hippo-memory 1.71.0 → 2.0.0

package/dist/api/session-end.js

@@ -0,0 +1,131 @@
+// The store writes a session's end makes after sleep and capture (handoff, snapshot close, re-read count), and the
+// compact-resume read; the hook verbs keep stdin, spawning and the log file.
+import * as path from 'path';
+import { isInitialized } from '../core/project-identity.js';
+import { closeTaskSnapshotsForSession, listSessionEvents, loadActiveTaskSnapshot, loadFreshActiveTaskSnapshot } from '../store/sessions.js';
+import { writeSessionEndHandoff } from '../store/handoffs.js';
+import { readApiCalls, recordRereads } from '../store/token-ledger.js';
+import { getGlobalRoot } from '../sharing/global-store.js';
+import { truncateCodePointSafe } from '../util/transcript-tail.js';
+import { errorMessage, log } from '../util/log.js';
+import { COMPACT_RESUME_EVENT_CONTENT_CAP, COMPACT_RESUME_MAX_AGE_MS, compactResumeText } from './context-render.js';
+/** Writes the session's handoff, then closes its snapshot unless `turn`; each step logs its own failure and never throws.
+ *  The handoff goes first, while the snapshot writeSessionEndHandoff reads is still active. */
+export function closeEndedSession(ctx, close) {
+    if (close.sessionId)
+        writeEndHandoff(ctx, close.sessionId, close);
+    if (close.turn) {
+        close.log('skip snapshot close: turn mode');
+        return;
+    }
+    closeSnapshot(ctx, close.sessionId, close.log);
+}
+function writeEndHandoff(ctx, sessionId, close) {
+    try {
+        const ownSnapshot = loadActiveTaskSnapshot(ctx.hippoRoot, ctx.tenantId)?.session_id === sessionId;
+        // A never-compacted session has no snapshot; read even when it has one, as another session's PreCompact can take the slot before the write.
+        const derived = close.workingState();
+        if (!ownSnapshot && !derived) {
+            close.log('skip: no snapshot or transcript for session');
+            return;
+        }
+        const handoff = writeSessionEndHandoff(ctx.hippoRoot, { tenantId: ctx.tenantId, sessionId, evidence: close.evidence(), derived, inPlace: close.turn });
+        close.log(handoff ? `wrote handoff for session ${sessionId}` : `skip: kept the existing handoff for session ${sessionId}`);
+    }
+    catch (err) {
+        close.log(`handoff write failed: ${errorMessage(err)}`);
+    }
+}
+// If session-end never fires (crash, kill -9), the freshness bound in loadFreshActiveTaskSnapshot is the backstop.
+function closeSnapshot(ctx, sessionId, line) {
+    try {
+        if (sessionId) {
+            const closed = closeTaskSnapshotsForSession(ctx.hippoRoot, ctx.tenantId, sessionId);
+            line(`closed ${closed} active snapshot(s) for session ${sessionId}`);
+        }
+        else {
+            line('skip: no session_id in SessionEnd payload, active snapshot left untouched');
+        }
+    }
+    catch (err) {
+        line(`snapshot close failed: ${errorMessage(err)}`);
+    }
+}
+/** Books the ending session's re-reads in each store its ledger rows can land in (`ctx.hippoRoot` and global); returns the log lines. */
+export async function bookSessionRereads(ctx, transcriptPath, sessionId) {
+    if (!transcriptPath || !sessionId)
+        return [];
+    let read;
+    try {
+        read = await readApiCalls(transcriptPath);
+    }
+    catch (err) {
