hippo-memory 1.72.0 → 2.0.0

package/dist/cli/transfer.js

@@ -27,12 +27,31 @@ import { CliExit } from './exit.js';
 const STDERR_PREVIEW_CHARS = 80;
 const MAX_ENTRIES_SHOWN = 10;
 // Watch command
-async function cmdWatch(command, hippoRoot, tenantId) {
-    if (!command) {
-        printError('Usage: hippo watch "<command>"');
+const WATCH_USAGE = 'Usage: hippo watch -- <command> [args...], or hippo watch --shell "<command line>"';
+/** The argv to run and whether a shell parses it: `--shell` takes one command line, anything else is argv as given. */
+function watchedCommand(args, flags) {
+    if (flags['shell'] !== undefined) {
+        const line = nonEmptyStringFlag(flags, 'shell');
+        if (line === undefined) {
+            printError(WATCH_USAGE);
+            throw new CliExit(1);
+        }
+        return { argv: [line], shell: true };
+    }
+    if (args.length === 0) {
+        printError(WATCH_USAGE);
         throw new CliExit(1);
     }
-    const { exitCode, stderr } = await runWatched(command);
+    // A quoted 1.x command line would now run as one program name, so it is refused rather than guessed at.
+    if (args.length === 1 && /\s/.test(args[0])) {
+        printError(`hippo watch: "${args[0]}" is one argument with spaces. Use \`hippo watch -- cmd args\` or \`hippo watch --shell "<command line>"\`.`);
+        throw new CliExit(1);
+    }
+    return { argv: [...args], shell: false };
+}
+async function cmdWatch(argv, shell, hippoRoot, tenantId) {
+    const command = argv.join(' ');
+    const { exitCode, stderr } = await runWatched(argv, undefined, { shell });
     if (exitCode === 0) {
         // Success: no noise
         return;
@@ -46,7 +65,7 @@ async function cmdWatch(command, hippoRoot, tenantId) {
     // A rejection-guard refusal of a failed command's output must not crash the watcher:
     // skip with the message below and still exit with the wrapped command's real exit code.
     try {
-        api.rememberLocally(cliApiContext(hippoRoot, tenantId), {
+        await api.rememberLocally(cliApiContext(hippoRoot, tenantId), {
             content: failure.content,
             tags: failure.tags,
             layer: failure.layer,
@@ -69,7 +88,7 @@ async function cmdWatch(command, hippoRoot, tenantId) {
     throw new CliExit(exitCode);
 }
 // Learn command
-export function handleLearn({ hippoRoot, tenantId, flags }) {
+export async function handleLearn({ hippoRoot, tenantId, flags }) {
     requireInit(hippoRoot);
     if (!flags['git']) {
         printError('Usage: hippo learn --git [--days <n>] [--repos <paths>]');
@@ -84,14 +103,14 @@ export function handleLearn({ hippoRoot, tenantId, flags }) {
         let totalSkipped = 0;
         for (const repo of repos) {
             const label = path.basename(repo);
-            const { added, skipped } = learnFromRepo(hippoRoot, tenantId, repo, days, label);
+            const { added, skipped } = await learnFromRepo(hippoRoot, tenantId, repo, days, label);
             totalAdded += added;
             totalSkipped += skipped;
         }
         console.log(`Git learn complete: ${totalAdded} new lessons added, ${totalSkipped} duplicates skipped across ${repos.length} repos.`);
     }
     else {
-        const { added, skipped } = learnFromRepo(hippoRoot, tenantId, process.cwd(), days);
+        const { added, skipped } = await learnFromRepo(hippoRoot, tenantId, process.cwd(), days);
         console.log(`Git learn complete: ${added} new lessons added, ${skipped} duplicates skipped.`);
     }
 }
@@ -118,7 +137,7 @@ function warnRedacted(count) {
     if (count)
         printError(`Warning: secret-shaped text was redacted from ${count} imported ${count === 1 ? 'entry' : 'entries'} before storing`);
 }
-export function handleImport({ hippoRoot, tenantId, args, flags }) {
+export async function handleImport({ hippoRoot, tenantId, args, flags }) {
     const useGlobal = boolFlag(flags, 'global');
     const dryRun = boolFlag(flags, 'dry-run');
     const extraTags = Array.isArray(flags['tag'])
@@ -144,7 +163,7 @@ export function handleImport({ hippoRoot, tenantId, args, flags }) {
     // Vault import is a FOLDER importer that dispatches apart from the single-file slot below; it writes through tenant-scoped api calls,
     // so the tenant is resolved and passed through. --global is unsupported (the connector raw-archive path is tenant-local).
     if (flags['vault'])
-        return importVaultFolder(hippoRoot, tenantId, flags, importOptions, useGlobal, dryRun);
+        return await importVaultFolder(hippoRoot, tenantId, flags, importOptions, useGlobal, dryRun);
     importFromFile(targetRoot, args, flags, { importOptions, useGlobal, dryRun, tenantId });
 }
 // Determine which importer to use based on flag
@@ -219,7 +238,7 @@ function importAgentMemories(hippoRoot, useGlobal, dryRun) {
     for (const warning of report.warnings)
         printError(`hippo: agent memories: ${warning}`);
 }
-function importVaultFolder(hippoRoot, tenantId, flags, importOptions, useGlobal, dryRun) {
+async function importVaultFolder(hippoRoot, tenantId, flags, importOptions, useGlobal, dryRun) {
     const folderPath = String(flags['vault']);
     checkVaultArgs(folderPath, flags, useGlobal);
     const vaultOptions = {
@@ -228,7 +247,7 @@ function importVaultFolder(hippoRoot, tenantId, flags, importOptions, useGlobal,
         name: flags['name'] ? String(flags['name']) : undefined,
         scope: flags['scope'] ? String(flags['scope']) : undefined,
     };
-    const vaultResult = importVault(folderPath, vaultOptions);
+    const vaultResult = await importVault(folderPath, vaultOptions);
     printVaultSummary(vaultResult, folderPath, cliApiContext(hippoRoot, tenantId), dryRun);
 }
 function checkVaultArgs(folderPath, flags, useGlobal) {
@@ -300,9 +319,9 @@ export function handleSync({ hippoRoot, flags }) {
     console.log(`Synced ${count} global memories into local project.${includeCrossProject ? '' : ' (other-project rows skipped; use --cross-project to ' +
         'include them)'}`);
 }
-export async function handleWatch({ hippoRoot, tenantId, args }) {
-    const watchCmd = args.join(' ').trim();
-    await cmdWatch(watchCmd, hippoRoot, tenantId);
+export async function handleWatch({ hippoRoot, tenantId, args, flags }) {
+    const { argv, shell } = watchedCommand(args, flags);
+    await cmdWatch(argv, shell, hippoRoot, tenantId);
 }
 export async function handlePromote({ hippoRoot, tenantId, args }) {
     const id = args[0];

