hippo-memory 1.72.0 → 2.0.0

package/dist/capture/compaction-spool.js

@@ -29,11 +29,6 @@ const BAD = /^([\w-]+)\.(?:\w+\.)?bad$/;
 const BAD_TMP = /^[\w-]+\.\w+\.bad\.[0-9a-f]{8}\.tmp$/;
 const NEW_STEM = /^(\d{13})-[0-9a-f]{8}$/;
 const LEGACY_STEM_TIME = /-(\d+)$/;
-let fsx = fs;
-/** Test-only seam, so a test can make one fs call fail; null restores the real fs. */
-export function _setSpoolFsForTests(next) {
-    fsx = next ?? fs;
-}
 const stamp = (ms) => String(Math.trunc(ms)).padStart(STAMP_DIGITS, '0');
 const isTime = (value) => typeof value === 'number' && Number.isFinite(value);
 const idle = new Int32Array(new SharedArrayBuffer(4));
@@ -99,7 +94,7 @@ function claimOf(name) {
 function spoolFile(hippoRoot) {
     return path.join(hippoRoot, SPOOL_DIR, `${stamp(Date.now())}-${randomBytes(4).toString('hex')}.a0.json`);
 }
-export function spool(hippoRoot, tenantId, payload, text, at) {
+export function spool(hippoRoot, tenantId, payload, text, at, fsx = fs) {
     const file = spoolFile(hippoRoot);
     fsx.mkdirSync(path.dirname(file), { recursive: true });
     const body = {
@@ -160,7 +155,7 @@ function parseLock(text) {
     return { pid, at: raw.at, token };
 }
 /** The lock's body; its mtime stands in for the time when the body does not parse. */
-function readLock(lock, log) {
+function readLock(fsx, lock, log) {
     let text = '';
     const read = settle(() => { text = fsx.readFileSync(lock, 'utf8'); }, log, 'spool lock not read');
     if (read !== 'done')
@@ -172,7 +167,7 @@ function readLock(lock, log) {
     const stat = settle(() => { mtime = fsx.statSync(lock).mtimeMs; }, log, 'spool lock not read');
     return stat === 'done' ? { pid: null, at: mtime, token: null } : stat;
 }
-function createLock(lock, body, log) {
+function createLock(fsx, lock, body, log) {
     try {
         fsx.writeFileSync(lock, body, { encoding: 'utf8', flag: 'wx' });
         return 'taken';
@@ -188,18 +183,18 @@ function createLock(lock, body, log) {
     }
 }
 /** This run's token and take time once it holds `replay.lock`, else null: another replayer holds it, or it could not be made. */
-function takeLock(dir, log) {
+function takeLock(fsx, dir, log) {
     const lock = path.join(dir, LOCK);
     const token = randomBytes(8).toString('hex');
     const at = Date.now();
     const body = JSON.stringify({ pid: process.pid, at, token });
     for (let tries = 0; tries < 2; tries++) {
-        const made = createLock(lock, body, log);
+        const made = createLock(fsx, lock, body, log);
         if (made === 'taken')
             return { token, at };
         if (made === 'skip')
             break;
-        const held = readLock(lock, log);
+        const held = readLock(fsx, lock, log);
         if (held === 'gone')
             continue;
         if (held === 'busy')
@@ -216,24 +211,24 @@ function takeLock(dir, log) {
     return null;
 }
 /** False, after saying so, once `replay.lock` no longer holds this run's token or cannot be read. */
-function ownsLock(dir, token, log) {
-    const held = readLock(path.join(dir, LOCK), log);
+function ownsLock(fsx, dir, token, log) {
+    const held = readLock(fsx, path.join(dir, LOCK), log);
     if (held !== 'gone' && held !== 'busy' && held.token === token)
         return true;
     log(held === 'busy' ? 'spool lock could not be read, stopping' : 'spool left to another replayer (lock taken over)');
     return false;
 }
 /** Removes `replay.lock` only while it holds this run's token, so a run never deletes a successor's lock. Never throws. */
-function releaseLock(dir, mine, log) {
+function releaseLock(fsx, dir, mine, log) {
     const lock = path.join(dir, LOCK);
-    const held = readLock(lock, log);
+    const held = readLock(fsx, lock, log);