+        return [`skip re-read count: cannot read the transcript: ${errorMessage(err)}`];
+    }
+    const roots = new Set([ctx.hippoRoot, getGlobalRoot()].filter((root) => isInitialized(root)).map((root) => path.resolve(root)));
+    const lines = [];
+    let tokens = 0;
+    for (const root of roots) {
+        try {
+            tokens += recordRereads(root, ctx.tenantId, sessionId, read.calls);
+        }
+        catch (err) {
+            lines.push(`re-read count failed: ${errorMessage(err)}`);
+        }
+    }
+    const skipped = read.malformed > 0 ? `, ${read.malformed} unparsable transcript lines skipped` : '';
+    lines.push(`re-read ${tokens} tokens over ${read.calls.length} model calls for session ${sessionId}${skipped}`);
+    return lines;
+}
+/** The block a compaction lost: the fresh task snapshot and its session trail, or null with none or another session's snapshot. */
+export function compactResumeBlock(ctx, payloadSessionId) {
+    const snapshot = loadFreshActiveTaskSnapshot(ctx.hippoRoot, ctx.tenantId, { maxAgeMs: COMPACT_RESUME_MAX_AGE_MS });
+    // Concurrent sessions must not cross-restore: only when both ids are present and differ, so a manual run with no payload id still prints.
+    if (!snapshot || (payloadSessionId !== null && snapshot.session_id !== null && payloadSessionId !== snapshot.session_id))
+        return null;
+    // A bad trail row costs the trail, not the snapshot; stderr stays out of the model's context.
+    let events = [];
+    try {
+        if (snapshot.session_id) {
+            events = listSessionEvents(ctx.hippoRoot, ctx.tenantId, { session_id: snapshot.session_id }).map((e) => ({
+                ...e,
+                content: truncateCodePointSafe(e.content, COMPACT_RESUME_EVENT_CONTENT_CAP),
+            }));
+        }
+    }
+    catch (err) {
+        log.warn(`hippo compact-resume: trail skipped: ${errorMessage(err)}`);
+    }
+    return compactResumeText(snapshot, events);
+}
+/** Books re-reads, sleeps, captures, digests and closes one ended session, in that order. */
+export async function sessionEndWork(w) {
+    const rereadLog = await bookSessionRereads(w.contextFor(w.hippoRoot), w.transcriptPath, w.sessionId)
+        .catch((err) => [`re-read count failed: ${errorMessage(err)}`]);
+    // Sleep starts the log file afresh, so the lines go in after it; on exit too, in case sleep exits the process.
+    const flushRereadLog = () => { for (const line of rereadLog.splice(0))
+        w.log(line); };
+    process.once('exit', flushRereadLog);
+    // A folder with neither a project nor a global store must not get one made.
+    const store = w.storeRoot();
+    if (!isInitialized(store)) {
+        w.log('skip: no hippo store for this folder or globally', { startFresh: true });
+        flushRereadLog();
+        return;
+    }
+    await w.sleep();
+    flushRereadLog();
+    const scan = w.readScan((line) => w.log(line));
+    w.capture(store, scan);
+    w.digest(scan, (line) => w.log(line));
+    // Only this session's snapshot, and only after sleep and capture.
+    const closeLog = (line) => w.log(line);
+    closeEndedSession(w.contextFor(store), {
+        sessionId: w.sessionId,
+        turn: w.mode === 'turn',
+        workingState: () => (w.transcriptPath ? w.workingState(closeLog) : null),
+        evidence: w.evidence,
+        log: closeLog,
+    });
+}
+//# sourceMappingURL=session-end.js.map

