hippo-memory 1.72.0 → 2.1.0

package/dist/cli/verbs/health.js

@@ -4,6 +4,7 @@ import { DEFAULT_ASSEMBLE_BUDGET } from '../../api/assemble.js';
 import { verb } from '../verb-row.js';
 export const HEALTH_VERBS = {
     status: verb(() => import('../status.js'), 'handleStatus', {
+        repairsCodexWrapper: true,
         flags: {},
         usage: [`
   status                   Show memory health stats`],
@@ -98,6 +99,7 @@ export const HEALTH_VERBS = {
     --json                 Output as JSON`],
     }),
     outcome: verb(() => import('../curate.js'), 'handleOutcome', {
+        repairsCodexWrapper: true,
         scoped: true,
         flags: { switches: ['bad', 'good'], values: ['id'] },
         usage: [`

package/dist/cli/verbs/memory.js

@@ -1,10 +1,13 @@
 // Store, recall and maintenance verbs; every verbs/ file keeps its rows in the order `hippo help` lists them.
-import { DEFAULT_LOCAL_BUMP, DEFAULT_RECALL_BUDGET } from '../../core/search-types.js';
-import { DEFAULT_EMBEDDING_WEIGHT, DEFAULT_MMR_LAMBDA } from '../../search/hybrid.js';
+import { CONFLICT_PEER_MULTIPLIER, DEFAULT_LOCAL_BUMP, DEFAULT_MMR_LAMBDA, DEFAULT_RECALL_BUDGET, SALIENCE_MIN_MULTIPLIER, UTILITY_LENGTH_PENALTY_CAP, UTILITY_LENGTH_TOKENS, VALUE_MULT_MAX, VALUE_MULT_MIN, VALUE_MULT_SLOPE, } from '../../core/search-types.js';
+import { DEFAULT_EMBEDDING_WEIGHT } from '../../search/hybrid.js';
 import { DEFAULT_GRAPH_HOPS, DEFAULT_GRAPH_SEED_COUNT } from '../../graph/stream.js';
 import { verb } from '../verb-row.js';
+const VALUE_CLIP = `clip(1 + ${VALUE_MULT_SLOPE}*tanh(pos - neg), ${VALUE_MULT_MIN}, ${VALUE_MULT_MAX})`;
 export const MEMORY_VERBS = {
     init: verb(() => import('../init.js'), 'handleInit', {
+        repairsCodexWrapper: true,
+        scoped: true,
         flags: { switches: ['global', 'no-hooks', 'no-learn', 'no-schedule'], values: ['scan'], numbers: ['days'] },
         usage: [`
   init                     Create .hippo/ structure in current directory
@@ -18,6 +21,7 @@ export const MEMORY_VERBS = {
                            coding agents' own memories (every init imports those)`],
     }),
     remember: verb(() => import('../remember.js'), 'handleRemember', {
+        repairsCodexWrapper: true,
         flags: {
             switches: ['error', 'extract', 'force', 'global', 'inferred', 'observed', 'pin', 'verified'],
             values: ['artifact-ref', 'kind', 'layer', 'owner', 'scope'],
@@ -43,6 +47,7 @@ export const MEMORY_VERBS = {
     --pin                  Pin the new memory (default: pinned if the old one was)`],
     }),
     recall: verb(() => import('../recall.js'), 'handleRecall', {
+        repairsCodexWrapper: true,
         scoped: true,
         flags: {
             switches: ['classic', 'continuity', 'equal-sources', 'evc-adaptive', 'filter-conflicts', 'graph-stream',
@@ -61,47 +66,40 @@ export const MEMORY_VERBS = {
     --as-of <iso-date>     Return the memories that were current on that date
     --multihop             Search a second time with the speaker: and topic: tags the
                            first pass found (also on when config multihop.enabled is true)
-    --hops <n>             E3.2 multi-hop graph recall: also surface memories
-                           reached by walking the entities/relations graph <n>
-                           hops (0..3, default off) out from the lexical seeds.
-                           Graph hits are tagged [graph: Nhop <rel>]. Today the
-                           graph holds supersedes edges (E3.1); cross-object edges
-                           light up the same traversal once extracted.
+    --hops <n>             Also surface memories reached by walking the entity and
+                           relation graph <n> hops (0..3, default off) out from the
+                           lexical matches. Graph hits are tagged [graph: Nhop <rel>].
+                           Today the graph holds supersedes edges; cross-object
+                           edges light up the same walk once extracted.
     --max-neighbors <n>    Per-hop fanout cap for --hops (1..200, default 25).
-    --graph-stream         L1: fuse a graph-retrieval stream into RRF, re-ranking
-                           in-pool results by graph proximity to the strong lexical
-                           seeds. Implies rrf scoring (default is blend). Local store
-                           only. Distinct from --hops (which injects out-of-pool
-                           neighbours); this re-ranks within the candidate pool.
+    --graph-stream         Fuse a graph-proximity ranking into the result list,
+                           re-ranking in-pool results by closeness to the strong
+                           lexical matches. Implies rrf scoring (default is blend).
+                           Local store only. Unlike --hops, it adds no memories
+                           from outside the candidate pool.
     --graph-hops <n>       Hops for --graph-stream (1..3, default ${DEFAULT_GRAPH_HOPS}).
     --graph-seeds <n>      Lexical anchors for --graph-stream (default ${DEFAULT_GRAPH_SEED_COUNT}). The stream
-                           re-ranks the rank>seeds tail; on a pool with <= n candidates
-                           every candidate is a seed and the stream is inert.
+                           re-ranks the results below the anchors; on a pool with <= n
+                           candidates every candidate is an anchor and the stream is inert.
     --no-mmr               Disable MMR diversity re-ranking
     --mmr-lambda <f>       MMR balance 0..1 (default: ${DEFAULT_MMR_LAMBDA}, 1.0 = pure relevance)
-    --evc-adaptive         ACC-style: when top-K shows high inter-item overlap
-                           (= conflict cluster), expand pool and re-rank by
-                           recency. Default off. RESEARCH.md §PFC.ACC.
-    --filter-conflicts     vlPFC interference filter: drop superseded entries
-                           and 0.3x-downweight entries flagged in an open
-                           conflict with a peer in the same result set.
-                           Uses recorded supersession + conflicts only — never
-                           lexical inference. Default off. RESEARCH.md §PFC.vlPFC.
-    --value-aware          vmPFC value attribution: boost memories with positive
