hippo-memory 1.72.0 → 2.1.0

package/dist/cli/refine-llm.d.ts

@@ -1,4 +1,6 @@
-/** LLM refinement of consolidated semantic memories (`hippo refine`): a separate command so API-key users opt in; idempotent via the `llm-refined` tag.
+/**
+ * LLM refinement of consolidated semantic memories (`hippo refine`): a separate command so API-key users opt in;
+ * idempotent via the `llm-refined` tag.
  * Uses fetch directly (no SDK dependency); on any failure the original memory is untouched. */
 import { MemoryEntry } from '../core/memory.js';
 export interface RefineOptions {
@@ -10,7 +12,10 @@ export interface RefineOptions {
     all?: boolean;
     /** Injected for testing — defaults to the real fetch. */
     fetcher?: typeof fetch;
-    /** Tenant scope: only that tenant's consolidated entries are scanned; cross-tenant parents return null and are skipped. */
+    /**
+     * Tenant scope: only that tenant's consolidated entries are scanned; cross-tenant parents return null and are
+     * skipped.
+     */
     tenantId?: string;
 }
 export interface RefineResult {
@@ -24,12 +29,18 @@ export interface RefineResult {
         reason?: string;
     }>;
 }
-/** Ask Claude to synthesize a clean semantic memory from the merged content and its sources; returns null when the API call failed. */
+/**
+ * Ask Claude to synthesize a clean semantic memory from the merged content and its sources; returns null when the API
+ * call failed.
+ */
 export declare function refineSemanticMemory(merged: string, sources: MemoryEntry[], opts: {
     apiKey: string;
     model?: string;
     fetcher?: typeof fetch;
 }): Promise<string | null>;
-/** Refine each consolidated semantic memory with the LLM and write it back, tagging `llm-refined` so reruns skip it (unless `all`). */
+/**
+ * Refine each consolidated semantic memory with the LLM and write it back, tagging `llm-refined` so reruns skip it
+ * (unless `all`).
+ */
 export declare function refineStore(hippoRoot: string, opts: RefineOptions): Promise<RefineResult>;
 //# sourceMappingURL=refine-llm.d.ts.map

package/dist/cli/refine-llm.js

@@ -1,8 +1,10 @@
-/** LLM refinement of consolidated semantic memories (`hippo refine`): a separate command so API-key users opt in; idempotent via the `llm-refined` tag.
+/**
+ * LLM refinement of consolidated semantic memories (`hippo refine`): a separate command so API-key users opt in;
+ * idempotent via the `llm-refined` tag.
  * Uses fetch directly (no SDK dependency); on any failure the original memory is untouched. */
 import { Layer } from '../core/memory.js';
 import { REFINED_TAG, storeRefinement } from '../api/index.js';
-import { listMemories, listMemoriesByIds } from '../api/memories.js';
+import { listMemories, listMemoriesByIds } from '../api/memories/memories.js';
 import { cliApiContext } from './api-context.js';
 import { chunked } from '../util/chunked.js';
 import { redactSecretsStrict } from '../util/secret-detect.js';
@@ -17,7 +19,10 @@ const CONSOLIDATED_MARKERS = [
     '[Consolidated from',
     '[Consolidated pattern from',
 ];
-/** Ask Claude to synthesize a clean semantic memory from the merged content and its sources; returns null when the API call failed. */
+/**
+ * Ask Claude to synthesize a clean semantic memory from the merged content and its sources; returns null when the API
+ * call failed.
+ */
 export async function refineSemanticMemory(merged, sources, opts) {
     const sourceBlock = sources
         .slice(0, MAX_REFINE_SOURCES)
@@ -61,6 +66,7 @@ function describeRefineFailure(failure) {
         case 'request': return `refine: request failed: ${failure.message}`;
         case 'http': return `refine: API answered HTTP ${failure.status}${failure.detail ? `: ${failure.detail}` : ''}`;
         case 'unreadable': return `refine: unreadable response: ${failure.message}`;
+        case 'empty': return 'refine: response held no text';
     }
 }
 function isConsolidated(entry) {
@@ -68,7 +74,10 @@ function isConsolidated(entry) {
         return false;
     return CONSOLIDATED_MARKERS.some((m) => entry.content.startsWith(m));
 }
-/** Refine each consolidated semantic memory with the LLM and write it back, tagging `llm-refined` so reruns skip it (unless `all`). */
+/**
+ * Refine each consolidated semantic memory with the LLM and write it back, tagging `llm-refined` so reruns skip it
+ * (unless `all`).
