hippo-memory 2.0.0 → 2.1.0

package/dist/store/working-memory.js

@@ -1,4 +1,5 @@
-/** Working Memory: bounded buffer for current-state notes, separate from long-term memory; scoped, importance-ranked, evicted past WM_MAX_ENTRIES per scope. */
+/** Working Memory: bounded buffer for current-state notes, separate from long-term memory; scoped, importance-ranked,
+ * evicted past WM_MAX_ENTRIES per scope. */
 import { withWriteScope } from '../db/index.js';
 import { onHandle, openStore } from './open.js';
 import { warnDamagedColumn } from '../util/stored-json.js';
@@ -7,8 +8,8 @@ export const WM_MAX_ENTRIES = 20;
 function rowToItem(row) {
     let metadata = {};
     try {
-        // SAFETY: metadata_json is always written by wmPush via JSON.stringify(opts.metadata ?? {}), so a successful parse yields a plain JSON object;
-        // malformed content falls through to the catch below.
+        // SAFETY: metadata_json is always written by wmPush via JSON.stringify(opts.metadata ?? {}), so a successful parse
+        // yields a plain JSON object; malformed content falls through to the catch below.
         metadata = JSON.parse(row.metadata_json);
     }
     catch {
@@ -27,18 +28,21 @@ function rowToItem(row) {
         updatedAt: row.updated_at,
     };
 }
-/** Push a new entry into working memory; past WM_MAX_ENTRIES the scope's lowest-importance entry is evicted (ties: oldest created_at). Returns the new
- * row ID. */
+/** Push a new entry into working memory; past WM_MAX_ENTRIES the scope's lowest-importance entry is evicted (ties:
+ * oldest created_at). Returns the new row ID. */
 export function wmPush(hippoRoot, opts) {
     return onHandle(hippoRoot, (db) => {
         const now = new Date().toISOString();
         const importance = opts.importance ?? 0;
         const tenantId = opts.tenantId ?? resolveTenantId({});
         return withWriteScope(db, 'wm_push', () => {
-            const result = db.prepare(`
-        INSERT INTO working_memory(scope, session_id, task_id, importance, content, metadata_json, created_at, updated_at, tenant_id)
+            const result = db
+                .prepare(`
+        INSERT INTO working_memory(scope, session_id, task_id, importance, content, metadata_json, created_at,
+        updated_at, tenant_id)
         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-      `).run(opts.scope, opts.sessionId ?? null, opts.taskId ?? null, importance, opts.content, JSON.stringify(opts.metadata ?? {}), now, now, tenantId);
+      `)
+                .run(opts.scope, opts.sessionId ?? null, opts.taskId ?? null, importance, opts.content, JSON.stringify(opts.metadata ?? {}), now, now, tenantId);
             const id = Number(result.lastInsertRowid ?? 0);
             evictOverCapacity(db, opts.scope, tenantId);
             return id;
@@ -111,7 +115,8 @@ export function wmClear(hippoRoot, opts) {
         return Number(result.changes ?? 0);
     }, openStore);
 }
-/** Flush working memory after session end: same as wmClear, but marks the session-boundary discard of ephemeral state. Returns the count flushed. */
+/** Flush working memory after session end: same as wmClear, but marks the session-boundary discard of ephemeral state.
+ * Returns the count flushed. */
 export function wmFlush(hippoRoot, opts) {
     return wmClear(hippoRoot, opts);
 }

