hippo-memory 1.72.0 → 2.1.0

package/dist/util/compaction-items.d.ts

@@ -9,7 +9,10 @@ export interface CompactionItemRows {
     tooLong: number;
     capped: number;
 }
-/** The <summary> body of a PostCompact compact_summary with any <analysis> block removed; the whole text trimmed when there is no <summary> tag. */
+/**
+ * The <summary> body of a PostCompact compact_summary with any <analysis> block removed; the whole text trimmed when
+ * there is no <summary> tag.
+ */
 export declare function compactSummaryBody(compactSummary: string): string;
 /** found=false when no "Memories for hippo" heading; items in order, "none" dropped, never cut. */
 export declare function parseCompactionItems(summaryBody: string): ParsedCompactionItems;

package/dist/util/compaction-items.js

@@ -20,14 +20,20 @@ function withoutAnalysis(text) {
         from = close + ANALYSIS_CLOSE.length;
     }
 }
-/** `text` minus its trailing run of `*`, `:` and spaces; read from the end, as a `+$` pattern retries the run from each character. */
+/**
+ * `text` minus its trailing run of `*`, `:` and spaces; read from the end, as a `+$` pattern retries the run from each
+ * character.
+ */
 function withoutHeadingTrailer(text) {
     let end = text.length;
     while (end > 0 && HEADING_TRAILER.test(text[end - 1]))
         end--;
     return text.slice(0, end);
 }
-/** The <summary> body of a PostCompact compact_summary with any <analysis> block removed; the whole text trimmed when there is no <summary> tag. */
+/**
+ * The <summary> body of a PostCompact compact_summary with any <analysis> block removed; the whole text trimmed when
+ * there is no <summary> tag.
+ */
 export function compactSummaryBody(compactSummary) {
     const text = withoutAnalysis(compactSummary);
     const open = text.lastIndexOf('<summary>');

package/dist/util/crash-handlers.d.ts

@@ -3,10 +3,15 @@ export interface Shutdown {
     readonly run: () => void | Promise<void>;
     readonly boundMs: number;
 }
-/** Exit once stdout and stderr have drained, so the last reply and the last log line reach their reader; capped at 1 s. */
+/**
+ * Exit once stdout and stderr have drained, so the last reply and the last log line reach their reader; capped at 1 s.
+ */
 export declare function exitAfterFlush(code: number): void;
 /** On SIGTERM or SIGINT: runs `shutdown` once, then exits 0. */
 export declare function installSignalHandlers(name: string, shutdown: Shutdown): void;
-/** After an uncaught throw the process state is unknown: log the cause, run `shutdown` once, then exit 1 for the supervisor or client to restart it. */
+/**
+ * After an uncaught throw the process state is unknown: log the cause, run `shutdown` once, then exit 1 for the
+ * supervisor or client to restart it.
+ */
 export declare function installCrashHandlers(name: string, shutdown?: Shutdown): void;
 //# sourceMappingURL=crash-handlers.d.ts.map

package/dist/util/crash-handlers.js

@@ -8,16 +8,22 @@ function afterFlush(leave) {
     process.stderr.write('', done);
     setTimeout(leave, 1000).unref();
 }
-/** Exit once stdout and stderr have drained, so the last reply and the last log line reach their reader; capped at 1 s. */
+/**
+ * Exit once stdout and stderr have drained, so the last reply and the last log line reach their reader; capped at 1 s.
+ */
 export function exitAfterFlush(code) {
     process.exitCode = code;
     afterFlush(() => process.exit(code));
 }
-// process.exit joins every worker thread, so one stuck in a synchronous statement would hold the exit open; a kill cannot be held.
+// process.exit joins every worker thread, so one stuck in a synchronous statement would hold the exit open; a kill
+// cannot be held.
 function killSelf() {
     process.kill(process.pid, 'SIGKILL');
 }
-/** Runs `shutdown` for `cause`, then exits with `code`, or 1 when it threw. One still running after its bound is logged and the process ended without it. */
+/**
+ * Runs `shutdown` for `cause`, then exits with `code`, or 1 when it threw. One still running after its bound is logged
+ * and the process ended without it.
+ */
 function exitAfterShutdown(name, cause, shutdown, code) {
     let ended = false;
     // Referenced on purpose: a shutdown that never settles must end at the bound, not when the loop happens to empty.
@@ -52,7 +58,10 @@ export function installSignalHandlers(name, shutdown) {
     process.once('SIGTERM', () => stopFor('SIGTERM'));
     process.once('SIGINT', () => stopFor('SIGINT'));
 }
-/** After an uncaught throw the process state is unknown: log the cause, run `shutdown` once, then exit 1 for the supervisor or client to restart it. */
+/**
+ * After an uncaught throw the process state is unknown: log the cause, run `shutdown` once, then exit 1 for the
+ * supervisor or client to restart it.
+ */
 export function installCrashHandlers(name, shutdown) {
     let crashing = false;
     const crash = (kind, err) => {