package/dist/cli/usage.d.ts

@@ -2,5 +2,5 @@ export declare function printAuditPruneUsage(): void;
 export declare function printSlackBackfillUsage(): void;
 export declare function printSlackWorkspacesUsage(): void;
 export declare const USAGE_HEADER = "\nHippo - Make your agent's memory work like a brain. Hippo is long-term memory for coding agents.\n\nUsage: hippo <command> [options]\n\nCommands:";
-export declare const USAGE_EXAMPLES = "\n\nExamples:\n  hippo init\n  hippo remember \"FRED cache can silently drop series\" --tag error\n  hippo recall \"data pipeline issues\" --budget 2000\n  hippo context --auto --budget 1500\n  hippo conflicts\n  hippo reject mem_abc123 --reason \"leaked credential\"\n  hippo reject --value \"never store my key again\" --reason \"secret\"\n  hippo rejections\n  hippo unreject a1b2c3d4e5f6\n  hippo dormant \"staging hostname\"\n  hippo dormant restore mem_abc123\n  hippo tokens --days 7\n  hippo session log --id sess_123 --task \"Ship feature\" --type progress --content \"Build is green, next step is docs\"\n  hippo session latest --json\n  hippo session resume\n  hippo snapshot save --task \"Ship feature\" --summary \"Tests are green\" --next-step \"Open the PR\" --session sess_123\n  hippo handoff create --summary \"PR is open, tests green\" --next \"Merge after review\" --session sess_123 --artifact src/foo.ts\n  hippo handoff create --summary s --constraint a --constraint b --outcome partial --target-runtime codex --card-id c1 --tests pass\n  hippo card create --title \"Add cards table\" --repo hippo --depends-on card_abc\n  hippo card claim card_abc --runtime codex\n  hippo card complete card_abc --outcome success\n  hippo card heartbeat card_abc --run 7\n  hippo card reclaim\n  hippo embed --status\n  hippo watch \"npm run build\"\n  hippo learn --git --days 30\n  hippo promote mem_abc123\n  hippo sync\n  hippo setup\n  hippo hook install claude-code\n  hippo decide \"Use PostgreSQL for new services\" --context \"JSONB support\"\n  hippo incident \"Prod outage: DB connection pool exhausted\" --context \"spike at 14:00\"\n  hippo process new \"Release\" --step \"run tests\" --step \"bump version\" --step \"publish\"\n  hippo policy new \"Data retention\" --text \"Delete logs after 90 days\" --from 2026-01-01\n  hippo policy asof 2026-03-01 --name \"Data retention\"\n  hippo skill new \"Run tests\" --instructions \"npm test before every commit\" --trigger \"before commit\"\n  hippo skill export\n  hippo brief new \"hippo\" --summary \"Agent-memory library; E2 first-class objects in progress\"\n  hippo brief refresh \"hippo\"\n  hippo note new \"Acme Corp\" --text \"Renewal call: wants SSO before Q3; champion is the VP Eng\"\n  hippo note list --customer \"Acme Corp\" --status active\n  hippo graph extract\n  hippo invalidate \"REST API\" --dry-run\n  hippo invalidate \"REST API\" --reason \"migrated to GraphQL\"\n  hippo invalidate --id mem_a1b2c3d4e5f6 --reason \"superseded by new policy\"\n  hippo invalidate --churn --dry-run\n  hippo export memories.json\n  hippo export --format markdown memories.md\n  hippo sleep --dry-run\n  hippo outcome --good\n  hippo status\n";
+export declare const USAGE_EXAMPLES = "\n\nExamples:\n  hippo init\n  hippo remember \"FRED cache can silently drop series\" --tag error\n  hippo recall \"data pipeline issues\" --budget 2000\n  hippo context --auto --budget 1500\n  hippo conflicts\n  hippo reject mem_abc123 --reason \"leaked credential\"\n  hippo reject --value \"never store my key again\" --reason \"secret\"\n  hippo rejections\n  hippo unreject a1b2c3d4e5f6\n  hippo dormant \"staging hostname\"\n  hippo dormant restore mem_abc123\n  hippo tokens --days 7\n  hippo session log --id sess_123 --task \"Ship feature\" --type progress --content \"Build is green, next step is docs\"\n  hippo session latest --json\n  hippo session resume\n  hippo snapshot save --task \"Ship feature\" --summary \"Tests are green\" --next-step \"Open the PR\" --session sess_123\n  hippo handoff create --summary \"PR is open, tests green\" --next \"Merge after review\" --session sess_123 --artifact src/foo.ts\n  hippo handoff create --summary s --constraint a --constraint b --outcome partial --target-runtime codex --card-id c1 --tests pass\n  hippo card create --title \"Add cards table\" --repo hippo --depends-on card_abc\n  hippo card claim card_abc --runtime codex\n  hippo card complete card_abc --outcome success\n  hippo card heartbeat card_abc --run 7\n  hippo card reclaim\n  hippo embed --status\n  hippo watch -- npm run build\n  hippo learn --git --days 30\n  hippo promote mem_abc123\n  hippo sync\n  hippo setup\n  hippo hook install claude-code\n  hippo decide \"Use PostgreSQL for new services\" --context \"JSONB support\"\n  hippo incident \"Prod outage: DB connection pool exhausted\" --context \"spike at 14:00\"\n  hippo process new \"Release\" --step \"run tests\" --step \"bump version\" --step \"publish\"\n  hippo policy new \"Data retention\" --text \"Delete logs after 90 days\" --from 2026-01-01\n  hippo policy asof 2026-03-01 --name \"Data retention\"\n  hippo skill new \"Run tests\" --instructions \"npm test before every commit\" --trigger \"before commit\"\n  hippo skill export\n  hippo brief new \"hippo\" --summary \"Agent-memory library; E2 first-class objects in progress\"\n  hippo brief refresh \"hippo\"\n  hippo note new \"Acme Corp\" --text \"Renewal call: wants SSO before Q3; champion is the VP Eng\"\n  hippo note list --customer \"Acme Corp\" --status active\n  hippo graph extract\n  hippo invalidate \"REST API\" --dry-run\n  hippo invalidate \"REST API\" --reason \"migrated to GraphQL\"\n  hippo invalidate --id mem_a1b2c3d4e5f6 --reason \"superseded by new policy\"\n  hippo invalidate --churn --dry-run\n  hippo export memories.json\n  hippo export --format markdown memories.md\n  hippo sleep --dry-run\n  hippo outcome --good\n  hippo status\n";
 //# sourceMappingURL=usage.d.ts.map

