hippo-memory 2.0.0 → 2.1.0

package/dist/api/tokens.js

@@ -1,13 +1,12 @@
 // Token-use and failure reports.
 import { rethrowIfSqliteBlocked } from '../util/sqlite-blocked.js';
-import { storeFor } from '../store/sqlite/store.js';
-import { failureLogSummary, tokenUseSummary } from '../store/usage-reports.js';
-import { errorMessage, log } from '../util/log.js';
+import { errorMessage, log, errorFields } from '../util/log.js';
 import { DAY_MS } from '../util/time.js';
-/** Records memory text handed to an agent in the token ledger. Best-effort: never throws, since a ledger failure must not fail the recall or context call. */
+/** Records memory text handed to an agent in the token ledger. Best-effort: never throws, since a ledger failure must
+ * not fail the recall or context call. */
 export async function recordTokens(ctx, surface, use) {
     try {
-        await storeFor(ctx).recordTokens({
+        await ctx.store.recordTokens({
             tenantId: ctx.tenantId,
             sessionId: use.sessionId ?? null,
             surface,
@@ -18,17 +17,17 @@ export async function recordTokens(ctx, surface, use) {
     }
     catch (err) {
         rethrowIfSqliteBlocked(err);
-        log.warnThenDebug('api-token-ledger', `token ledger write failed; the reply is unaffected: ${errorMessage(err)}`);
+        log.warnThenDebug('api-token-ledger', `token ledger write failed; the reply is unaffected: ${errorMessage(err)}`, errorFields(err));
     }
 }
-/** Token ledger totals for the tenant over the last `days` days (default 30): tokens sent, skipped as unchanged and re-read,
- * per surface, with session counts and mean tokens per session. */
+/** Token ledger totals for the tenant over the last `days` days (default 30): tokens sent, skipped as unchanged and
+ * re-read, per surface, with session counts and mean tokens per session. */
 export function tokenSummary(ctx, opts = {}) {
-    return tokenUseSummary(ctx.hippoRoot, ctx.tenantId, reportWindowStart(opts.days));
+    return ctx.store.reports.tokenUse(ctx.tenantId, reportWindowStart(opts.days));
 }
 /** Failed tool calls by outcome, and repeats across sessions, over the last `days` days (default 30). */
 export function failureSummary(ctx, opts = {}) {
-    return failureLogSummary(ctx.hippoRoot, ctx.tenantId, reportWindowStart(opts.days));
+    return ctx.store.reports.failures(ctx.tenantId, reportWindowStart(opts.days));
 }
 function reportWindowStart(days) {
     const span = days !== undefined && Number.isFinite(days) && days > 0 ? days : 30;

package/dist/api/types.d.ts

@@ -1,6 +1,9 @@
 import { BadRequestError } from '../core/api-errors.js';
-import type { HippoStore } from '../store/index.js';
-/** Actor identity + role for a Context: the audit-log subject (pass `ctx.actor.subject` to audit helpers) and the role for admin gating.
+import { type HippoStore, type StoreGroup, type StoreWith } from '../store/index.js';
+import type { HippoConfig } from '../core/config.js';
+import type { StoreReach } from '../store/port.js';
+/** Actor identity + role for a Context: the audit-log subject (pass `ctx.actor.subject` to audit helpers) and the role
+ *  for admin gating.
  * Role checks happen at the request boundary (e.g. /v1/sleep), except in authCreate and authRevoke (ForbiddenError). */
 export interface Actor {
     /** 'cli' | 'localhost:cli' | 'api_key:<key_id>' | 'mcp' | 'connector:slack' | 'connector:github' */
@@ -10,7 +13,8 @@ export interface Actor {
     scopes?: readonly string[];
     /** An auth resolver vouched for this caller, so its admin role stops at its own tenant. */
     viaAuthResolver?: true;
-    /** The host's operator (CLI, stdio MCP, keyless loopback set to admin, host-tenant admin key): may act beyond its tenant. */
+    /** The host's operator (CLI, stdio MCP, keyless loopback set to
+     * admin, host-tenant admin key): may act beyond its tenant. */
     hostAdmin?: true;
     owner?: string;
 }
@@ -19,19 +23,36 @@ export interface Context {
     tenantId: string;
     actor: Actor;
     store?: HippoStore;
+    /** Set by a composition root. Absent, the api reads one project and no global store, as for an integrator's store. */
+    reach?: StoreReach;
+    /** Set by a composition root per command or request; absent, the api reads the store's config.json. */
+    config?: HippoConfig;
 }
 export type HippoDbContext = Context & {
     store?: undefined;
 };
-/** Builds process-local Actor values (admin and host admin) for CLI and CLI-run connector Contexts; Bearer-authed callers build Actor from the api_keys row
- * instead. */
+/** A Context whose store a composition root already built; every
+ * api function that reads or writes the store takes this. */
+export type StoreContext = Context & {
+    readonly store: HippoStore;
+};
+/** A Context whose store a gate proved holds `G`; the api function reads `ctx.store.<group>` directly. */
+export type ContextWith<G extends StoreGroup> = Context & {
+    readonly store: StoreWith<G>;
+};
+/** `ctx` itself once its store proves every group, so a gate hands a handler the type with no copy; throws
+ * StoreNotPortedError for the first missing one. */
+export declare function narrowContext<G extends StoreGroup>(ctx: StoreContext, ...groups: readonly [G, ...G[]]): ContextWith<G>;
+/** Builds process-local Actor values (admin and host admin) for CLI and CLI-run connector Contexts; Bearer-authed
+ * callers build Actor from the api_keys row instead. */
 export declare function adminActor(subject: string): Actor;
 /** Throws unless the caller is the host's operator: `action` reaches past the caller's tenant. */
 export declare function requireHostAdmin(ctx: Context, action: string): void;
 /** The per-person key: an unowned key gets its own bucket by key id rather than sharing one. */
 export declare function ownerOrSubject(actor: Actor): string;
-/** Thrown by `api.recall` on a contract violation; the stable `code` lets callers discriminate without parsing the message.
- * 'fresh_tail_requires_session_id' (needs HIPPO_REQUIRE_SESSION_SCOPED_FRESH_TAIL=1) or 'invalid_scorer_window' (0 would hit an uncapped fallback). */
+/** Thrown by `api.recall` on a contract violation; the stable `code` lets callers discriminate without parsing the
+ * message. 'fresh_tail_requires_session_id' (needs HIPPO_REQUIRE_SESSION_SCOPED_FRESH_TAIL=1) or
+ * 'invalid_scorer_window' (0 would hit an uncapped fallback). */
 export declare class RecallContractError extends BadRequestError {
     readonly code: 'fresh_tail_requires_session_id' | 'invalid_scorer_window';
     constructor(code: 'fresh_tail_requires_session_id' | 'invalid_scorer_window', message: string);