package/dist/support-bundle.js

@@ -18,7 +18,8 @@ import { errorMessage } from './util/log.js';
 const TAIL_MAX_BYTES = 256 * 1024;
 export const TAIL_MAX_LINES = 200;
 const TAIL_MAX_LINE_CHARS = 2000;
-// Greedy on purpose: complete key blocks are redacted first, so any END left is an orphan and what precedes it may be key body.
+// Greedy on purpose: complete key blocks are redacted first, so any END left is an orphan and what precedes it may be
+// key body.
 const ORPHAN_KEY_END_RE = /^[\s\S]*-----END [A-Z ]*PRIVATE KEY-----/;
 // The other env vars hippo reads outside the HIPPO_ prefix (src/embeddings/provider.ts, connectors/*).
 const OTHER_ENV_NAMES = [
@@ -202,7 +203,8 @@ const HOME_SPELLINGS = [
     fileUrlPath,
     (p) => p.replace(/[^A-Za-z0-9]/g, '-'),
 ];
-// Git Bash, Cygwin and WSL mount a drive at /c, /cygdrive/c and /mnt/c; a Claude Code folder name writes each / and : as -.
+// Git Bash, Cygwin and WSL mount a drive at /c, /cygdrive/c and /mnt/c; a Claude Code folder name writes each / and :
+// as -.
 function mountedDrive(letter) {
     return `(?:${letter}[:-]|(?:[-/](?:cygdrive|mnt))?[-/]${letter})`;
 }
@@ -211,7 +213,8 @@ function spellingPattern(spelling, deep) {
     if (process.platform !== 'win32')
         return spelling.length >= 3 ? escapeRegex(spelling) : null;
     // Each tool that mounts a drive writes it its own way, so a home two or more folders below its drive (\Users\<name>)
-    // matches after any prefix, with \, / or JSON's \\ between folders. A drive written a known way goes into the swap with it.
+    // matches after any prefix, with \, / or JSON's \\ between folders. A drive written a known way goes into the swap
+    // with it.
     const drive = /^([A-Za-z])[:-]/.exec(spelling);
     const below = drive === null ? spelling : spelling.slice(2);
     const body = below.split(/[\\/]+/).map(escapeRegex).join('[\\\\/]+');
@@ -222,7 +225,8 @@ function spellingPattern(spelling, deep) {
     }
     if (deep)
         return `${mountedDrive(drive[1])}?${body}`;
-    // One folder (C:\x, D:\home) is a name any path may hold, so it swaps only after its drive and as a whole name; a drive
+    // One folder (C:\x, D:\home) is a name any path may hold, so it swaps only after its drive and as a whole name; a
+    // drive
     // root swaps nothing.
     return /[^\\/-]/.test(below) ? `(?<![\\p{L}\\p{N}_])${mountedDrive(drive[1])}${body}` : null;
 }
@@ -301,7 +305,8 @@ export function buildSupportBundle(opts) {
         env: listSetEnvNames(),
         logs: buildLogsSection(opts),
     };
-    // Store paths found from the working folder arrive resolved; the global root arrives as HIPPO_HOME was typed, and log lines
+    // Store paths found from the working folder arrive resolved; the global root arrives as HIPPO_HOME was typed, and log
+    // lines
     // often quote the temp folder, which usually sits under the home.
     const redacted = redactStrings(bundle, buildHomePattern(opts.home, [getGlobalRoot(), os.tmpdir()]));
     // SAFETY: the value built above is always a JsonObject; redactStrings preserves object shape.

package/dist/trust/quarantine.d.ts

@@ -1,4 +1,3 @@
 /** Quarantine tier (CD5, AT3): pending/approved/rejected record for a memory `remember` flagged as untrusted. */
-export { quarantineScopeFor } from '../store/quarantine.js';
-export declare function isQuarantineScope(scope: string | null | undefined): boolean;
+export { isQuarantineScope, quarantineScopeFor } from '../store/quarantine.js';
 //# sourceMappingURL=quarantine.d.ts.map

package/dist/trust/quarantine.js

@@ -1,8 +1,4 @@
 /** Quarantine tier (CD5, AT3): pending/approved/rejected record for a memory `remember` flagged as untrusted. */
-import { QUARANTINE_SCOPE_PREFIX } from '../store/quarantine.js';
 // The scope a held memory is stored under is the table's own rule, so the store module owns it.
-export { quarantineScopeFor } from '../store/quarantine.js';
-export function isQuarantineScope(scope) {
-    return scope != null && scope.startsWith(QUARANTINE_SCOPE_PREFIX);
-}
+export { isQuarantineScope, quarantineScopeFor } from '../store/quarantine.js';
 //# sourceMappingURL=quarantine.js.map