package/dist/cli/usage.js

@@ -50,7 +50,7 @@ Examples:
   hippo card heartbeat card_abc --run 7
   hippo card reclaim
   hippo embed --status
-  hippo watch "npm run build"
+  hippo watch -- npm run build
   hippo learn --git --days 30
   hippo promote mem_abc123
   hippo sync

package/dist/cli/verb-row.d.ts

@@ -18,6 +18,8 @@ export interface VerbRow {
     readonly aliases?: readonly string[];
     /** Runs in a request scope, opening each store once; set on api-backed verbs, as hook verbs open their own. */
     readonly scoped?: true;
+    /** Routine verbs after which a previously installed codex wrapper is repaired (never first-installed). */
+    readonly repairsCodexWrapper?: true;
     /** Deletes or hides memories: an unknown flag stops the run instead of being ignored. */
     readonly destructive?: true;
     /** Unset: --dry-run is honoured exactly when the verb declares it; `false` refuses it even so. */

package/dist/cli/verbs/health.js

@@ -4,6 +4,7 @@ import { DEFAULT_ASSEMBLE_BUDGET } from '../../api/assemble.js';
 import { verb } from '../verb-row.js';
 export const HEALTH_VERBS = {
     status: verb(() => import('../status.js'), 'handleStatus', {
+        repairsCodexWrapper: true,
         flags: {},
         usage: [`
   status                   Show memory health stats`],
@@ -98,6 +99,7 @@ export const HEALTH_VERBS = {
     --json                 Output as JSON`],
     }),
     outcome: verb(() => import('../curate.js'), 'handleOutcome', {
+        repairsCodexWrapper: true,
         scoped: true,
         flags: { switches: ['bad', 'good'], values: ['id'] },
         usage: [`

