hippo-memory 2.0.0 → 2.1.0

package/dist/api/{projects.d.ts → objects/projects.d.ts}

@@ -1,7 +1,7 @@
-import { type MergeResult, type ProjectSummary, type RepairResult } from '../sharing/project-merge.js';
-import type { Context } from './types.js';
-export type { MergeResult, ProjectCollision, ProjectSummary, RepairResult } from '../sharing/project-merge.js';
-export type { ProjectFold } from '../agent-memories/project-folds.js';
+import { type MergeResult, type ProjectSummary, type RepairResult } from '../../sharing/project-merge.js';
+import type { Context } from '../types.js';
+export type { MergeResult, ProjectCollision, ProjectSummary, RepairResult } from '../../sharing/project-merge.js';
+export type { ProjectFold } from '../../agent-memories/project-folds.js';
 export interface MergeProjectNamesOpts {
     from: string;
     into: string;
@@ -10,7 +10,10 @@ export interface MergeProjectNamesOpts {
 }
 /** Live rows per project name in the caller's tenant, newest write first. */
 export declare function listProjectNames(ctx: Context): ProjectSummary[];
-/** Folds project `from` into `into`, backed up and audited as `ctx.actor`; throws on user-global, unknown or equal names. */
+/**
+ * Folds project `from` into `into`, backed up and audited as `ctx.actor`; throws on user-global, unknown or equal
+ * names.
+ */
 export declare function mergeProjectNames(ctx: Context, opts: MergeProjectNamesOpts): MergeResult;
 /** Sets aside stray imports, folds renamed projects and re-tags sleep's user-global merges; a dry run only plans. */
 export declare function repairProjectNames(ctx: Context, opts: {

package/dist/api/{projects.js → objects/projects.js}

@@ -1,7 +1,8 @@
-// Project names for every front end: list them, fold one into another, and repair old tags; the store opens hippo.db and owns each transaction.
+// Project names for every front end: list them, fold one into another, and repair old tags; the store opens hippo.db
+// and owns each transaction.
 // SHORTCUT: hippo.db only, since the store port has no project calls; a projects group when a served store needs them.
-import { listProjects, mergeProjects, repairOnceOnSleep, repairProjects, } from '../sharing/project-merge.js';
-import { onProjectTags } from '../store/project-tags.js';
+import { listProjects, mergeProjects, repairOnceOnSleep, repairProjects, } from '../../sharing/project-merge.js';
+import { onProjectTags } from '../../store/project-tags.js';
 function onProjects(ctx, fn) {
     return onProjectTags({ hippoRoot: ctx.hippoRoot, tenantId: ctx.tenantId, actor: ctx.actor.subject }, fn);
 }
@@ -9,7 +10,10 @@ function onProjects(ctx, fn) {
 export function listProjectNames(ctx) {
     return onProjects(ctx, listProjects);
 }
-/** Folds project `from` into `into`, backed up and audited as `ctx.actor`; throws on user-global, unknown or equal names. */
+/**
+ * Folds project `from` into `into`, backed up and audited as `ctx.actor`; throws on user-global, unknown or equal
+ * names.
+ */
 export function mergeProjectNames(ctx, opts) {
     return onProjects(ctx, (store) => mergeProjects(store, opts));
 }

package/dist/api/pilot-arm.d.ts

@@ -1,10 +1,14 @@
-import { type LedgerRootOpts } from './ledger-db.js';
+import { type LedgerReach } from './ledger-db.js';
 import { type PilotArm } from '../store/pilot-arm.js';
-export interface SessionArmOpts extends LedgerRootOpts {
-    /** Only the caller tenant's arm row counts, so a caller holding another tenant's session id cannot claim that session's arm. */
+export interface SessionArmOpts {
+    readonly reach: LedgerReach;
+    /**
+     * Only the caller tenant's arm row counts, so a caller holding another tenant's session id cannot claim that
+     * session's arm.
+     */
     readonly ownTenantOnly?: boolean;
 }
 /** The session's arm, or null at rate 0, with no session id, or with no store.
  *  `write` books the arm row; a read-only caller (env-only id, sub-agent) follows the stored arm, else the hash. */
-export declare function sessionPilotArm(hippoRoot: string, tenantId: string, sessionId: string | undefined, write: boolean, opts?: SessionArmOpts): PilotArm | null;
+export declare function sessionPilotArm(hippoRoot: string, tenantId: string, sessionId: string | undefined, write: boolean, opts: SessionArmOpts): PilotArm | null;
 //# sourceMappingURL=pilot-arm.d.ts.map