+ */
 export async function refineStore(hippoRoot, opts) {
     const result = {
         scanned: 0,
@@ -80,7 +89,7 @@ export async function refineStore(hippoRoot, opts) {
     // No tenant means every tenant, so the ctx's own tenant is never read.
     const ctx = cliApiContext(hippoRoot, opts.tenantId ?? '');
     const reach = { everyTenant: opts.tenantId === undefined };
-    const entries = listMemories(ctx, reach);
+    const entries = await listMemories(ctx, reach);
     let processed = 0;
     for (const entry of entries) {
         if (!isConsolidated(entry))
@@ -104,7 +113,8 @@ async function refineOneEntry(ctx, reach, entry, opts, result) {
     const parentIds = Array.isArray(entry.parents) ? entry.parents : [];
     // Parent lookup is tenant-scoped; cross-tenant parents are absent and skipped,
     // so refine still works from the merged content alone.
-    const found = new Map(chunked(parentIds).flatMap((chunk) => listMemoriesByIds(ctx, chunk, reach)).map((p) => [p.id, p]));
+    const chunks = await Promise.all(chunked(parentIds).map((chunk) => listMemoriesByIds(ctx, chunk, reach)));
+    const found = new Map(chunks.flat().map((p) => [p.id, p]));
     const sources = parentIds.flatMap((pid) => found.get(pid) ?? []);
     const refined = await refineSemanticMemory(entry.content, sources, {
         apiKey: opts.apiKey,
@@ -121,7 +131,7 @@ async function refineOneEntry(ctx, reach, entry, opts, result) {
         result.details.push({ id: entry.id, status: 'refined', reason: 'dry-run (no write)' });
         return;
     }
-    storeRefinement(cliApiContext(ctx.hippoRoot, entry.tenantId), entry, refined);
+    await storeRefinement(cliApiContext(ctx.hippoRoot, entry.tenant_id), entry, refined);
     result.refined++;
     result.details.push({ id: entry.id, status: 'refined' });
 }

package/dist/cli/remember.js

@@ -4,7 +4,7 @@ import { evalNow, strengthAblation } from '../core/ablation.js';
 import * as fs from 'fs';
 import { calculateStrength, calculateRewardFactor, confidenceFacets, confidenceLabel, Layer, } from '../core/memory.js';
 import * as api from '../api/index.js';
-import { getMemory } from '../api/memories.js';
+import { getMemory } from '../api/memories/memories.js';
 import { ConflictError, NotFoundError } from '../core/api-errors.js';
 import { isInitialized } from '../core/project-identity.js';
 import { RejectedValueError } from '../core/api-errors.js';
@@ -20,10 +20,10 @@ import { validateOwner, isStrictOwnerEnv } from './owner-validation.js';
 import { printError } from './output.js';
 import { requireInit, runViaServerIfAvailable } from './shared.js';
 import { fmt } from './print.js';
-import { boolFlag, flagIsTrue, isOneOf, stringFlag, stringListFlag } from './flag-values.js';
+import { boolFlag, flagIsTrue, isOneOf, stringFlag, stringFlagOrExit, stringListFlag, } from './flag-values.js';
 import { DAY_MS } from '../util/time.js';
 import { errorMessage } from '../util/log.js';
-import { CliExit } from './exit.js';
+import { CliExit, fail } from './exit.js';
 const PARENT_PREVIEW_CHARS = 70;
 const DETAIL_CONTENT_CHARS = 160;
 // Shared by the direct write and the routed request so both store the same tags.
@@ -36,7 +36,7 @@ function rememberTags(flags, cwd) {
         if (!all.includes(pt))
             all.push(pt);
     }
-    const explicitScope = flags['scope'] !== undefined ? String(flags['scope']).trim() : null;
+    const explicitScope = stringFlagOrExit(flags, 'scope') ?? null;
     const activeScope = explicitScope || detectScope();
     if (activeScope) {
         const scopeTag = `scope:${activeScope}`;
@@ -60,12 +60,12 @@ const USER_VISIBLE_KINDS = ['distilled', 'superseded'];
 function parseKindFlag(flags) {
     const kindFlagRaw = stringFlag(flags, 'kind');
     const kindFlag = kindFlagRaw === undefined ? undefined : kindFlagRaw.toLowerCase();
-    // 'raw' is reserved for ingestion connectors (deletions go through archiveRawMemory); the append-only trigger aborts forget/consolidate on raw rows,
-    // so exposing --kind raw would create unforgettable memories. 'archived' is an internal sentinel set only in that transaction.