package/dist/cli/verbs/memory.js

@@ -5,6 +5,7 @@ import { DEFAULT_GRAPH_HOPS, DEFAULT_GRAPH_SEED_COUNT } from '../../graph/stream
 import { verb } from '../verb-row.js';
 export const MEMORY_VERBS = {
     init: verb(() => import('../init.js'), 'handleInit', {
+        repairsCodexWrapper: true,
         flags: { switches: ['global', 'no-hooks', 'no-learn', 'no-schedule'], values: ['scan'], numbers: ['days'] },
         usage: [`
   init                     Create .hippo/ structure in current directory
@@ -18,6 +19,7 @@ export const MEMORY_VERBS = {
                            coding agents' own memories (every init imports those)`],
     }),
     remember: verb(() => import('../remember.js'), 'handleRemember', {
+        repairsCodexWrapper: true,
         flags: {
             switches: ['error', 'extract', 'force', 'global', 'inferred', 'observed', 'pin', 'verified'],
             values: ['artifact-ref', 'kind', 'layer', 'owner', 'scope'],
@@ -43,6 +45,7 @@ export const MEMORY_VERBS = {
     --pin                  Pin the new memory (default: pinned if the old one was)`],
     }),
     recall: verb(() => import('../recall.js'), 'handleRecall', {
+        repairsCodexWrapper: true,
         scoped: true,
         flags: {
             switches: ['classic', 'continuity', 'equal-sources', 'evc-adaptive', 'filter-conflicts', 'graph-stream',
@@ -61,47 +64,40 @@ export const MEMORY_VERBS = {
     --as-of <iso-date>     Return the memories that were current on that date
     --multihop             Search a second time with the speaker: and topic: tags the
                            first pass found (also on when config multihop.enabled is true)
-    --hops <n>             E3.2 multi-hop graph recall: also surface memories
-                           reached by walking the entities/relations graph <n>
-                           hops (0..3, default off) out from the lexical seeds.
-                           Graph hits are tagged [graph: Nhop <rel>]. Today the
-                           graph holds supersedes edges (E3.1); cross-object edges
-                           light up the same traversal once extracted.
+    --hops <n>             Also surface memories reached by walking the entity and
+                           relation graph <n> hops (0..3, default off) out from the
+                           lexical matches. Graph hits are tagged [graph: Nhop <rel>].
+                           Today the graph holds supersedes edges; cross-object
+                           edges light up the same walk once extracted.
     --max-neighbors <n>    Per-hop fanout cap for --hops (1..200, default 25).
-    --graph-stream         L1: fuse a graph-retrieval stream into RRF, re-ranking
-                           in-pool results by graph proximity to the strong lexical
-                           seeds. Implies rrf scoring (default is blend). Local store
-                           only. Distinct from --hops (which injects out-of-pool
-                           neighbours); this re-ranks within the candidate pool.
+    --graph-stream         Fuse a graph-proximity ranking into the result list,
+                           re-ranking in-pool results by closeness to the strong
+                           lexical matches. Implies rrf scoring (default is blend).
+                           Local store only. Unlike --hops, it adds no memories
+                           from outside the candidate pool.
     --graph-hops <n>       Hops for --graph-stream (1..3, default ${DEFAULT_GRAPH_HOPS}).
     --graph-seeds <n>      Lexical anchors for --graph-stream (default ${DEFAULT_GRAPH_SEED_COUNT}). The stream
-                           re-ranks the rank>seeds tail; on a pool with <= n candidates
-                           every candidate is a seed and the stream is inert.
+                           re-ranks the results below the anchors; on a pool with <= n
+                           candidates every candidate is an anchor and the stream is inert.
     --no-mmr               Disable MMR diversity re-ranking
     --mmr-lambda <f>       MMR balance 0..1 (default: ${DEFAULT_MMR_LAMBDA}, 1.0 = pure relevance)
-    --evc-adaptive         ACC-style: when top-K shows high inter-item overlap
-                           (= conflict cluster), expand pool and re-rank by
-                           recency. Default off. RESEARCH.md §PFC.ACC.
-    --filter-conflicts     vlPFC interference filter: drop superseded entries
-                           and 0.3x-downweight entries flagged in an open
-                           conflict with a peer in the same result set.
-                           Uses recorded supersession + conflicts only — never
-                           lexical inference. Default off. RESEARCH.md §PFC.vlPFC.
-    --value-aware          vmPFC value attribution: boost memories with positive
-                           cumulative outcomes and demote those with negative
-                           outcomes during ranking. Multiplier
-                           clip(1 + 0.3*tanh(pos - neg), 0.7, 1.3). Reuses
-                           outcome_positive / outcome_negative; no schema
-                           change. Default off. RESEARCH.md §PFC.vmPFC.
-    --rerank-utility       OFC option-value re-ranker: combine relevance,
-                           strength, and integration cost into a single utility
-                           = score * (0.5 + 0.5 * strength) * (1 - cost_factor)
-                           where cost_factor = min(0.3, tokens / 10000). Re-sorts
-                           results by utility. Default off. RESEARCH.md §PFC.OFC.
+    --evc-adaptive         When the top results overlap heavily (a conflict
+                           cluster), widen the pool and re-rank by recency.
+                           Default off.
+    --filter-conflicts     Drop superseded entries and down-weight by 0.3x any
+                           entry in an open conflict with another result.
+                           Uses recorded supersession and conflicts only, never
+                           lexical inference. Default off.
+    --value-aware          Boost memories with positive cumulative outcomes and
+                           demote those with negative ones during ranking:
+                           multiplier clip(1 + 0.3*tanh(pos - neg), 0.7, 1.3).
+                           Reads outcome_positive and outcome_negative. Default off.
+    --rerank-utility       Re-sort results by utility = score * (0.5 + 0.5 * strength)
+                           * (1 - cost_factor), where cost_factor =
+                           min(0.3, tokens / 10000). Default off.
     --reranker <name>      Apply a reranker pass after retrieval
-                           (cross-encoder|jev|clef-flash|clef|llm). Looks up
-                           the named reranker from src/rerankers/index.ts and
-                           re-orders the top-K candidates. Default unset (no reranker).
+                           (cross-encoder|jev|clef-flash|clef|llm) to re-order the
+                           top-K candidates. Default unset (no reranker).
                            jev calls the hosted TypeSafe Jev API: it needs
                            TYPESAFE_API_KEY, sends the query and candidate
                            text to that API, costs about 0.0004 USD a recall,
@@ -110,30 +106,24 @@ export const MEMORY_VERBS = {
                            Cloudflare Workers AI (CLOUDFLARE_ACCOUNT_ID and
                            CLOUDFLARE_API_TOKEN) or to HIPPO_CLEF_ENDPOINT, and
                            keep the native order on any failure.
-                           See docs/evals/2026-09-19-jev-reranker.md and
-                           docs/plans/2026-05-10-f6-reranker-hardening.md.
     --reranker-top-k <n>   Cap candidates passed to the reranker (default 50;
                            40 for jev, clef-flash and clef).
-    --goal <tag>           dlPFC goal-conditioned recall: memories tagged with
-                           the goal tag get a 1.5x score boost and results are
-                           re-sorted. Default off. RESEARCH.md §PFC.dlPFC.
-    --session-id <id>      Session identifier for dlPFC goal-stack boost.
+    --goal <tag>           Goal-conditioned recall: memories tagged with the
+                           goal tag get a 1.5x score boost and results are
+                           re-sorted. Default off.
+    --session-id <id>      Session identifier for the goal-stack boost.
                            Defaults to $HIPPO_SESSION_ID. When set and the
                            (tenant, session) has active goals (see
                            'hippo goal push'), recall auto-boosts memories
                            whose tags match an active goal name. Boost stacks
                            on top of base BM25 score, capped at 3.0x.
     --salience-threshold <n>
-                           Pineal salience: down-weight memories whose
-                           retrieval_count is below n. score *= max(0.5,
-                           retrieval_count / n) for entries with count < n;
-                           entries at or above n are unchanged. Salience emerges
-                           from USE, not from lexical overlap. Default off.
-                           RESEARCH.md §"AI Pineal Gland". (v1's creation-time
-                           lexical gate destroyed LoCoMo 0.28 -> 0.02; this v2
-                           is retrieval-side, opt-in only — see MEMORY.md
-                           "Hippo salience gate destroys benchmark recall".)
-    --continuity           Include continuity block (active task snapshot,
+                           Down-weight memories retrieved fewer than n times:
+                           score *= max(0.5, retrieval_count / n) for entries
+                           with count < n; entries at or above n are unchanged.
+                           Salience comes from use, not from lexical overlap.
+                           Default off.
+    --continuity           Include a continuity block (active task snapshot,
                            latest matching session handoff, last 5 session
                            events) above the memory list. Useful at agent
                            boot when you want both relevant memories AND
@@ -198,6 +188,7 @@ export const MEMORY_VERBS = {
     --json                 Output full summary as JSON`],
     }),
     context: verb(() => import('../context.js'), 'handleContext', {
+        repairsCodexWrapper: true,
         flags: {
             switches: ['auto', 'cross-project', 'pinned-only'],
             values: ['budget', 'format', 'framing', 'include-recent', 'runtime', 'scope'],
@@ -215,6 +206,7 @@ export const MEMORY_VERBS = {
     --framing <mode>       Framing: observe (default), suggest, assert`],
     }),
     sleep: verb(() => import('../sleep.js'), 'handleSleep', {
+        repairsCodexWrapper: true,
         destructive: true,
         scoped: true,
         flags: { switches: ['dry-run', 'no-learn', 'no-share'], values: ['log-file'] },