-                           cumulative outcomes and demote those with negative
-                           outcomes during ranking. Multiplier
-                           clip(1 + 0.3*tanh(pos - neg), 0.7, 1.3). Reuses
-                           outcome_positive / outcome_negative; no schema
-                           change. Default off. RESEARCH.md §PFC.vmPFC.
-    --rerank-utility       OFC option-value re-ranker: combine relevance,
-                           strength, and integration cost into a single utility
-                           = score * (0.5 + 0.5 * strength) * (1 - cost_factor)
-                           where cost_factor = min(0.3, tokens / 10000). Re-sorts
-                           results by utility. Default off. RESEARCH.md §PFC.OFC.
+    --evc-adaptive         When the top results overlap heavily (a conflict
+                           cluster), widen the pool and re-rank by recency.
+                           Default off.
+    --filter-conflicts     Drop superseded entries and down-weight by ${CONFLICT_PEER_MULTIPLIER}x any
+                           entry in an open conflict with another result.
+                           Uses recorded supersession and conflicts only, never
+                           lexical inference. Default off.
+    --value-aware          Boost memories with positive cumulative outcomes and
+                           demote those with negative ones during ranking:
+                           multiplier ${VALUE_CLIP}.
+                           Reads outcome_positive and outcome_negative. Default off.
+    --rerank-utility       Re-sort results by utility = score * (0.5 + 0.5 * strength)
+                           * (1 - cost_factor), where cost_factor =
+                           min(${UTILITY_LENGTH_PENALTY_CAP}, tokens / ${UTILITY_LENGTH_TOKENS}). Default off.
     --reranker <name>      Apply a reranker pass after retrieval
-                           (cross-encoder|jev|clef-flash|clef|llm). Looks up
-                           the named reranker from src/rerankers/index.ts and
-                           re-orders the top-K candidates. Default unset (no reranker).
+                           (cross-encoder|jev|clef-flash|clef|llm) to re-order the
+                           top-K candidates. Default unset (no reranker).
                            jev calls the hosted TypeSafe Jev API: it needs
                            TYPESAFE_API_KEY, sends the query and candidate
                            text to that API, costs about 0.0004 USD a recall,
@@ -110,30 +108,24 @@ export const MEMORY_VERBS = {
                            Cloudflare Workers AI (CLOUDFLARE_ACCOUNT_ID and
                            CLOUDFLARE_API_TOKEN) or to HIPPO_CLEF_ENDPOINT, and
                            keep the native order on any failure.
-                           See docs/evals/2026-09-19-jev-reranker.md and
-                           docs/plans/2026-05-10-f6-reranker-hardening.md.
     --reranker-top-k <n>   Cap candidates passed to the reranker (default 50;
                            40 for jev, clef-flash and clef).
-    --goal <tag>           dlPFC goal-conditioned recall: memories tagged with
-                           the goal tag get a 1.5x score boost and results are
-                           re-sorted. Default off. RESEARCH.md §PFC.dlPFC.
-    --session-id <id>      Session identifier for dlPFC goal-stack boost.
+    --goal <tag>           Goal-conditioned recall: memories tagged with the
+                           goal tag get a 1.5x score boost and results are
+                           re-sorted. Default off.
+    --session-id <id>      Session identifier for the goal-stack boost.
                            Defaults to $HIPPO_SESSION_ID. When set and the
                            (tenant, session) has active goals (see
                            'hippo goal push'), recall auto-boosts memories
                            whose tags match an active goal name. Boost stacks
                            on top of base BM25 score, capped at 3.0x.
     --salience-threshold <n>
-                           Pineal salience: down-weight memories whose
-                           retrieval_count is below n. score *= max(0.5,
-                           retrieval_count / n) for entries with count < n;
-                           entries at or above n are unchanged. Salience emerges
-                           from USE, not from lexical overlap. Default off.
-                           RESEARCH.md §"AI Pineal Gland". (v1's creation-time
-                           lexical gate destroyed LoCoMo 0.28 -> 0.02; this v2
-                           is retrieval-side, opt-in only — see MEMORY.md
-                           "Hippo salience gate destroys benchmark recall".)
-    --continuity           Include continuity block (active task snapshot,
+                           Down-weight memories retrieved fewer than n times:
+                           score *= max(${SALIENCE_MIN_MULTIPLIER}, retrieval_count / n) for entries
+                           with count < n; entries at or above n are unchanged.
+                           Salience comes from use, not from lexical overlap.
+                           Default off.
+    --continuity           Include a continuity block (active task snapshot,
                            latest matching session handoff, last 5 session
                            events) above the memory list. Useful at agent
                            boot when you want both relevant memories AND
@@ -198,6 +190,7 @@ export const MEMORY_VERBS = {
     --json                 Output full summary as JSON`],
     }),
     context: verb(() => import('../context.js'), 'handleContext', {
+        repairsCodexWrapper: true,
         flags: {
             switches: ['auto', 'cross-project', 'pinned-only'],
             values: ['budget', 'format', 'framing', 'include-recent', 'runtime', 'scope'],
@@ -215,6 +208,7 @@ export const MEMORY_VERBS = {
     --framing <mode>       Framing: observe (default), suggest, assert`],
     }),
     sleep: verb(() => import('../sleep.js'), 'handleSleep', {
+        repairsCodexWrapper: true,
         destructive: true,
         scoped: true,
         flags: { switches: ['dry-run', 'no-learn', 'no-share'], values: ['log-file'] },