package/dist/trust/reject-flow.d.ts

@@ -9,14 +9,23 @@ export interface RejectFlowOpts {
     memoryId?: string;
     /** Pre-emptive form: reject a value not currently stored (or already gone). */
     value?: string;
-    /** The caller's own personal scope: the only personal rows the sweep may remove. Unset (the CLI) skips every personal row. */
+    /**
+     * The caller's own personal scope: the only personal rows the sweep may remove. Unset (the CLI) skips every personal
+     * row.
+     */
     ownScope?: string;
 }
 export type RejectFlowResult = AppliedRejection;
-/** `hippo reject` and `api.reject`: refuses a bad request, then tombstones the value and removes every row in reach that holds it. */
+/**
+ * `hippo reject` and `api.reject`: refuses a bad request, then tombstones the value and removes every row in reach that
+ * holds it.
+ */
 export declare function rejectValue(opts: RejectFlowOpts): RejectFlowResult;
 export type UnrejectOutcome = LiftedRejection;
-/** `hippo unreject` and `api.unreject`: lifts the one tombstone a digest or prefix names. The only way to allow a rejected value again. */
+/**
+ * `hippo unreject` and `api.unreject`: lifts the one tombstone a digest or prefix names. The only way to allow a
+ * rejected value again.
+ */
 export declare function unrejectValue(hippoRoot: string, tenantId: string, digestOrPrefix: string, actor: string): UnrejectOutcome;
 /** `hippo rejections` / `api.listRejections` — list tombstones for a tenant. */
 export declare function listRejectionsForTenant(hippoRoot: string, tenantId: string): RejectedValueRow[];

package/dist/trust/reject-flow.js

@@ -18,7 +18,8 @@ function assertRejectOpts(opts) {
         throw new Error('reject accepts either a memory id or --value, not both.');
     }
     if (opts.value !== undefined && normalizeValueForRejection(opts.value).length === 0) {
-        // Direct api callers can pass strings the CLI flag parser would refuse; an empty-normalized tombstone would refuse nothing and pollute the listing.
+        // Direct api callers can pass strings the CLI flag parser would refuse; an empty-normalized tombstone would refuse
+        // nothing and pollute the listing.
         throw new Error('reject --value requires non-empty content.');
     }
 }
@@ -29,15 +30,19 @@ function contentToReject(opts, row) {
         throw new Error(`memory not found: ${opts.memoryId}`);
     }
     // A tombstone is tenant-wide, so one made from personal text would show its reason to everyone.
-    if (isPersonalScope(row.scope))
+    if (isPersonalScope(row.scope)) {
         throw new BadRequestError("Personal memories can't be rejected. Use forget to remove it.");
+    }
     return row.content;
 }
 /** Every row but another person's personal one, which is outside the caller's recall and so outside its reject. */
 function inReach(opts, scope) {
     return !isPersonalScope(scope) || scope === opts.ownScope;
 }
-/** `hippo reject` and `api.reject`: refuses a bad request, then tombstones the value and removes every row in reach that holds it. */
+/**
+ * `hippo reject` and `api.reject`: refuses a bad request, then tombstones the value and removes every row in reach that
+ * holds it.
+ */
 export function rejectValue(opts) {
     assertRejectOpts(opts);
     return applyRejection(opts.hippoRoot, {
@@ -50,7 +55,10 @@ export function rejectValue(opts) {
         successorOf: mergedSuccessor,
     });
 }
-/** `hippo unreject` and `api.unreject`: lifts the one tombstone a digest or prefix names. The only way to allow a rejected value again. */
+/**
+ * `hippo unreject` and `api.unreject`: lifts the one tombstone a digest or prefix names. The only way to allow a
+ * rejected value again.
+ */
 export function unrejectValue(hippoRoot, tenantId, digestOrPrefix, actor) {
     // A blank prefix would match every digest and list the whole tombstone set as ambiguous.
     if (digestOrPrefix.trim().length === 0) {

package/dist/util/anthropic-messages.d.ts

@@ -1,4 +1,7 @@
-/** The one Anthropic Messages client: sends one user prompt and returns the reply text or a typed failure the caller reacts to. */
+/**
+ * The one Anthropic Messages client: sends one user prompt and returns the reply text or a typed failure the caller
+ * reacts to.
+ */
 export interface AnthropicMessageRequest {
     apiKey: string;
     model?: string;