     // A takeover needs a lock over STALE_MS old, so a busy read of one this run took more recently is still this run's.
     const ours = held === 'busy' ? Date.now() - mine.at < STALE_MS : held !== 'gone' && held.token === mine.token;
     if (ours)
         settle(() => fsx.unlinkSync(lock), log, 'spool lock not released');
 }
 /** Claim time sits in the claim's name, so a claim over STALE_MS away from now belongs to a replayer that never finished. True when one was put back. */
-function recoverStaleClaims(dir, names, log) {
+function recoverStaleClaims(fsx, dir, names, log) {
     const now = Date.now();
     // A claim whose unlink stayed busy after its `.bad` landed is a spare copy, not a second failure.
     const setAside = new Set(names.flatMap((name) => BAD.exec(name)?.[1] ?? []));
@@ -256,21 +251,21 @@ function recoverStaleClaims(dir, names, log) {
                 putBackOne = true;
             }
         }
-        else if (moveBad(dir, file, { stem: claim.stem, attempt: claim.attempt, cause: 'interrupted', log })) {
+        else if (moveBad(fsx, dir, file, { stem: claim.stem, attempt: claim.attempt, cause: 'interrupted', log })) {
             log(`spool file ${claim.name} was claimed by a replayer that never finished ${MAX_ATTEMPTS} times, set aside as .bad`);
         }
     }
     return putBackOne;
 }
 /** Returns a claim to the waiting files as `<stem>.a<attempt>.json`; one that stays busy is left for stale recovery. */
-function putBack(dir, claim, stem, attempt, log) {
+function putBack(fsx, dir, claim, stem, attempt, log) {
     const name = path.basename(claim);
     if (settle(() => fsx.renameSync(claim, path.join(dir, `${stem}.a${attempt}.json`)), log, `spool file ${name} not put back`) === 'busy') {
         log(`spool file ${name} could not be put back; it returns ${STALE_MS / MINUTE_MS} minutes after its claim`);
     }
 }
 /** Writes `<stem>.<cause>.bad` through a random temp file, so the rename replaces any torn `.bad` a crash left. */
-function writeBad(dir, options) {
+function writeBad(fsx, dir, options) {
     const { stem, cause, text, log, what } = options;
     const tmp = path.join(dir, `${stem}.${cause}.bad.${randomBytes(4).toString('hex')}.tmp`);
     const written = settle(() => fsx.writeFileSync(tmp, text, { encoding: 'utf8', flag: 'wx' }), log, what);
@@ -280,21 +275,21 @@ function writeBad(dir, options) {
     return moved === 'done';
 }
 /** Sets a claim aside as `.bad` before the claim goes, so a crash between leaves a whole copy; a busy write puts the claim back. */
-function moveBad(dir, claim, options) {
+function moveBad(fsx, dir, claim, options) {
     const { stem, attempt, cause, log, raw } = options;
     const what = `spool file ${path.basename(claim)} not set aside`;
     let text = raw ?? '';
     if (raw === undefined && settle(() => { text = fsx.readFileSync(claim, 'utf8'); }, log, what) !== 'done')
         return false;
-    if (!writeBad(dir, { stem, cause, text, log, what })) {
-        putBack(dir, claim, stem, attempt, log);
+    if (!writeBad(fsx, dir, { stem, cause, text, log, what })) {
+        putBack(fsx, dir, claim, stem, attempt, log);
         return false;
     }
     settle(() => fsx.unlinkSync(claim), log, what);
     return true;
 }
 /** A tmp over STALE_MS old belongs to a spool that never renamed it: a whole one joins the waiting files, a torn one is set aside. True when one joined. */
-function promoteTmp(dir, names, tenantId, log) {
+function promoteTmp(fsx, dir, names, tenantId, log) {
     const now = Date.now();
     let promoted = false;
     for (const name of names) {
@@ -320,7 +315,7 @@ function promoteTmp(dir, names, tenantId, log) {
                 promoted = true;
             }
         }
-        else if (writeBad(dir, { stem: m[1], cause: 'unreadable', text, log, what })) {