package/dist/util/env.d.ts

@@ -1,4 +1,7 @@
-/** The whole environment, for code that takes it as an injectable map (agent-memory machines, owner checks, support bundles). */
+/**
+ * The whole environment, for code that takes it as an injectable map (agent-memory machines, owner checks, support
+ * bundles).
+ */
 export declare function processEnv(): NodeJS.ProcessEnv;
 /** A variable whose name comes from configuration, such as an embedding provider's key variable. */
 export declare function envByName(name: string): string | undefined;
@@ -22,6 +25,8 @@ export declare function envHippoHome(): string | undefined;
 export declare function envXdgDataHome(): string | undefined;
 export declare function envHomeDir(): string | undefined;
 export declare function envPath(): string | undefined;
+/** The extensions win32 tries on a bare command name, in order. */
+export declare function envPathExt(): string | undefined;
 export declare function envModelCache(): string | undefined;
 export declare function envHippoSessionId(): string | undefined;
 export declare function envClaudeCodeSessionId(): string | undefined;
@@ -44,12 +49,21 @@ export declare function envLogLevel(): string;
 /** `HIPPO_LOG_FORMAT=json` writes each log line as one JSON object; anything else keeps the text line. */
 export declare function envLogJson(): boolean;
 export declare function envPort(): string | undefined;
-/** How long a client waits for a running server's /health before writing to the store directly; server-detect.ts holds the default. */
+/**
+ * How long a client waits for a running server's /health before writing to the store directly; server-detect.ts holds
+ * the default.
+ */
 export declare function envHealthProbeMs(): number | undefined;
 export declare function envRequireAuth(): boolean;
-/** `1` lets a request made on this machine in with no key, as host admin; HIPPO_REQUIRE_AUTH=1 wins over it. */
+/** `1` lets a request made on this machine in with no key; HIPPO_REQUIRE_AUTH=1 wins over it. */
 export declare function envAllowKeylessLocal(): boolean;
+/** The role a keyless local request gets: `admin` (host admin) only when asked for by name, else `member`. */
+export declare function envKeylessLocalRole(): 'admin' | 'member';
+/** `1` lets a non-loopback bind start without TLS, for TLS that ends at a proxy in front. */
+export declare function envAllowCleartext(): boolean;
 export declare function envV1Rps(): string | undefined;
+/** Requests per second each authenticated caller may make; `0` turns the per-caller limit off. */
+export declare function envCallerRps(): string | undefined;
 /** How long a request body may take to arrive; http-util.ts holds the default. */
 export declare function envBodyTimeoutMs(): number | undefined;
 /** How long POST /v1/sleep lets its consolidation run; server/sleep-offload.ts holds the default. */
@@ -57,12 +71,16 @@ export declare function envSleepTimeoutMs(): number | undefined;
 /** How long a /v1 or /mcp request may run before the server answers 504, and a stdio MCP
  * request before its timeout error; 0 for no deadline; util/request-scope.ts holds the default. */
 export declare function envRequestDeadlineMs(): number | undefined;
-/** How many store calls may wait for one worker thread before the next is refused; store/sqlite/executor.ts holds the default. */
+/**
+ * How many store calls may wait for one worker thread before the next is refused; store/sqlite/executor.ts holds the
+ * default.
+ */
 export declare function envStoreQueueMax(): number | undefined;
 /** How long the daily runner lets one child `hippo` step run; cli/setup.ts holds the default. */
 export declare function envDailyStepTimeoutMs(): number | undefined;
 export declare function envApiKey(): string | undefined;
 export declare function envClientIpHeader(): string | undefined;
+/** The peers whose HIPPO_CLIENT_IP_HEADER is believed: IPs or CIDRs, or `*` for any peer. */
 export declare function envTrustedProxies(): string | undefined;
 /** Paths to the PEM certificate and key `hippo serve` answers HTTPS with; the --tls-cert and --tls-key flags win. */
 export declare function envTlsCert(): string | undefined;
@@ -75,7 +93,10 @@ export declare function envLlmTimeoutMs(): number | undefined;
 export declare function envTypesafeApiKey(): string | undefined;
 export declare function envJevTimeoutMs(): number | undefined;
 export declare function envJevModel(): string | undefined;
-/** How long a recall waits for an API provider to embed its query before ranking on BM25 alone; search/vector.ts holds the default. */
+/**
+ * How long a recall waits for an API provider to embed its query before ranking on BM25 alone; search/vector.ts holds
+ * the default.
+ */
 export declare function envQueryEmbedTimeoutMs(): number | undefined;
 export declare function envLlmRerankerUrl(): string | undefined;
 export declare function envLlmRerankerKey(): string | undefined;