package/dist/api/pilot-arm.js

@@ -1,21 +1,22 @@
-// Which pilot arm a session is in: the rate comes from the ledger store's config, the arm row from src/store/pilot-arm.ts.
+// Which pilot arm a session is in: the rate comes from the ledger store's config, the arm row from
+// src/store/pilot-arm.ts.
 import { loadConfig } from '../core/config.js';
 import { ledgerRoot, onLedgerRoot } from './ledger-db.js';
 import { pilotArmOnRoot } from '../store/ledger-turn.js';
 import { hashArm } from '../store/pilot-arm.js';
 /** The session's arm, or null at rate 0, with no session id, or with no store.
  *  `write` books the arm row; a read-only caller (env-only id, sub-agent) follows the stored arm, else the hash. */
-export function sessionPilotArm(hippoRoot, tenantId, sessionId, write, opts = {}) {
+export function sessionPilotArm(hippoRoot, tenantId, sessionId, write, opts) {
     if (sessionId === undefined || sessionId.trim() === '')
         return null;
-    const root = ledgerRoot(hippoRoot, opts);
+    const root = ledgerRoot(hippoRoot, opts.reach);
     if (root === null)
         return null;
     const rate = loadConfig(root).pilot.holdoutRateBp;
     if (rate <= 0)
         return null;
     const { ownTenantOnly } = opts;
-    const arm = onLedgerRoot(hippoRoot, opts, (at) => pilotArmOnRoot(at, tenantId, sessionId, rate, { write, ownTenantOnly }));
+    const arm = onLedgerRoot(hippoRoot, opts.reach, (at) => pilotArmOnRoot(at, tenantId, sessionId, rate, { write, ownTenantOnly }));
     return arm ?? hashArm(sessionId, rate);
 }
 //# sourceMappingURL=pilot-arm.js.map