+    // 'raw' is reserved for ingestion connectors (deletions go through archiveRawMemory); the append-only trigger aborts
+    // forget/consolidate on raw rows, so exposing --kind raw would create unforgettable memories. 'archived' is an
+    // internal sentinel set only in that transaction.
     if (kindFlag !== undefined && !isOneOf(USER_VISIBLE_KINDS, kindFlag)) {
         printError(`Invalid --kind: "${kindFlagRaw}". Must be one of: ${USER_VISIBLE_KINDS.join(', ')}`);
-        printError(`(kind='raw' is reserved for ingestion connectors; kind='archived' is internal.)`);
-        throw new CliExit(1);
+        fail(`(kind='raw' is reserved for ingestion connectors; kind='archived' is internal.)`);
     }
     return kindFlag;
 }
@@ -74,8 +74,7 @@ function parseRememberEnvelope(flags) {
     const ownerRaw = stringFlag(flags, 'owner') ?? null;
     const ownerCheck = validateOwner(ownerRaw, { strict: isStrictOwnerEnv() });
     if (!ownerCheck.ok) {
-        printError(ownerCheck.message);
-        throw new CliExit(1);
+        fail(ownerCheck.message);
     }
     if (ownerCheck.message)
         printError(ownerCheck.message);
@@ -97,7 +96,7 @@ async function cmdRemember(hippoRoot, tenantId, text, flags) {
     const { requested: requestedTags, all: allTags } = rememberTags(flags, process.cwd());
     const envelope = parseRememberEnvelope(flags);
     const ctx = cliApiContext(targetRoot, tenantId);
-    const outcome = api.rememberLocally(ctx, {
+    const outcome = await api.rememberLocally(ctx, {
         content: text,
         kind: envelope.kind,
         scope: envelope.scope ?? undefined,
@@ -126,7 +125,8 @@ async function cmdRemember(hippoRoot, tenantId, text, flags) {
 function printRemembered(entry, useGlobal) {
     const prefix = useGlobal ? '[global] ' : '';
     console.log(`${prefix}Remembered [${entry.id}]`);
-    console.log(`   Layer: ${entry.layer} | Strength: ${fmt(entry.strength)} | Half-life: ${entry.half_life_days}d | Confidence: ${entry.confidence}`);
+    console.log(`   Layer: ${entry.layer} | Strength: ${fmt(entry.strength)} | Half-life: ${entry.half_life_days}d | ` +
+        `Confidence: ${entry.confidence}`);
     if (entry.tags.length > 0)
         console.log(`   Tags: ${entry.tags.join(', ')}`);
     if (entry.pinned)
@@ -150,7 +150,9 @@ function supersedeTags(flags) {
 /** The api's conflict text differs by which writer lost; the row itself names its successor either way. */
 async function alreadySupersededLine(hippoRoot, oldId, tenantId, conflict) {
     const by = (await getMemory(cliApiContext(hippoRoot, tenantId), oldId))?.superseded_by;
-    return by ? `Error: memory ${oldId} is already superseded by ${by}. Supersede that one instead.` : `Error: ${conflict.message}`;
+    return by
+        ? `Error: memory ${oldId} is already superseded by ${by}. Supersede that one instead.`
+        : `Error: ${conflict.message}`;
 }
 function parseLayerFlag(flags) {
     const raw = stringFlag(flags, 'layer');
@@ -158,8 +160,7 @@ function parseLayerFlag(flags) {
         return undefined;
     const layer = Object.values(Layer).find((l) => l === raw);
     if (layer === undefined) {
-        printError(`Invalid --layer: "${raw}". Must be one of: ${Object.values(Layer).join(', ')}`);
-        throw new CliExit(1);
+        fail(`Invalid --layer: "${raw}". Must be one of: ${Object.values(Layer).join(', ')}`);
     }
     return layer;
 }
@@ -173,7 +174,7 @@ async function cmdSupersede(hippoRoot, tenantId, oldId, newContent, flags) {
     };
     let newId;
     try {
-        ({ newId } = api.supersede(cliApiContext(hippoRoot, tenantId), oldId, newContent, overrides));