package/dist/util/env.js

@@ -1,5 +1,6 @@
 // The one module in src/ that reads process.env; scripts/check-env-reads.mjs fails CI on any other read.
-// Accessors read at call time, so a test that sets a variable between cases, or a HIPPO_HOME switch mid-process, still holds.
+// Accessors read at call time, so a test that sets a variable between cases, or a HIPPO_HOME switch mid-process, still
+// holds.
 function raw(name) {
     return process.env[name];
 }
@@ -24,7 +25,10 @@ function nonNegativeInt(name) {
 function trimmed(name) {
     return raw(name)?.trim() || undefined;
 }
-/** The whole environment, for code that takes it as an injectable map (agent-memory machines, owner checks, support bundles). */
+/**
+ * The whole environment, for code that takes it as an injectable map (agent-memory machines, owner checks, support
+ * bundles).
+ */
 export function processEnv() {
     return process.env;
 }
@@ -64,6 +68,8 @@ export function envHippoHome() { return raw('HIPPO_HOME')?.trim(); }
 export function envXdgDataHome() { return raw('XDG_DATA_HOME')?.trim(); }
 export function envHomeDir() { return raw('HOME') || raw('USERPROFILE'); }
 export function envPath() { return raw('PATH'); }
+/** The extensions win32 tries on a bare command name, in order. */
+export function envPathExt() { return raw('PATHEXT'); }
 export function envModelCache() { return trimmed('HIPPO_MODEL_CACHE'); }
 // Session, scope and tenant.
 export function envHippoSessionId() { return trimmed('HIPPO_SESSION_ID'); }
@@ -91,12 +97,23 @@ export function envLogLevel() { return raw('HIPPO_LOG')?.trim().toLowerCase() ??
 export function envLogJson() { return raw('HIPPO_LOG_FORMAT')?.trim().toLowerCase() === 'json'; }
 // Server.
 export function envPort() { return raw('HIPPO_PORT'); }
-/** How long a client waits for a running server's /health before writing to the store directly; server-detect.ts holds the default. */
+/**
+ * How long a client waits for a running server's /health before writing to the store directly; server-detect.ts holds
+ * the default.
+ */
 export function envHealthProbeMs() { return positiveInt('HIPPO_HEALTH_PROBE_MS'); }
 export function envRequireAuth() { return isOne('HIPPO_REQUIRE_AUTH'); }
-/** `1` lets a request made on this machine in with no key, as host admin; HIPPO_REQUIRE_AUTH=1 wins over it. */
+/** `1` lets a request made on this machine in with no key; HIPPO_REQUIRE_AUTH=1 wins over it. */
 export function envAllowKeylessLocal() { return isOne('HIPPO_ALLOW_KEYLESS_LOCAL'); }
+/** The role a keyless local request gets: `admin` (host admin) only when asked for by name, else `member`. */
+export function envKeylessLocalRole() {
+    return trimmed('HIPPO_KEYLESS_LOCAL_ROLE')?.toLowerCase() === 'admin' ? 'admin' : 'member';
+}
+/** `1` lets a non-loopback bind start without TLS, for TLS that ends at a proxy in front. */
+export function envAllowCleartext() { return isOne('HIPPO_ALLOW_CLEARTEXT'); }
 export function envV1Rps() { return raw('HIPPO_V1_RPS'); }
+/** Requests per second each authenticated caller may make; `0` turns the per-caller limit off. */
+export function envCallerRps() { return trimmed('HIPPO_CALLER_RPS'); }
 /** How long a request body may take to arrive; http-util.ts holds the default. */
 export function envBodyTimeoutMs() { return positiveInt('HIPPO_BODY_TIMEOUT_MS'); }
 /** How long POST /v1/sleep lets its consolidation run; server/sleep-offload.ts holds the default. */
@@ -104,12 +121,16 @@ export function envSleepTimeoutMs() { return positiveInt('HIPPO_SLEEP_TIMEOUT_MS
 /** How long a /v1 or /mcp request may run before the server answers 504, and a stdio MCP
  * request before its timeout error; 0 for no deadline; util/request-scope.ts holds the default. */
 export function envRequestDeadlineMs() { return nonNegativeInt('HIPPO_REQUEST_DEADLINE_MS'); }
-/** How many store calls may wait for one worker thread before the next is refused; store/sqlite/executor.ts holds the default. */
+/**
+ * How many store calls may wait for one worker thread before the next is refused; store/sqlite/executor.ts holds the
+ * default.
+ */
 export function envStoreQueueMax() { return positiveInt('HIPPO_STORE_QUEUE_MAX'); }
 /** How long the daily runner lets one child `hippo` step run; cli/setup.ts holds the default. */
 export function envDailyStepTimeoutMs() { return positiveInt('HIPPO_DAILY_STEP_TIMEOUT_MS'); }
 export function envApiKey() { return raw('HIPPO_API_KEY'); }
 export function envClientIpHeader() { return raw('HIPPO_CLIENT_IP_HEADER')?.trim().toLowerCase(); }