package/dist/api/prompt-hook.d.ts

@@ -1,7 +1,9 @@
-import { type Context, type ContextResult, type ContextResultEntry } from './index.js';
+import { type Context, type ContextResult, type ContextResultEntry, type ContextWith } from './index.js';
+import { type HippoConfig } from '../core/config.js';
 import { type DeliveryEventType, type DeliveryFault, type DeliveryRecorder } from '../store/delivery-recorder.js';
 import type { HookRuntime } from '../core/capture-contract.js';
 import { type JsonValue } from '../util/json.js';
+import { type LedgerReach } from './ledger-db.js';
 import type { MemoryEntry } from '../core/memory.js';
 import type { PilotArm } from '../store/pilot-arm.js';
 import type { DeliveryWrite } from '../store/ledger-turn.js';
@@ -17,13 +19,17 @@ export interface DeliveryStart {
 }
 /** A delivery recorder for a hook on `ctx.hippoRoot` when the ledger store enables one, else null; never throws. */
 export declare function startDeliveryRecorder(ctx: Context, start: DeliveryStart): DeliveryRecorder | null;
-/** A recorder for `hippo capture-error`, only when the failure log and the ledger are one store, so `failure_id` never points into another. */
+/** A recorder for `hippo capture-error`, only when the failure log and the ledger are one store, so `failure_id` never
+ * points into another. */
 export declare function startToolFailureRecorder(ctx: Context, start: Omit<DeliveryStart, 'eventType'>): DeliveryRecorder | null;
-/** With `write`, stores on the token ledger's connection (same store); without it, opens its own. A second flush is a no-op. */
+/** With `write`, stores on the token ledger's connection (same
+ * store); without it, opens its own. A second flush is a no-op. */
 export declare function flushDeliveryRecorder(rec: DeliveryRecorder | null, write?: DeliveryWrite): void;
 /** What one render needs once api.getContext has answered. */
 export interface ContextView {
     readonly hippoRoot: string;
+    /** The caller's Context config, else the folder's config.json is read. */
+    readonly config?: HippoConfig;
     readonly tenantId: string;
     readonly ledgerSessionId: string | undefined;
     readonly payloadSessionId: string | undefined;
@@ -31,17 +37,20 @@ export interface ContextView {
     readonly framing: string;
     readonly rec: DeliveryRecorder | null;
     readonly result: ContextResult;
-    /** Ledger rows stay in `hippoRoot`, never the global store; see promptHookContext. */
-    readonly sharedStore?: boolean;
+    /** Where the ledger rows go; a shared store's reach has no global store, see promptHookContext. */
+    readonly reach: LedgerReach;
     /** The static block's hash the caller says it printed last. Undefined keeps the ledger-only skip rule;
-     *  a string or null also needs that hash to match, because the ledger counts blocks a caller that prints elsewhere may never have shown. */
+     *  a string or null also needs that hash to match, because the ledger counts blocks a caller that prints elsewhere
+     *  may never have shown. */
     readonly printedHash?: string | null;
     /** The reply's JSON wrapper; absent means Claude Code's UserPromptSubmit. */
     readonly envelope?: HookEnvelope;
 }
-/** `copilot-session-start` is the Copilot harness's top-level reply, `vscode-session-start` the nested one VS Code Local reads. */
+/** `copilot-session-start` is the Copilot harness's top-level reply,
+ * `vscode-session-start` the nested one VS Code Local reads. */
 export type HookEnvelope = 'user-prompt-submit' | 'copilot-session-start' | 'vscode-session-start';
-/** A Copilot sessionStart reply's wrapper, picked by the sender's casing: stdin.ts keeps a camelCase `sessionId`, which only the Copilot harness sends. */
+/** A Copilot sessionStart reply's wrapper, picked by the sender's casing: stdin.ts keeps a camelCase `sessionId`, which
+ * only the Copilot harness sends. */
 export declare function sessionStartEnvelope(stdinText: string | undefined): HookEnvelope;
 export declare function hasContextData(result: ContextResult): boolean;
 export type RenderItem = {
@@ -51,36 +60,40 @@ export type RenderItem = {
     isGlobal: boolean;
 };
 export declare function toRenderItems(entries: ContextResultEntry[]): RenderItem[];
-/** The hook format's stdout, '' when nothing is sent: a skippable static block (snapshot, handoff, events, pins, recent-N) and a never-skipped recall block. */
+/** The hook format's stdout, '' when nothing is sent: a skippable static block (snapshot, handoff, events, pins,
+ * recent-N) and a never-skipped recall block. */
 export declare function additionalContextOutput(view: ContextView): string;
-/** The project a hook caller runs in: its id, the folder name its older rows carry, and any other names it resolves to. */
+/** The project a hook caller runs in: its id, the folder name
+ * its older rows carry, and any other names it resolves to. */
 export interface CallerProject {
     readonly name: string;
     readonly legacyName: string;
     readonly aliases?: readonly string[];
 }
-interface PromptHookRequest {
+export interface PromptHookRequest {
     readonly sessionId: string;
     readonly project: CallerProject;
     readonly payload?: Readonly<Record<string, JsonValue>>;
-    /** The staticHash of the last reply whose stdout the caller printed in this session; absent, the block is always sent. */
+    /** The staticHash of the last reply whose stdout the caller
+     * printed in this session; absent, the block is always sent. */
     readonly printedHash?: string;
 }
-interface PromptHookOpts {
+export interface PromptHookOpts {
     /** The store serves many people, so the caller is not its owner: no global store, no user-global recent rows,
      *  task state only for the caller's own owner and project, and no ledger rows outside this store. */
     readonly sharedStore?: true;
 }
 /** The caps on a hook caller's session id and project names, so a caller other than an HTTP route is bounded too. */
 export declare function assertCallerIds(sessionId: string, project: CallerProject): void;
-/** The text `hippo context --pinned-only --include-recent 5 --format additional-context` prints for this session, read on `ctx`'s store for its project.
- * Omits an unchanged static block only when `printedHash` matches; `arm` is the ledger arm (`hippo` or `holdout`, null at rate 0); a holdout gets empty stdout.
- * `staticHash` is the hash to echo back (null with no static block, a sub-agent or a holdout). Scope detection and delivery-ledger events are CLI-only.
- * Throws BadRequestError past the input caps, and on a shared store for a project assertCallerProject refuses, before any arm is booked. */
-export declare function promptHookContext(ctx: Context, req: PromptHookRequest, opts?: PromptHookOpts): Promise<{
+/** The text `hippo context --pinned-only --include-recent 5 --format additional-context` prints for this session, read
+ * on `ctx`'s store for its project. Omits an unchanged static block only when `printedHash` matches; `arm` is the
+ * ledger arm (`hippo` or `holdout`, null at rate 0); a holdout gets empty stdout. `staticHash` is the hash to echo back
+ * (null with no static block, a sub-agent or a holdout). Scope detection and delivery-ledger events are CLI-only.
+ * Throws BadRequestError past the input caps, and on a shared store for a project assertCallerProject refuses, before
+ * any arm is booked. */
+export declare function promptHookContext(ctx: ContextWith<'contextReads'>, req: PromptHookRequest, opts?: PromptHookOpts): Promise<{
     arm: PilotArm | null;
     stdout: string;
     staticHash: string | null;
 }>;
-export {};
 //# sourceMappingURL=prompt-hook.d.ts.map