package/dist/api/sleep-run.d.ts

@@ -1,5 +1,5 @@
 import { loadAllEntries } from '../store/entry-reads.js';
-import { auditMemories } from '../store/audit.js';
+import { auditMemories } from '../core/memory-audit.js';
 import { autoShare } from '../sharing/share.js';
 import { consolidate } from '../consolidate/sleep.js';
 import { loadConfig } from '../core/config.js';

package/dist/api/sleep-run.js

@@ -1,9 +1,10 @@
 // The sleep pipeline behind `sleep`, with its phase dependencies injectable; kept out of the package root.
 import { loadAllEntries } from '../store/entry-reads.js';
 import { memoriesBackingObjects } from '../store/delete-and-batch.js';
-import { reportAuditWriteFailure, auditMemories } from '../store/audit.js';
+import { reportAuditWriteFailure } from '../store/audit.js';
+import { auditMemories } from '../core/memory-audit.js';
 import { sqliteSyncStore } from '../store/sqlite/store.js';
-import { autoShare } from '../sharing/share.js';
+import { AUTO_SHARE_MIN_SCORE, autoShare } from '../sharing/share.js';
 import { consolidate } from '../consolidate/sleep.js';
 import { failedUnitOf } from '../store/delete-and-batch.js';
 import { loadConfig } from '../core/config.js';
@@ -51,13 +52,16 @@ async function runSleepPhases(ctx, opts, phases, counts) {
     const consolidateResult = await phases.consolidate(ctx.hippoRoot, { dryRun });
     counts.consolidation = consolidateResult.semanticCreated + consolidateResult.merged;
     const result = sleepResultFrom(consolidateResult, dryRun);
+    // Consolidate's own read predates its writes, so it cannot stand in for this one.
+    // One read after consolidation serves dedup, the audit and ambient: dedup reports every row it deletes, so later phases subtract.
+    const loaded = { entries: phases.loadAllEntries(ctx.hippoRoot), backing: memoriesBackingObjects(ctx.hippoRoot) };
     // Phase 2: Dedup (post-consolidate near-duplicate cleanup).
-    const dedupResult = phases.deduplicateStore(ctx.hippoRoot, { dryRun, actor: ctx.actor.subject });
+    const dedupResult = phases.deduplicateStore(ctx.hippoRoot, { dryRun, actor: ctx.actor.subject, loaded });
     counts.dedup = dedupResult.removed;
     if (dedupResult.removed > 0)
         result.deduped = dedupSummary(dedupResult);
     // Phase 3: Quality audit (remove junk, report warnings; a dry run skips rows earlier phases would remove).
-    const audited = runQualityAudit(ctx, phases, { dryRun, consolidateResult, dedupResult, result });
+    const audited = await runQualityAudit(ctx, phases, { dryRun, consolidateResult, dedupResult, result, loaded });
     counts.auditDeleted = audited.removed;
     if (dryRun)
         return result;
@@ -114,16 +118,17 @@ function dedupSummary(dedupResult) {
     };
 }
 /** `removed` counts audit errors deleted (or that would be under dryRun); `remaining` is what the audit read, less the rows it deleted. */
-function runQualityAudit(ctx, phases, options) {
-    const { dryRun, consolidateResult, dedupResult, result } = options;
-    const planned = new Set(dryRun ? [...(consolidateResult.removedIds ?? []), ...dedupResult.pairs.map((p) => p.removed)] : []);
-    const allEntries = phases.loadAllEntries(ctx.hippoRoot).filter((e) => !planned.has(e.id));
-    const auditOut = phases.auditMemories(allEntries, memoriesBackingObjects(ctx.hippoRoot));
+async function runQualityAudit(ctx, phases, options) {
+    const { dryRun, consolidateResult, dedupResult, result, loaded } = options;
+    // The load followed consolidation, so only a dry run still holds the rows consolidation would remove; dedup's pairs are gone or would be.
+    const planned = new Set([...(dryRun ? consolidateResult.removedIds ?? [] : []), ...dedupResult.pairs.map((p) => p.removed)]);
+    const allEntries = loaded.entries.filter((e) => !planned.has(e.id));
+    const auditOut = phases.auditMemories(allEntries, loaded.backing);
     if (auditOut.issues.length === 0)
         return { removed: 0, remaining: allEntries };
     const errors = auditOut.issues.filter((i) => i.severity === 'error');
     const warnings = auditOut.issues.filter((i) => i.severity === 'warning');
-    const gone = dryRun ? errors.map((issue) => issue.memoryId) : removeAuditErrors(ctx, 'sleep-audit', errors);
+    const gone = dryRun ? errors.map((issue) => issue.memoryId) : await removeAuditErrors(ctx, 'sleep-audit', errors);
     const removed = gone.length;
     const deleted = new Set(gone);
     if (removed > 0 || warnings.length > 0) {
@@ -140,7 +145,7 @@ function shareOnSleep(ctx, phases, result) {
         return;
     // Both skip counters are surfaced so the secret veto and the rejection tombstone are observable, not silent.
     const autoShareStats = { secretSkipped: 0, rejectedSkipped: 0 };
-    const shared = phases.autoShare(ctx.hippoRoot, { minScore: 0.6, stats: autoShareStats });
+    const shared = phases.autoShare(ctx.hippoRoot, { minScore: AUTO_SHARE_MIN_SCORE, stats: autoShareStats });
     if (shared.length > 0) {
         result.shared = shared.length;
     }