package/dist/util/anthropic-messages.js

@@ -1,6 +1,9 @@
-/** The one Anthropic Messages client: sends one user prompt and returns the reply text or a typed failure the caller reacts to. */
+/**
+ * The one Anthropic Messages client: sends one user prompt and returns the reply text or a typed failure the caller
+ * reacts to.
+ */
 import { fetchWithRetry, llmTimeoutMs, llmTotalMs } from './http-retry.js';
-import { errorMessage } from './log.js';
+import { errorFields, errorMessage, log } from './log.js';
 import { readCappedJson, readCappedText } from './capped-json.js';
 import { isJsonObject, isJsonString } from './json.js';
 import { redactSecretsStrict } from './secret-detect.js';
@@ -24,10 +27,15 @@ function firstText(reply) {
 export function isPermanentFailure(failure) {
     return failure.kind === 'http' && PERMANENT_STATUSES.has(failure.status);
 }
-/** The start of a failed reply's body, on one line with any key-shaped text masked; empty when the body cannot be read. */
+/**
+ * The start of a failed reply's body, on one line with any key-shaped text masked; empty when the body cannot be read.
+ */
 async function errorSnippet(res) {
     // The status is the failure reported; a body that cannot be read only costs its snippet.
-    const body = await readCappedText(res, ERROR_SNIPPET_CHARS * UTF8_MAX_BYTES_PER_CHAR).catch(() => '');
+    const body = await readCappedText(res, ERROR_SNIPPET_CHARS * UTF8_MAX_BYTES_PER_CHAR).catch((err) => {
+        log.warn(`anthropic: could not read the error body of a ${res.status} reply`, errorFields(err));
+        return '';
+    });
     // Masked before the cut, so a key that straddles the cut is never left half shown.
     return redactSecretsStrict(body.replace(/\s+/g, ' ').trim()).slice(0, ERROR_SNIPPET_CHARS);
 }
@@ -56,8 +64,9 @@ export async function sendAnthropicMessage(req) {
         return { ok: false, failure: { kind: 'http', status: res.status, detail: await errorSnippet(res) } };
     try {
         const data = await readCappedJson(res, MAX_REPLY_BYTES);
-        if (!isJsonObject(data))
+        if (!isJsonObject(data)) {
             return { ok: false, failure: { kind: 'unreadable', message: 'the reply is not a JSON object' } };
+        }
         const text = firstText(data);
         return text === '' ? { ok: false, failure: { kind: 'empty' } } : { ok: true, text };
     }

package/dist/util/atomic-write.d.ts

@@ -1,5 +1,7 @@
-/** Replaces `file` through a flushed temp file and a rename, so a reader, or a crash at any point, finds the old content or the new, whole.
- *  A file with other hard links, or a rename the platform refuses (logged), is written in place: a crash mid-write can leave it truncated.
+/** Replaces `file` through a flushed temp file and a rename, so a reader, or a crash at any point, finds the old
+ * content or the new, whole.
+ * A file with other hard links, or a rename the platform refuses (logged), is written in place: a crash mid-write can
+ * leave it truncated.
  *  `durable: false` skips the fsyncs for derived files that can be rebuilt; a reader still never sees a torn file. */
 export declare function writeFileAtomic(file: string, text: string, opts?: {
     readonly durable?: boolean;