+        ({ newId } = await api.supersede(cliApiContext(hippoRoot, tenantId), oldId, newContent, overrides));
     }
     catch (err) {
         if (err instanceof NotFoundError)
@@ -193,46 +194,39 @@ function parseStepsOrExit(stepsJson) {
         return parseSteps(stepsJson);
     }
     catch (err) {
-        printError(errorMessage(err));
-        throw new CliExit(1);
+        fail(errorMessage(err));
     }
 }
 function traceTags(flags) {
-    const rawTags = flags['tag'];
-    return Array.isArray(rawTags)
-        ? rawTags.map((t) => String(t))
-        : rawTags !== undefined
-            ? [String(rawTags)]
-            : [];
+    return stringListFlag(flags, 'tag') ?? [];
 }
-function cmdTraceRecord(hippoRoot, tenantId, flags) {
+async function cmdTraceRecord(hippoRoot, tenantId, flags) {
     requireInit(hippoRoot);
-    const task = String(flags['task'] ?? '').trim();
-    const stepsJson = String(flags['steps'] ?? '').trim();
-    const outcome = String(flags['outcome'] ?? '').trim();
+    const task = stringFlagOrExit(flags, 'task') ?? '';
+    const stepsJson = stringFlagOrExit(flags, 'steps') ?? '';
+    const outcome = stringFlagOrExit(flags, 'outcome') ?? '';
     const validOutcomes = ['success', 'failure', 'partial'];
     if (!task || !stepsJson || !outcome) {
-        printError('Usage: hippo trace record --task <t> --steps <json> --outcome <success|failure|partial> [--session <id>] [--tag <t>]');
-        throw new CliExit(1);
+        fail('Usage: hippo trace record --task <t> --steps <json> --outcome <success|failure|partial> ' +
+            '[--session <id>] [--tag <t>]');
     }
     if (!isOneOf(validOutcomes, outcome)) {
-        printError(`Invalid outcome: "${outcome}". Must be one of: ${validOutcomes.join(', ')}.`);
-        throw new CliExit(1);
+        fail(`Invalid outcome: "${outcome}". Must be one of: ${validOutcomes.join(', ')}.`);
     }
     const steps = parseStepsOrExit(stepsJson);
-    const sessionId = String(flags['session'] ?? '').trim() || null;
+    const sessionId = stringFlagOrExit(flags, 'session') || null;
     const tags = traceTags(flags);
     const content = renderTraceContent({
         task,
         steps,
         outcome,
     });
-    const { id } = api.remember(cliApiContext(hippoRoot, tenantId), {
+    const { id } = await api.remember(cliApiContext(hippoRoot, tenantId), {
         content,
         tags,
         local: {
             layer: Layer.Trace,
-            source: String(flags['source'] ?? 'cli'),
+            source: stringFlagOrExit(flags, 'source') ?? 'cli',
             traceOutcome: outcome,
             sourceSessionId: sessionId,
         },
@@ -251,8 +245,7 @@ async function cmdTrace(hippoRoot, tenantId, id, flags) {
         sourceLabel = 'global';
     }
     if (!entry) {
-        printError(`Memory not found: ${id}`);
-        throw new CliExit(1);
+        fail(`Memory not found: ${id}`);
     }
     const t = {
         entry, id, sourceLabel,
@@ -288,12 +281,15 @@ async function traceLineage(hippoRoot, globalRoot, entry, id, tenantId) {
     for (const pid of parents) {
         const p = (await getMemory(cliApiContext(hippoRoot, tenantId), pid))
             ?? (isInitialized(globalRoot) ? await getMemory(cliApiContext(globalRoot, tenantId), pid) : null);
-        parentPreviews.push({ id: pid, content: p ? p.content.replace(/\s+/g, ' ').slice(0, PARENT_PREVIEW_CHARS) : '(not found)' });
+        parentPreviews.push({
+            id: pid,
+            content: p ? p.content.replace(/\s+/g, ' ').slice(0, PARENT_PREVIEW_CHARS) : '(not found)',
+        });
     }
     // Open conflicts involving this memory.