package/dist/api/sleep.js

@@ -1,10 +1,11 @@
 // The sleep cycle: decay, consolidation, dedupe, graph extraction and the other maintenance passes.
 import { runSleep } from './sleep-run.js';
+import { requireGroup } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 /** Sleeps the WHOLE hippoRoot, every tenant, so /v1/sleep stays loopback-only; SQLite only; never auto-deletes pinned, raw, kept or object-backing rows. */
 export async function sleep(ctx, opts = {}) {
-    if (ctx.store && ctx.store.kind !== 'sqlite') {
-        throw new Error(`sleep supports only the sqlite store, not '${ctx.store.kind}'`);
-    }
+    // Sleep reopens hippo.db by folder, here and in its child process.
+    requireGroup(storeFor(ctx), 'localFiles');
     return runSleep(ctx, opts);
 }
 //# sourceMappingURL=sleep.js.map

package/dist/api/status.d.ts

@@ -0,0 +1,24 @@
+import type { PhysicsParticle } from '../core/physics.js';
+import type { LegacyStats } from '../store/rows.js';
+import { type StatusCounts } from '../store/candidates.js';
+import { type StoredVectorSummary } from '../store/vector-index.js';
+import { type CorrectionLatencyReport } from './correction-latency.js';
+import { type ProvenanceCoverage } from './provenance-coverage.js';
+import { type Context } from './types.js';
+export interface StoreStatus {
+    stats: LegacyStats;
+    counts: StatusCounts;
+}
+/** Lifetime stats and row counts for the whole store. Every tenant, so the host admin only. */
+export declare function storeStatus(ctx: Context, now: Date, atRiskBelow: number): StoreStatus;
+/** Ids and dimension of the stored vectors. Every tenant, so the host admin only. */
+export declare function vectorSummary(ctx: Context): StoredVectorSummary;
+/** Whether the stored vectors were built by a different model than `providerId`. Every tenant, so the host admin only. */
+export declare function embeddingReindexNeeded(ctx: Context, providerId: string): boolean;
+/** Every stored physics particle. Every tenant, so the host admin only. */
+export declare function storedParticles(ctx: Context): PhysicsParticle[];
+/** Correction latency over every superseded row in the store. Every tenant, so the host admin only. */
+export declare function correctionLatencyReport(ctx: Context): CorrectionLatencyReport;
+/** Provenance coverage over every kind=raw row in the store. Every tenant, so the host admin only. */
+export declare function provenanceCoverageReport(ctx: Context): ProvenanceCoverage;
+//# sourceMappingURL=status.d.ts.map

package/dist/api/status.js

@@ -0,0 +1,40 @@
+// Store-wide status reads: counts, stats, vector index state and the correction and provenance reports.
+import { loadCorrectionEntries, loadRawEntries } from '../store/report-reads.js';
+import { loadStats } from '../store/index-and-stats.js';
+import { loadStatusCounts } from '../store/candidates.js';
+import { embeddingModelRequiresReindex } from '../store/embeddings/index.js';
+import { loadStoredParticles, storedVectorSummary } from '../store/vector-index.js';
+import { buildCorrectionLatency } from './correction-latency.js';
+import { buildProvenanceCoverage } from './provenance-coverage.js';
+import { requireHostAdmin } from './types.js';
+/** Lifetime stats and row counts for the whole store. Every tenant, so the host admin only. */
+export function storeStatus(ctx, now, atRiskBelow) {
+    requireHostAdmin(ctx, 'Reading every tenant');
+    return { stats: loadStats(ctx.hippoRoot), counts: loadStatusCounts(ctx.hippoRoot, now, atRiskBelow) };
+}
+/** Ids and dimension of the stored vectors. Every tenant, so the host admin only. */
+export function vectorSummary(ctx) {
+    requireHostAdmin(ctx, 'Reading every tenant');
+    return storedVectorSummary(ctx.hippoRoot);
+}
+/** Whether the stored vectors were built by a different model than `providerId`. Every tenant, so the host admin only. */
+export function embeddingReindexNeeded(ctx, providerId) {
+    requireHostAdmin(ctx, 'Reading every tenant');
+    return embeddingModelRequiresReindex(ctx.hippoRoot, providerId);
+}
+/** Every stored physics particle. Every tenant, so the host admin only. */
+export function storedParticles(ctx) {
+    requireHostAdmin(ctx, 'Reading every tenant');
+    return loadStoredParticles(ctx.hippoRoot);
+}
+/** Correction latency over every superseded row in the store. Every tenant, so the host admin only. */
+export function correctionLatencyReport(ctx) {
+    requireHostAdmin(ctx, 'Reading every tenant');
+    return buildCorrectionLatency(loadCorrectionEntries(ctx.hippoRoot));
+}
+/** Provenance coverage over every kind=raw row in the store. Every tenant, so the host admin only. */
+export function provenanceCoverageReport(ctx) {
+    requireHostAdmin(ctx, 'Reading every tenant');
+    return buildProvenanceCoverage(loadRawEntries(ctx.hippoRoot));
+}
+//# sourceMappingURL=status.js.map