package/dist/api/prompt-hook.js

@@ -1,35 +1,36 @@
-// The per-prompt hook's block and ledger rows, rendered here for `hippo context` and for promptHookContext (a remote hook route's call).
-// promptHookContext keeps the server-side copy of the CLI's getContext flags (cli/context.ts);
-// the CLI parity case in tests/prompt-hook-context.test.ts is all that ties the two.
+// The per-prompt hook's block and ledger rows, rendered here for `hippo context` and for promptHookContext (a remote
+// hook route's call). promptHookContext keeps the server-side copy of the CLI's getContext flags (cli/context.ts); the
+// CLI parity case in tests/prompt-hook-context.test.ts is all that ties the two.
 import { getContext } from './index.js';
 import { BadRequestError } from '../core/api-errors.js';
 import { isSharedStore, loadConfig } from '../core/config.js';
-import { contextBlockLines, contextCost, crossProjectLines, handoffText, sessionTrailText, settleTokens, snapshotText } from './context-render.js';
-import { createDeliveryRecorder } from '../store/delivery-recorder.js';
+import { contextBlockLines, contextCost, crossProjectLines, handoffText, sessionTrailText, settleTokens, snapshotText, } from './context-render.js';
+import { createDeliveryRecorder, } from '../store/delivery-recorder.js';
 import { realpathOrResolve } from '../util/real-path.js';
 import { MAX_ID_LEN } from '../util/limits.js';
 import { isJsonString } from '../util/json.js';
-import { bookLedgerTurn, ledgerLastSent, ledgerRoot } from './ledger-db.js';
+import { bookLedgerTurn, ledgerLastSent, ledgerReachOf, ledgerRoot } from './ledger-db.js';
 import { noteLedgerRowSkipped } from '../store/ledger-turn.js';
 import { sessionPilotArm } from './pilot-arm.js';
-import { assertCallerProject, isGlobalStoreRoot, MAX_PROJECT_ALIASES } from '../core/project-identity.js';
+import { assertCallerProject, MAX_PROJECT_ALIASES } from '../core/project-identity.js';
 import { writeDeliveryEventAtRoot } from '../store/recall-trace.js';
 import { shouldSkipUnchanged } from '../store/token-ledger.js';
 import { hookPayloadString, isSubagentPayload } from '../util/hook-payload.js';
 import { blockHash, estimateTokens } from '../util/token-text.js';
-import { errorMessage, log } from '../util/log.js';
+import { errorMessage, log, errorFields } from '../util/log.js';
 import { DEFAULT_CONTEXT_BUDGET } from './context.js';
 /** A delivery recorder for a hook on `ctx.hippoRoot` when the ledger store enables one, else null; never throws. */
 export function startDeliveryRecorder(ctx, start) {
     try {
         // The same store the token ledger writes to, so its config governs both.
-        const root = ledgerRoot(ctx.hippoRoot);
+        const root = ledgerRoot(ctx.hippoRoot, ledgerReachOf(ctx));
         if (root === null || !loadConfig(root).deliveryLedger.enabled)
             return null;
         return createDeliveryRecorder({
             root,
             storeHash: blockHash(realpathOrResolve(root)),
-            writeStore: isGlobalStoreRoot(root) ? 'global' : 'local',
+            // ledgerRoot falls back to the global root only when the primary is not initialized.
+            writeStore: root !== ctx.hippoRoot || ctx.reach?.isGlobal === true ? 'global' : 'local',
             tenantId: ctx.tenantId,
             stdinText: start.stdinText,
             envSessionId: start.envSessionId,
@@ -39,24 +40,26 @@ export function startDeliveryRecorder(ctx, start) {
         });
     }
     catch (error) {
-        log.warn(`delivery ledger skipped: ${errorMessage(error)}`);
+        log.warn(`delivery ledger skipped: ${errorMessage(error)}`, errorFields(error));
         return null;
     }
 }
-/** A recorder for `hippo capture-error`, only when the failure log and the ledger are one store, so `failure_id` never points into another. */
+/** A recorder for `hippo capture-error`, only when the failure log and the ledger are one store, so `failure_id` never
+ * points into another. */