     const allConflicts = [
-        ...api.listConflicts(cliApiContext(hippoRoot, tenantId), 'open'),
-        ...(isInitialized(globalRoot) ? api.listConflicts(cliApiContext(globalRoot, tenantId), 'open') : []),
+        ...(await api.listConflicts(cliApiContext(hippoRoot, tenantId), 'open')),
+        ...(isInitialized(globalRoot) ? await api.listConflicts(cliApiContext(globalRoot, tenantId), 'open') : []),
     ];
     const myConflicts = allConflicts.filter((c) => c.memory_a_id === id || c.memory_b_id === id);
     return { parentPreviews, myConflicts };
@@ -328,13 +324,16 @@ function printTraceJson(t) {
     }, null, 2));
 }
 function printTraceText(t) {
-    const { entry, id, sourceLabel, conf, ageDays, strength, projectedAt, halfLife, rewardFactor, effHalfLife, sinceLast } = t;
+    const { entry, id, sourceLabel, conf, ageDays, strength, projectedAt } = t;
+    const { halfLife, rewardFactor, effHalfLife, sinceLast } = t;
     const { parentPreviews, myConflicts } = t;
     console.log(`Memory: ${entry.id}  [${sourceLabel}]`);
     console.log('='.repeat(50));
-    console.log(`Content:   ${entry.content.replace(/\s+/g, ' ').slice(0, DETAIL_CONTENT_CHARS)}${entry.content.length > DETAIL_CONTENT_CHARS ? '...' : ''}`);
-    console.log(`Layer:     ${entry.layer.padEnd(10)} Confidence: ${conf.padEnd(14)} Pinned: ${entry.pinned ? 'yes' : 'no'}${entry.starred ? '  Starred: ' +
-        'yes' : ''}`);
+    const ellipsis = entry.content.length > DETAIL_CONTENT_CHARS ? '...' : '';
+    console.log(`Content:   ${entry.content.replace(/\s+/g, ' ').slice(0, DETAIL_CONTENT_CHARS)}${ellipsis}`);
+    const starred = entry.starred ? '  Starred: ' + 'yes' : '';
+    const pinned = entry.pinned ? 'yes' : 'no';
+    console.log(`Layer:     ${entry.layer.padEnd(10)} Confidence: ${conf.padEnd(14)} Pinned: ${pinned}${starred}`);
     console.log(`Tags:      ${entry.tags.join(', ') || '(none)'}`);
     console.log(`Created:   ${entry.created}  (${fmt(ageDays, 1)} days ago)`);
     console.log();
@@ -374,11 +373,11 @@ export async function handleRemember({ hippoRoot, tenantId, args, flags }) {
         text = args.join(' ').trim();
     }
     if (!text || text.length < 3) {
-        printError('Memory content too short (minimum 3 characters).');
-        throw new CliExit(1);
+        fail('Memory content too short (minimum 3 characters).');
     }
-    // Thin-client routing: simple `remember` calls go over HTTP so the daemon stays the single writer; rich flags need the direct path.
-    // The salience gate is not in richFlag and the route does not apply it, so a routed remember stores what a direct one would skip.
+    // Thin-client routing: simple `remember` calls go over HTTP so the daemon stays the single writer; rich flags need
+    // the direct path. The salience gate is not in richFlag and the route does not apply it, so a routed remember stores
+    // what a direct one would skip.