package/dist/api/store-init.d.ts

@@ -0,0 +1,4 @@
+import { type Context } from './types.js';
+/** Create the store at `ctx.hippoRoot`, or finish setting up one that exists; a store holds every tenant, so the host admin only. */
+export declare function initMemoryStore(ctx: Context): void;
+//# sourceMappingURL=store-init.d.ts.map

package/dist/api/store-init.js

@@ -0,0 +1,9 @@
+// Creating a store for `hippo init`: the database, its mirror folders and first-run setup.
+import { initStore } from '../store/open.js';
+import { requireHostAdmin } from './types.js';
+/** Create the store at `ctx.hippoRoot`, or finish setting up one that exists; a store holds every tenant, so the host admin only. */
+export function initMemoryStore(ctx) {
+    requireHostAdmin(ctx, 'Creating a store');
+    initStore(ctx.hippoRoot);
+}
+//# sourceMappingURL=store-init.js.map

package/dist/api/tokens.js

@@ -1,6 +1,6 @@
 // Token-use and failure reports.
-import { rethrowIfSqliteBlocked } from '../db/index.js';
-import { storeFor } from '../store/index.js';
+import { rethrowIfSqliteBlocked } from '../util/sqlite-blocked.js';
+import { storeFor } from '../store/sqlite/store.js';
 import { failureLogSummary, tokenUseSummary } from '../store/usage-reports.js';
 import { errorMessage, log } from '../util/log.js';
 import { DAY_MS } from '../util/time.js';

package/dist/api/types.d.ts

@@ -10,7 +10,7 @@ export interface Actor {
     scopes?: readonly string[];
     /** An auth resolver vouched for this caller, so its admin role stops at its own tenant. */
     viaAuthResolver?: true;
-    /** The host's operator (CLI, stdio MCP, keyless loopback, host-tenant admin key): may act beyond its tenant. */
+    /** The host's operator (CLI, stdio MCP, keyless loopback set to admin, host-tenant admin key): may act beyond its tenant. */
     hostAdmin?: true;
     owner?: string;
 }
@@ -23,15 +23,11 @@ export interface Context {
 export type HippoDbContext = Context & {
     store?: undefined;
 };
-export type StoreReply<C extends Context, R> = C extends {
-    readonly store: HippoStore;
-} ? Promise<R> : C extends {
-    readonly hippoRoot: string;
-    readonly store?: undefined;
-} ? R : R | Promise<R>;
 /** Builds process-local Actor values (admin and host admin) for CLI and CLI-run connector Contexts; Bearer-authed callers build Actor from the api_keys row
  * instead. */
 export declare function adminActor(subject: string): Actor;
+/** Throws unless the caller is the host's operator: `action` reaches past the caller's tenant. */
+export declare function requireHostAdmin(ctx: Context, action: string): void;
 /** The per-person key: an unowned key gets its own bucket by key id rather than sharing one. */
 export declare function ownerOrSubject(actor: Actor): string;
 /** Thrown by `api.recall` on a contract violation; the stable `code` lets callers discriminate without parsing the message.