 export function startToolFailureRecorder(ctx, start) {
     try {
-        const root = ledgerRoot(ctx.hippoRoot);
+        const root = ledgerRoot(ctx.hippoRoot, ledgerReachOf(ctx));
         if (root === null || realpathOrResolve(root) !== realpathOrResolve(ctx.hippoRoot))
             return null;
         return startDeliveryRecorder(ctx, { ...start, eventType: 'tool-failure' });
     }
     catch (error) {
-        log.warn(`delivery ledger skipped: ${errorMessage(error)}`);
+        log.warn(`delivery ledger skipped: ${errorMessage(error)}`, errorFields(error));
         return null;
     }
 }
-/** With `write`, stores on the token ledger's connection (same store); without it, opens its own. A second flush is a no-op. */
+/** With `write`, stores on the token ledger's connection (same
+ * store); without it, opens its own. A second flush is a no-op. */
 export function flushDeliveryRecorder(rec, write) {
     if (rec === null)
         return;
@@ -64,10 +67,11 @@ export function flushDeliveryRecorder(rec, write) {
         rec.flush(write ?? ((input) => writeDeliveryEventAtRoot(rec.root, input)));
     }
     catch (error) {
-        log.error(`delivery ledger write failed: ${errorMessage(error)}`);
+        log.error(`delivery ledger write failed: ${errorMessage(error)}`, errorFields(error));
     }
 }
-/** A Copilot sessionStart reply's wrapper, picked by the sender's casing: stdin.ts keeps a camelCase `sessionId`, which only the Copilot harness sends. */
+/** A Copilot sessionStart reply's wrapper, picked by the sender's casing: stdin.ts keeps a camelCase `sessionId`, which
+ * only the Copilot harness sends. */
 export function sessionStartEnvelope(stdinText) {
     return hookPayloadString(stdinText, 'sessionId') !== null ? 'copilot-session-start' : 'vscode-session-start';
 }
@@ -87,17 +91,14 @@ export function hasContextData(result) {
 export function toRenderItems(entries) {
     return entries.map((r) => ({ entry: r.entry, score: r.score, tokens: r.tokens, isGlobal: r.isGlobal ?? false }));
 }
-/** The hook format's stdout, '' when nothing is sent: a skippable static block (snapshot, handoff, events, pins, recent-N) and a never-skipped recall block. */
+/** The hook format's stdout, '' when nothing is sent: a skippable static block (snapshot, handoff, events, pins,
+ * recent-N) and a never-skipped recall block. */
 export function additionalContextOutput(view) {
     return renderAdditionalContext(view).stdout;
 }
-function renderAdditionalContext(view) {
-    const { result, rec, framing } = view;
-    const staticEntries = result.entries.filter((r) => r.category !== 'cross-project' && !r.promptRecall);
-    const staticCrossEntries = result.entries.filter((r) => r.category === 'cross-project' && !r.promptRecall);
-    const staticItems = toRenderItems(staticEntries);
-    const recallItems = toRenderItems(result.entries.filter((r) => r.promptRecall));
-    const staticBlock = settleTokens((t) => [
+function renderStaticBlock(view, staticItems, staticCrossEntries) {
+    const { result, framing } = view;
+    return settleTokens((t) => [
         ...(result.activeSnapshot ? [snapshotText(result.activeSnapshot)] : []),
         ...(result.sessionHandoff ? [handoffText(result.sessionHandoff)] : []),
         ...(result.recentEvents && result.recentEvents.length > 0 ? [sessionTrailText(result.recentEvents)] : []),
@@ -105,9 +106,20 @@ function renderAdditionalContext(view) {
         ...(staticItems.length > 0 ? contextBlockLines(staticItems, t, framing, { showStrength: false }) : []),
         ...crossProjectLines(staticCrossEntries),
     ].join('\n'));
-    const recallBlock = recallItems.length > 0
-        ? settleTokens((t) => contextBlockLines(recallItems, t, framing, { showStrength: false, heading: 'Prompt-Relevant Memory' }).join('\n'))
-        : '';
+}
+function renderRecallBlock(recallItems, framing) {
+    if (recallItems.length === 0)
+        return '';