+        else if (writeBad(fsx, dir, { stem: m[1], cause: 'unreadable', text, log, what })) {
             settle(() => fsx.unlinkSync(file), log, what);
             log(`spool file ${name} was never finished, set aside as .bad`);
         }
@@ -328,13 +323,13 @@ function promoteTmp(dir, names, tenantId, log) {
     return promoted;
 }
 /** Removes a claim once the store holds its summary; a claim left behind is imported again, so the log says so. */
-function removeClaim(claim, name, log) {
+function removeClaim(fsx, claim, name, log) {
     const removed = settleCode(() => fsx.unlinkSync(claim), log, `spool file ${name} claim not removed`);
     if (removed.settled === 'busy')
         log(`spool file ${name} saved; its claim could not be removed (${removed.code}); it will be imported again`);
 }
 /** After an importer throw: a busy store stops the run with the count unchanged, any other error counts one try toward .bad. */
-function importFailed(dir, claim, entry, options) {
+function importFailed(fsx, dir, claim, entry, options) {
     const { text, recorded, cause, log } = options;
     const { name } = entry;
     const busy = isSqliteBusy(cause);
@@ -346,22 +341,22 @@ function importFailed(dir, claim, entry, options) {
         return busy ? 'stop' : 'skipped';
     }
     if (busy) {
-        putBack(dir, claim, entry.stem, entry.attempt, log);
+        putBack(fsx, dir, claim, entry.stem, entry.attempt, log);
         log(`spool file ${name} waits for the next run: the store is busy`);
         return 'stop';
     }
     const next = entry.attempt + 1;
     if (next < MAX_ATTEMPTS) {
-        putBack(dir, claim, entry.stem, next, log);
+        putBack(fsx, dir, claim, entry.stem, next, log);
         log(`spool file ${name} failed to import (try ${next} of ${MAX_ATTEMPTS}): ${errorMessage(cause)}`);
     }
-    else if (moveBad(dir, claim, { stem: entry.stem, attempt: entry.attempt, cause: 'failed', log, raw: text })) {
+    else if (moveBad(fsx, dir, claim, { stem: entry.stem, attempt: entry.attempt, cause: 'failed', log, raw: text })) {
         log(`spool file ${name} set aside as .bad after ${MAX_ATTEMPTS} tries: ${errorMessage(cause)}`);
     }
     return 'skipped';
 }
 /** Claims, reads and imports one waiting file; `stop` ends the run because the store is busy. */
-function importFile(dir, entry, tenantId, log, importOne) {
+function importFile(fsx, dir, entry, tenantId, log, importOne) {
     const { name } = entry;
     const claim = path.join(dir, `${entry.stem}.a${entry.attempt}.claim-${stamp(Date.now())}`);
     const taken = settleCode(() => fsx.renameSync(path.join(dir, name), claim), log, `spool file ${name} not claimed`);
@@ -374,12 +369,12 @@ function importFile(dir, entry, tenantId, log, importOne) {
     if (read === 'gone')
         log(`spool file ${name} vanished`);
     if (read === 'busy')
-        putBack(dir, claim, entry.stem, entry.attempt, log);
+        putBack(fsx, dir, claim, entry.stem, entry.attempt, log);
     if (read !== 'done')
         return 'skipped';
     const spooled = parseSpooled(text, tenantId);
     if (spooled === null) {
-        if (moveBad(dir, claim, { stem: entry.stem, attempt: entry.attempt, cause: 'unreadable', log, raw: text })) {
+        if (moveBad(fsx, dir, claim, { stem: entry.stem, attempt: entry.attempt, cause: 'unreadable', log, raw: text })) {
             log(`spool file ${name} is not readable, set aside as .bad`);
         }
         return 'skipped';
@@ -389,7 +384,7 @@ function importFile(dir, entry, tenantId, log, importOne) {
         if (recorded)
             return;
         recorded = true;
-        removeClaim(claim, name, log);
+        removeClaim(fsx, claim, name, log);
     };
     try {
