debug(`session-end: ${receipt.reason}`);
     return null;
 }
-function sessionEndWorkerArgs(logFile, transcriptPath, sessionId, turn) {
+function sessionEndWorkerArgs(o) {
+    const { logFile, transcriptPath, sessionId, turn } = o;
     const workerArgs = [process.argv[1], '__session-end-worker'];
     if (logFile)
         workerArgs.push('--log-file', logFile);
@@ -173,6 +150,26 @@ function sessionEndWorkerArgs(logFile, transcriptPath, sessionId, turn) {
         workerArgs.push('--turn');
     return workerArgs;
 }
+/** The flags the detached worker would parse from its argv, so the inline run sees what the child would have; the hook's own flags fill the gaps. */
+function inlineWorkerFlags(flags, w) {
+    const out = {};
+    const keep = (name, value) => {
+        if (value)
+            out[name] = value;
+    };
+    keep('log-file', w.logFile ?? flags['log-file']);
+    keep('transcript', w.transcriptPath ?? flags['transcript']);
+    keep('session-id', w.sessionId ?? flags['session-id']);
+    if (flagIsTrue(flags, 'turn'))
+        out['turn'] = true;
+    if (flagIsTrue(flags, 'dry-run'))
+        out['dry-run'] = true;
+    if (flagIsTrue(flags, 'no-learn'))
+        out['no-learn'] = true;
+    if (flagIsTrue(flags, 'no-share'))
+        out['no-share'] = true;
+    return out;
+}
 function spawnSessionEndWorker(workerArgs) {
     const child = spawn(process.execPath, workerArgs, {
         detached: true,
@@ -195,64 +192,38 @@ async function cmdSessionEndWorker(hippoRoot, tenantId, flags) {
 export function handleSessionEndWorker({ hippoRoot, tenantId, flags }) {
     return cmdSessionEndWorker(hippoRoot, tenantId, flags);
 }
-async function sessionEndWork(hippoRoot, tenantId, flags, mode) {
+function sessionEndWork(hippoRoot, tenantId, flags, mode) {
     const transcriptPath = stringFlag(flags, 'transcript');
-    const closeLogFile = stringFlag(flags, 'log-file') ?? null;
-    const closeSessionId = stringFlag(flags, 'session-id') ?? null;
-    const rereadLog = await bookSessionRereads(hippoRoot, tenantId, transcriptPath, closeSessionId)
-        .catch((err) => [`re-read count failed: ${errorMessage(err)}`]);
-    // Sleep starts the log file afresh, so the lines go in after it; on exit too, in case sleep exits the process.
-    const flushRereadLog = () => { for (const line of rereadLog.splice(0))
-        appendSessionEndCloseLog(closeLogFile, line); };
-    process.once('exit', flushRereadLog);
-    // Like the other hooks: project store, else global; a folder with neither must not get one made.