+/** The peers whose HIPPO_CLIENT_IP_HEADER is believed: IPs or CIDRs, or `*` for any peer. */
 export function envTrustedProxies() { return raw('HIPPO_TRUSTED_PROXIES'); }
 /** Paths to the PEM certificate and key `hippo serve` answers HTTPS with; the --tls-cert and --tls-key flags win. */
 export function envTlsCert() { return trimmed('HIPPO_TLS_CERT'); }
@@ -123,25 +144,66 @@ export function envLlmTimeoutMs() { return positiveInt('HIPPO_LLM_TIMEOUT_MS');
 export function envTypesafeApiKey() { return trimmed('TYPESAFE_API_KEY'); }
 export function envJevTimeoutMs() { return positiveInt('HIPPO_JEV_TIMEOUT_MS'); }
 export function envJevModel() { return raw('HIPPO_JEV_MODEL'); }
-/** How long a recall waits for an API provider to embed its query before ranking on BM25 alone; search/vector.ts holds the default. */
-export function envQueryEmbedTimeoutMs() { return positiveInt('HIPPO_QUERY_EMBED_TIMEOUT_MS'); }
-export function envLlmRerankerUrl() { return raw('HIPPO_LLM_RERANKER_URL'); }
-export function envLlmRerankerKey() { return raw('HIPPO_LLM_RERANKER_KEY'); }
-export function envLlmRerankerModel() { return raw('HIPPO_LLM_RERANKER_MODEL'); }
-export function envLlmRerankerTimeoutMs() { return positiveInt('HIPPO_LLM_RERANKER_TIMEOUT_MS'); }
-export function envClefEndpoint() { return raw('HIPPO_CLEF_ENDPOINT')?.trim(); }
-export function envClefEndpointToken() { return raw('HIPPO_CLEF_ENDPOINT_TOKEN')?.trim() || undefined; }
-export function envClefTimeoutMs() { return raw('HIPPO_CLEF_TIMEOUT_MS'); }
-export function envCloudflareAccountId() { return raw('CLOUDFLARE_ACCOUNT_ID')?.trim() ?? ''; }
-export function envCloudflareApiToken() { return raw('CLOUDFLARE_API_TOKEN')?.trim() ?? ''; }
+/**
+ * How long a recall waits for an API provider to embed its query before ranking on BM25 alone; search/vector.ts holds
+ * the default.
+ */
+export function envQueryEmbedTimeoutMs() {
+    return positiveInt('HIPPO_QUERY_EMBED_TIMEOUT_MS');
+}
+export function envLlmRerankerUrl() {
+    return raw('HIPPO_LLM_RERANKER_URL');
+}
+export function envLlmRerankerKey() {
+    return raw('HIPPO_LLM_RERANKER_KEY');
+}
+export function envLlmRerankerModel() {
+    return raw('HIPPO_LLM_RERANKER_MODEL');
+}
+export function envLlmRerankerTimeoutMs() {
+    return positiveInt('HIPPO_LLM_RERANKER_TIMEOUT_MS');
+}
+export function envClefEndpoint() {
+    return raw('HIPPO_CLEF_ENDPOINT')?.trim();
+}
+export function envClefEndpointToken() {
+    return raw('HIPPO_CLEF_ENDPOINT_TOKEN')?.trim() || undefined;
+}
+export function envClefTimeoutMs() {
+    return raw('HIPPO_CLEF_TIMEOUT_MS');
+}
+export function envCloudflareAccountId() {
+    return raw('CLOUDFLARE_ACCOUNT_ID')?.trim() ?? '';
+}
+export function envCloudflareApiToken() {
+    return raw('CLOUDFLARE_API_TOKEN')?.trim() ?? '';
+}
 // Connectors.
-export function envSlackBotToken() { return raw('SLACK_BOT_TOKEN'); }
-export function envSlackTeamId() { return raw('SLACK_TEAM_ID'); }
-export function envSlackSigningSecret() { return raw('SLACK_SIGNING_SECRET'); }
-export function envSlackSigningSecretPrevious() { return raw('SLACK_SIGNING_SECRET_PREVIOUS'); }
-export function envSlackAllowUnknownTeamFallback() { return isOne('SLACK_ALLOW_UNKNOWN_TEAM_FALLBACK'); }
-export function envGitHubToken() { return raw('GITHUB_TOKEN'); }
-export function envGitHubWebhookSecret() { return raw('GITHUB_WEBHOOK_SECRET'); }
-export function envGitHubWebhookSecretPrevious() { return raw('GITHUB_WEBHOOK_SECRET_PREVIOUS'); }
-export function envGitHubAllowUnknownInstallationFallback() { return isOne('GITHUB_ALLOW_UNKNOWN_INSTALLATION_FALLBACK'); }
+export function envSlackBotToken() {
+    return raw('SLACK_BOT_TOKEN');
+}
+export function envSlackTeamId() {
+    return raw('SLACK_TEAM_ID');
+}
+export function envSlackSigningSecret() {
+    return raw('SLACK_SIGNING_SECRET');
+}
+export function envSlackSigningSecretPrevious() {
+    return raw('SLACK_SIGNING_SECRET_PREVIOUS');
+}
+export function envSlackAllowUnknownTeamFallback() {
+    return isOne('SLACK_ALLOW_UNKNOWN_TEAM_FALLBACK');
+}
+export function envGitHubToken() {
+    return raw('GITHUB_TOKEN');
+}
+export function envGitHubWebhookSecret() {
+    return raw('GITHUB_WEBHOOK_SECRET');
+}
+export function envGitHubWebhookSecretPrevious() {
+    return raw('GITHUB_WEBHOOK_SECRET_PREVIOUS');
+}
+export function envGitHubAllowUnknownInstallationFallback() {
+    return isOne('GITHUB_ALLOW_UNKNOWN_INSTALLATION_FALLBACK');
+}
 //# sourceMappingURL=env.js.map