package/dist/api/types.js

@@ -1,7 +1,15 @@
 // Request context (caller identity and tenant) shared by every API module, plus the recall contract error.
 import { BadRequestError, ForbiddenError } from '../core/api-errors.js';
-/** Builds process-local Actor values (admin and host admin) for CLI and CLI-run connector Contexts; Bearer-authed callers build Actor from the api_keys row
- * instead. */
+import { narrowStore } from '../store/index.js';
+/** `ctx` itself once its store proves every group, so a gate hands a handler the type with no copy; throws
+ * StoreNotPortedError for the first missing one. */
+export function narrowContext(ctx, ...groups) {
+    narrowStore(ctx.store, ...groups);
+    // SAFETY: narrowStore above proved every group on ctx.store.
+    return ctx;
+}
+/** Builds process-local Actor values (admin and host admin) for CLI and CLI-run connector Contexts; Bearer-authed
+ * callers build Actor from the api_keys row instead. */
 export function adminActor(subject) {
     return { subject, role: 'admin', hostAdmin: true };
 }
@@ -14,8 +22,9 @@ export function requireHostAdmin(ctx, action) {
 export function ownerOrSubject(actor) {
     return actor.owner ?? actor.subject;
 }
-/** Thrown by `api.recall` on a contract violation; the stable `code` lets callers discriminate without parsing the message.
- * 'fresh_tail_requires_session_id' (needs HIPPO_REQUIRE_SESSION_SCOPED_FRESH_TAIL=1) or 'invalid_scorer_window' (0 would hit an uncapped fallback). */
+/** Thrown by `api.recall` on a contract violation; the stable `code` lets callers discriminate without parsing the
+ * message. 'fresh_tail_requires_session_id' (needs HIPPO_REQUIRE_SESSION_SCOPED_FRESH_TAIL=1) or
+ * 'invalid_scorer_window' (0 would hit an uncapped fallback). */
 export class RecallContractError extends BadRequestError {
     code;
     constructor(code, message) {

package/dist/capture/caller-session.d.ts

@@ -2,11 +2,17 @@ import { type Context } from '../api/types.js';
 import { type CallerProject } from '../api/prompt-hook.js';
 import type { ContinuityKey } from '../store/sessions.js';
 import { type WorkingState } from './working-state.js';
-/** Checks the ids, then binds the session to the caller's owner (a ConflictError when another owner holds it). Returns the key the call's rows go under. */
+/**
+ * Checks the ids, then binds the session to the caller's owner (a ConflictError when another owner holds it). Returns
+ * the key the call's rows go under.
+ */
 export declare function bindCaller(ctx: Context, sessionId: string, project: CallerProject): ContinuityKey;
 /** Read only: the session's first prompt booked its arm, and a holdout session gets nothing from hippo. */
 export declare function callerInHoldout(ctx: Context, sessionId: string): boolean;
-/** Refuses a field past the cap a transcript read gives, naming it; scrubbed again, since the caller's scrub is not trusted, then cut back to the cap. */
+/**
+ * Refuses a field past the cap a transcript read gives, naming it; scrubbed again, since the caller's scrub is not
+ * trusted, then cut back to the cap.
+ */
 export declare function checkedWorkingState(state: WorkingState | null): WorkingState | null;
 export declare function assertTrigger(trigger: string | null): void;
 export declare function assertRequestId(requestId: string): void;