-    const store = hookStoreRoot(hippoRoot);
-    if (!isInitialized(store)) {
-        appendSessionEndCloseLog(closeLogFile, 'skip: no hippo store for this folder or globally', { startFresh: true });
-        flushRereadLog();
-        return;
-    }
-    if (mode === 'turn' && closeSessionId)
-        await sleepIfDue(hippoRoot, tenantId, flags, closeLogFile, transcriptPath, closeSessionId);
-    else
-        await sleepProjectStore(hippoRoot, tenantId, flags, closeLogFile, transcriptPath);
-    flushRereadLog();
-    const digestLog = (message) => appendSessionEndCloseLog(closeLogFile, message);
-    const scan = transcriptPath ? readSessionScan(transcriptPath, digestLog) : null;
-    const capture = (turns) => captureEndedSession(hippoRoot, tenantId, store, flags, transcriptPath, turns);
-    if (mode === 'turn')
-        captureNewTurns(transcriptPath, closeSessionId, scan, capture, digestLog);
-    else
-        capture(scan?.turns);
-    recordSessionDigest(hippoRoot, scan, {
-        key: closeSessionId || path.basename(transcriptPath ?? '', '.jsonl'),
+    const logFile = stringFlag(flags, 'log-file') ?? null;
+    const sessionId = stringFlag(flags, 'session-id') ?? null;
+    return runSessionEnd({
+        mode,
+        hippoRoot,
         tenantId,
-        log: digestLog,
+        sessionId,
+        transcriptPath,
+        contextFor: (root) => cliApiContext(root, tenantId),
+        storeRoot: () => hookStoreRoot(hippoRoot),
+        log: (line, opts) => appendSessionEndCloseLog(logFile, line, opts),
+        sleep: () => (mode === 'turn' && sessionId
+            ? sleepIfDue(hippoRoot, tenantId, flags, logFile, transcriptPath, sessionId)
+            : sleepProjectStore(hippoRoot, tenantId, flags, logFile, transcriptPath)),
+        readScan: (log) => (transcriptPath ? readSessionScan(transcriptPath, log) : null),
+        capture: (store, scan) => {
+            const capture = (turns) => captureEndedSession(hippoRoot, tenantId, store, flags, transcriptPath, turns);
+            if (mode === 'turn')
+                captureNewTurns(transcriptPath, sessionId, scan, capture, (line) => appendSessionEndCloseLog(logFile, line));
+            else
+                capture(scan?.turns);
+        },
+        digest: (scan, log) => recordSessionDigest(hippoRoot, scan, {
+            key: sessionId || path.basename(transcriptPath ?? '', '.jsonl'),
+            tenantId,
+            log,
+        }),
+        workingState: (log) => (transcriptPath ? transcriptWorkingState(transcriptPath, log) : null),
+        evidence: () => collectHandoffEvidence(process.cwd(), 'unknown'),
     });
-    // Close only this session's snapshot, after sleep+capture; if session-end never fires (crash, kill -9) the freshness bound in
-    // loadFreshActiveTaskSnapshot is the backstop. The handoff is written first, while the snapshot writeSessionEndHandoff reads is active.
-    if (closeSessionId)
-        writeEndHandoff(store, tenantId, closeSessionId, transcriptPath, closeLogFile, mode === 'turn');
-    if (mode === 'turn') {
-        // The chat goes on after a reply, so its snapshot stays for the next compaction to restore.
-        appendSessionEndCloseLog(closeLogFile, 'skip snapshot close: turn mode');
-        return;
-    }
-    closeEndedSessionSnapshot(store, tenantId, closeSessionId, closeLogFile);
-}
-function closeEndedSessionSnapshot(store, tenantId, closeSessionId, closeLogFile) {
-    try {
-        if (closeSessionId) {
-            const closed = closeTaskSnapshotsForSession(store, tenantId, closeSessionId);
-            appendSessionEndCloseLog(closeLogFile, `closed ${closed} active snapshot(s) for session ${closeSessionId}`);
-        }
-        else {
-            appendSessionEndCloseLog(closeLogFile, 'skip: no session_id in SessionEnd payload, active snapshot left untouched');
-        }
-    }
-    catch (err) {
-        appendSessionEndCloseLog(closeLogFile, `snapshot close failed: ${errorMessage(err)}`);
-    }
 }
 async function sleepProjectStore(hippoRoot, tenantId, flags, closeLogFile, transcriptPath) {
     // Sleeping the global store from here would learn this folder's git commits into it; it has its own daily sleep.
@@ -330,53 +301,6 @@ function captureEndedSession(hippoRoot, tenantId, store, flags, transcriptPath,
         return false;
     }
 }
-function writeEndHandoff(store, tenantId, closeSessionId, transcriptPath, closeLogFile, inPlace = false) {
-    try {
-        const ownSnapshot = loadActiveTaskSnapshot(store, tenantId)?.session_id === closeSessionId;
-        // A never-compacted session has no snapshot; read even when it has one, as another session's PreCompact can take the slot before the write.