package/dist/util/atomic-write.js

@@ -1,17 +1,19 @@
 // One way to replace a file a user or another program depends on: write a temp file beside it, then rename over it.
 import * as fs from 'fs';
 import * as path from 'path';
-import { errorMessage, log } from './log.js';
+import { errorMessage, log, errorFields } from './log.js';
 const RENAME_RETRY_MS = 1000;
 const WINDOWS_RENAME_REFUSALS = ['EPERM', 'EACCES', 'EBUSY'];
-// A rename can be refused where an in-place write still works (a bind-mounted file, a read-only folder), so these fall back to one.
+// A rename can be refused where an in-place write still works (a bind-mounted file, a read-only folder), so these fall
+// back to one.
 const REPLACE_REFUSALS = ['EBUSY', 'EXDEV', 'EACCES', 'EPERM'];
 // Matches the usual SYMLOOP_MAX, so a link cycle ends in an error instead of a hang.
 const MAX_LINK_HOPS = 40;
 function errnoCode(err) {
     return 'code' in err ? String(err.code) : '';
 }
-/** Windows refuses a rename onto a file another program has open, usually for a moment, so a refusal is retried before it is reported. */
+/** Windows refuses a rename onto a file another program has open, usually for a moment, so a refusal is retried
+ * before it is reported. */
 function renameOnto(tmp, target) {
     const deadline = Date.now() + RENAME_RETRY_MS;
     const idle = new Int32Array(new SharedArrayBuffer(4));
@@ -29,7 +31,8 @@ function renameOnto(tmp, target) {
         }
     }
 }
-/** Where a write to `file` lands: through any symlink, a dangling one included, so a dotfile manager's link survives. */
+/** Where a write to `file` lands: through any symlink, a
+ * dangling one included, so a dotfile manager's link survives. */
 function writeTarget(file) {
     let target = file;
     for (let hop = 0; hop < MAX_LINK_HOPS && fs.lstatSync(target, { throwIfNoEntry: false })?.isSymbolicLink(); hop++) {
@@ -43,16 +46,18 @@ function keepAccess(tmp, old) {
     if (process.getuid?.() === 0)
         fs.chownSync(tmp, old.uid, old.gid);
 }
-/** Cleanup must not hide the failure that made it necessary, so a cleanup error is logged and the first error stays the one thrown. */
+/** Cleanup must not hide the failure that made it necessary, so a cleanup error is logged and the first error stays
+ * the one thrown. */
 function removeTemp(tmp) {
     try {
         fs.rmSync(tmp, { force: true });
     }
     catch (err) {
-        log.warn(`could not remove the temporary file ${tmp}: ${errorMessage(err)}`);
+        log.warn(`could not remove the temporary file ${tmp}: ${errorMessage(err)}`, errorFields(err));
     }
 }
-/** Flushed before the rename, or a crash soon after could leave the file's name on bytes that never reached the disk. */
+/** Flushed before the rename, or a crash soon after could
+ * leave the file's name on bytes that never reached the disk. */
 function writeFlushed(tmp, text, old, durable) {
     const fd = fs.openSync(tmp, 'w', (old?.mode ?? 0o666) & 0o777);
     try {
@@ -66,7 +71,8 @@ function writeFlushed(tmp, text, old, durable) {
         fs.closeSync(fd);
     }
 }
-/** Stores the rename itself. Windows cannot flush a folder handle, and a failure here costs durability, not content, so it only warns. */
+/** Stores the rename itself. Windows cannot flush a folder handle, and a failure here costs durability, not content,
+ * so it only warns. */
 function flushFolder(dir) {
     if (process.platform === 'win32')
         return;
@@ -80,7 +86,7 @@ function flushFolder(dir) {
         }
     }
     catch (err) {
-        log.warn(`could not flush the folder ${dir} to disk after replacing a file in it: ${errorMessage(err)}`);
+        log.warn(`could not flush the folder ${dir} to disk after replacing a file in it: ${errorMessage(err)}`, errorFields(err));
     }
 }
 function replaceViaTemp(target, text, old, durable) {
@@ -96,7 +102,8 @@ function replaceViaTemp(target, text, old, durable) {
     if (durable)
         flushFolder(path.dirname(target));
 }
-/** The pre-rename write: it truncates first, so it is only the fallback, but it needs just a writable file and keeps hard links together. */
+/** The pre-rename write: it truncates first, so it is only the fallback, but it needs just a writable file and keeps
+ * hard links together. */
 function writeInPlace(target, text) {
     try {
         fs.writeFileSync(target, text, 'utf8');
@@ -110,8 +117,10 @@ function writeInPlace(target, text) {
         throw new Error(`${target} ${reason}`, { cause: err });
     }
 }
-/** Replaces `file` through a flushed temp file and a rename, so a reader, or a crash at any point, finds the old content or the new, whole.
- *  A file with other hard links, or a rename the platform refuses (logged), is written in place: a crash mid-write can leave it truncated.
+/** Replaces `file` through a flushed temp file and a rename, so a reader, or a crash at any point, finds the old
+ * content or the new, whole.
+ * A file with other hard links, or a rename the platform refuses (logged), is written in place: a crash mid-write can
+ * leave it truncated.
  *  `durable: false` skips the fsyncs for derived files that can be rebuilt; a reader still never sees a torn file. */
 export function writeFileAtomic(file, text, opts = {}) {
     const durable = opts.durable !== false;
@@ -121,7 +130,8 @@ export function writeFileAtomic(file, text, opts = {}) {
         fs.mkdirSync(path.dirname(target), { recursive: true });
     }
     else {
-        // A rename replaces a read-only file that the in-place write refused, and Windows would retry that refusal for a second.
+        // A rename replaces a read-only file that the in-place write
+        // refused, and Windows would retry that refusal for a second.
         fs.accessSync(target, fs.constants.W_OK);
     }
     if (old !== undefined && old.nlink > 1) {
@@ -135,7 +145,8 @@ export function writeFileAtomic(file, text, opts = {}) {
     catch (err) {
         if (!(err instanceof Error) || !REPLACE_REFUSALS.includes(errnoCode(err)))
             throw err;
-        log.warn(`${target} could not be replaced by a rename (${errnoCode(err)}), so it is written in place: not atomic, a crash mid-write can leave it truncated`);
+        log.warn(`${target} could not be replaced by a rename (${errnoCode(err)}), so it is ` +
+            `written in place: not atomic, a crash mid-write can leave it truncated`, errorFields(err));
         writeInPlace(target, text);
     }
 }