package/dist/cli/verbs/objects.js

@@ -1,5 +1,5 @@
 // First-class object, server, goal and auth verbs, in `hippo help` order.
-import { DEFAULT_KEY_TTL_DAYS, MAX_TTL_DAYS } from '../../api/auth.js';
+import { DEFAULT_KEY_TTL_DAYS, MAX_TTL_DAYS } from '../../api/auth/auth.js';
 import { DEFAULT_SERVER_HOST, DEFAULT_SERVER_PORT } from '../../server/defaults.js';
 import { verb } from '../verb-row.js';
 export const OBJECT_VERBS = {
@@ -188,16 +188,19 @@ export const OBJECT_VERBS = {
   mcp                      Start MCP server (stdio transport)`],
     }),
     serve: verb(() => import('../serve.js'), 'handleServe', {
-        flags: { values: ['host', 'tls-cert', 'tls-key'], numbers: ['port'] },
+        flags: { switches: ['allow-cleartext'], values: ['host', 'tls-cert', 'tls-key'], numbers: ['port'] },
         usage: [`
   serve                    Start the HTTP API server for this store (Ctrl+C stops it)
     --port <n>             Port to serve on (default: $HIPPO_PORT or ${DEFAULT_SERVER_PORT})
     --host <host>          Address to bind (default: ${DEFAULT_SERVER_HOST})
     --tls-cert <file>      PEM certificate; serve HTTPS only (or $HIPPO_TLS_CERT)
     --tls-key <file>       PEM private key for it; give both (or $HIPPO_TLS_KEY)
+    --allow-cleartext      Bind a non-loopback host without TLS, for a TLS proxy
+                           in front (or $HIPPO_ALLOW_CLEARTEXT=1)
                            Every request needs an API key (hippo auth create).
                            $HIPPO_ALLOW_KEYLESS_LOCAL=1 lets requests from this machine
-                           in without one; $HIPPO_REQUIRE_AUTH=1 wins over it.`],
+                           in without one, as a member ($HIPPO_KEYLESS_LOCAL_ROLE=admin
+                           for host admin); $HIPPO_REQUIRE_AUTH=1 wins over it.`],
     }),
     goal: verb(() => import('../goals.js'), 'handleGoal', {
         scoped: true,
@@ -206,7 +209,7 @@ export const OBJECT_VERBS = {
             values: ['level', 'outcome', 'parent', 'policy', 'session-id', 'success', 'tenant-id'],
         },
         usage: [`
-  goal <sub>               dlPFC goal stack (B3) — scoped per session
+  goal <sub>               Goal stack, scoped per session
     goal push <name>       Push a new active goal; prints the new goal id
       --policy <type>      schema-fit-biased | error-prioritized |
                            recency-first | hybrid
@@ -225,8 +228,13 @@ export const OBJECT_VERBS = {
     }),
     auth: verb(() => import('../auth.js'), 'handleAuth', {
         scoped: true,
-        flags: { switches: ['all', 'global', 'json', 'no-expiry'], values: ['label', 'role', 'tenant'], numbers: ['ttl-days'] },
-        usage: [`
+        flags: {
+            switches: ['all', 'global', 'json', 'no-expiry'],
+            values: ['label', 'role', 'tenant'],
+            numbers: ['ttl-days'],
+        },
+        usage: [
+            `
   auth <sub>               Manage API keys (A5 stub auth)
     auth create            Mint a new API key (plaintext shown ONCE)
       --label <s>          Optional human label
@@ -248,7 +256,8 @@ export const OBJECT_VERBS = {
       --global             Operate on the global store
     auth ungrant <key_id> <scope>  Remove a scope grant
       --json               Output as JSON
-      --global             Operate on the global store`],
+      --global             Operate on the global store`
+        ],
     }),
 };
 //# sourceMappingURL=objects.js.map