package/dist/util/format.d.ts

@@ -1,3 +1,5 @@
 /** A 0..1 fraction as a percentage with one decimal, e.g. 0.256 -> "25.6%". */
 export declare function pct(fraction: number): string;
+/** Rounds to one decimal place. */
+export declare function round1(value: number): number;
 //# sourceMappingURL=format.d.ts.map

package/dist/util/format.js

@@ -3,4 +3,8 @@
 export function pct(fraction) {
     return (fraction * 100).toFixed(1) + '%';
 }
+/** Rounds to one decimal place. */
+export function round1(value) {
+    return Math.round(value * 10) / 10;
+}
 //# sourceMappingURL=format.js.map

package/dist/util/home-path.js

@@ -1,11 +1,14 @@
-// Home-directory paths name their user, so text bound for a shared store tests or masks them here; no imports keep it light.
+// Home-directory paths name their user, so text bound for a shared
+// store tests or masks them here; no imports keep it light.
 // VS Code writes file links URL-encoded, so a separator may be %5C or %2F.
 const WIN_SEP = String.raw `(?:[\\/]|%5[Cc]|%2[Ff])`;
 const WIN_CHAR = String.raw `(?:(?!%5[Cc]|%2[Ff])[^\\/:*?"<>|\s])`;
 // A Windows name never holds a quote, so JSON stops it; one with spaces runs to a separator, quote,
 // closing mark or line end, leaving the mark, as stopping at its first word leaks the surname.
-const WIN_USER = String.raw `(?:${WIN_CHAR}+(?: ${WIN_CHAR}+){0,3}(?=${WIN_SEP}|["'\`)\]>,;]|\.(?=\s|$)|(?<!\.)(?:[^\S ]|$))(?<![\`)\],;'])|${WIN_CHAR}+)`;
-// Slash-led homes with their case spelled out and no flag, so one pattern can hold all four: Git Bash and WSL mounts, Linux, root and macOS.
+const WIN_USER = String.raw `(?:${WIN_CHAR}+(?: ${WIN_CHAR}+){0,3}(?=${WIN_SEP}|["'\`)\]>,;]|\.(?=\s|$)|` +
+    String.raw `(?<!\.)(?:[^\S ]|$))(?<![\`)\],;'])|${WIN_CHAR}+)`;
+// Slash-led homes with their case spelled out and no flag, so one pattern can hold all four: Git Bash and WSL mounts,
+// Linux, root and macOS.
 const MOUNT_HOME = String.raw `(?:\/[Mm][Nn][Tt])?\/[A-Za-z]\/[Uu][Ss][Ee][Rr][Ss]\/${WIN_USER}`;
 const LINUX_HOME = String.raw `(?:\/var)?\/home\/[^/\s]+`;
 const ROOT_HOME = String.raw `(?:\/var)?\/root(?![\w.-])`;
@@ -35,8 +38,10 @@ const MASK = '[home]';
 // Global copies, so the shared test patterns keep their lastIndex at 0.
 const allOf = (re) => new RegExp(re.source, `${re.flags}g`);
 const [DRIVE_HOMES, LONG_PATHS, SHARE_HOMES, SHORT_NAMES] = [DRIVE_HOME, LONG_PATH, SHARE_HOME, SHORT_NAME].map(allOf);
-// A home glued after another starts where a mask will end, which no guard refuses: one match takes the whole run, as masking one a pass costs a pass per home.
-// A run holds only shapes whose own step is not still to come, so a later step meets the same text it would without the run.
+// A home glued after another starts where a mask will end, which no guard
+// refuses: one match takes the whole run, as masking one a pass costs a
+// pass per home. A run holds only shapes whose own step is not still to
+// come, so a later step meets the same text it would without the run.
 const runFrom = (start, ...glued) => new RegExp(`${start}(?:${glued.join('|')})*`, 'g');
 const MOUNT_RUNS = runFrom(MOUNT_START, MOUNT_HOME);
 const LINUX_RUNS = runFrom(LINUX_START, MOUNT_HOME, LINUX_HOME);
@@ -59,7 +64,8 @@ function maskOnce(text) {
 export function maskHomePaths(text) {
     let out = text;
     let next = maskOnce(out);
-    // A mask can uncover a home path its text was hiding, so passes repeat until one changes nothing; each takes a separator out, so they end.
+    // A mask can uncover a home path its text was hiding, so passes repeat until one changes nothing; each takes a
+    // separator out, so they end.
     while (next !== out) {
         out = next;
         next = maskOnce(out);