package/dist/capture/caller-session.js

@@ -1,14 +1,19 @@
-// The checks every caller call shares: ids, project, the session's owner and the pilot arm, all from the request, never the server's env or folder.
+// The checks every caller call shares: ids, project, the session's owner and the pilot arm, all from the request, never
+// the server's env or folder.
 import { BadRequestError } from '../core/api-errors.js';
 import { ownerOrSubject } from '../api/types.js';
 import { MAX_ID_LEN } from '../util/limits.js';
 import { sessionPilotArm } from '../api/pilot-arm.js';
+import { ledgerReachOf } from '../api/ledger-db.js';
 import { assertCallerIds } from '../api/prompt-hook.js';
 import { assertCallerProject, projectNames } from '../core/project-identity.js';
 import { maskEmails, redactSecretsStrict } from '../util/secret-detect.js';
-import { bindSessionOwner } from '../api/session-owners.js';
+import { bindSessionOwner } from '../api/auth/session-owners.js';
 import { fitWorkingState, WORKING_STATE_CAPS } from './working-state.js';
-/** Checks the ids, then binds the session to the caller's owner (a ConflictError when another owner holds it). Returns the key the call's rows go under. */
+/**
+ * Checks the ids, then binds the session to the caller's owner (a ConflictError when another owner holds it). Returns
+ * the key the call's rows go under.
+ */
 export function bindCaller(ctx, sessionId, project) {
     assertCallerIds(sessionId, project);
     if (sessionId.trim() === '')
@@ -20,9 +25,13 @@ export function bindCaller(ctx, sessionId, project) {
 }
 /** Read only: the session's first prompt booked its arm, and a holdout session gets nothing from hippo. */
 export function callerInHoldout(ctx, sessionId) {
-    return sessionPilotArm(ctx.hippoRoot, ctx.tenantId, sessionId, false, { sharedStore: true, ownTenantOnly: true }) === 'holdout';
+    const reach = ledgerReachOf(ctx, true);
+    return sessionPilotArm(ctx.hippoRoot, ctx.tenantId, sessionId, false, { reach, ownTenantOnly: true }) === 'holdout';
 }
-/** Refuses a field past the cap a transcript read gives, naming it; scrubbed again, since the caller's scrub is not trusted, then cut back to the cap. */
+/**
+ * Refuses a field past the cap a transcript read gives, naming it; scrubbed again, since the caller's scrub is not
+ * trusted, then cut back to the cap.
+ */
 export function checkedWorkingState(state) {
     if (state === null)
         return null;
@@ -35,8 +44,9 @@ export function checkedWorkingState(state) {
     return fitWorkingState({ task: scrub(state.task), summary: scrub(state.summary), next_step: scrub(state.next_step) });
 }
 export function assertTrigger(trigger) {
-    if (trigger !== null && trigger.length > MAX_ID_LEN)
+    if (trigger !== null && trigger.length > MAX_ID_LEN) {
         throw new BadRequestError(`trigger: at most ${MAX_ID_LEN} characters`);
+    }
 }
 export function assertRequestId(requestId) {
     if (requestId.trim() === '')

package/dist/capture/capture-error.d.ts

@@ -1,6 +1,8 @@
 import type { CaptureErrorOutcome } from '../store/failure-log.js';
 import type { JsonValue } from '../util/json.js';
-/** Store a failure as an error memory unless it is routine or a repeat, and log it either way, even when storing throws. */
+/**
+ * Store a failure as an error memory unless it is routine or a repeat, and log it either way, even when storing throws.
+ */
 export declare function captureToolFailure(hippoRoot: string, tenantId: string, payload: JsonValue, onLogged?: (failureId: number | null) => void): CaptureErrorOutcome;
 /** Who sent a failure from another machine: the audit actor and the project its lesson and repeat check belong to. */
 export interface LessonCaller {

package/dist/capture/capture-error.js

@@ -7,7 +7,9 @@ import { loadContentsWithTag } from '../store/entry-reads.js';
 import { loadConfig } from '../core/config.js';
 import { recordFailureAt } from '../store/failure-log-at.js';
 import { failureHash, failureSignature, lessonFromFailure, payloadString, } from './failure-reading.js';
-/** Store a failure as an error memory unless it is routine or a repeat, and log it either way, even when storing throws. */
+/**
+ * Store a failure as an error memory unless it is routine or a repeat, and log it either way, even when storing throws.
+ */
 export function captureToolFailure(hippoRoot, tenantId, payload, onLogged) {
     const lesson = lessonFromFailure(payload);
     let outcome = 'store-failed';