package/dist/util/compaction-items.d.ts

@@ -9,7 +9,10 @@ export interface CompactionItemRows {
     tooLong: number;
     capped: number;
 }
-/** The <summary> body of a PostCompact compact_summary with any <analysis> block removed; the whole text trimmed when there is no <summary> tag. */
+/**
+ * The <summary> body of a PostCompact compact_summary with any <analysis> block removed; the whole text trimmed when
+ * there is no <summary> tag.
+ */
 export declare function compactSummaryBody(compactSummary: string): string;
 /** found=false when no "Memories for hippo" heading; items in order, "none" dropped, never cut. */
 export declare function parseCompactionItems(summaryBody: string): ParsedCompactionItems;

package/dist/util/compaction-items.js

@@ -20,14 +20,20 @@ function withoutAnalysis(text) {
         from = close + ANALYSIS_CLOSE.length;
     }
 }
-/** `text` minus its trailing run of `*`, `:` and spaces; read from the end, as a `+$` pattern retries the run from each character. */
+/**
+ * `text` minus its trailing run of `*`, `:` and spaces; read from the end, as a `+$` pattern retries the run from each
+ * character.
+ */
 function withoutHeadingTrailer(text) {
     let end = text.length;
     while (end > 0 && HEADING_TRAILER.test(text[end - 1]))
         end--;
     return text.slice(0, end);
 }
-/** The <summary> body of a PostCompact compact_summary with any <analysis> block removed; the whole text trimmed when there is no <summary> tag. */
+/**
+ * The <summary> body of a PostCompact compact_summary with any <analysis> block removed; the whole text trimmed when
+ * there is no <summary> tag.
+ */
 export function compactSummaryBody(compactSummary) {
     const text = withoutAnalysis(compactSummary);
     const open = text.lastIndexOf('<summary>');

package/dist/util/crash-handlers.d.ts

@@ -3,10 +3,15 @@ export interface Shutdown {
     readonly run: () => void | Promise<void>;
     readonly boundMs: number;
 }
-/** Exit once stdout and stderr have drained, so the last reply and the last log line reach their reader; capped at 1 s. */
+/**
+ * Exit once stdout and stderr have drained, so the last reply and the last log line reach their reader; capped at 1 s.
+ */
 export declare function exitAfterFlush(code: number): void;
 /** On SIGTERM or SIGINT: runs `shutdown` once, then exits 0. */
 export declare function installSignalHandlers(name: string, shutdown: Shutdown): void;
-/** After an uncaught throw the process state is unknown: log the cause, run `shutdown` once, then exit 1 for the supervisor or client to restart it. */
+/**
+ * After an uncaught throw the process state is unknown: log the cause, run `shutdown` once, then exit 1 for the
+ * supervisor or client to restart it.
+ */
 export declare function installCrashHandlers(name: string, shutdown?: Shutdown): void;
 //# sourceMappingURL=crash-handlers.d.ts.map