-        const derived = transcriptPath
-            ? transcriptWorkingState(transcriptPath, (message) => appendSessionEndCloseLog(closeLogFile, message))
-            : null;
-        if (!ownSnapshot && !derived) {
-            appendSessionEndCloseLog(closeLogFile, 'skip: no snapshot or transcript for session');
-        }
-        else {
-            const evidence = collectHandoffEvidence(process.cwd(), 'unknown');
-            const handoff = writeSessionEndHandoff(store, tenantId, closeSessionId, evidence, derived, undefined, { inPlace });
-            appendSessionEndCloseLog(closeLogFile, handoff ? `wrote handoff for session ${closeSessionId}` : `skip: kept the existing handoff for session ${closeSessionId}`);
-        }
-    }
-    catch (err) {
-        // SAFETY: catch clauses bind unknown, but Node/V8 always throws an Error here.
-        appendSessionEndCloseLog(closeLogFile, `handoff write failed: ${errorMessage(err)}`);
-    }
-}
-/** Books the ending session's re-reads in each store its ledger rows can land in (project and global); returns the log lines. */
-async function bookSessionRereads(hippoRoot, tenantId, transcriptPath, sessionId) {
-    if (!transcriptPath || !sessionId)
-        return [];
-    let read;
-    try {
-        read = await readApiCalls(transcriptPath);
-    }
-    catch (err) {
-        return [`skip re-read count: cannot read the transcript: ${errorMessage(err)}`];
-    }
-    const roots = new Set([hippoRoot, getGlobalRoot()].filter((root) => isInitialized(root)).map((root) => path.resolve(root)));
-    const lines = [];
-    let tokens = 0;
-    for (const root of roots) {
-        try {
-            tokens += recordRereads(root, tenantId, sessionId, read.calls);
-        }
-        catch (err) {
-            lines.push(`re-read count failed: ${errorMessage(err)}`);
-        }
-    }
-    const skipped = read.malformed > 0 ? `, ${read.malformed} unparsable transcript lines skipped` : '';
-    lines.push(`re-read ${tokens} tokens over ${read.calls.length} model calls for session ${sessionId}${skipped}`);
-    return lines;
-}
 function loadCodexWrapperMetadata() {
     const { metadataPath } = resolveCodexWrapperPaths();
     if (!fs.existsSync(metadataPath)) {
@@ -385,20 +309,6 @@ function loadCodexWrapperMetadata() {
     // SAFETY: the file is the one installCodexWrapper wrote; handleCodexRun reads only logFile and realCodexPath from it.
     return JSON.parse(fs.readFileSync(metadataPath, 'utf8'));
 }
-/** Quotes one cmd.exe argument; each `%` leaves the quotes as `^%`, so no %NAME% pair can expand. */
-export function quoteCmdArg(arg) {
-    if (arg.length === 0)
-        return '""';
-    if (!/[ \t"&()^<>|%!]/.test(arg))
-        return arg;
-    return `"${arg.replace(/"/g, '""').replace(/%/g, '"^%"')}"`;
-}
-/** cmd.exe arguments that run a .cmd or .bat shim with every forwarded argument delivered verbatim. */
-export function cmdShimArgs(shimPath, forwardArgs) {
-    const command = `"${shimPath}"${forwardArgs.length > 0 ? ` ${forwardArgs.map(quoteCmdArg).join(' ')}` : ''}`;
-    // The line is already quoted for cmd.exe, so Node must not quote it again; /s strips the outer pair.