package/dist/api/types.js

@@ -1,10 +1,15 @@
 // Request context (caller identity and tenant) shared by every API module, plus the recall contract error.
-import { BadRequestError } from '../core/api-errors.js';
+import { BadRequestError, ForbiddenError } from '../core/api-errors.js';
 /** Builds process-local Actor values (admin and host admin) for CLI and CLI-run connector Contexts; Bearer-authed callers build Actor from the api_keys row
  * instead. */
 export function adminActor(subject) {
     return { subject, role: 'admin', hostAdmin: true };
 }
+/** Throws unless the caller is the host's operator: `action` reaches past the caller's tenant. */
+export function requireHostAdmin(ctx, action) {
+    if (!ctx.actor.hostAdmin)
+        throw new ForbiddenError(`${action} requires a host admin`);
+}
 /** The per-person key: an unowned key gets its own bucket by key id rather than sharing one. */
 export function ownerOrSubject(actor) {
     return actor.owner ?? actor.subject;

package/dist/capture/caller-session.d.ts

@@ -1,5 +1,4 @@
 import { type Context } from '../api/types.js';
-import { type DatabaseSyncLike } from '../db/index.js';
 import { type CallerProject } from '../api/prompt-hook.js';
 import type { ContinuityKey } from '../store/sessions.js';
 import { type WorkingState } from './working-state.js';
@@ -11,6 +10,4 @@ export declare function callerInHoldout(ctx: Context, sessionId: string): boolea
 export declare function checkedWorkingState(state: WorkingState | null): WorkingState | null;
 export declare function assertTrigger(trigger: string | null): void;
 export declare function assertRequestId(requestId: string): void;
-/** Opens with the request's own lock wait, so a busy store becomes a 503 rather than a long stall. */
-export declare function withCallerDb<T>(ctx: Context, fn: (db: DatabaseSyncLike) => T): T;
 //# sourceMappingURL=caller-session.d.ts.map

package/dist/capture/caller-session.js

@@ -1,8 +1,7 @@
 // The checks every caller call shares: ids, project, the session's owner and the pilot arm, all from the request, never the server's env or folder.
 import { BadRequestError } from '../core/api-errors.js';
 import { ownerOrSubject } from '../api/types.js';
-import { closeHippoDb, openHippoDb } from '../db/index.js';
-import { MAX_ID_LEN } from '../util/http-util.js';
+import { MAX_ID_LEN } from '../util/limits.js';
 import { sessionPilotArm } from '../api/pilot-arm.js';
 import { assertCallerIds } from '../api/prompt-hook.js';
 import { assertCallerProject, projectNames } from '../core/project-identity.js';
@@ -45,14 +44,4 @@ export function assertRequestId(requestId) {
     if (requestId.length > MAX_ID_LEN)
         throw new BadRequestError(`request id: at most ${MAX_ID_LEN} characters`);
 }
-/** Opens with the request's own lock wait, so a busy store becomes a 503 rather than a long stall. */
-export function withCallerDb(ctx, fn) {
-    const db = openHippoDb(ctx.hippoRoot);
-    try {
-        return fn(db);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
 //# sourceMappingURL=caller-session.js.map

package/dist/capture/capture-error.d.ts

@@ -1,7 +1,7 @@
-import { type CaptureErrorOutcome } from '../store/failure-log.js';
+import type { CaptureErrorOutcome } from '../store/failure-log.js';
 import type { JsonValue } from '../util/json.js';
 /** Store a failure as an error memory unless it is routine or a repeat, and log it either way, even when storing throws. */
-export declare function captureToolFailure(hippoRoot: string, tenantId: string, payload: JsonValue): CaptureErrorOutcome;
+export declare function captureToolFailure(hippoRoot: string, tenantId: string, payload: JsonValue, onLogged?: (failureId: number | null) => void): CaptureErrorOutcome;
 /** Who sent a failure from another machine: the audit actor and the project its lesson and repeat check belong to. */
 export interface LessonCaller {
     actor: string;