package/dist/cli/verbs/sessions.js

@@ -132,9 +132,10 @@ export const SESSION_VERBS = {
     --status               Show embedding coverage`],
     }),
     watch: verb(() => import('../transfer.js'), 'handleWatch', {
-        flags: {},
+        flags: { values: ['shell'] },
         usage: [`
-  watch "<command>"        Run command, auto-learn from failures`],
+  watch -- <cmd> [args]    Run command, auto-learn from failures (no shell)
+    --shell "<line>"       Run one command line through the shell instead`],
     }),
     learn: verb(() => import('../transfer.js'), 'handleLearn', {
         scoped: true,
@@ -203,6 +204,7 @@ export const SESSION_VERBS = {
     --format <fmt>         Output format: json (default) or markdown`],
     }),
     capture: verb(() => import('../session-hooks.js'), 'handleCapture', {
+        repairsCodexWrapper: true,
         flags: { switches: ['dry-run', 'global', 'last-session', 'stdin'], values: ['file', 'log-file', 'transcript'] },
         usage: [`
   capture                  Extract memories from conversation text

package/dist/cli/versioned-verbs.d.ts

@@ -1,4 +1,5 @@
 import { type CliFlags, type CommandContext } from './flag-values.js';
+import type { Objects } from '../store/port.js';
 import { printLifecycleTail, type ObjectNames } from './object-verbs.js';
 type VersionedRow = Parameters<typeof printLifecycleTail>[0] & {
     readonly id: number;
@@ -23,29 +24,29 @@ export interface VersionedKind<O extends VersionedRow, S extends string, B> {
     readonly body: (flags: CliFlags, verb: 'new' | 'supersede') => B | undefined;
     /** What a new version keeps from the one it supersedes: the repo, customer or name. */
     readonly keyOf: (o: O) => string;
-    readonly save: (key: string, body: B, extraTags: string[], from?: Succession) => O;
+    readonly save: (key: string, body: B, extraTags: string[], from?: Succession) => Promise<O>;
     /** The first line `new` prints. */
     readonly recorded: (o: O) => string;
     readonly list: (opts: {
         status?: S;
         limit: number;
-    }, flags: CliFlags) => readonly O[];
-    readonly loadById: (id: number) => O | null;
-    readonly close: (id: number) => {
+    }, flags: CliFlags) => Promise<readonly O[]>;
+    readonly loadById: (id: number) => Promise<O | null>;
+    readonly close: (id: number) => Promise<{
         id: number;
-    };
+    }>;
     readonly printRow: (o: O) => void;
     /** The `get` lines between the header and the lifecycle tail. */
     readonly printDetail: (o: O) => void;
     /** A subcommand only this kind has. */
     readonly extra?: {
         readonly sub: string;
-        readonly run: (args: string[], flags: CliFlags) => void;
+        readonly run: (args: string[], flags: CliFlags) => Promise<void>;
     };
 }
 /** A flag that must carry text: its raw value, or undefined when absent or blank. */
 export declare function requiredText(flags: CliFlags, name: string): string | undefined;
 /** The `hippo <cmd>` handler for a kind; `kindAt` binds the descriptor to the store the command runs against. */
-export declare function versionedVerbs<O extends VersionedRow, S extends string, B>(kindAt: (hippoRoot: string, tenantId: string) => VersionedKind<O, S, B>): (ctx: CommandContext) => void;
+export declare function versionedVerbs<O extends VersionedRow, S extends string, B>(kindAt: (objects: Objects, hippoRoot: string, tenantId: string) => VersionedKind<O, S, B>): (ctx: CommandContext) => Promise<void>;
 export {};
 //# sourceMappingURL=versioned-verbs.d.ts.map