-    return ['/d', '/v:off', '/s', '/c', `"${command}"`];
-}
 function spawnRealCodex(realCodexPath, forwardArgs, cwd) {
     const ext = path.extname(realCodexPath).toLowerCase();
     if (process.platform === 'win32' && ext === '.ps1') {
@@ -565,15 +475,17 @@ function captureCodexTranscript(hippoRoot, tenantId, store, flags, logFile) {
         reportSessionEndFailure(logFile ?? null, 'codex session-end: transcript scan or digest', err);
     }
 }
-export async function handlePreCompact({ hippoRoot, flags }) {
+export async function handlePreCompact({ hippoRoot, tenantId, flags }) {
     // Bounded wait, not a TTY guard: an idle non-TTY pipe must not hang.
     const { text: stdinText, timedOut: stdinTimedOut } = await readHookStdin();
     const runtime = hookRuntime(flags);
     const root = payloadCwdRoot(hippoRoot, stdinText, runtime);
     await runHookWithStores(async () => {
         // Started before any store wait, so two fires of one hook carry timestamps close enough to match as duplicates.
-        const rec = startDeliveryRecorder(hookStoreRoot(root), stdinText, runtime, 'pre-compact');
-        resetHookInjection(root, stdinText, null);
+        const rec = startDeliveryRecorder(cliApiContext(hookStoreRoot(root), tenantId), {
+            stdinText, runtime, eventType: 'pre-compact', envSessionId: hostSessionId(),
+        });
+        resetHookInjection(root, tenantId, stdinText, null);
         await cmdPreCompact(hookStoreRoot(root), {
             stdinText,
             stdinTimedOut,
@@ -587,7 +499,8 @@ export async function handlePreCompact({ hippoRoot, flags }) {
     });
 }
 export async function handlePostCompact({ hippoRoot, flags }) {
-    // PostCompact hook: saves the compaction summary and its memories, then prints one plain line, because Claude Code shows this hook's stdout as-is. Always exits 0.
+    // PostCompact hook: saves the compaction summary and its memories, then prints one plain line, because Claude Code shows this hook's
+    // stdout as-is. Always exits 0.
     const { text, timedOut } = await readHookStdin();
     const logFlag = flags['log-file'];
     const store = hookStoreRoot(hippoRoot);
@@ -618,7 +531,15 @@ export async function handleCaptureError({ hippoRoot, tenantId, flags }) {
         if (isInitialized(root) && payload) {
             // SAFETY: JSON.parse returns a JSON value by definition.
             const failure = JSON.parse(payload);
-            await runHookWithStores(() => captureToolFailure(root, tenantId, failure));
+            const rec = startToolFailureRecorder(cliApiContext(root, tenantId), { stdinText: text, runtime: hookRuntime(flags), envSessionId: hostSessionId() });
+            await runHookWithStores(() => {
+                try {
+                    return captureToolFailure(root, tenantId, failure, (id) => rec?.logged(id));
+                }
+                finally {
+                    flushDeliveryRecorder(rec);
+                }
+            });
         }
     }
     catch (err) {
@@ -629,7 +550,7 @@ export async function handleCaptureError({ hippoRoot, tenantId, flags }) {
 export async function handleCompactResume({ hippoRoot, tenantId }) {
     const { text: stdinText, timedOut: stdinTimedOut } = await readHookStdin();
     await runHookWithStores(() => {
-        resetHookInjection(hippoRoot, stdinText, 'compact');
+        resetHookInjection(hippoRoot, tenantId, stdinText, 'compact');
         cmdCompactResume(hookStoreRoot(hippoRoot), tenantId, stdinText, stdinTimedOut);
     });
 }

package/dist/cli/setup.d.ts

@@ -1,5 +1,5 @@
 import { type CommandContext } from './flag-values.js';
 export declare function handleHook({ args }: CommandContext): void;
 export declare function handleSetup({ flags }: CommandContext): void;
-export declare function handleDailyRunner(_ctx: CommandContext): void;
+export declare function handleDailyRunner({ tenantId }: CommandContext): Promise<void>;
 //# sourceMappingURL=setup.d.ts.map

package/dist/cli/setup.js

@@ -1,4 +1,5 @@
 // `hippo hook`, `hippo setup` and `hippo daily-runner`: install and run the agent and machine integrations.