package/dist/util/hook-payload.d.ts

@@ -2,7 +2,9 @@
 export declare function hookPayloadSessionId(stdinText: string | undefined, requiredSource?: string | null): string | null;
 /** A hook payload's string `field` as sent, or null when the payload or the field is missing or not a string. */
 export declare function hookPayloadString(stdinText: string | undefined, field: string): string | null;
-/** Whether a hook fired inside a sub-agent, the only payload with `agent_id` (https://code.claude.com/docs/en/hooks#common-input-fields).
+/**
+ * Whether a hook fired inside a sub-agent, the only payload with `agent_id`
+ * (https://code.claude.com/docs/en/hooks#common-input-fields).
  *  Its `session_id` is the parent's, so a sub-agent's blocks and compactions must not count as the parent's. */
 export declare function isSubagentPayload(stdinText: string | undefined): boolean;
 //# sourceMappingURL=hook-payload.d.ts.map

package/dist/util/hook-payload.js

@@ -28,7 +28,9 @@ export function hookPayloadString(stdinText, field) {
     const value = parseHookPayload(stdinText)?.[field];
     return isJsonString(value) ? value : null;
 }
-/** Whether a hook fired inside a sub-agent, the only payload with `agent_id` (https://code.claude.com/docs/en/hooks#common-input-fields).
+/**
+ * Whether a hook fired inside a sub-agent, the only payload with `agent_id`
+ * (https://code.claude.com/docs/en/hooks#common-input-fields).
  *  Its `session_id` is the parent's, so a sub-agent's blocks and compactions must not count as the parent's. */
 export function isSubagentPayload(stdinText) {
     const agentId = parseHookPayload(stdinText)?.agent_id;