         importOne(spooled, markRecorded);
@@ -397,10 +392,10 @@ function importFile(dir, entry, tenantId, log, importOne) {
         return 'imported';
     }
     catch (err) {
-        return importFailed(dir, claim, entry, { text, recorded, cause: err, log });
+        return importFailed(fsx, dir, claim, entry, { text, recorded, cause: err, log });
     }
 }
-function mtimeOf(file) {
+function mtimeOf(fsx, file) {
     try {
         return fsx.statSync(file).mtimeMs;
     }
@@ -413,7 +408,7 @@ function mtimeOf(file) {
     }
 }
 /** What doctor reports, read only: files a replay should have taken by now, claims and tmp files a dead process left, and `.bad` files. */
-export function spoolCounts(hippoRoot, now, waitingAfterMs) {
+export function spoolCounts(hippoRoot, now, waitingAfterMs, fsx = fs) {
     const counts = { waiting: 0, stale: 0, bad: 0 };
     const dir = path.join(hippoRoot, SPOOL_DIR);
     if (!fsx.existsSync(dir))
@@ -426,12 +421,12 @@ export function spoolCounts(hippoRoot, now, waitingAfterMs) {
         if (name.endsWith('.bad'))
             counts.bad++;
         else if (waiting !== null) {
-            const spooled = NEW_STEM.test(waiting[1]) ? created(waiting[1]) : mtimeOf(file);
+            const spooled = NEW_STEM.test(waiting[1]) ? created(waiting[1]) : mtimeOf(fsx, file);
             if (spooled !== null && at - spooled > waitingAfterMs)
                 counts.waiting++;
         }
         else if (claim !== null || TMP.test(name)) {
-            const since = claim?.claimedAt ?? mtimeOf(file);
+            const since = claim?.claimedAt ?? mtimeOf(fsx, file);
             if (since !== null && Math.abs(at - since) > STALE_MS)
                 counts.stale++;
         }
@@ -439,25 +434,25 @@ export function spoolCounts(hippoRoot, now, waitingAfterMs) {
     return counts;
 }
 /** One replayer at a time holds `replay.lock`, so only one process claims a file even where Windows lets two renames of it both land. */
-export function importSpool(hippoRoot, tenantId, log, deadline, importOne) {
+export function importSpool(hippoRoot, tenantId, log, deadline, importOne, fsx = fs) {
     const dir = path.join(hippoRoot, SPOOL_DIR);
     if (!fsx.existsSync(dir))
         return 0;
-    const mine = takeLock(dir, log);
+    const mine = takeLock(fsx, dir, log);
     if (mine === null)
         return 0;
     try {
-        if (!ownsLock(dir, mine.token, log))
+        if (!ownsLock(fsx, dir, mine.token, log))
             return 0;
         const names = fsx.readdirSync(dir);
-        const promoted = promoteTmp(dir, names, tenantId, log);
-        const recovered = recoverStaleClaims(dir, names, log);
+        const promoted = promoteTmp(fsx, dir, names, tenantId, log);
+        const recovered = recoverStaleClaims(fsx, dir, names, log);
         let finished = 0;
         // Only promotion and recovery add waiting names, so the folder is listed again only after one of them did.
         for (const entry of waitingFiles(promoted || recovered ? fsx.readdirSync(dir) : names)) {
-            if (Date.now() > deadline || !ownsLock(dir, mine.token, log))
+            if (Date.now() > deadline || !ownsLock(fsx, dir, mine.token, log))
                 break;
-            const outcome = importFile(dir, entry, tenantId, log, importOne);
+            const outcome = importFile(fsx, dir, entry, tenantId, log, importOne);
             if (outcome === 'imported')
                 finished++;
             if (outcome === 'stop')
@@ -466,7 +461,7 @@ export function importSpool(hippoRoot, tenantId, log, deadline, importOne) {
         return finished;
     }
     finally {
-        releaseLock(dir, mine, log);
+        releaseLock(fsx, dir, mine, log);
     }
 }
 //# sourceMappingURL=compaction-spool.js.map