package/dist/util/crash-handlers.js

@@ -8,16 +8,22 @@ function afterFlush(leave) {
     process.stderr.write('', done);
     setTimeout(leave, 1000).unref();
 }
-/** Exit once stdout and stderr have drained, so the last reply and the last log line reach their reader; capped at 1 s. */
+/**
+ * Exit once stdout and stderr have drained, so the last reply and the last log line reach their reader; capped at 1 s.
+ */
 export function exitAfterFlush(code) {
     process.exitCode = code;
     afterFlush(() => process.exit(code));
 }
-// process.exit joins every worker thread, so one stuck in a synchronous statement would hold the exit open; a kill cannot be held.
+// process.exit joins every worker thread, so one stuck in a synchronous statement would hold the exit open; a kill
+// cannot be held.
 function killSelf() {
     process.kill(process.pid, 'SIGKILL');
 }
-/** Runs `shutdown` for `cause`, then exits with `code`, or 1 when it threw. One still running after its bound is logged and the process ended without it. */
+/**
+ * Runs `shutdown` for `cause`, then exits with `code`, or 1 when it threw. One still running after its bound is logged
+ * and the process ended without it.
+ */
 function exitAfterShutdown(name, cause, shutdown, code) {
     let ended = false;
     // Referenced on purpose: a shutdown that never settles must end at the bound, not when the loop happens to empty.
@@ -52,7 +58,10 @@ export function installSignalHandlers(name, shutdown) {
     process.once('SIGTERM', () => stopFor('SIGTERM'));
     process.once('SIGINT', () => stopFor('SIGINT'));
 }
-/** After an uncaught throw the process state is unknown: log the cause, run `shutdown` once, then exit 1 for the supervisor or client to restart it. */
+/**
+ * After an uncaught throw the process state is unknown: log the cause, run `shutdown` once, then exit 1 for the
+ * supervisor or client to restart it.
+ */
 export function installCrashHandlers(name, shutdown) {
     let crashing = false;
     const crash = (kind, err) => {

package/dist/util/env.d.ts

@@ -1,4 +1,7 @@
-/** The whole environment, for code that takes it as an injectable map (agent-memory machines, owner checks, support bundles). */
+/**
+ * The whole environment, for code that takes it as an injectable map (agent-memory machines, owner checks, support
+ * bundles).
+ */
 export declare function processEnv(): NodeJS.ProcessEnv;
 /** A variable whose name comes from configuration, such as an embedding provider's key variable. */
 export declare function envByName(name: string): string | undefined;
@@ -46,7 +49,10 @@ export declare function envLogLevel(): string;
 /** `HIPPO_LOG_FORMAT=json` writes each log line as one JSON object; anything else keeps the text line. */
 export declare function envLogJson(): boolean;
 export declare function envPort(): string | undefined;
-/** How long a client waits for a running server's /health before writing to the store directly; server-detect.ts holds the default. */
+/**
+ * How long a client waits for a running server's /health before writing to the store directly; server-detect.ts holds
+ * the default.
+ */
 export declare function envHealthProbeMs(): number | undefined;
 export declare function envRequireAuth(): boolean;
 /** `1` lets a request made on this machine in with no key; HIPPO_REQUIRE_AUTH=1 wins over it. */
@@ -65,7 +71,10 @@ export declare function envSleepTimeoutMs(): number | undefined;
 /** How long a /v1 or /mcp request may run before the server answers 504, and a stdio MCP
  * request before its timeout error; 0 for no deadline; util/request-scope.ts holds the default. */
 export declare function envRequestDeadlineMs(): number | undefined;
-/** How many store calls may wait for one worker thread before the next is refused; store/sqlite/executor.ts holds the default. */
+/**
+ * How many store calls may wait for one worker thread before the next is refused; store/sqlite/executor.ts holds the
+ * default.
+ */
 export declare function envStoreQueueMax(): number | undefined;
 /** How long the daily runner lets one child `hippo` step run; cli/setup.ts holds the default. */
 export declare function envDailyStepTimeoutMs(): number | undefined;
@@ -84,7 +93,10 @@ export declare function envLlmTimeoutMs(): number | undefined;
 export declare function envTypesafeApiKey(): string | undefined;
 export declare function envJevTimeoutMs(): number | undefined;
 export declare function envJevModel(): string | undefined;
-/** How long a recall waits for an API provider to embed its query before ranking on BM25 alone; search/vector.ts holds the default. */
+/**
+ * How long a recall waits for an API provider to embed its query before ranking on BM25 alone; search/vector.ts holds
+ * the default.
+ */
 export declare function envQueryEmbedTimeoutMs(): number | undefined;
 export declare function envLlmRerankerUrl(): string | undefined;
 export declare function envLlmRerankerKey(): string | undefined;