package/dist/capture/codex-patch.js

@@ -40,9 +40,14 @@ const HEREDOC = new RegExp(String.raw `^\s*(?:cd\s+(?<cd>'[^']*'|"[^"]*"|[^\s'"&
     String.raw `(?<body>[\s\S]*?)\r?\n\s*\k<tag>\s*$`);
 /** The script a shell argv runs, for the shells Codex checks for an apply_patch heredoc. */
 function shellScript(argv) {
-    const exe = path.basename(argv[0] ?? '').toLowerCase().replace(/\.exe$/, '');
-    if ((exe === 'bash' || exe === 'zsh' || exe === 'sh') && argv.length === 3 && (argv[1] === '-lc' || argv[1] === '-c'))
+    const exe = path
+        .basename(argv[0] ?? '')
+        .toLowerCase()
+        .replace(/\.exe$/, '');
+    const isPosixShell = exe === 'bash' || exe === 'zsh' || exe === 'sh';
+    if (isPosixShell && argv.length === 3 && (argv[1] === '-lc' || argv[1] === '-c')) {
         return argv[2];
+    }
     if (exe === 'pwsh' || exe === 'powershell') {
         const rest = argv.slice(1).filter((a) => a.toLowerCase() !== '-noprofile');
         if (rest.length === 2 && rest[0].toLowerCase() === '-command')

package/dist/capture/command.d.ts

@@ -12,12 +12,14 @@ export interface CaptureOptions {
     stdinText?: string;
     stdinTimedOut?: boolean;
     sessionTurns?: readonly SessionTurn[];
-    /** Tee stdout/stderr to this log file while capture runs, so SessionEnd output (lost in TUI teardown) shows via `hippo last-sleep`.
+    /** Tee stdout/stderr to this log file while capture runs, so SessionEnd output (lost in TUI teardown) shows via
+     *  `hippo last-sleep`.
      *  Appends, because `hippo sleep` writes the same file first. */
     logFile?: string;
     dryRun: boolean;
     global: boolean;
-    /** Tenant scope for the dedup read in `cmdCaptureCore`: when set and `global` is false, only this tenant's memories count.
+    /** Tenant scope for the dedup read in `cmdCaptureCore`: when set and `global` is false, only this tenant's
+     *  memories count.
      *  Undefined means host-wide dedup; ignored when `global: true`. */
     tenantId?: string;
     /** The session's project: rows are stamped with its id, and dedup reads its rows under either name. */