package/dist/capture/session-end-caller.js

@@ -24,7 +24,7 @@ export function sessionEndHandoffForCaller(ctx, req) {
     const state = checkedWorkingState(req.workingState);
     const evidence = checkedEvidence(req.evidence);
     const key = bindCaller(ctx, req.sessionId, req.project);
-    const handoff = writeSessionEndHandoff(ctx.hippoRoot, ctx.tenantId, req.sessionId, evidence, state, key);
+    const handoff = writeSessionEndHandoff(ctx.hippoRoot, { tenantId: ctx.tenantId, sessionId: req.sessionId, evidence, derived: state, key });
     const snapshotsClosed = closeTaskSnapshotsForSession(ctx.hippoRoot, ctx.tenantId, req.sessionId, 'session-ended', key);
     return { handoffWritten: handoff !== null, snapshotsClosed };
 }

package/dist/capture/session-worker.js

@@ -3,7 +3,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { homeDir } from '../util/agent-homes.js';
-import { errorMessage, log as logger } from '../util/log.js';
+import { errorCode, errorMessage, log as logger } from '../util/log.js';
 import { isObjectLike, isStringValue } from '../core/capture-contract.js';
 import { SESSION_ID_RE } from './copilot-transcript.js';
 import { blockHash } from '../util/token-text.js';
@@ -78,10 +78,16 @@ function releaseSessionLock(lock) {
         logger.debug(`session lock not removed: ${errorMessage(err)}`);
     }
 }
-/** False when the sessions folder cannot be written, so the caller runs unlocked as before. */
+/** False when the request could not be queued; the caller then refuses the run, since an unlocked worker could race a live one. */
 function queueRun(files, mode) {
     try {
         fs.mkdirSync(path.dirname(files.queued), { recursive: true });
+    }
+    catch (err) {
+        logger.warn(`session worker: cannot create ${path.dirname(files.queued)}, so the ${mode} close is not run: ${errorMessage(err)}`);
+        return false;
+    }
+    try {
         // A full close outranks a turn close: it overwrites a queued turn, and a turn never replaces a queued full close.
         if (mode === 'full')
             fs.writeFileSync(files.queued, 'full');
@@ -90,7 +96,10 @@ function queueRun(files, mode) {
         return true;
     }
     catch (err) {
-        return err instanceof Error && 'code' in err && err.code === 'EEXIST';
+        if (errorCode(err) === 'EEXIST')
+            return true;
+        logger.warn(`session worker: cannot queue the ${mode} close in ${files.queued}, so it is not run: ${errorMessage(err)}`);
+        return false;
     }
 }
 /** Takes the queued request by renaming it, so one queued while this reads it lands in a fresh file. */
@@ -99,8 +108,10 @@ function takeQueued(queued) {
     try {
         fs.renameSync(queued, taken);
     }
-    catch {
-        // Nothing queued, or a rename refused for a moment; the request stays queued for the next round.
+    catch (err) {
+        // ENOENT means nothing is queued; any other refusal leaves the request queued for the next round, but is told.
+        if (errorCode(err) !== 'ENOENT')
+            logger.warn(`session worker: cannot take the queued request ${queued}: ${errorMessage(err)}`);
         return null;
     }
     try {
@@ -113,8 +124,10 @@ function takeQueued(queued) {
 /** Runs `work` unless a live worker holds this session, which then runs the request after its own so the last reply is never dropped. */
 export async function runSessionWorker(sessionId, mode, work) {
     const files = sessionStateFiles(sessionId);
-    if (files === null || !queueRun(files, mode))
+    if (files === null)
         return work(mode);
+    if (!queueRun(files, mode))
+        return;
     for (let take = takeSessionLock(files.lock); take !== 'held'; take = takeSessionLock(files.lock)) {
         if (take === 'unusable')
             return work(mode);