+    return settleTokens((t) => contextBlockLines(recallItems, t, framing, { showStrength: false, heading: 'Prompt-Relevant Memory' }).join('\n'));
+}
+function renderAdditionalContext(view) {
+    const { result, rec, framing } = view;
+    const staticEntries = result.entries.filter((r) => r.category !== 'cross-project' && !r.promptRecall);
+    const staticCrossEntries = result.entries.filter((r) => r.category === 'cross-project' && !r.promptRecall);
+    const staticItems = toRenderItems(staticEntries);
+    const recallItems = toRenderItems(result.entries.filter((r) => r.promptRecall));
+    const staticBlock = renderStaticBlock(view, staticItems, staticCrossEntries);
+    const recallBlock = renderRecallBlock(recallItems, framing);
     if (!staticBlock.trim() && !recallBlock.trim()) {
         rec?.delivered({ state: 'empty' });
         return NOTHING_RENDERED;
@@ -139,13 +151,12 @@ function renderAdditionalContext(view) {
 /** True, after booking the skip row, when the hook may omit a static block this session already holds. */
 function skipUnchangedStatic(view, surface, staticBlock, recallBlock, staticCount) {
     const { hippoRoot, payloadSessionId, rec } = view;
-    const ledgerOpts = { sharedStore: view.sharedStore };
     if (!view.pinnedOnly || payloadSessionId === undefined)
         return false;
     // Session start is the only injection Copilot gets, so a resumed session needs the whole block again.
     if (view.envelope === 'copilot-session-start' || view.envelope === 'vscode-session-start')
         return false;
-    const injectCfg = loadConfig(hippoRoot).pinnedInject;
+    const injectCfg = (view.config ?? loadConfig(hippoRoot)).pinnedInject;
     if (injectCfg.skipUnchanged === false)
         return false;
     const refreshTurns = Number.isFinite(injectCfg.refreshTurns) && injectCfg.refreshTurns >= 0
@@ -156,7 +167,7 @@ function skipUnchangedStatic(view, surface, staticBlock, recallBlock, staticCoun
     // Before the ledger read, so a caller that did not print this block books no skip row.
     if (view.printedHash !== undefined && view.printedHash !== staticHash)
         return false;
-    const last = ledgerLastSent(hippoRoot, view.tenantId, payloadSessionId, surface, ledgerOpts);
+    const last = ledgerLastSent(hippoRoot, view.tenantId, payloadSessionId, surface, view.reach);
     if (!shouldSkipUnchanged(last ?? null, staticHash, refreshTurns))
         return false;
     bookLedgerTurn(hippoRoot, {
@@ -168,20 +179,24 @@ function skipUnchangedStatic(view, surface, staticBlock, recallBlock, staticCoun
             rec?.delivered({ state: 'reused', staticHash, staticReused: true });
             flushDeliveryRecorder(rec, write);
         },
-    }, ledgerOpts);
+    }, view.reach);
     return true;
 }
-/** One connection for both rows; a failed row is logged and the other still lands, because a ledger failure must not break the hook. */
+/** One connection for both rows; a failed row is logged and the other still lands, because a ledger failure must not
+ * break the hook. */
 function recordAdditionalContextRows(view, surface, staticPart, recallPart) {
     const row = (part, on) => ({
         tenantId: view.tenantId, sessionId: view.ledgerSessionId, surface: on, event: 'inject',
         items: part.items, tokens: estimateTokens(part.text), hash: blockHash(part.text),
     });
     bookLedgerTurn(view.hippoRoot, {
-        uses: [...(staticPart.text ? [row(staticPart, surface)] : []), ...(recallPart.text ? [row(recallPart, 'hook_recall')] : [])],
+        uses: [
+            ...(staticPart.text ? [row(staticPart, surface)] : []),
+            ...(recallPart.text ? [row(recallPart, 'hook_recall')] : []),
+        ],
         onRowError: noteLedgerRowSkipped,
         delivery: (write) => flushDeliveryRecorder(view.rec, write),
-    }, { sharedStore: view.sharedStore });
+    }, view.reach);
 }
 // The flags HIPPO_PINNED_INJECT_COMMAND gives the local hook; the CLI parity test fails if the two drift.