package/dist/cli/verbs/objects.js

@@ -188,16 +188,19 @@ export const OBJECT_VERBS = {
   mcp                      Start MCP server (stdio transport)`],
     }),
     serve: verb(() => import('../serve.js'), 'handleServe', {
-        flags: { values: ['host', 'tls-cert', 'tls-key'], numbers: ['port'] },
+        flags: { switches: ['allow-cleartext'], values: ['host', 'tls-cert', 'tls-key'], numbers: ['port'] },
         usage: [`
   serve                    Start the HTTP API server for this store (Ctrl+C stops it)
     --port <n>             Port to serve on (default: $HIPPO_PORT or ${DEFAULT_SERVER_PORT})
     --host <host>          Address to bind (default: ${DEFAULT_SERVER_HOST})
     --tls-cert <file>      PEM certificate; serve HTTPS only (or $HIPPO_TLS_CERT)
     --tls-key <file>       PEM private key for it; give both (or $HIPPO_TLS_KEY)
+    --allow-cleartext      Bind a non-loopback host without TLS, for a TLS proxy
+                           in front (or $HIPPO_ALLOW_CLEARTEXT=1)
                            Every request needs an API key (hippo auth create).
                            $HIPPO_ALLOW_KEYLESS_LOCAL=1 lets requests from this machine
-                           in without one; $HIPPO_REQUIRE_AUTH=1 wins over it.`],
+                           in without one, as a member ($HIPPO_KEYLESS_LOCAL_ROLE=admin
+                           for host admin); $HIPPO_REQUIRE_AUTH=1 wins over it.`],
     }),
     goal: verb(() => import('../goals.js'), 'handleGoal', {
         scoped: true,
@@ -206,7 +209,7 @@ export const OBJECT_VERBS = {
             values: ['level', 'outcome', 'parent', 'policy', 'session-id', 'success', 'tenant-id'],
         },
         usage: [`
-  goal <sub>               dlPFC goal stack (B3) — scoped per session
+  goal <sub>               Goal stack, scoped per session
     goal push <name>       Push a new active goal; prints the new goal id
       --policy <type>      schema-fit-biased | error-prioritized |
                            recency-first | hybrid