     const richFlag = flags['pin'] || flags['global'] || flags['extract'] || flags['force'] ||
         flags['observed'] || flags['inferred'] || flags['verified'] ||
         flags['layer'] !== undefined;
@@ -395,8 +394,7 @@ async function rememberViaThinClient(hippoRoot, text, flags) {
     const thinOwnerRaw = stringFlag(flags, 'owner');
     const thinOwnerCheck = validateOwner(thinOwnerRaw, { strict: isStrictOwnerEnv() });
     if (!thinOwnerCheck.ok) {
-        printError(thinOwnerCheck.message);
-        throw new CliExit(1);
+        fail(thinOwnerCheck.message);
     }
     if (thinOwnerCheck.message)
         printError(thinOwnerCheck.message);
@@ -419,20 +417,18 @@ export async function handleSupersede({ hippoRoot, tenantId, args, flags }) {
     const oldId = args[0];
     const newContent = args.slice(1).join(' ').trim();
     if (!oldId || !newContent) {
-        printError('Usage: hippo supersede <old-id> "<new content>" [--layer L] [--tag T] [--pin]');
-        throw new CliExit(1);
+        fail('Usage: hippo supersede <old-id> "<new content>" [--layer L] [--tag T] [--pin]');
     }
     await cmdSupersede(hippoRoot, tenantId, oldId, newContent, flags);
 }
 export async function handleTrace({ hippoRoot, tenantId, args, flags }) {
     const sub = args[0] ? String(args[0]) : '';
     if (sub === 'record') {
-        cmdTraceRecord(hippoRoot, tenantId, flags);
+        await cmdTraceRecord(hippoRoot, tenantId, flags);
         return;
     }
     if (!sub) {
-        printError('Usage: hippo trace <memory-id> | hippo trace record --task <t> --steps <json> --outcome <o>');
-        throw new CliExit(1);
+        fail('Usage: hippo trace <memory-id> | hippo trace record --task <t> --steps <json> --outcome <o>');
     }
     await cmdTrace(hippoRoot, tenantId, sub, flags);
 }

package/dist/cli/scheduler.d.ts

@@ -13,7 +13,10 @@ export declare function hasUnsafeRunnerPathChars(runnerDir: string, platform: No
 export declare function buildDailyRunnerCommand(projectDir: string, platform?: NodeJS.Platform): string;
 /** What the Windows task runs. A plain `cmd /c` task opens a visible console every morning. */
 export declare function buildWindowsTaskRun(cmd: string): string;
-/** `text` for the inside of one double-quoted Windows argument: a backslash run before a quote or the end doubles, so no quote ends the argument early. */
+/**
+ * `text` for the inside of one double-quoted Windows argument: a backslash run before a quote or the end doubles, so no
+ * quote ends the argument early.
+ */
 export declare function quoteInsideWindowsArg(text: string): string;
 /** Argv for `schtasks`, passed without a shell: through cmd.exe the `&&` in /tr split the command. */
 export declare function buildSchtasksCreateArgs(taskName: string, cmd: string): string[];

package/dist/cli/scheduler.js

@@ -1,6 +1,6 @@
 import * as fs from 'fs';
 import * as path from 'path';
-import { errorMessage, log } from '../util/log.js';
+import { errorMessage, log, errorFields } from '../util/log.js';
 import { writeFileAtomic } from '../util/atomic-write.js';
 export const DAILY_TASK_NAME = 'hippo-daily-runner';
 function defaultRegistry() {
@@ -24,7 +24,7 @@ export function loadWorkspaceRegistry(globalRoot) {
         text = fs.readFileSync(registryPath, 'utf8');
     }
     catch (err) {
-        log.warn(`workspace registry ${registryPath} could not be read (${errorMessage(err)}); starting with no workspaces`);
+        log.warn(`workspace registry ${registryPath} could not be read (${errorMessage(err)}); starting with no workspaces`, errorFields(err));
         return defaultRegistry();
     }
     try {
@@ -51,8 +51,9 @@ function setAsideCorruptRegistry(registryPath, err) {
         log.warn(`workspace registry ${registryPath} is corrupt (${reason}); moved it to ${aside} and starting with no workspaces`);
     }
     catch (renameErr) {
-        log.warn(`workspace registry ${registryPath} is corrupt (${reason}) and could not be moved aside (${errorMessage(renameErr)}); ` +
-            `starting with no workspaces`);
+        log.warn(`workspace registry ${registryPath} is corrupt (${reason}) and could not be moved aside ` +
+            `(${errorMessage(renameErr)}); ` +
+            `starting with no workspaces`, errorFields(renameErr));
     }
 }
 export function saveWorkspaceRegistry(globalRoot, registry) {
@@ -89,7 +90,10 @@ export function buildDailyRunnerCommand(projectDir, platform = process.platform)
 export function buildWindowsTaskRun(cmd) {
     return `conhost.exe --headless cmd /c ${cmd}`;
 }
-/** `text` for the inside of one double-quoted Windows argument: a backslash run before a quote or the end doubles, so no quote ends the argument early. */
+/**
+ * `text` for the inside of one double-quoted Windows argument: a backslash run before a quote or the end doubles, so no
+ * quote ends the argument early.