 const HOOK_INCLUDE_RECENT = 5;
@@ -192,8 +207,9 @@ const BLOCK_HASH_RE = /^[0-9a-f]{16}$/;
 /** The caps on a hook caller's session id and project names, so a caller other than an HTTP route is bounded too. */
 export function assertCallerIds(sessionId, project) {
     const { name, legacyName, aliases = [] } = project;
-    if (aliases.length > MAX_PROJECT_ALIASES)
+    if (aliases.length > MAX_PROJECT_ALIASES) {
         throw new BadRequestError(`project aliases: at most ${MAX_PROJECT_ALIASES}`);
+    }
     if ([sessionId, name, legacyName, ...aliases].some((v) => v.length > MAX_ID_LEN)) {
         throw new BadRequestError(`session id and project names: at most ${MAX_ID_LEN} characters each`);
     }
@@ -204,20 +220,24 @@ function assertPromptHookRequest(req) {
         throw new BadRequestError('printed hash: 16 lowercase hex characters');
     }
 }
-/** The text `hippo context --pinned-only --include-recent 5 --format additional-context` prints for this session, read on `ctx`'s store for its project.
- * Omits an unchanged static block only when `printedHash` matches; `arm` is the ledger arm (`hippo` or `holdout`, null at rate 0); a holdout gets empty stdout.
- * `staticHash` is the hash to echo back (null with no static block, a sub-agent or a holdout). Scope detection and delivery-ledger events are CLI-only.
- * Throws BadRequestError past the input caps, and on a shared store for a project assertCallerProject refuses, before any arm is booked. */
+/** The text `hippo context --pinned-only --include-recent 5 --format additional-context` prints for this session, read
+ * on `ctx`'s store for its project. Omits an unchanged static block only when `printedHash` matches; `arm` is the
+ * ledger arm (`hippo` or `holdout`, null at rate 0); a holdout gets empty stdout. `staticHash` is the hash to echo back
+ * (null with no static block, a sub-agent or a holdout). Scope detection and delivery-ledger events are CLI-only.
+ * Throws BadRequestError past the input caps, and on a shared store for a project assertCallerProject refuses, before
+ * any arm is booked. */
 export async function promptHookContext(ctx, req, opts = {}) {
     assertPromptHookRequest(req);
     const { sessionId, payload } = req;
     const { sharedStore } = opts;
-    if (sharedStore || isSharedStore(ctx.hippoRoot))
+    const sharedByReach = ctx.reach ? ctx.reach.shared : isSharedStore(ctx.hippoRoot);
+    if (sharedStore || sharedByReach)
         assertCallerProject(req.project);
     // The test the local hook runs on its stdin, so a sub-agent books no arm and no session rows here either.
     const subagent = payload !== undefined && isSubagentPayload(JSON.stringify(payload));
     const ledgerSessionId = subagent ? undefined : sessionId;
-    const arm = sessionPilotArm(ctx.hippoRoot, ctx.tenantId, sessionId, !subagent, { sharedStore, ownTenantOnly: true });
+    const reach = ledgerReachOf(ctx, sharedStore);
+    const arm = sessionPilotArm(ctx.hippoRoot, ctx.tenantId, sessionId, !subagent, { reach, ownTenantOnly: true });
     if (arm === 'holdout')
         return { arm, ...NOTHING_RENDERED };
     const prompt = payload?.prompt;
@@ -234,8 +254,9 @@ export async function promptHookContext(ctx, req, opts = {}) {
     });
     const rendered = hasContextData(result)
         ? renderAdditionalContext({
-            hippoRoot: ctx.hippoRoot, tenantId: ctx.tenantId, ledgerSessionId, payloadSessionId: ledgerSessionId,
-            pinnedOnly: true, framing: HOOK_FRAMING, rec: null, result, sharedStore, printedHash: req.printedHash ?? null,
+            hippoRoot: ctx.hippoRoot, config: ctx.config, tenantId: ctx.tenantId, ledgerSessionId,
+            payloadSessionId: ledgerSessionId, pinnedOnly: true, framing: HOOK_FRAMING, rec: null, result, reach,
+            printedHash: req.printedHash ?? null,
         })
         : NOTHING_RENDERED;
     // A sub-agent's output is not the session's, so its caller must not record it as printed.