package/dist/cli/versioned-verbs.js

@@ -1,11 +1,14 @@
-// One handler set for the kinds that evolve by supersession (brief, note, policy, process, skill), each driven by a descriptor.
+// One handler set for the kinds that evolve by supersession (brief, note, policy, process, skill),
+// each driven by a descriptor.
 import { extractPathTags } from '../search/path-context.js';
 import { errorMessage } from '../util/log.js';
 import { printError } from './output.js';
 import { nonEmptyStringFlag, stringFlag } from './flag-values.js';
 import { requireInit } from './shared.js';
-import { closeObject, foundOrExit, idArgOrExit, listObjects, printLifecycleTail } from './object-verbs.js';
-import { CliExit } from './exit.js';
+import { objectsOf } from '../api/objects/objects.js';
+import { cliApiContext } from './api-context.js';
+import { closeObject, foundOrExit, idArgOrExit, listObjects, printLifecycleTail, } from './object-verbs.js';
+import { CliExit, fail } from './exit.js';
 /** A flag that must carry text: its raw value, or undefined when absent or blank. */
 export function requiredText(flags, name) {
     const raw = stringFlag(flags, name);
@@ -13,14 +16,19 @@ export function requiredText(flags, name) {
 }
 /** The `hippo <cmd>` handler for a kind; `kindAt` binds the descriptor to the store the command runs against. */
 export function versionedVerbs(kindAt) {
-    return ({ hippoRoot, tenantId, args, flags }) => {
+    return async ({ hippoRoot, tenantId, args, flags }) => {
         requireInit(hippoRoot);
-        const kind = kindAt(hippoRoot, tenantId);
+        const kind = kindAt(objectsOf(cliApiContext(hippoRoot, tenantId)), hippoRoot, tenantId);
         const sub = args[0] ?? '';
         if (sub === kind.extra?.sub)
             return kind.extra.run(args, flags);
         if (sub === 'list') {
-            return listObjects(flags, { plural: kind.plural, states: kind.states, load: (opts) => kind.list(opts, flags), printRow: kind.printRow });
+            return listObjects(flags, {
+                plural: kind.plural,
+                states: kind.states,
+                load: (opts) => kind.list(opts, flags),
+                printRow: kind.printRow,
+            });
         }
         if (sub === 'get')
             return getVersion(kind, args);
@@ -29,46 +37,48 @@ export function versionedVerbs(kindAt) {
         if (sub === 'close')
             return closeObject(args, kind.names, kind.close);
         // Both `<cmd> new "<key>"` and the bare `<cmd> "<key>"` create.
-        createVersion(kind, sub === 'new' ? (args[1] ?? '') : sub, flags);
+        await createVersion(kind, sub === 'new' ? (args[1] ?? '') : sub, flags);
     };
 }
-function getVersion(kind, args) {
+async function getVersion(kind, args) {
     const id = idArgOrExit(args, `Usage: hippo ${kind.names.cmd} get <id>`, kind.names.idLabel);
-    const o = foundOrExit(kind.loadById(id), kind.names.noun, id);
+    const o = foundOrExit(await kind.loadById(id), kind.names.noun, id);
     console.log(`${kind.names.noun} #${o.id}`);
     kind.printDetail(o);
     printLifecycleTail(o);
 }
-function createVersion(kind, key, flags) {
+async function createVersion(kind, key, flags) {
     const body = key ? kind.body(flags, 'new') : undefined;
     if (body === undefined) {
         for (const line of kind.usage)
             printError(line);
         throw new CliExit(1);
     }
-    const created = saveVersion(kind, key, body);
+    const created = await saveVersion(kind, key, body);
     printSaved(kind.recorded(created), created);
 }
-function supersedeVersion(kind, args, flags) {
+async function supersedeVersion(kind, args, flags) {
     const id = idArgOrExit(args, kind.supersedeUsage, kind.names.idLabel);
     const body = kind.body(flags, 'supersede');
     if (body === undefined) {
-        printError(`hippo ${kind.names.cmd} supersede requires ${kind.bodyRequired} for the new version.`);
-        throw new CliExit(1);
+        fail(`hippo ${kind.names.cmd} supersede requires ${kind.bodyRequired} for the new version.`);
     }
-    // The lookup only gives a missing id its not-found line; the save's own preflight is the authoritative active-state check.
-    const existing = foundOrExit(kind.loadById(id), kind.names.noun, id);
-    const created = saveVersion(kind, kind.keyOf(existing), body, { id, changeSummary: nonEmptyStringFlag(flags, 'change') });
+    // The lookup only gives a missing id its not-found line; the save's own preflight is the
+    // authoritative active-state check.
+    const existing = foundOrExit(await kind.loadById(id), kind.names.noun, id);
+    const created = await saveVersion(kind, kind.keyOf(existing), body, {
+        id,
+        changeSummary: nonEmptyStringFlag(flags, 'change'),
+    });
     printSaved(`${kind.names.noun} #${created.id} recorded (v${created.version}), superseding #${id}.`, created);
 }
 /** Every kind's save goes through here, so a refused write always prints the store's message and exits 1. */
-function saveVersion(kind, key, body, from) {
+async function saveVersion(kind, key, body, from) {
     try {
-        return kind.save(key, body, extractPathTags(process.cwd()), from);
+        return await kind.save(key, body, extractPathTags(process.cwd()), from);
     }
     catch (e) {
-        printError(errorMessage(e));
-        throw new CliExit(1);
+        fail(errorMessage(e));
     }
 }
 function printSaved(line, o) {