package/dist/capture/command.js

@@ -10,12 +10,13 @@ import { maskEmails, redactSecretsStrict } from '../util/secret-detect.js';
 import { withRejectionProbe } from '../store/rejection-probe.js';
 import { loadConfig } from '../core/config.js';
 import { classifyOriginProject, projectId, isInitialized } from '../core/project-identity.js';
-import { errorMessage, log } from '../util/log.js';
+import { errorMessage, log, errorFields } from '../util/log.js';
 import { teeStdStreams } from '../util/stream-tee.js';
 import { extractFromTexts } from './extract.js';
 import { collectSessionTurns, sessionTail, resolveLastSessionTranscript } from './transcript.js';
 export function cmdCapture(hippoRoot, options) {
-    // Tee to a log file for the SessionEnd hook; APPEND, because `hippo sleep` runs first in that sequence and already wrote its header and body.
+    // Tee to a log file for the SessionEnd hook; APPEND, because `hippo sleep` runs first in that sequence and already
+    // wrote its header and body.
     const restoreStdio = options.logFile ? beginLogTee(options.logFile) : null;
     try {
         cmdCaptureCore(hippoRoot, options);
@@ -45,7 +46,7 @@ function writeLogBanner(logFile) {
         fs.appendFileSync(logFile, `[hippo] ${new Date().toISOString()} capturing session...\n`, 'utf8');
     }
     catch (err) {
-        log.warn(`could not open log file ${logFile}: ${errorMessage(err)}`);
+        log.warn(`could not open log file ${logFile}: ${errorMessage(err)}`, errorFields(err));
         return false;
     }
     return true;
@@ -59,8 +60,11 @@ function cmdCaptureCore(hippoRoot, options) {
     }
     else {
         if (!isInitialized(hippoRoot)) {
-            console.error(`No hippo store at ${hippoRoot} (searched ${process.cwd()} and its parents up to your home directory). Run \`hippo init\` first.`);
-            process.exit(1);
+            console.error(`No hippo store at ${hippoRoot} (searched ${process.cwd()} and its parents up to your home directory). ` +
+                `Run \`hippo init\` first.`);
+            // Set, not exit, so cmdCapture's finally restores the tee'd stdio.
+            process.exitCode = 1;
+            return;
         }
     }
     const read = readCaptureTexts(options);
@@ -71,7 +75,8 @@ function cmdCaptureCore(hippoRoot, options) {
         console.log('No text to capture from.');
         return;
     }
-    // Scrub once here, as the snapshot fields are: every source can carry a pasted token (AGENTS.md: no secrets in memories).
+    // Scrub once here, as the snapshot fields are: every source can
+    // carry a pasted token (AGENTS.md: no secrets in memories).
     const extracted = extractFromTexts(texts.map((text) => maskEmails(redactSecretsStrict(text))), userTexts);
     if (extracted.length === 0) {
         console.log('No actionable items found in the input.');
@@ -86,7 +91,8 @@ function cmdCaptureCore(hippoRoot, options) {
     };
     printCaptureTally(options, captureExtractedItems(targetRoot, writeOpts, extracted, keys));
 }
-// Dedup only against rows this capture's reader sees: another tenant's or project's rows are hidden, so they must not stop its own copy.
+// Dedup only against rows this capture's reader sees: another tenant's or project's rows are hidden, so they must not
+// stop its own copy.
 // Only a row holding an item's longest word can hold that item, so the store returns those rows and no others.
 function storedKeysInView(targetRoot, options, extracted) {
     const stored = loadTextsHoldingWords(targetRoot, options.global ? undefined : options.tenantId, extracted.map((item) => longestWord(item.content)), undefined, EVERY_SCOPE);
@@ -102,7 +108,8 @@ function printCaptureTally(options, { captured, skipped, rejected }) {
         (rejected > 0 ? `, ${rejected} rejected` : '') +
         ')');
 }
-/** The raw texts for the chosen source, one per session turn, the person's turns first; null after printing why a last-session capture has nothing.
+/** The raw texts for the chosen source, one per session turn, the person's turns first; null after printing why a
+ *  last-session capture has nothing.
  *  Only a session says who spoke, so a piped or file capture counts no user texts. */
 function readCaptureTexts(options) {
     switch (options.source) {
@@ -112,17 +119,20 @@ function readCaptureTexts(options) {
             }
             catch {
                 console.error('No input on stdin. Pipe text in or use --file <path>.');
-                process.exit(1);
+                process.exitCode = 1;
+                return null;
             }
         }
         case 'file': {
             if (!options.filePath) {
                 console.error('Missing file path. Usage: hippo capture --file <path>');
-                process.exit(1);
+                process.exitCode = 1;
+                return null;
             }
             if (!fs.existsSync(options.filePath)) {
                 console.error(`File not found: ${options.filePath}`);
-                process.exit(1);
+                process.exitCode = 1;
+                return null;
             }
             return { texts: [fs.readFileSync(options.filePath, 'utf8')], userTexts: 0 };
         }
@@ -149,7 +159,14 @@ export function captureExtractedItems(targetRoot, options, extracted, keys) {
     const tally = { captured: 0, skipped: 0, rejected: 0 };
     const baseHalfLifeDays = loadConfig(targetRoot).defaultHalfLifeDays;
     if (!options.dryRun) {
-        const outcomes = writeCapturedItems(targetRoot, extracted.map((item) => ({ content: item.content, makeEntry: () => captureEntry(item, options, baseHalfLifeDays) })), keys, { actor: options.actor, lean: options.lean, onCaptured: options.lean ? undefined : (entry) => void embedMemory(targetRoot, entry) });
+        const outcomes = writeCapturedItems(targetRoot, extracted.map((item) => ({
+            content: item.content,
+            makeEntry: () => captureEntry(item, options, baseHalfLifeDays),
+        })), keys, {
+            actor: options.actor,
+            lean: options.lean,
+            onCaptured: options.lean ? undefined : (entry) => void embedMemory(targetRoot, entry),
+        });
         for (const outcome of outcomes)
             tally[outcome]++;
         return tally;
@@ -187,9 +204,11 @@ function captureEntry(item, options, baseHalfLifeDays) {
         confidence: 'observed',
         pinned: item.fromUser === true && item.category === 'rule',
         tenantId: options.tenantId,
-        source_session_id: options.sessionId,
+        sourceSessionId: options.sessionId,
         baseHalfLifeDays,
     });
-    return options.originProject === undefined ? created : { ...created, origin_project: projectId(options.originProject) };
+    if (options.originProject === undefined)
+        return created;
+    return { ...created, origin_project: projectId(options.originProject) };
 }
 //# sourceMappingURL=command.js.map