package/dist/util/http-retry.d.ts

@@ -1,17 +1,20 @@
-/** One retry policy for outbound HTTP: a timeout on every attempt, backoff on 429 and 5xx, and on a dropped connection where a replay is safe. */
+/** One retry policy for outbound HTTP: a timeout on every attempt, backoff on 429 and 5xx, and on a dropped
+ * connection where a replay is safe. */
 export interface RetryPolicy {
     /** Per-attempt limit; a stalled peer ends as a thrown `TimeoutError`, never a hang. */
     timeoutMs: number;
     /** Total attempts including the first. */
     attempts?: number;
-    /** Limit on the whole call, waits included: an attempt is cut short at it and no retry starts whose wait would reach it. */
+    /** Limit on the whole call, waits included: an attempt is cut short at it and no retry starts whose wait would
+     * reach it. */
     totalMs?: number;
     baseDelayMs?: number;
     /** A Retry-After longer than this hands the response back, so a caller with its own long pause keeps it. */
     maxDelayMs?: number;
     /** Which responses to retry; defaults to 429 and 5xx. A write narrows it to answers that prove nothing committed. */
     retryOn?: (res: Response) => boolean;
-    /** Also retry a dropped connection or a timed-out attempt. On for GET and HEAD; any other method turns it on only when a replay cannot commit twice. */
+    /** Also retry a dropped connection or a timed-out attempt. On for GET and HEAD; any other method turns it on only
+     * when a replay cannot commit twice. */
     retryTransport?: boolean;
     fetchFn?: typeof fetch;
     /** Replaces the timer between attempts. A caller `signal` that aborts still ends the wait at once. */
@@ -20,14 +23,17 @@ export interface RetryPolicy {
     /** Replaces the clock `totalMs` is measured on. */
     now?: () => number;
 }
-/** LLM calls (consolidation refine, DAG summaries, fact extraction) share one budget; `HIPPO_LLM_TIMEOUT_MS` overrides it. */
+/** LLM calls (consolidation refine, DAG summaries, fact extraction) share one budget; `HIPPO_LLM_TIMEOUT_MS`
+ * overrides it. */
 export declare function llmTimeoutMs(): number;
-/** One LLM call with its retries: two full attempts and the longest wait between them, where three slow failures would hold a sleep for 3x the timeout. */
+/** One LLM call with its retries: two full attempts and the longest wait between them, where three slow failures
+ * would hold a sleep for 3x the timeout. */
 export declare function llmTotalMs(): number;
 export declare function isRetryableStatus(status: number): boolean;
 /** Retry-After as milliseconds: delta-seconds or an HTTP date; null when absent or unreadable. */
 export declare function parseRetryAfterMs(header: string | null, now?: number): number | null;
-/** A dropped connection, a DNS hiccup or a timed-out attempt: faults a second try can clear. A refused connection is not one. */
+/** A dropped connection, a DNS hiccup or a timed-out attempt: faults a second try can clear. A refused connection is
+ * not one. */
 export declare function isTransientTransportError<E>(err: E): boolean;
 /** `fetch` with a per-attempt timeout and up to `attempts` tries on 429, 5xx and (see
  * `retryTransport`) transport faults; the last response or error comes back as is. */

package/dist/util/http-retry.js

@@ -1,4 +1,5 @@
-/** One retry policy for outbound HTTP: a timeout on every attempt, backoff on 429 and 5xx, and on a dropped connection where a replay is safe. */
+/** One retry policy for outbound HTTP: a timeout on every attempt, backoff on 429 and 5xx, and on a dropped
+ * connection where a replay is safe. */
 import { MINUTE_MS } from './time.js';
 import { envLlmTimeoutMs } from './env.js';
 import { errorCode, errorFields, log } from './log.js';
@@ -6,11 +7,13 @@ const DEFAULT_ATTEMPTS = 3;
 const DEFAULT_BASE_DELAY_MS = 250;
 const DEFAULT_MAX_DELAY_MS = 8_000;
 const DEFAULT_LLM_TIMEOUT_MS = MINUTE_MS;
-/** LLM calls (consolidation refine, DAG summaries, fact extraction) share one budget; `HIPPO_LLM_TIMEOUT_MS` overrides it. */
+/** LLM calls (consolidation refine, DAG summaries, fact extraction) share one budget; `HIPPO_LLM_TIMEOUT_MS`
+ * overrides it. */
 export function llmTimeoutMs() {
     return envLlmTimeoutMs() ?? DEFAULT_LLM_TIMEOUT_MS;
 }
-/** One LLM call with its retries: two full attempts and the longest wait between them, where three slow failures would hold a sleep for 3x the timeout. */
+/** One LLM call with its retries: two full attempts and the longest wait between them, where three slow failures
+ * would hold a sleep for 3x the timeout. */
 export function llmTotalMs() {
     return 2 * llmTimeoutMs() + DEFAULT_MAX_DELAY_MS;
 }
@@ -31,7 +34,8 @@ export function parseRetryAfterMs(header, now = Date.now()) {
 const TRANSIENT_CODES = new Set([
     'ECONNRESET', 'ETIMEDOUT', 'EAI_AGAIN', 'UND_ERR_SOCKET', 'UND_ERR_CONNECT_TIMEOUT', 'UND_ERR_HEADERS_TIMEOUT',
 ]);
-/** A dropped connection, a DNS hiccup or a timed-out attempt: faults a second try can clear. A refused connection is not one. */
+/** A dropped connection, a DNS hiccup or a timed-out attempt: faults a second try can clear. A refused connection is
+ * not one. */
 export function isTransientTransportError(err) {
     if (!(err instanceof Error))
         return false;
@@ -58,7 +62,11 @@ function redactedTarget(url) {
 function logRetry(init, url, reason, attempt, attempts, delayMs) {
     // Debug: an attempt that may still succeed is not a warning, and the caller reports the final failure.
     log.debug('http retry', {
-        method: (init.method ?? 'GET').toUpperCase(), target: redactedTarget(url), reason, attempt: `${attempt}/${attempts}`, delayMs: Math.round(delayMs),
+        method: (init.method ?? 'GET').toUpperCase(),
+        target: redactedTarget(url),
+        reason,
+        attempt: `${attempt}/${attempts}`,
+        delayMs: Math.round(delayMs),
     });
 }
 // `cancel` clears the timer, so a wait the caller left does not keep the process alive.
@@ -66,7 +74,8 @@ const timerSleep = (ms, cancel) => new Promise((resolve) => {
     const timer = setTimeout(resolve, ms);
     cancel?.addEventListener('abort', () => clearTimeout(timer), { once: true });
 });
-/** The wait between attempts. With a caller signal it ends the moment that signal aborts and rejects with its reason, so no further attempt starts. */
+/** The wait between attempts. With a caller signal it ends the moment that signal aborts and rejects with its
+ * reason, so no further attempt starts. */
 async function backoffWait(ms, sleep, signal) {
     if (!signal)
         return (sleep ?? timerSleep)(ms);
@@ -132,6 +141,7 @@ export async function fetchWithRetry(url, init, policy) {
             await res.body?.cancel();
         }
         catch (err) {
+            // Best-effort: the response is spent either way, so a failed cancel only leaves the socket to idle out.
             log.debug('http retry: body cancel failed', errorFields(err));
         }
         logRetry(init, url, `status ${res.status}`, attempt, attempts, delay);