+import { MINUTE_MS } from '../util/time.js';
 import * as path from 'path';
 import * as fs from 'fs';
 import { execFileSync } from 'child_process';
@@ -7,7 +8,7 @@ import { detectInstalledTools } from '../hooks/shared.js';
 import { ensureCodexWrapperInstalled, installCodexWrapper, detectRealCodexPath, uninstallCodexWrapper, } from '../hooks/codex-wrapper.js';
 import { installOpencodePlugin, uninstallOpencodePlugin, resolveOpencodePluginPath } from '../hooks/opencode.js';
 import { COPILOT_CLI_MCP, VSCODE_MCP, copilotMcpSnippet, copilotPaths, installCopilot, isCopilotCliPresent, isMcpFailure, uninstallCopilot, } from '../hooks/copilot.js';
-import { isInitialized } from '../store/open.js';
+import { isInitialized } from '../core/project-identity.js';
 import { currentMachine, importUserMemories } from '../agent-memories/sync.js';
 import { getGlobalRoot } from '../sharing/global-store.js';
 import { listRegisteredWorkspaces, runDailyMaintenance } from './scheduler.js';
@@ -188,7 +189,8 @@ const VSCODE_INSTRUCTIONS_REMOVE_LINES = {
     absent: () => '',
     kept: (file) => `Left ${file}: it is not the text hippo wrote. Delete it by hand if no agent needs it.`,
 };
-const VSCODE_HOOKS_LINE = 'VS Code: hooks need VS Code 1.109.3 or later with chat.useHooks on (the default); older versions get the MCP server and the instructions file only.';
+const VSCODE_HOOKS_LINE = 'VS Code: hooks need VS Code 1.109.3 or later with chat.useHooks on (the default); older versions get the MCP server and the ' +
+    'instructions file only.';
 function mcpInstallLine(file, mcp, host) {
     return isMcpFailure(mcp) ? mcpFailureLine(file, mcp, addByHand(host)) : MCP_MERGE_LINES[mcp](file, host);
 }
@@ -198,7 +200,8 @@ function printVscodeInstall(result, indent) {
     console.log(`${indent}${VSCODE_INSTRUCTIONS_INSTALL_LINES[result.instructions](paths.instructions)}`);
     if (paths.profiles.length > 0) {
         const names = paths.profiles.map((dir) => path.basename(dir)).join(', ');
-        console.log(`${indent}Found VS Code profiles (${names}) under ${path.join(paths.userDir, 'profiles')}: hippo set up the default profile only; copy the "hippo" server and prompts/hippo.instructions.md into a profile to use hippo there.`);
+        console.log(`${indent}Found VS Code profiles (${names}) under ${path.join(paths.userDir, 'profiles')}: ` +
+            'hippo set up the default profile only; copy the "hippo" server and prompts/hippo.instructions.md into a profile to use hippo there.');
     }
 }
 function printCopilotInstall(result, indent) {
@@ -206,7 +209,8 @@ function printCopilotInstall(result, indent) {
     const hooks = result.hooks ? `Installed hippo's Copilot hooks (${copilotHookEvents().join(', ')}) ->` : "hippo's Copilot hooks are already in";
     console.log(`${indent}${hooks} ${paths.hooks}`);
     if (result.mcp === null || result.instructions === null) {
-        console.log(`${indent}No Copilot CLI files in ${path.dirname(paths.mcpConfig)}, so hippo skipped mcp-config.json and copilot-instructions.md, which only the Copilot CLI reads`);
+        console.log(`${indent}No Copilot CLI files in ${path.dirname(paths.mcpConfig)}, ` +
+            'so hippo skipped mcp-config.json and copilot-instructions.md, which only the Copilot CLI reads');
     }
     else {
         console.log(`${indent}${mcpInstallLine(paths.mcpConfig, result.mcp, COPILOT_CLI_MCP)}`);
@@ -226,8 +230,10 @@ function mcpRemoveLines(file, mcp) {
         return [`Removed the "hippo" MCP server from ${file}`];
     if (mcp === 'user-owned')
         return [`Left the "hippo" MCP server in ${file}: hippo did not write it`];
-    if (mcp === 'unreadable')
-        return [`WARNING: ${file} has comments or is not a JSON object hippo can edit, so it was left unchanged; remove the "hippo" server by hand if hippo added it`];
+    if (mcp === 'unreadable') {
+        return [`WARNING: ${file} has comments or is not a JSON object hippo can edit, so it was left unchanged; ` +
+                'remove the "hippo" server by hand if hippo added it'];
+    }
     return [];
 }
 function printCopilotUninstall(result) {
@@ -473,21 +479,21 @@ function setupPluginTool(tool, dryRun) {
     }
 }
 // Three times the 10 minutes POST /v1/sleep allows a consolidation, so a slow real sleep fits and a hung child cannot stall every later workspace.