package/dist/cli/audit.js

@@ -72,7 +72,7 @@ async function cmdAuditList(hippoRoot, tenantId, flags) {
         console.log(formatAuditRow(ev));
     }
 }
-function cmdAuditPrune(hippoRoot, ctxTenantId, flags) {
+async function cmdAuditPrune(hippoRoot, ctxTenantId, flags) {
     const olderThanRaw = stringFlag(flags, 'older-than') ?? '';
     if (!olderThanRaw) {
         printError('Usage: hippo audit prune --older-than <Nd> [--dry-run] [--tenant <t>]');
@@ -89,7 +89,7 @@ function cmdAuditPrune(hippoRoot, ctxTenantId, flags) {
     const tenantId = stringFlag(flags, 'tenant')?.trim() || ctxTenantId;
     const dryRun = flagIsTrue(flags, 'dry-run');
     const asJson = boolFlag(flags, 'json');
-    const result = api.pruneAuditLog(cliApiContext(hippoRoot, tenantId), { olderThanDays, dryRun });
+    const result = await api.pruneAuditLog(cliApiContext(hippoRoot, tenantId), { olderThanDays, dryRun });
     if (asJson) {
         console.log(JSON.stringify(result));
         return;
@@ -107,15 +107,15 @@ async function cmdAuditLog(hippoRoot, tenantId, args, flags) {
         return;
     }
     if (sub === 'prune') {
-        cmdAuditPrune(hippoRoot, tenantId, flags);
+        await cmdAuditPrune(hippoRoot, tenantId, flags);
         return;
     }
     printError(`Unknown audit subcommand: ${sub}. Expected: list | prune.`);
     throw new CliExit(1);
 }
-function auditRepair(hippoRoot, tenantId, flags) {
+async function auditRepair(hippoRoot, tenantId, flags) {
     const apply = flagIsTrue(flags, 'apply') && flags['dry-run'] !== true;
-    const result = api.repairMemoryQuality(cliApiContext(flags['global'] ? getGlobalRoot() : hippoRoot, tenantId), apply);
+    const result = await api.repairMemoryQuality(cliApiContext(flags['global'] ? getGlobalRoot() : hippoRoot, tenantId), apply);
     if (flags['json']) {
         console.log(JSON.stringify(result));
         return;
@@ -137,7 +137,7 @@ function auditRepair(hippoRoot, tenantId, flags) {
     if (!apply)
         console.log('Preview only. Add --apply to move set-aside memories to dormant storage. Pin a review memory to keep it.');
 }
-function fixAuditErrors(hippoRoot, tenantId, result, flags) {
+async function fixAuditErrors(hippoRoot, tenantId, result, flags) {
     const errors = result.issues.filter(i => i.severity === 'error');
     if (errors.length > 0 && flagIsTrue(flags, 'dry-run')) {
         console.log(`\nWould remove ${errors.length} error-severity memories (dry run, nothing deleted).`);
@@ -145,7 +145,7 @@ function fixAuditErrors(hippoRoot, tenantId, result, flags) {
     }
     else if (errors.length > 0) {
         const ctx = cliApiContext(hippoRoot, tenantId);
-        const removedCount = api.removeAuditErrors(ctx, 'audit --fix', errors).length;
+        const removedCount = (await api.removeAuditErrors(ctx, 'audit --fix', errors)).length;
         console.log(`\nRemoved ${removedCount} error-severity memories.`);
         console.log(`${result.issues.length - errors.length} warnings remain (review manually).`);
     }
@@ -155,7 +155,7 @@ function fixAuditErrors(hippoRoot, tenantId, result, flags) {
 }
 export async function handleAudit({ hippoRoot, tenantId, args, flags }) {
     if (args[0] === 'repair') {
-        auditRepair(hippoRoot, tenantId, flags);
+        await auditRepair(hippoRoot, tenantId, flags);
         return;
     }
     // `audit list` and `audit prune` are the audit-log subcommands; other forms (no sub, --fix) keep the memory-quality auditor.
@@ -164,7 +164,7 @@ export async function handleAudit({ hippoRoot, tenantId, args, flags }) {
         return;
     }
     requireInit(hippoRoot);
-    const result = api.auditMemoryQuality(cliApiContext(hippoRoot, tenantId));
+    const result = await api.auditMemoryQuality(cliApiContext(hippoRoot, tenantId));
     const shouldFix = boolFlag(flags, 'fix');
     if (result.issues.length === 0) {
         console.log(`All ${result.total} memories passed quality checks.`);
@@ -177,7 +177,7 @@ export async function handleAudit({ hippoRoot, tenantId, args, flags }) {
             console.log(`         "${truncateWithEllipsis(issue.content, 80)}"`);
         }
         if (shouldFix) {
-            fixAuditErrors(hippoRoot, tenantId, result, flags);
+            await fixAuditErrors(hippoRoot, tenantId, result, flags);
         }
         else {
             console.log(`\nRun with --fix to auto-remove error-severity issues.`);

package/dist/cli/auth.js

@@ -28,7 +28,7 @@ function noteMintDefaults(roleGiven, expiryGiven) {
     if (notes.length > 0)
         printError(`hippo auth create: ${notes.join('; ')}.`);
 }
-function cmdAuthCreate(hippoRoot, defaultTenantId, flags) {
+async function cmdAuthCreate(hippoRoot, defaultTenantId, flags) {
     const root = resolveAuthRoot(hippoRoot, flags);
     const tenantFlag = stringFlag(flags, 'tenant');
     const labelFlag = stringFlag(flags, 'label');
@@ -45,7 +45,7 @@ function cmdAuthCreate(hippoRoot, defaultTenantId, flags) {
     const ctx = cliApiContext(root, tenantFlag ?? defaultTenantId);
     let result;
     try {
-        result = api.authCreate(ctx, { label: labelFlag, role, ttlDays, noExpiry: noExpiry || undefined });
+        result = await api.authCreate(ctx, { label: labelFlag, role, ttlDays, noExpiry: noExpiry || undefined });
     }
     catch (err) {
         if (!(err instanceof api.BadRequestError))
@@ -112,7 +112,7 @@ async function cmdAuthRevoke(hippoRoot, tenantId, keyId, flags) {
     const ctx = await keyContext(resolveAuthRoot(hippoRoot, flags), tenantId, keyId);
     let revokedAt;
     try {
-        revokedAt = api.authRevoke(ctx, keyId).revokedAt;
+        revokedAt = (await api.authRevoke(ctx, keyId)).revokedAt;
     }
     catch (err) {
         printError(`Error: ${errorMessage(err)}`);
@@ -152,7 +152,7 @@ export async function handleAuth({ hippoRoot, tenantId, args, flags }) {
     const subArgs = args.slice(1);
     switch (sub) {
         case 'create':
-            cmdAuthCreate(hippoRoot, tenantId, flags);
+            await cmdAuthCreate(hippoRoot, tenantId, flags);
             return;
         case 'list':
             cmdAuthList(hippoRoot, tenantId, flags);