+ */
 export function quoteInsideWindowsArg(text) {
     return text.replace(/(\\*)"/g, '$1$1\\"').replace(/\\+$/, '$&$&');
 }

package/dist/cli/serve.js

@@ -1,20 +1,21 @@
 // Long-running verbs: `hippo dashboard`, `hippo mcp` and `hippo serve`.
 import { installCrashHandlers } from '../util/crash-handlers.js';
-import { envAllowKeylessLocal, envPort, envRequireAuth, envTlsCert, envTlsKey } from '../util/env.js';
+import { envAllowKeylessLocal, envKeylessLocalRole, envPort, envRequireAuth, envTlsCert, envTlsKey, } from '../util/env.js';
 import * as fs from 'fs';
 import * as path from 'path';
-import { printError } from './output.js';
-import { stringFlagOrExit, stringFlag, numberFlag } from './flag-values.js';
+import { flagIsTrue, stringFlagOrExit, stringFlag, numberFlag } from './flag-values.js';
 import { requireInit } from './shared.js';
 import { errorMessage } from '../util/log.js';
-import { CliExit } from './exit.js';
+import { fail } from './exit.js';
+import { cliStdioHost } from './api-context.js';
 import { DEFAULT_DASHBOARD_PORT, DEFAULT_SERVER_HOST, DEFAULT_SERVER_PORT } from '../server/defaults.js';
 export async function handleDashboard({ hippoRoot, flags }) {
     requireInit(hippoRoot);
     const port = numberFlag(flags, 'port') ?? DEFAULT_DASHBOARD_PORT;
     const { serveDashboard } = await import('../dashboard/dashboard.js');
     serveDashboard(hippoRoot, port, undefined, { handleSignals: true });
-    // A later throw ends in one log line and exit 1, as it does for serve and mcp; a busy port is reported by the dashboard itself.
+    // A later throw ends in one log line and exit 1, as it does for serve and mcp; a busy port is reported by the
+    // dashboard itself.
     installCrashHandlers('dashboard');
     await new Promise(() => { }); // run until Ctrl+C
 }
@@ -24,11 +25,12 @@ export async function handleMcp() {
     // stdio loop here. (HTTP/SSE transport is wired in src/server.ts and
     // imports the same module without triggering stdin handlers.)
     const mod = await import('../mcp/server.js');
-    mod.startStdioLoop();
+    mod.startStdioLoop(cliStdioHost);
     // Server runs until stdin closes, so we never reach here
     await new Promise(() => { }); // hang forever
 }
-/** The certificate and key for HTTPS, from --tls-cert and --tls-key or HIPPO_TLS_CERT and HIPPO_TLS_KEY; undefined when neither is set. */
+/** The certificate and key for HTTPS, from --tls-cert and --tls-key or HIPPO_TLS_CERT and HIPPO_TLS_KEY; undefined when
+ * neither is set. */
 function readTlsFiles(flags) {
     // A flag with no value exits here; falling back to cleartext would hide the mistake.
     const certPath = stringFlagOrExit(flags, 'tls-cert') ?? envTlsCert();
@@ -36,39 +38,47 @@ function readTlsFiles(flags) {
     if (certPath === undefined && keyPath === undefined)
         return undefined;
     if (certPath === undefined || keyPath === undefined) {
-        printError('hippo serve: TLS needs both a certificate and a key: --tls-cert and --tls-key, or HIPPO_TLS_CERT and HIPPO_TLS_KEY.');
-        throw new CliExit(1);
+        fail('hippo serve: TLS needs both a certificate and a key: --tls-cert and --tls-key, ' +
+            'or HIPPO_TLS_CERT and HIPPO_TLS_KEY.');
     }
     try {
         return { cert: fs.readFileSync(certPath), key: fs.readFileSync(keyPath) };
     }
     catch (err) {
-        printError(`hippo serve: cannot read the TLS files: ${errorMessage(err)}`);
-        throw new CliExit(1);
+        fail(`hippo serve: cannot read the TLS files: ${errorMessage(err)}`);
     }
 }
-/** Said at every start, so the key rule is a choice an operator sees, and an upgrade that changed it explains itself. */
+/** Said at every start, so the key rule is a choice an operator sees, and an upgrade that changed it explains
+ * itself. */
 function keyRuleLine() {
     if (envRequireAuth())