-const DAILY_STEP_TIMEOUT_MS = 30 * 60_000;
+const DAILY_STEP_TIMEOUT_MS = 30 * MINUTE_MS;
 /** Why a child step failed; a child killed at the deadline says so, since its own message is only the spawn error code. */
 function dailyStepFailure(err, timeoutMs) {
     if (err instanceof Error && 'code' in err && err.code === 'ETIMEDOUT')
         return `timed out after ${timeoutMs} ms and was stopped`;
     return errorMessage(err);
 }
-export function handleDailyRunner(_ctx) {
+export async function handleDailyRunner({ tenantId }) {
     const globalRoot = getGlobalRoot();
     // No workspace sleep ever opens the global store, yet hooks in folders without a store compact into it.
     if (isInitialized(globalRoot)) {
         const finished = replayCompactionsAt(globalRoot, (message) => log.warn(`compaction replay: ${message}`));
         if (finished > 0)
             console.log(`Finished saving ${finished} compaction${finished === 1 ? '' : 's'} left over in the global store.`);
-        repairQualityOnceAt(globalRoot);
+        await repairQualityOnceAt(globalRoot, tenantId);
     }
     printAgentImport(importUserMemories(globalRoot, { machine: currentMachine() }), '');
     const workspaces = listRegisteredWorkspaces(globalRoot);
@@ -516,7 +522,8 @@ export function handleDailyRunner(_ctx) {
             log.error(`daily-runner failed in ${cwd} during \`${action}\`: ${dailyStepFailure(err, timeout)}`, { workspace: cwd, ...errorFields(err) });
         }
     });
-    console.log(`Daily maintenance complete: ${processed} workspace${processed === 1 ? '' : 's'} processed, ${failed} command failure${failed === 1 ? '' : 's'}.`);
+    console.log(`Daily maintenance complete: ${processed} workspace${processed === 1 ? '' : 's'} processed, ` +
+        `${failed} command failure${failed === 1 ? '' : 's'}.`);
     // The scheduler that runs this only sees the exit code, so a failed workspace must not read as a clean run.