package/dist/capture/compact-resume-caller.js

@@ -1,6 +1,6 @@
-import { COMPACT_RESUME_EVENT_CONTENT_CAP, COMPACT_RESUME_MAX_AGE_MS, compactResumeText } from '../api/context-render.js';
-import { bookTokenUse } from '../api/ledger-db.js';
-import { errorMessage, log } from '../util/log.js';
+import { COMPACT_RESUME_EVENT_CONTENT_CAP, COMPACT_RESUME_MAX_AGE_MS, compactResumeText, } from '../api/context-render.js';
+import { bookTokenUse, ledgerReachOf } from '../api/ledger-db.js';
+import { errorMessage, log, errorFields } from '../util/log.js';
 import { listSessionEvents, loadFreshActiveTaskSnapshot } from '../store/sessions.js';
 import { estimateTokens } from '../util/token-text.js';
 import { truncateCodePointSafe } from '../util/transcript-tail.js';
@@ -10,13 +10,20 @@ export function compactResumeForCaller(ctx, req) {
     if (req.source !== 'compact' || callerInHoldout(ctx, req.sessionId))
         return { stdout: '' };
     const snapshot = loadFreshActiveTaskSnapshot(ctx.hippoRoot, ctx.tenantId, { maxAgeMs: COMPACT_RESUME_MAX_AGE_MS }, key);
-    // One owner's concurrent sessions must not cross-restore; a snapshot with no session still restores, as on the local path.
-    if (snapshot === null || (snapshot.session_id !== null && snapshot.session_id !== req.sessionId))
+    // One owner's concurrent sessions must not cross-restore; a
+    // snapshot with no session still restores, as on the local path.
+    if (snapshot === null || (snapshot.session_id !== null && snapshot.session_id !== req.sessionId)) {
         return { stdout: '' };
+    }
     const text = compactResumeText(snapshot, sessionTrail(ctx, snapshot.session_id));
     bookTokenUse(ctx.hippoRoot, {
-        tenantId: ctx.tenantId, sessionId: req.sessionId, surface: 'compact_resume', event: 'inject', items: 1, tokens: estimateTokens(text),
-    }, { sharedStore: true });
+        tenantId: ctx.tenantId,
+        sessionId: req.sessionId,
+        surface: 'compact_resume',
+        event: 'inject',
+        items: 1,
+        tokens: estimateTokens(text),
+    }, ledgerReachOf(ctx, true));
     return { stdout: text };
 }
 /** A bad trail row costs the trail, not the snapshot. */
@@ -28,7 +35,7 @@ function sessionTrail(ctx, sessionId) {
             .map((e) => ({ ...e, content: truncateCodePointSafe(e.content, COMPACT_RESUME_EVENT_CONTENT_CAP) }));
     }
     catch (err) {
-        log.warn(`compact-resume: trail skipped: ${errorMessage(err)}`);
+        log.warn(`compact-resume: trail skipped: ${errorMessage(err)}`, errorFields(err));
         return [];
     }
 }

package/dist/capture/compact.d.ts

@@ -1,6 +1,7 @@
 import { type HookRuntime } from '../core/capture-contract.js';
-/** Log-forgery guard: strip C0 control chars (newlines above all) from payload-controlled values so a crafted value cannot inject fake `[hippo]` log lines.
- *  Exported as the one shared guard for every `[hippo]`-prefixed log writer that interpolates payload values. */
+/** Log-forgery guard: strip C0 control chars (newlines above all) from payload-controlled values so a crafted value
+ * cannot inject fake `[hippo]` log lines. Exported as the one shared guard for every `[hippo]`-prefixed log writer that
+ * interpolates payload values. */
 export declare function sanitizeLogMessage(message: string): string;
 export interface PreCompactOptions {
     stdinText?: string;
@@ -10,8 +11,9 @@ export interface PreCompactOptions {
     /** Called once when the hook accepts a compaction, with the text it printed or null when it printed none. */
     onBoundary?: (printed: string | null) => void;
 }
-/** PreCompact hook entry point. Exit code 2 BLOCKS compaction, so every path (bad stdin, missing transcript, store error) must exit 0 as a logged no-op.
- *  Callers must not wrap this in anything that turns a caught-and-logged failure into a non-zero exit. */
+/** PreCompact hook entry point. Exit code 2 BLOCKS compaction, so every path (bad stdin, missing transcript, store
+ * error) must exit 0 as a logged no-op. Callers must not wrap this in anything that turns a caught-and-logged failure
+ * into a non-zero exit. */
 export declare function cmdPreCompact(hippoRoot: string, options: PreCompactOptions): Promise<void>;
 export interface PostCompactOptions {
     stdinText?: string;
@@ -19,6 +21,7 @@ export interface PostCompactOptions {
     logFile?: string;
     afterSave?: (transcriptPath: string, cwd: string | null, log: (message: string) => void) => void;
 }
-/** PostCompact entry point: saves the summary and its items, replays earlier leftovers, returns the one line to show. Never throws, so the hook exits 0. */
+/** PostCompact entry point: saves the summary and its items, replays earlier leftovers, returns the one line to show.
+ * Never throws, so the hook exits 0. */
 export declare function cmdPostCompact(hippoRoot: string, options: PostCompactOptions): string | null;
 //# sourceMappingURL=compact.d.ts.map