package/dist/util/http-util.d.ts

@@ -10,7 +10,10 @@ export declare class HttpError extends Error {
     readonly retryAfterSec: number | undefined;
     constructor(status: number, message: string, retryAfterSec?: number);
 }
-/** A request, or a store call it waited on, ran past the request's deadline; the reply carries `code` so a client branches without parsing prose. */
+/**
+ * A request, or a store call it waited on, ran past the request's deadline; the reply carries `code` so a client
+ * branches without parsing prose.
+ */
 export declare class DeadlineExceededError extends HttpError {
     readonly code = "deadline_exceeded";
     constructor(message: string);
@@ -25,7 +28,10 @@ export declare const INTERNAL_ERROR_MESSAGE = "internal server error";
 export declare const STORE_NOT_PORTED_MESSAGE = "store_not_ported";
 /** Serialises before the head goes out, so a body that is not JSON still reaches the caller's error reply. */
 export declare function sendJson<T>(res: ServerResponse, status: number, body: T): void;
-/** How long any route waits for a request body, so a client that sends headers and then stalls cannot hold a request open: 30 s, or HIPPO_BODY_TIMEOUT_MS. */
+/**
+ * How long any route waits for a request body, so a client that sends headers and then stalls cannot hold a request
+ * open: 30 s, or HIPPO_BODY_TIMEOUT_MS.
+ */
 export declare function bodyDeadlineMs(): number;
 export interface ReadBodyOpts {
     /** Defaults to 1 MB. */
@@ -33,7 +39,10 @@ export interface ReadBodyOpts {
     /** Fails with BodyTimeoutError when the whole body has not arrived by then; defaults to bodyDeadlineMs(). */
     deadlineMs?: number;
 }
-/** The body as text, refused mid-stream past maxBytes and past deadlineMs, so an oversized or slow sender cannot tie up the server. */
+/**
+ * The body as text, refused mid-stream past maxBytes and past deadlineMs, so an oversized or slow sender cannot tie up
+ * the server.
+ */
 export declare function readBody(req: IncomingMessage, { maxBytes, deadlineMs }?: ReadBodyOpts): Promise<string>;
 export declare function closeAfterReply(req: IncomingMessage): void;
 export declare const LOOPBACK_HOST_HEADER: RegExp;
@@ -48,8 +57,14 @@ export interface WebhookRequest {
         webhookBodyDeadlineMs?: number;
     };
 }
-/** Call before refusing a webhook unread: a caller still sending its body loses the socket once the reply is out, as it does after a 413. */
+/**
+ * Call before refusing a webhook unread: a caller still sending its body loses the socket once the reply is out, as it
+ * does after a 413.
+ */
 export declare function closeIfBodyUnread({ req, res }: WebhookRequest): void;
-/** A webhook's raw body, exactly as sent, for the receiver's HMAC check; call it only once a secret is configured and the signature headers are present. */
+/**
+ * A webhook's raw body, exactly as sent, for the receiver's HMAC check; call it only once a secret is configured and
+ * the signature headers are present.
+ */
 export declare function readWebhookBody({ req, opts }: WebhookRequest): Promise<string>;
 //# sourceMappingURL=http-util.d.ts.map