package/dist/cli/verbs/sessions.js

@@ -132,9 +132,10 @@ export const SESSION_VERBS = {
     --status               Show embedding coverage`],
     }),
     watch: verb(() => import('../transfer.js'), 'handleWatch', {
-        flags: {},
+        flags: { values: ['shell'] },
         usage: [`
-  watch "<command>"        Run command, auto-learn from failures`],
+  watch -- <cmd> [args]    Run command, auto-learn from failures (no shell)
+    --shell "<line>"       Run one command line through the shell instead`],
     }),
     learn: verb(() => import('../transfer.js'), 'handleLearn', {
         scoped: true,
@@ -203,6 +204,7 @@ export const SESSION_VERBS = {
     --format <fmt>         Output format: json (default) or markdown`],
     }),
     capture: verb(() => import('../session-hooks.js'), 'handleCapture', {
+        repairsCodexWrapper: true,
         flags: { switches: ['dry-run', 'global', 'last-session', 'stdin'], values: ['file', 'log-file', 'transcript'] },
         usage: [`
   capture                  Extract memories from conversation text

package/dist/cli.js

@@ -107,9 +107,8 @@ export function parseArgs(argv) {
 export function shouldAutoRepairCodexWrapper(currentCommand, flags) {
     if (envSkipAutoIntegrations())
         return false;
-    if (!['context', 'remember', 'recall', 'sleep', 'capture', 'outcome', 'status', 'init'].includes(currentCommand)) {
+    if (!COMMAND_INDEX.get(currentCommand)?.repairsCodexWrapper)
         return false;
-    }
     if (currentCommand === 'init' && flagIsTrue(flags, 'no-hooks'))
         return false;
     return true;

package/dist/connectors/dlq.js

@@ -1,7 +1,8 @@
 // The dead-letter queue every webhook connector parks into: one redaction, one unroutable sentinel, one set of defaults, one replay result.
 import { DEFAULT_LIST_LIMIT } from '../util/limits.js';
 import { DLQ_REDACTED_NOTE, redactPayload } from '../util/secret-detect.js';
-import { requireGroup, storeFor } from '../store/index.js';
+import { requireGroup } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 import { errorMessage } from '../util/log.js';
 /** The tenant stored on a row no tenant was resolved for; the column is NOT NULL. */
 const UNROUTABLE_TENANT = '__unroutable__';

package/dist/connectors/github/deletion.js

@@ -1,4 +1,5 @@
-import { requireGroup, storeFor } from '../../store/index.js';
+import { requireGroup } from '../../store/index.js';
+import { storeFor } from '../../store/sqlite/store.js';
 /** Handle `issue_comment.deleted` and `pull_request_review_comment.deleted`: archive ALL active raw rows for the artifact_ref in one write.
  *  Tenant and kind='raw' filtering are load-bearing: without them a deletion could archive another tenant's row or a distilled row. */
 export async function handleCommentDeleted(ctx, input) {

package/dist/connectors/github/ingest.js

@@ -1,7 +1,8 @@
 // GitHub event ingest, once per idempotency key. The key comes from the event's own content, never from the unsigned
 // X-GitHub-Delivery header, so a replay cannot get past it by rotating the delivery id. The pre-check is only the fast path:
 // the store logs the key in the memory's own transaction, which is what holds when two workers race.
-import { requireGroup, storeFor } from '../../store/index.js';
+import { requireGroup } from '../../store/index.js';
+import { storeFor } from '../../store/sqlite/store.js';
 import { rememberWithEventLog } from '../ingest.js';
 import { computeIdempotencyKey } from './signature.js';
 import { issueEventToRememberOpts, issueCommentEventToRememberOpts, pullRequestEventToRememberOpts, prReviewCommentEventToRememberOpts, } from './transform.js';

package/dist/connectors/github/tenant-routing.js

@@ -1,5 +1,6 @@
 import { envGitHubAllowUnknownInstallationFallback, envTenant } from '../../util/env.js';
-import { requireGroup, storeFor } from '../../store/index.js';
+import { requireGroup } from '../../store/index.js';
+import { storeFor } from '../../store/sqlite/store.js';
 /** Resolve a GitHub envelope's tenant_id by installation id, then repository.full_name; the HIPPO_TENANT fallback applies only if both tables are empty.
  *  An unknown installation or repo on a multi-tenant deployment returns null (fail closed); GITHUB_ALLOW_UNKNOWN_INSTALLATION_FALLBACK=1 escapes. */
 export async function resolveTenantForGitHub(hippoRoot, args, store) {