package/dist/capture/compact.js

@@ -7,15 +7,16 @@ import { recordCompactionStart, recordSnapshotSaved } from '../store/compactions
 import { COMPACTION_DB_WAIT_MS } from '../core/compaction-timing.js';
 import { resolveTenantId } from '../store/tenant.js';
 import { defaultPreCompactLogPath, vscodeUserHooksFile } from '../hooks/shared.js';
-import { readClaudeCodePostCompact, readClaudeCodePreCompact } from '../core/capture-contract.js';
-import { errorMessage, log as logger } from '../util/log.js';
+import { readClaudeCodePostCompact, readClaudeCodePreCompact, } from '../core/capture-contract.js';
+import { errorMessage, log as logger, errorFields } from '../util/log.js';
 import { resolveLastSessionTranscript } from './transcript.js';
 import { isVscodeTranscript } from './copilot-transcript.js';
 import { mergeWorkingState, transcriptWorkingState } from './working-state.js';
 // Diagnostic-only log; a long-lived install must not grow it unbounded.
 const PRE_COMPACT_LOG_MAX_BYTES = 256 * 1024;
-/** Log-forgery guard: strip C0 control chars (newlines above all) from payload-controlled values so a crafted value cannot inject fake `[hippo]` log lines.
- *  Exported as the one shared guard for every `[hippo]`-prefixed log writer that interpolates payload values. */
+/** Log-forgery guard: strip C0 control chars (newlines above all) from payload-controlled values so a crafted value
+ * cannot inject fake `[hippo]` log lines. Exported as the one shared guard for every `[hippo]`-prefixed log writer that
+ * interpolates payload values. */
 export function sanitizeLogMessage(message) {
     // eslint-disable-next-line no-control-regex
     return message.replace(/[\x00-\x1f]/g, '');
@@ -23,14 +24,16 @@ export function sanitizeLogMessage(message) {
 function appendPreCompactLog(logFile, message) {
     try {
         fs.mkdirSync(path.dirname(logFile), { recursive: true });
-        // One handle, so the cap acts on the file it measured; two hooks writing in the same instant can overwrite one diagnostic line, which this log accepts.
+        // One handle, so the cap acts on the file it measured; two hooks writing in the same instant can overwrite one
+        // diagnostic line, which this log accepts.
         const fd = fs.openSync(logFile, fs.constants.O_RDWR | fs.constants.O_CREAT);
         try {
             const size = fs.fstatSync(fd).size;
             const startFresh = size > PRE_COMPACT_LOG_MAX_BYTES; // a dumb cap, no rotation
             if (startFresh)
                 fs.ftruncateSync(fd, 0);
-            fs.writeSync(fd, `[hippo] ${new Date().toISOString()} ${sanitizeLogMessage(message)}\n`, startFresh ? 0 : size, 'utf8');
+            const line = `[hippo] ${new Date().toISOString()} ${sanitizeLogMessage(message)}\n`;
+            fs.writeSync(fd, line, startFresh ? 0 : size, 'utf8');
         }
         finally {
             fs.closeSync(fd);
@@ -38,7 +41,7 @@ function appendPreCompactLog(logFile, message) {
     }
     catch (err) {
         // Diagnostic-only; a log write failure must never affect the exit-0 contract.
-        logger.debug(`pre-compact log not written: ${errorMessage(err)}`);
+        logger.debug(`pre-compact log not written: ${errorMessage(err)}`, errorFields(err));
     }
 }
 /** True iff `filePath` exists and is readable — checks both in one call. */
@@ -51,8 +54,8 @@ function isReadableFile(filePath) {
         return false; // missing and unreadable both mean "no file" to the caller
     }
 }
-/** PreCompact stdout is the summariser's instructions; sent before the snapshot work because a locked store can run the hook past its 30
- * s limit, and via writeSync because process.exit drops buffered pipe output. */
+/** PreCompact stdout is the summariser's instructions; sent before the snapshot work because a locked store can run the
+ * hook past its 30 s limit, and via writeSync because process.exit drops buffered pipe output. */
 function printPreCompactInstruction(logFile) {
     const text = `${PRE_COMPACT_INSTRUCTION}\n`;
     try {
@@ -70,13 +73,15 @@ function snapshotJustSaved(hippoRoot, sessionId) {
     if (sessionId === null || sessionId === '')
         return false;
     const active = loadActiveTaskSnapshot(hippoRoot, resolveTenantId({}));
-    return active?.session_id === sessionId && active.source === 'pre-compact' && Date.now() - Date.parse(active.updated_at) < TWIN_FIRE_MS;
+    return active?.session_id === sessionId && active.source === 'pre-compact' &&
+        Date.now() - Date.parse(active.updated_at) < TWIN_FIRE_MS;
 }
-/** Runs the PreCompact producer: records the compaction, asks the summariser for memories, saves a working-state snapshot. Never extracts
- * memories itself; SessionEnd capture owns that. */
+/** Runs the PreCompact producer: records the compaction, asks the summariser for memories, saves a working-state
+ * snapshot. Never extracts memories itself; SessionEnd capture owns that. */
 function runPreCompact(hippoRoot, options, logFile) {
     const { stdinText, stdinTimedOut = false, runtime = 'claude-code' } = options;
-    // PreCompact fires in every Claude Code project, including ones that never ran `hippo init`; gate before any call that would create a store.
+    // PreCompact fires in every Claude Code project, including ones that never ran `hippo init`; gate before any call