package/dist/capture/capture-error.js

@@ -5,11 +5,10 @@ import { createMemory } from '../core/memory.js';
 import { writeEntry } from '../store/entry-writes.js';
 import { loadContentsWithTag } from '../store/entry-reads.js';
 import { loadConfig } from '../core/config.js';
-import { closeHippoDb, openHippoDb } from '../db/index.js';
-import { recordFailure } from '../store/failure-log.js';
+import { recordFailureAt } from '../store/failure-log-at.js';
 import { failureHash, failureSignature, lessonFromFailure, payloadString, } from './failure-reading.js';
 /** Store a failure as an error memory unless it is routine or a repeat, and log it either way, even when storing throws. */
-export function captureToolFailure(hippoRoot, tenantId, payload) {
+export function captureToolFailure(hippoRoot, tenantId, payload, onLogged) {
     const lesson = lessonFromFailure(payload);
     let outcome = 'store-failed';
     try {
@@ -17,26 +16,32 @@ export function captureToolFailure(hippoRoot, tenantId, payload) {
         return outcome;
     }
     finally {
-        logFailure(hippoRoot, tenantId, payload, lesson, outcome);
+        logAndReport(hippoRoot, tenantId, payload, lesson, outcome, onLogged);
     }
 }
-function logFailure(hippoRoot, tenantId, payload, lesson, outcome) {
-    const hash = (s) => (s === null ? null : failureHash(s));
-    const db = openHippoDb(hippoRoot);
+/** Logs the failure, then tells the caller the row id, or null when the write threw; the throw goes on. */
+function logAndReport(hippoRoot, tenantId, payload, lesson, outcome, onLogged) {
+    let id;
     try {
-        recordFailure(db, {
-            tenantId,
-            sessionId: payloadString(payload, 'session_id'),
-            tool: payloadString(payload, 'tool_name'),
-            outcome,
-            rule: 'rule' in lesson ? lesson.rule : null,
-            sigHash: hash(lesson.text),
-            detailHash: hash(lesson.detail),
-        });
+        id = logFailure(hippoRoot, tenantId, payload, lesson, outcome);
     }
-    finally {
-        closeHippoDb(db);
+    catch (error) {
+        onLogged?.(null);
+        throw error;
     }
+    onLogged?.(id);
+}
+function logFailure(hippoRoot, tenantId, payload, lesson, outcome) {
+    const hash = (s) => (s === null ? null : failureHash(s));
+    return recordFailureAt(hippoRoot, {
+        tenantId,
+        sessionId: payloadString(payload, 'session_id'),
+        tool: payloadString(payload, 'tool_name'),
+        outcome,
+        rule: 'rule' in lesson ? lesson.rule : null,
+        sigHash: hash(lesson.text),
+        detailHash: hash(lesson.detail),
+    });
 }
 export function storeLesson(hippoRoot, tenantId, text, caller) {
     const sig = failureSignature(text);

package/dist/capture/codex-patch.js

@@ -35,7 +35,9 @@ export function patchPaths(body) {
     }
     return paths.filter(Boolean);
 }
-const HEREDOC = /^\s*(?:cd\s+(?<cd>'[^']*'|"[^"]*"|[^\s'"&|;]+)\s+&&\s+)?(?:apply_patch|applypatch)\s+<<\s*(?<q>['"]?)(?<tag>\w+)\k<q>[ \t]*\r?\n(?<body>[\s\S]*?)\r?\n\s*\k<tag>\s*$/;
+const HEREDOC = new RegExp(String.raw `^\s*(?:cd\s+(?<cd>'[^']*'|"[^"]*"|[^\s'"&|;]+)\s+&&\s+)?` +
+    String.raw `(?:apply_patch|applypatch)\s+<<\s*(?<q>['"]?)(?<tag>\w+)\k<q>[ \t]*\r?\n` +
+    String.raw `(?<body>[\s\S]*?)\r?\n\s*\k<tag>\s*$`);
 /** The script a shell argv runs, for the shells Codex checks for an apply_patch heredoc. */
 function shellScript(argv) {
     const exe = path.basename(argv[0] ?? '').toLowerCase().replace(/\.exe$/, '');