package/dist/connectors/github/webhook.js

@@ -1,4 +1,5 @@
 import { envGitHubWebhookSecret, envGitHubWebhookSecretPrevious } from '../../util/env.js';
+import { DAY_MS } from '../../util/time.js';
 import { verifyGitHubSignature } from './signature.js';
 import { isGitHubWebhookEnvelope, isGitHubIssueEvent, isGitHubIssueCommentEvent, isGitHubPullRequestEvent, isGitHubPullRequestReviewCommentEvent, } from './types.js';
 import { ingestEvent as ingestGitHubEvent } from './ingest.js';
@@ -58,9 +59,10 @@ export async function handleGitHubEventsWebhook(request, store) {
     }
 }
 // GitHub signs no timestamp, so a captured delivery verifies forever; this window is what refuses its replay.
-const DELIVERY_REPLAY_TTL_MS = 24 * 60 * 60 * 1000;
+const DELIVERY_REPLAY_TTL_MS = DAY_MS;
 const DELIVERY_REPLAY_MAX_IDS = 10_000;
-// SHORTCUT: seen ids live in this process and reset on restart or eviction; move them to the store if serve ever runs as several processes.
+// A fast path only: the durable dedupe is the connector event log's content-derived idempotency key (ingest.ts, and the deletion key below),
+// so a replay after a restart or an eviction is a stored 'duplicate' with no new rows.
 const seenDeliveries = new Map();
 /** Claims a delivery id for the window; false when it was claimed within the window already. The oldest claim goes first at the cap. */
 function claimDelivery(key, now) {

package/dist/connectors/ingest.js

@@ -1,6 +1,7 @@
 // The write half every connector's ingest shares, after its own pre-check of the event log.
 import { remember } from '../api/index.js';
-import { requireGroup, storeFor } from '../store/index.js';
+import { requireGroup } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 import { RejectedValueError } from '../core/api-errors.js';
 /** Stores `opts` once per event key; null `opts` (an empty body) and a tombstoned value are logged with no memory, so a redelivery acks instead of retrying. */
 export async function rememberWithEventLog(ctx, event, opts) {

package/dist/connectors/slack/deletion.js

@@ -1,5 +1,6 @@
 import { archiveRaw } from '../../api/index.js';
-import { requireGroup, storeFor } from '../../store/index.js';
+import { requireGroup } from '../../store/index.js';
+import { storeFor } from '../../store/sqlite/store.js';
 /** Handles Slack `message_deleted`. The store logs the event in the archive's own transaction, so a crash cannot leave a retry
  *  answering `not_found` where `duplicate` is due. */
 export async function handleMessageDeleted(ctx, input) {

package/dist/connectors/slack/ingest.js

@@ -1,4 +1,5 @@
-import { requireGroup, storeFor } from '../../store/index.js';
+import { requireGroup } from '../../store/index.js';
+import { storeFor } from '../../store/sqlite/store.js';
 import { rememberWithEventLog } from '../ingest.js';
 import { messageToRememberOpts } from './transform.js';
 /** Ingests a Slack message as a kind='raw' memory once per event id (Slack redelivers within a minute); the pre-check is only the fast path,

package/dist/connectors/slack/tenant-routing.js

@@ -1,5 +1,6 @@
 import { envSlackAllowUnknownTeamFallback, envTenant } from '../../util/env.js';
-import { requireGroup, storeFor } from '../../store/index.js';
+import { requireGroup } from '../../store/index.js';
+import { storeFor } from '../../store/sqlite/store.js';
 /** Look up the tenant_id for a Slack team_id; the HIPPO_TENANT fallback applies only when slack_workspaces is empty (single-workspace install).
  *  An unknown team on a multi-workspace install returns null (fail closed); SLACK_ALLOW_UNKNOWN_TEAM_FALLBACK=1 is the emergency escape. */
 export async function resolveTenantForSlackTeam(hippoRoot, teamId, store) {

package/dist/consolidate/conflicts.js

@@ -65,7 +65,7 @@ function recalledTogether(a, b) {
     // A personal row pairs only inside its own scope; any other pair shows its id to someone else.
     if ((isPersonalScope(a.scope) || isPersonalScope(b.scope)) && a.scope !== b.scope)
         return false;
-    if (a.tenantId !== b.tenantId)
+    if (a.tenant_id !== b.tenant_id)
         return false;
     const [x, y] = [a.origin_project ?? null, b.origin_project ?? null];
     return x === y || (x === '' && y !== null) || (y === '' && x !== null);