+    // that would create a store.
     if (!isInitialized(hippoRoot)) {
         appendPreCompactLog(logFile, 'skip: store not initialized');
         return;
@@ -87,7 +92,8 @@ function runPreCompact(hippoRoot, options, logFile) {
         return;
     }
     const { sessionId, transcriptPath: payloadTranscriptPath } = receipt.input;
-    // With chat.useClaudeHooks on, VS Code runs Claude Code's hooks too; it never sends PostCompact to close a record, nor reads the summariser text.
+    // With chat.useClaudeHooks on, VS Code runs Claude Code's hooks too; it never sends PostCompact to close a record,
+    // nor reads the summariser text.
     const vscode = runtime === 'claude-code' && isVscodeTranscript(payloadTranscriptPath);
     if (vscode && fs.existsSync(vscodeUserHooksFile())) {
         appendPreCompactLog(logFile, 'skip: VS Code payload, hippo.json runs pre-compact for this chat');
@@ -97,7 +103,8 @@ function runPreCompact(hippoRoot, options, logFile) {
         appendPreCompactLog(logFile, `skip: snapshot for session ${sessionId} saved under ${TWIN_FIRE_MS / 1000} s ago, by the other preCompact entry`);
         return;
     }
-    const recordId = markCompactionBoundary(hippoRoot, options, logFile, receipt.input, runtime === 'claude-code' && !vscode);
+    const closable = runtime === 'claude-code' && !vscode;
+    const recordId = markCompactionBoundary(hippoRoot, options, logFile, receipt.input, closable);
     const transcriptPath = resolvePreCompactTranscript(payloadTranscriptPath, stdinText, logFile, runtime);
     if (!transcriptPath)
         return;
@@ -107,8 +114,8 @@ function runPreCompact(hippoRoot, options, logFile) {
         return;
     saveDerivedSnapshot(hippoRoot, logFile, sessionId, recordId, derived);
 }
-/** Starts the compaction record when the host will close one (`closable`), then tells `onBoundary` what was printed; the record id, or
- * null without a record. */
+/** Starts the compaction record when the host will close one (`closable`), then tells `onBoundary` what was printed;
+ * the record id, or null without a record. */
 function markCompactionBoundary(hippoRoot, options, logFile, input, closable) {
     const { sessionId } = input;
     // The record is the "something saved before every compaction", so it lands even when no snapshot is derivable later.
@@ -162,9 +169,10 @@ function saveDerivedSnapshot(hippoRoot, logFile, sessionId, recordId, derived) {
         existing = loadActiveTaskSnapshot(hippoRoot, tenantId);
     }
     catch (err) {
-        logger.debug(`pre-compact: stored snapshot unreadable, saving the derived one alone: ${errorMessage(err)}`);
+        logger.warn(`pre-compact: stored snapshot unreadable, saving the derived one alone: ${errorMessage(err)}`, errorFields(err));
     }
-    // Carried-over fields are not re-capped, as `hippo snapshot save` stays uncapped; saveActiveTaskSnapshot scrubs every field.
+    // Carried-over fields are not re-capped, as `hippo snapshot save` stays uncapped; saveActiveTaskSnapshot scrubs every
+    // field.
     const merged = mergeWorkingState(derived, existing, sessionId);
     if (merged === null) {
         appendPreCompactLog(logFile, 'skip: no snapshot content for this session (nothing derivable; fallback blocked or empty)');
@@ -173,16 +181,18 @@ function saveDerivedSnapshot(hippoRoot, logFile, sessionId, recordId, derived) {
         try {
             saveActiveTaskSnapshot(hippoRoot, tenantId, { ...merged, source: 'pre-compact', session_id: sessionId });
             appendPreCompactLog(logFile, 'snapshot saved');
-            if (recordId !== null)
+            if (recordId !== null) {
                 recordSnapshotSaved(hippoRoot, tenantId, recordId, (message) => appendPreCompactLog(logFile, message));
+            }
         }
         catch (err) {
             appendPreCompactLog(logFile, `snapshot save failed: ${errorMessage(err)}`);
         }
     }
 }
-/** PreCompact hook entry point. Exit code 2 BLOCKS compaction, so every path (bad stdin, missing transcript, store error) must exit 0 as a logged no-op.
- *  Callers must not wrap this in anything that turns a caught-and-logged failure into a non-zero exit. */
+/** PreCompact hook entry point. Exit code 2 BLOCKS compaction, so every path (bad stdin, missing transcript, store
+ * error) must exit 0 as a logged no-op. Callers must not wrap this in anything that turns a caught-and-logged failure
+ * into a non-zero exit. */
 export async function cmdPreCompact(hippoRoot, options) {
     const logFile = options.logFile ?? defaultPreCompactLogPath();
     try {
@@ -195,7 +205,8 @@ export async function cmdPreCompact(hippoRoot, options) {
 }
 /** A PostCompact hook has 10 s in all; replay stops starting new records after this. */
 const POST_COMPACT_REPLAY_BUDGET_MS = 6000;
-/** PostCompact entry point: saves the summary and its items, replays earlier leftovers, returns the one line to show. Never throws, so the hook exits 0. */
+/** PostCompact entry point: saves the summary and its items, replays earlier leftovers, returns the one line to show.
+ * Never throws, so the hook exits 0. */
 export function cmdPostCompact(hippoRoot, options) {
     const logFile = options.logFile ?? defaultPreCompactLogPath();
     const log = (message) => appendPreCompactLog(logFile, `post-compact: ${message}`);