package/dist/cli.js

@@ -12,17 +12,18 @@ import { printGitHubBackfillUsage } from './cli/github.js';
 import { printError } from './cli/output.js';
 import { errorFields, errorMessage, isLevelEnabled, log } from './util/log.js';
 import { STORE_BUSY_MESSAGE } from './store/port.js';
-import { isStoreBusy } from './store/sqlite/busy.js';
+import { isStoreBusy } from './api/busy.js';
 import { flagIsTrue, isBooleanFlag, isStringFlag } from './cli/flag-values.js';
-import { USAGE_HEADER, USAGE_EXAMPLES, printAuditPruneUsage, printSlackBackfillUsage, printSlackWorkspacesUsage } from './cli/usage.js';
+import { USAGE_HEADER, USAGE_EXAMPLES, printAuditPruneUsage, printSlackBackfillUsage, printSlackWorkspacesUsage, } from './cli/usage.js';
 import { flagKind, isKnownFlag, undeclaredFlags } from './cli/flags.js';
 import { COMMANDS } from './cli/verbs.js';
-import { CliExit } from './cli/exit.js';
-// Helpers
+import { CliExit, fail } from './cli/exit.js';
 // A command that does not honour --dry-run would ignore it and run for real.
 function dryRunRefusal(command, spec, args, flags) {
     const only = spec?.dryRun;
-    const honoured = only === undefined ? spec?.flags.switches?.includes('dry-run') : only !== false && only.honoured(args, flags);
+    const honoured = only === undefined
+        ? spec?.flags.switches?.includes('dry-run')
+        : only !== false && only.honoured(args, flags);
     if (honoured)
         return null;
     const where = only ? ` outside \`hippo ${command} ${only.form}\`` : '';
@@ -59,7 +60,6 @@ function setSeparatedFlag(flags, key, next, kind) {
         return 2;
     }
     if (!next || next.startsWith('--') || kind === 'switch') {
-        // Boolean flag
         flags[key] = true;
         return 1;
     }
@@ -107,9 +107,8 @@ export function parseArgs(argv) {
 export function shouldAutoRepairCodexWrapper(currentCommand, flags) {
     if (envSkipAutoIntegrations())
         return false;
-    if (!['context', 'remember', 'recall', 'sleep', 'capture', 'outcome', 'status', 'init'].includes(currentCommand)) {
+    if (!COMMAND_INDEX.get(currentCommand)?.repairsCodexWrapper)
         return false;
-    }
     if (currentCommand === 'init' && flagIsTrue(flags, 'no-hooks'))
         return false;
     return true;
@@ -123,7 +122,7 @@ function maybeRepairCodexWrapper(currentCommand, flags) {
         repairCodexWrapperIfInstalled();
     }
     catch (err) {
-        log.debug(`codex wrapper not repaired: ${errorMessage(err)}`);
+        log.debug(`codex wrapper not repaired: ${errorMessage(err)}`, errorFields(err));
     }
 }
 const ROWS = Object.values(COMMANDS);
@@ -155,7 +154,6 @@ function printHelp(command, args) {
     else
         console.log(verbUsage(command) ?? usageText());
 }
-// Entry point
 function printVersion() {
     const __filename_local = fileURLToPath(import.meta.url);
     const __dirname_local = path.dirname(__filename_local);
@@ -169,8 +167,7 @@ function printVersion() {
  *  reject it once here so every command, thin-client relays included, sees only a non-empty string. */
 function rejectEmptyScope(flags) {
     if ('scope' in flags && (!isStringFlag(flags['scope']) || !flags['scope'].trim())) {
-        printError('--scope requires a non-empty value (e.g. --scope slack:private:C1).');
-        throw new CliExit(1);
+        fail('--scope requires a non-empty value (e.g. --scope slack:private:C1).');
     }
 }
 // parseArgs stores a value-less flag as boolean true, and NaN then survives every
@@ -180,8 +177,7 @@ function rejectNonNumericFlags(flags, declared) {
         if (flagKind(declared, key) !== 'number')
             continue;
         if (!isStringFlag(raw) || !raw.trim() || !Number.isFinite(Number(raw))) {
-            printError(`--${key} requires a numeric value.`);
-            throw new CliExit(1);
+            fail(`--${key} requires a numeric value.`);
         }
     }
 }
@@ -190,8 +186,7 @@ function rejectNonNumericFlags(flags, declared) {
 function rejectValuedSwitches(flags, declared) {
     for (const [key, raw] of Object.entries(flags)) {
         if (flagKind(declared, key) === 'switch' && !isBooleanFlag(raw)) {
-            printError(`--${key} takes no value`);
-            throw new CliExit(1);
+            fail(`--${key} takes no value`);
         }
     }
 }
@@ -208,8 +203,9 @@ function checkUnknownFlags(command, flags, spec) {
     }
     // main() refuses --dry-run by name on a verb without one, so that flag is not also called ignored.
     const ignored = declared ? undeclaredFlags(declared, Object.keys(flags)).filter((key) => key !== 'dry-run') : unknown;
-    if (ignored.length > 0)
+    if (ignored.length > 0) {
         printError(`hippo: ignoring unknown flag ${flagNames(ignored)}. A later release will reject it.`);
+    }
 }
 async function main(command, args, flags, hippoRoot) {
     if (command === '--version' || command === '-v' || flags['version'])
@@ -240,7 +236,7 @@ async function main(command, args, flags, hippoRoot) {
         throw new CliExit(1);
     }
     const run = () => spec.run({ hippoRoot, tenantId: resolveTenantId({}), args, flags });
-    await (spec.scoped ? (await import('./db/request-stores.js')).runWithRequestStores(run) : run());
+    await (spec.scoped ? (await import('./cli/api-context.js')).cliRequest(run) : run());
 }
 export async function runCli(argv = process.argv) {
     const { command, args, flags } = parseArgs(argv);