package/dist/cli/client.d.ts

@@ -1,8 +1,7 @@
 /** HTTP client wrapper for `hippo serve`: only the routed writes (remember, forget, archive, promote); every other command opens the store directly.
  * Server errors rethrow with the message verbatim so CLI substring matches still work; network errors propagate as the native fetch failure. */
 import type { RememberOpts, RememberResult } from '../api/index.js';
-/** An error the server answered with, not one the transport raised: the refused-connection classifier sniffs message text,
- *  and a server message quotes the caller's own id or content back verbatim. */
+/** An error the server answered with, not one the transport raised, so the transport classifier can skip it by class. */
 export declare class HttpResponseError extends Error {
     readonly status: number;
     constructor(message: string, status: number);

package/dist/cli/client.js

@@ -3,6 +3,7 @@
 import { fetchWithRetry } from '../util/http-retry.js';
 import { readCappedJson } from '../util/capped-json.js';
 import { isJsonObject, isJsonString } from '../util/json.js';
+import { isObjectLike } from '../core/capture-contract.js';
 /** A write the local server has not answered in this long is stuck; the caller treats it as delivery-unknown. */
 const SERVER_TIMEOUT_MS = 30_000;
 /** Five tries at the server's 1 s Retry-After keeps the roughly 5 s wait the CLI had before the server answered busy with 503. */
@@ -26,8 +27,7 @@ function buildHeaders(apiKey, withBody) {
         headers['authorization'] = `Bearer ${apiKey}`;
     return headers;
 }
-/** An error the server answered with, not one the transport raised: the refused-connection classifier sniffs message text,
- *  and a server message quotes the caller's own id or content back verbatim. */
+/** An error the server answered with, not one the transport raised, so the transport classifier can skip it by class. */
 export class HttpResponseError extends Error {
     status;
     constructor(message, status) {
@@ -109,29 +109,29 @@ export async function archiveRaw(serverUrl, apiKey, id, reason) {
         await throwForStatus(res);
     return readReply(res, 'POST /v1/memories/:id/archive', (b) => isJsonString(b.archivedAt));
 }
-function hasObjectCause(e) {
-    // Node's fs/net system errors (ECONNREFUSED, ECONNRESET) attach the syscall code on a non-null object `cause`;
-    // the strict-equality checks below validate it before use.
-    return typeof e.cause === 'object' && e.cause !== null;
+/** The syscall code Node puts on a system error itself (`http` errors) or on the `cause` of a fetch `TypeError`; '' when there is none. */
+function transportCode(err) {
+    if ('code' in err)
+        return String(err.code);
+    // Node's fetch attaches the syscall code (ECONNREFUSED, ECONNRESET) on a non-null object `cause`.
+    const cause = err.cause;
+    return isObjectLike(cause) && 'code' in cause ? String(cause.code) : '';
 }
 export function classifyTransportFailure(err) {
     // The server answered, so the transport worked, whatever the message says.
     if (err instanceof HttpResponseError)
         return 'none';
-    const message = err.message.toLowerCase();
-    const code = hasObjectCause(err) ? err.cause.code : undefined;
+    const code = transportCode(err);
     // Connect-phase failures: no request bytes ever left the client, so a stale
     // pidfile can be healed and the call replayed on the direct path.
     if (code === 'ECONNREFUSED' || code === 'ENOTFOUND' || code === 'EAI_AGAIN')
         return 'never-sent';
-    if (message.includes('econnrefused'))
-        return 'never-sent';
-    // The socket died mid-exchange. Node fetch surfaces this as a bare
-    // 'fetch failed' with the syscall code on the cause, so check both shapes.
+    // The socket died mid-exchange.
     if (code === 'ECONNRESET' || code === 'ECONNABORTED' || code === 'EPIPE' || code === 'UND_ERR_SOCKET') {
         return 'delivery-unknown';
     }
-    if (message.includes('socket hang up') || message.includes('fetch failed'))
+    // Fetch rejects every network failure as a TypeError, with a cause only when the syscall is known, so no code means the conservative answer.
+    if (err instanceof TypeError)
         return 'delivery-unknown';
     // The request was sent and the server went quiet, so it may have committed.
     if (err.name === 'TimeoutError')