package/dist/api/provenance-coverage.d.ts

@@ -8,7 +8,9 @@ export interface ProvenanceCoverage {
         missing: ('owner' | 'artifact_ref')[];
     }>;
 }
-/** Provenance coverage gate: every `kind='raw'` row must carry `owner` and `artifact_ref`; derivative or terminal rows are excluded.
+/**
+ * Provenance coverage gate: every `kind='raw'` row must carry `owner` and `artifact_ref`; derivative or terminal rows
+ * are excluded.
  * Coverage 1.0 on a non-empty raw set is the ship gate. */
 export declare function buildProvenanceCoverage(entries: MemoryEntry[]): ProvenanceCoverage;
 //# sourceMappingURL=provenance-coverage.d.ts.map

package/dist/api/provenance-coverage.js

@@ -1,4 +1,6 @@
-/** Provenance coverage gate: every `kind='raw'` row must carry `owner` and `artifact_ref`; derivative or terminal rows are excluded.
+/**
+ * Provenance coverage gate: every `kind='raw'` row must carry `owner` and `artifact_ref`; derivative or terminal rows
+ * are excluded.
  * Coverage 1.0 on a non-empty raw set is the ship gate. */
 export function buildProvenanceCoverage(entries) {
     const raws = entries.filter((e) => e.kind === 'raw');