package/dist/connectors/dlq.d.ts

@@ -1,4 +1,4 @@
-import { type HippoStore } from '../store/index.js';
+import type { StoreWith } from '../store/index.js';
 import type { ConnectorDeadLetter } from '../store/port.js';
 import type { JsonValue } from '../util/json.js';
 declare const DEFAULT_BUCKET = "parse_error";
@@ -19,8 +19,8 @@ export interface ParkedRow<Bucket extends string> {
     bucket: Bucket | typeof DEFAULT_BUCKET;
     signature: string | null;
 }
-/** What one connector supplies: the tag that names its table to the store, its list, its one-row read and its retry bump.
- * `Own` is the columns only its table has. */
+/** What one connector supplies: the tag that names its table to the store, its list, its one-row read and its retry
+ * bump. `Own` is the columns only its table has. */
 export interface ConnectorDlq<Own, Bucket extends string, Item> {
     readonly letter: (row: ParkedRow<Bucket> & Own) => ConnectorDeadLetter;
     readonly list: (hippoRoot: string, tenantId: string, limit: number) => Item[];
@@ -28,8 +28,7 @@ export interface ConnectorDlq<Own, Bucket extends string, Item> {
     /** Adds one to `retry_count` and stamps `retried_at`. */
     readonly bump: (hippoRoot: string, id: number) => void;
 }
-/** Parks on `store`, else on hippo.db under `hippoRoot`. */
-export declare function parkInDlq<Own, Bucket extends string>(dlq: ConnectorDlq<Own, Bucket, unknown>, hippoRoot: string, opts: ParkOpts<Bucket> & NoInfer<Own>, store?: HippoStore): Promise<number>;
+export declare function parkInDlq<Own, Bucket extends string>(dlq: ConnectorDlq<Own, Bucket, unknown>, store: StoreWith<'connectorEvents'>, opts: ParkOpts<Bucket> & NoInfer<Own>): Promise<number>;
 export declare function listDlq<Item>(dlq: ConnectorDlq<never, never, Item>, hippoRoot: string, opts: {
     tenantId: string;
     limit?: number;
@@ -74,7 +73,8 @@ export interface ReplaySteps<Item, Envelope extends JsonValue> {
     readonly notEnvelope: string;
     readonly reingest: (row: Item, envelope: Envelope) => Promise<Reingest>;
 }
-/** Re-runs a parked row under today's secret and routing; every attempt past the read is counted once, except a missing signature. */
+/** Re-runs a parked row under today's secret and routing; every
+ * attempt past the read is counted once, except a missing signature. */
 export declare function replayParked<Item extends ParkedEntry, Envelope extends JsonValue>(steps: ReplaySteps<Item, Envelope>, hippoRoot: string, id: number, force: boolean): Promise<ReplayResult>;
 export {};
 //# sourceMappingURL=dlq.d.ts.map