     if (failed > 0)
         process.exitCode = 1;

package/dist/cli/shared.d.ts

@@ -1,13 +1,9 @@
 import { type ChurnStaleResult } from '../learn/invalidation.js';
-import { type AuditOp } from '../store/audit.js';
 import { type ServerInfo } from '../server/server-detect.js';
-import type { JsonObject } from '../store/working-memory.js';
 import type { CliFlags } from './flag-values.js';
-/** Emit an audit event on its own short-lived connection to `hippoRoot`'s db; swallows all errors, since audit must never crash a CLI command. */
-export declare function emitCliAudit(hippoRoot: string, op: AuditOp, targetId?: string, metadata?: JsonObject): void;
 export declare function requireInit(hippoRoot: string): void;
 /** Runs detectChurnStale against every store this repo's memories can live in. */
-export declare function runChurnStaleForRepo(hippoRoot: string, dryRun: boolean): {
+export declare function runChurnStaleForRepo(hippoRoot: string, tenantId: string, dryRun: boolean): {
     root: string;
     result: ChurnStaleResult;
 }[];
@@ -21,7 +17,7 @@ interface LearnFromRepoResult {
     skipped: number;
     lowInfo: number;
 }
-export declare function learnFromRepo(hippoRoot: string, repoPath: string, days: number, label?: string): LearnFromRepoResult;
+export declare function learnFromRepo(hippoRoot: string, tenantId: string, repoPath: string, days: number, label?: string): Promise<LearnFromRepoResult>;
 export declare function resolveAuthRoot(hippoRoot: string, flags: CliFlags): string;
 export {};
 //# sourceMappingURL=shared.d.ts.map

package/dist/cli/shared.js

@@ -1,36 +1,17 @@
-// Store and server helpers the CLI verbs share: audit events, init checks, server routing, git learning and the auth root.
+// Store and server helpers the CLI verbs share: init checks, server routing, git learning and the auth root.
 // This module must never import cli.ts.
 import { envApiKey, envRequireServer } from '../util/env.js';
 import { execFileSync } from 'child_process';
 import { isSharedStore } from '../core/config.js';
-import { isInitialized } from '../store/open.js';
 import { detectChurnStale } from '../learn/invalidation.js';
-import { resolveProjectIdentity } from '../core/project-identity.js';
+import { resolveProjectIdentity, isInitialized } from '../core/project-identity.js';
 import { getGlobalRoot, initGlobal } from '../sharing/global-store.js';
-import { reportAuditWriteFailure } from '../store/audit.js';
-import { sqliteSyncStore } from '../store/sqlite/store.js';
 import * as client from './client.js';
 import { detectServer, removePidfileIfOwned } from '../server/server-detect.js';
-import { resolveTenantId } from '../store/tenant.js';
-import { adminActor, learn, CLI_LEARN } from '../api/index.js';
+import { learn, CLI_LEARN } from '../api/index.js';
+import { cliApiContext } from './api-context.js';
 import { errorMessage, log } from '../util/log.js';
 import { printError } from './output.js';
-/** Emit an audit event on its own short-lived connection to `hippoRoot`'s db; swallows all errors, since audit must never crash a CLI command. */
-export function emitCliAudit(hippoRoot, op, targetId, metadata) {
-    try {
-        sqliteSyncStore(hippoRoot).appendAuditEvents([{
-                tenantId: resolveTenantId({}),
-                actor: 'cli',
-                op,
-                targetId,
-                metadata,
-            }]);
-    }
-    catch (error) {
-        // Best effort: the command already did its work.
-        reportAuditWriteFailure(op, String(error), targetId);
-    }
-}
 export function requireInit(hippoRoot) {
     if (!isInitialized(hippoRoot)) {
         printError(`No hippo store at ${hippoRoot} (searched ${process.cwd()} and its parents up to your home directory). Run \`hippo init\` first.`);
@@ -38,12 +19,11 @@ export function requireInit(hippoRoot) {
     }
 }
 /** Runs detectChurnStale against every store this repo's memories can live in. */
-export function runChurnStaleForRepo(hippoRoot, dryRun) {
+export function runChurnStaleForRepo(hippoRoot, tenantId, dryRun) {
     const repoRoot = execFileSync('git', ['rev-parse', '--show-toplevel'], { cwd: process.cwd(), encoding: 'utf8', timeout: 10_000, windowsHide: true }).trim();
     const { name: projectName, legacyName } = resolveProjectIdentity(process.cwd());
     const globalRoot = getGlobalRoot();
     const roots = globalRoot !== hippoRoot && isInitialized(globalRoot) ? [hippoRoot, globalRoot] : [hippoRoot];
-    const tenantId = resolveTenantId({});
     return roots.map((root) => {
         // One store failing must not abort sleep's later phases or skip the other store.
         try {
@@ -89,7 +69,8 @@ export async function runViaServerIfAvailable(hippoRoot, httpFn) {
         if (failure === 'delivery-unknown') {
             // Every caller is a non-idempotent write, so replaying on the direct path would store a row the server may already have committed;
             // leave the pidfile alone: the next command's connect-phase failure heals it.