package/dist/consolidate/dag.js

@@ -1,6 +1,6 @@
 import { createMemory, Layer } from '../core/memory.js';
 import { writeEntry, writeEntriesTogether } from '../store/entry-writes.js';
-import { loadAllDirtySummaries, loadChildrenOfSummary, applyRebuildResult, clearSummaryDirtyAfterBuild, } from '../store/summaries.js';
+import { loadAllDirtySummaries, loadChildrenOfSummary, loadChildrenOfSummaries, childrenKey, applyRebuildResult, clearSummaryDirtyAfterBuild, } from '../store/summaries.js';
 import { RejectedValueError } from '../core/api-errors.js';
 import { generateDagSummary } from './dag-summary.js';
 import { overlapPartners } from './overlap-index.js';
@@ -50,7 +50,7 @@ export function clusterFacts(facts) {
 function partitionFactsByTenant(unparented) {
     const unparentedByTenant = new Map();
     for (const fact of unparented) {
-        const key = derivationPartitionKey(fact.tenantId, fact.scope, fact.origin_project);
+        const key = derivationPartitionKey(fact.tenant_id, fact.scope, fact.origin_project);
         const bucket = unparentedByTenant.get(key);
         if (bucket)
             bucket.push(fact);
@@ -103,7 +103,7 @@ async function summarizeCluster(hippoRoot, cluster, home, opts, result) {
     result.factsLinked += writeEntriesTogether(hippoRoot, cluster.members.map((member) => ({ ...member, dag_parent_id: summaryEntry.id })));
     // Member writes just marked this fresh summary dirty; clear it, or the same sleep cycle's
     // rebuild pass would re-rebuild every new summary at twice the LLM cost.
-    clearSummaryDirtyAfterBuild(hippoRoot, summaryEntry.id, summaryEntry.tenantId, 'buildDag');
+    clearSummaryDirtyAfterBuild(hippoRoot, summaryEntry.id, summaryEntry.tenant_id, 'buildDag');
 }
 export async function buildDag(hippoRoot, facts, opts) {
     const result = { candidateClusters: 0, summariesCreated: 0, factsLinked: 0, rejected: 0 };
@@ -111,7 +111,7 @@ export async function buildDag(hippoRoot, facts, opts) {
     const unparented = facts.filter((f) => f.dag_level === 1 && !f.dag_parent_id && f.tags.includes('extracted'));
     for (const [, tenantFacts] of partitionFactsByTenant(unparented)) {
         const home = {
-            tenantId: tenantFacts[0].tenantId,
+            tenantId: tenantFacts[0].tenant_id,
             scope: derivationScope(tenantFacts[0].scope),
             originProject: tenantFacts[0].origin_project,
             baseHalfLifeDays,
@@ -126,8 +126,11 @@ export async function buildDag(hippoRoot, facts, opts) {
     return result;
 }
 /** Regenerate one dirty summary from its children and tally the outcome; throws reach the caller's isolation. */
-async function rebuildOneSummary(hippoRoot, summary, opts, result) {
-    const children = loadChildrenOfSummary(hippoRoot, summary.id, summary.tenantId);
+async function rebuildOneSummary(hippoRoot, summary, opts, result, preloaded, queuedIds) {
+    // A queued child may have been rebuilt earlier in this drain, so its preloaded content is stale: reread then.
+    const children = preloaded.some((c) => queuedIds.has(c.id))
+        ? loadChildrenOfSummary(hippoRoot, summary.id, summary.tenant_id)
+        : preloaded;
     if (children.length === 0) {
         clearZeroChildSummary(hippoRoot, summary, result);
         return;
@@ -196,6 +199,8 @@ export async function rebuildDirtySummaries(hippoRoot, opts) {
         failed: 0,
         capped,
     };
+    const childrenByParent = loadChildrenOfSummaries(hippoRoot, queue);
+    const queuedIds = new Set(queue.map((s) => s.id));
     for (const [index, summary] of queue.entries()) {
         // Yield the macrotask queue every 25 summaries: each iteration is synchronous SQLite, so a batch of up to 1000
         // would starve timers and IPC (server keep-alives, Vitest's birpc heartbeat).
@@ -203,13 +208,13 @@ export async function rebuildDirtySummaries(hippoRoot, opts) {
             await new Promise((resolve) => setImmediate(resolve));
         }
         try {
-            await rebuildOneSummary(hippoRoot, summary, opts, result);
+            await rebuildOneSummary(hippoRoot, summary, opts, result, childrenByParent.get(childrenKey(summary.tenant_id, summary.id)) ?? [], queuedIds);
         }
         catch (err) {
             // One throw doesn't abort the queue; log enough to triage an exotic
             // failure (SQLite I/O, prepare), since audit() already catches its own.
             result.failed++;
-            log.error(`rebuildDirtySummaries: summary ${summary.id} (tenant ${summary.tenantId}) failed: ${errorMessage(err)}`, errorFields(err));
+            log.error(`rebuildDirtySummaries: summary ${summary.id} (tenant ${summary.tenant_id}) failed: ${errorMessage(err)}`, errorFields(err));
         }
     }
     return result;
@@ -275,7 +280,7 @@ export async function buildEntityProfiles(hippoRoot, l2Summaries, opts) {
     const unparented = l2Summaries.filter((s) => s.dag_level === 2 && !s.dag_parent_id);
     for (const [, tenantL2s] of partitionFactsByTenant(unparented)) {
         const home = {
-            tenantId: tenantL2s[0].tenantId,
+            tenantId: tenantL2s[0].tenant_id,
             scope: derivationScope(tenantL2s[0].scope),
             originProject: tenantL2s[0].origin_project,
             baseHalfLifeDays,

package/dist/consolidate/dedupe.js

@@ -34,7 +34,7 @@ function entriesByPartition(entries) {
     const entriesByTenant = new Map();
     for (const entry of entries) {
         // EI2: also split by restricted scope, else a private copy can delete the readable one.
-        const key = derivationPartitionKey(entry.tenantId, entry.scope, entry.origin_project);
+        const key = derivationPartitionKey(entry.tenant_id, entry.scope, entry.origin_project);
         const bucket = entriesByTenant.get(key);
         if (bucket)
             bucket.push(entry);

package/dist/consolidate/memory-value.js

@@ -114,7 +114,7 @@ export function rankNonPinnedByTenant(entries, now, weights = MEMORY_VALUE_WEIGH
             continue; // pinned entries never compete for rescue (never condemned)
         // Default an undefined tenantId as dag.ts:341 does: a raw/legacy row can carry one at runtime,
         // and keying it "undefined" would split it into its own singleton tenant.
-        const tenantId = e.tenantId ?? DEFAULT_TENANT_ID;
+        const tenantId = e.tenant_id ?? DEFAULT_TENANT_ID;
         const list = byTenant.get(tenantId);
         if (list)
             list.push(e);