         return 'every request needs an API key (HIPPO_REQUIRE_AUTH=1)';
     if (envAllowKeylessLocal()) {
-        return 'requests from this machine need no API key and act as host admin (HIPPO_ALLOW_KEYLESS_LOCAL=1); unset it to require a key on every request';
+        const role = envKeylessLocalRole() === 'admin'
+            ? 'act as host admin (HIPPO_ALLOW_KEYLESS_LOCAL=1, HIPPO_KEYLESS_LOCAL_ROLE=admin)'
+            : 'act as a member (HIPPO_ALLOW_KEYLESS_LOCAL=1; ' +
+                'HIPPO_KEYLESS_LOCAL_ROLE=admin opens sleep and the quarantine routes)';
+        return `requests from this machine need no API key and ${role}; ` +
+            'unset HIPPO_ALLOW_KEYLESS_LOCAL to require a key on every request';
     }
-    return 'every request needs an API key: mint one with `hippo auth create` and send it as "Authorization: Bearer <key>" ' +
-        '(the hippo CLI reads HIPPO_API_KEY). To let requests from this machine in without a key, start with HIPPO_ALLOW_KEYLESS_LOCAL=1';
+    return 'every request needs an API key: mint one with `hippo auth create` and send it as ' +
+        '"Authorization: Bearer <key>" ' +
+        '(the hippo CLI reads HIPPO_API_KEY). To let requests from this machine in without a key, ' +
+        'start with HIPPO_ALLOW_KEYLESS_LOCAL=1';
 }
 export async function handleServe({ hippoRoot, flags }) {
     requireInit(hippoRoot);
     const portRaw = flags['port'] ?? envPort() ?? DEFAULT_SERVER_PORT;
     const port = Number(portRaw);
     if (!Number.isFinite(port) || port < 0) {
-        printError(`Invalid --port: ${String(portRaw)}`);
-        throw new CliExit(1);
+        fail(`Invalid --port: ${String(portRaw)}`);
     }
     const host = stringFlag(flags, 'host') ?? DEFAULT_SERVER_HOST;
     const tls = readTlsFiles(flags);
     const { serve } = await import('../server.js');
-    const handle = await serve({ hippoRoot, port, host, handleSignals: true, tls });
+    // Unset rather than false without the flag, so HIPPO_ALLOW_CLEARTEXT=1 still applies.
+    const allowCleartext = flagIsTrue(flags, 'allow-cleartext') || undefined;
+    const handle = await serve({ hippoRoot, port, host, handleSignals: true, tls, allowCleartext });
     console.log(`hippo serve listening on ${handle.url} (pid ${process.pid})`);
     console.log(keyRuleLine());
     console.log(`pidfile: ${path.join(hippoRoot, 'server.pid')}`);

package/dist/cli/session-hooks.d.ts

@@ -1,12 +1,8 @@
 import { type CliFlags, type CommandContext } from './flag-values.js';
-/** SessionEnd entry: TUI teardown kills children still running, so read stdin inline, spawn a detached child that runs sleep then capture, and exit.
- * The child logs to a file that the next SessionStart reads via `hippo last-sleep`. */
+/** SessionEnd entry: TUI teardown kills children still running, so read stdin inline, spawn a detached child that runs
+ * sleep then capture, and exit. The child logs to a file that the next SessionStart reads via `hippo last-sleep`. */
 export declare function handleSessionEnd({ hippoRoot, tenantId, flags }: CommandContext): Promise<void>;
 export declare function handleSessionEndWorker({ hippoRoot, tenantId, flags }: CommandContext): Promise<void>;
-/** Quotes one cmd.exe argument; each `%` leaves the quotes as `^%`, so no %NAME% pair can expand. */
-export declare function quoteCmdArg(arg: string): string;
-/** cmd.exe arguments that run a .cmd or .bat shim with every forwarded argument delivered verbatim. */
-export declare function cmdShimArgs(shimPath: string, forwardArgs: readonly string[]): string[];
 export declare function handleCodexRun({ hippoRoot, tenantId, args }: CommandContext): void;
 export declare function cmdCodexSessionEndWorker(hippoRoot: string, tenantId: string, flags: CliFlags): Promise<void>;
 export declare function handleCodexSessionEndWorker({ hippoRoot, tenantId, flags }: CommandContext): Promise<void>;