package/dist/cli/context.js

@@ -54,7 +54,7 @@ async function renderContext(hippoRoot, resolvedTenant, args, flags, stdinText,
     const session = resolveContextSession(stdinText);
     const { currentSessionId, ledgerSessionId, payloadSessionId } = session;
     // The pilot arm is booked at the first hook call whatever the flags, so the holdout sees no budget or content branch.
-    if (inPilotHoldout(hippoRoot, resolvedTenant, currentSessionId, payloadSessionId !== undefined)) {
+    if (inPilotHoldout(hippoRoot, resolvedTenant, currentSessionId, { write: payloadSessionId !== undefined })) {
         rec?.disabled();
         return;
     }

package/dist/cli/curate.d.ts

@@ -1,5 +1,5 @@
 import { type CommandContext } from './flag-values.js';
-export declare function handleOutcome({ hippoRoot, tenantId, flags }: CommandContext): void;
+export declare function handleOutcome({ hippoRoot, tenantId, flags }: CommandContext): Promise<void>;
 export declare function handleConflicts({ hippoRoot, tenantId, flags }: CommandContext): void;
 export declare function handleResolve({ hippoRoot, tenantId, args, flags }: CommandContext): Promise<void>;
 export declare function handleReject({ hippoRoot, tenantId, args, flags }: CommandContext): void;

package/dist/cli/curate.js

@@ -21,7 +21,7 @@ const CONFLICT_PREVIEW_CHARS = 120;
 const REJECTED_DIGEST_LIST_CHARS = 16;
 const DORMANT_PREVIEW_CHARS = 100;
 const STRENGTH_DECIMALS = 3;
-export function handleOutcome({ hippoRoot, tenantId, flags }) {
+export async function handleOutcome({ hippoRoot, tenantId, flags }) {
     requireInit(hippoRoot);
     const good = boolFlag(flags, 'good');
     const bad = boolFlag(flags, 'bad');
@@ -34,10 +34,10 @@ export function handleOutcome({ hippoRoot, tenantId, flags }) {
     const specificId = flags['id'] ? String(flags['id']) : null;
     let updated;
     if (specificId) {
-        updated = api.outcome(ctx, [specificId], good).applied;
+        updated = (await api.outcome(ctx, [specificId], good)).applied;
     }
     else {
-        const r = api.outcomeForLastRecall(ctx, good);
+        const r = await api.outcomeForLastRecall(ctx, good);
         if (r.ids.length === 0) {
             console.log('No recent recall to apply outcome to. Use --id <id> to target a specific memory.');
             return;
@@ -48,17 +48,17 @@ export function handleOutcome({ hippoRoot, tenantId, flags }) {
 }
 // Shared between the forget dispatch and cmdForget so the message can't drift.
 const ARCHIVE_REASON_REQUIRED = 'hippo forget --archive requires --reason "<why>" (recorded on the archive).';
-function cmdForget(hippoRoot, tenantId, id, flags) {
+async function cmdForget(hippoRoot, tenantId, id, flags) {
     requireInit(hippoRoot);
     const ctx = cliApiContext(hippoRoot, tenantId);
     // Raw memories (connector ingestion) are append-only: a BEFORE-DELETE trigger aborts any delete,
     // so archiveRaw is the sanctioned removal path and records ctx.actor as the archiver.
     if (flagIsTrue(flags, 'archive')) {
-        archiveForgottenRaw(ctx, id, stringFlag(flags, 'reason') ?? null);
+        await archiveForgottenRaw(ctx, id, stringFlag(flags, 'reason') ?? null);
         return;
     }
     try {
-        api.forget(ctx, id);
+        await api.forget(ctx, id);
         console.log(`Forgot ${id}`);
     }
     catch (err) {
@@ -66,13 +66,13 @@ function cmdForget(hippoRoot, tenantId, id, flags) {
         throw new CliExit(1);
     }
 }
-function archiveForgottenRaw(ctx, id, reason) {
+async function archiveForgottenRaw(ctx, id, reason) {
     if (!reason) {
         printError(ARCHIVE_REASON_REQUIRED);
         throw new CliExit(1);
     }
     try {
-        api.archiveRaw(ctx, id, reason);
+        await api.archiveRaw(ctx, id, reason);
         console.log(`Archived ${id}`);
     }
     catch (err) {
@@ -453,7 +453,7 @@ export async function handleForget({ hippoRoot, tenantId, args, flags }) {
     });
     if (routed)
         return;
-    cmdForget(hippoRoot, tenantId, id, flags);
+    await cmdForget(hippoRoot, tenantId, id, flags);
 }
 function invalidateChurn(hippoRoot, tenantId, args, flags) {
     if (args[0] || flags['id'] !== undefined) {