package/dist/connectors/dlq.js

@@ -1,13 +1,12 @@
-// The dead-letter queue every webhook connector parks into: one redaction, one unroutable sentinel, one set of defaults, one replay result.
+// The dead-letter queue every webhook connector parks into: one redaction, one unroutable sentinel, one set of
+// defaults, one replay result.
 import { DEFAULT_LIST_LIMIT } from '../util/limits.js';
 import { DLQ_REDACTED_NOTE, redactPayload } from '../util/secret-detect.js';
-import { requireGroup, storeFor } from '../store/index.js';
 import { errorMessage } from '../util/log.js';
 /** The tenant stored on a row no tenant was resolved for; the column is NOT NULL. */
 const UNROUTABLE_TENANT = '__unroutable__';
 const DEFAULT_BUCKET = 'parse_error';
-/** Parks on `store`, else on hippo.db under `hippoRoot`. */
-export async function parkInDlq(dlq, hippoRoot, opts, store) {
+export async function parkInDlq(dlq, store, opts) {
     const rawPayload = redactPayload(opts.rawPayload);
     // A redacted body can never match its signature, so the row keeps none and replay needs --force.
     const redacted = rawPayload !== opts.rawPayload;
@@ -19,7 +18,7 @@ export async function parkInDlq(dlq, hippoRoot, opts, store) {
         bucket: opts.bucket ?? DEFAULT_BUCKET,
         signature: redacted ? null : opts.signature ?? null,
     });
-    return requireGroup(storeFor({ hippoRoot, store }), 'connectorEvents').parkDeadLetter(letter);
+    return store.connectorEvents.parkDeadLetter(letter);
 }
 export function listDlq(dlq, hippoRoot, opts) {
     return dlq.list(hippoRoot, opts.tenantId, opts.limit ?? DEFAULT_LIST_LIMIT);
@@ -33,7 +32,8 @@ function failAndBump(dlq, hippoRoot, row, status, reason) {
     dlq.bump(hippoRoot, row.id);
     return replayFailed(status, row.retryCount + 1, reason);
 }
-/** Re-runs a parked row under today's secret and routing; every attempt past the read is counted once, except a missing signature. */
+/** Re-runs a parked row under today's secret and routing; every
+ * attempt past the read is counted once, except a missing signature. */
 export async function replayParked(steps, hippoRoot, id, force) {
     const row = steps.dlq.entry(hippoRoot, id);
     if (!row)
@@ -56,7 +56,12 @@ export async function replayParked(steps, hippoRoot, id, force) {
     if (!outcome.ok)
         return failAndBump(steps.dlq, hippoRoot, row, outcome.status, outcome.reason);
     steps.dlq.bump(hippoRoot, row.id);
-    const result = { ok: true, status: outcome.status, memoryId: outcome.memoryId, retryCount: row.retryCount + 1 };
+    const result = {
+        ok: true,
+        status: outcome.status,
+        memoryId: outcome.memoryId,
+        retryCount: row.retryCount + 1,
+    };
     if (outcome.reason !== undefined)
         result.reason = outcome.reason;
     return result;

package/dist/connectors/github/backfill.d.ts

@@ -1,7 +1,7 @@
-/** Paginated backfill of the GitHub issues, issue-comments and PR-review-comments streams, each with its own high-water mark (HWM).
- *  An HWM is persisted only after its stream fully drains, so a crash in stream 2 leaves stream 1 committed and stream 2 resumes from its prior HWM.
+/** Paginated backfill of the GitHub issues, issue-comments and PR-review-comments streams, each with its own HWM.
+ *  An HWM (high-water mark) is saved only after its stream fully drains, so a crash in stream 2 keeps stream 1.
  *  `repository.private` is left undefined (REST lists omit it), so scopeFromRepository falls through to private. */
-import type { Context } from '../../api/index.js';
+import type { ConnectorContext } from '../store.js';
 import type { GitHubFetcher } from './octokit-client.js';
 export interface BackfillOpts {
     /** e.g. 'acme/repo'. */
@@ -24,5 +24,5 @@ export interface BackfillResult {
     ingested: BackfillStreamCounts;
     pages: BackfillStreamCounts;
 }
-export declare function backfillRepo(ctx: Context, opts: BackfillOpts): Promise<BackfillResult>;
+export declare function backfillRepo(ctx: ConnectorContext, opts: BackfillOpts): Promise<BackfillResult>;
 //# sourceMappingURL=backfill.d.ts.map