-            printError(`hippo: the connection to ${info.url} dropped or timed out mid-request, so the write may already have been applied. Not retrying locally. Check with \`hippo recall\` before running this again.`);
+            printError(`hippo: the connection to ${info.url} dropped or timed out mid-request, so the write may already have been applied. ` +
+                'Not retrying locally. Check with `hippo recall` before running this again.');
             process.exit(1);
         }
         throw err;
@@ -102,10 +83,9 @@ export function skipLearnOnSharedStore(hippoRoot) {
     console.log("Shared store: skipped learning from this account's git commits and coding agents' own memories.");
     return true;
 }
-export function learnFromRepo(hippoRoot, repoPath, days, label) {
+export async function learnFromRepo(hippoRoot, tenantId, repoPath, days, label) {
     const prefix = label ? `[${label}] ` : '';
-    const ctx = { hippoRoot, tenantId: resolveTenantId({}), actor: adminActor('cli') };
-    const result = learn(ctx, { repoPath, days, profile: CLI_LEARN });
+    const result = await learn(cliApiContext(hippoRoot, tenantId), { repoPath, days, profile: CLI_LEARN });
     if (result.status === 'not-a-repo') {
         console.log(`${prefix}No git history found (or not a git repository).`);
         return { added: 0, skipped: 0, lowInfo: 0 };

package/dist/cli/sleep-render.js

@@ -2,10 +2,12 @@
 import { renderAmbientSummary } from '../core/ambient.js';
 /** The lines `hippo sleep` prints for an api.sleep result; pure, so the snapshot tests read them without a console spy. */
 export function sleepResultLines(result) {
-    return [...sleepCountLines(result), ...(result.dryRun ? ['\n(dry run  - nothing written)'] : []), ...sleepDedupeAndAuditLines(result), ...sleepShareAndGraphLines(result)];
+    return [...sleepCountLines(result), ...(result.dryRun ? ['\n(dry run  - nothing ' +
+                'written)'] : []), ...sleepDedupeAndAuditLines(result), ...sleepShareAndGraphLines(result)];
 }
 function sleepCountLines(result) {
-    const lines = [`Running consolidation${result.dryRun ? ' (dry run)' : ''}...`, `\nResults:`, `   Active memories:  ${result.active}`, `   Removed (decayed): ${result.removed}`];
+    const lines = [`Running consolidation${result.dryRun ? ' (dry ' +
+            'run)' : ''}...`, `\nResults:`, `   Active memories:  ${result.active}`, `   Removed (decayed): ${result.removed}`];
     // Only when dormant.enabled moved something, so every other render stays byte-identical.
     if (result.dormant !== undefined && result.dormant > 0) {
         lines.push(`   Kept dormant:      ${result.dormant}  (hippo dormant to list)`);
@@ -29,7 +31,8 @@ function sleepDedupeAndAuditLines(result) {
             parts.push(`${epiDups} duplicate episodic lessons`);
         if (crossDups > 0)
             parts.push(`${crossDups} cross-layer duplicates`);
-        lines.push(`\n${result.dryRun ? 'Would dedupe' : 'Deduped'} ${removed} duplicates (${parts.join(', ')}). ${result.dryRun ? 'Would keep' : 'Kept'} stronger copies.`);
+        lines.push(`\n${result.dryRun ? 'Would ' +
+            'dedupe' : 'Deduped'} ${removed} duplicates (${parts.join(', ')}). ${result.dryRun ? 'Would keep' : 'Kept'} stronger copies.`);
     }
     if (result.audit) {
         if (result.audit.errorsRemoved > 0) {