@gamaze/hicortex 0.15.3 → 0.16.1

package/dist/index.js

@@ -163,10 +163,11 @@ async function buildLessonsBlock(project) {
     if (selected.length === 0)
         return null;
     const formatted = selected.map((l) => {
-        const titleMatch = l.content.match(/## Lesson: (.+)/);
         const typeMatch = l.content.match(/\*\*Type:\*\* (\w+)/);
         const severityMatch = l.content.match(/\*\*Severity:\*\* (\w+)/);
-        const title = titleMatch ? titleMatch[1] : l.content.slice(0, 150);
+        // First line, with any legacy `## Lesson:` prefix stripped — new lessons
+        // are stored topic-first without the prefix (memory_type carries the type).
+        const title = l.content.replace(/^##\s*Lesson:\s*/i, "").split("\n")[0].slice(0, 150);
         const meta = [severityMatch?.[1], typeMatch?.[1]].filter(Boolean).join(", ");
         return `- ${title}${meta ? ` (${meta})` : ""}`;
     });
@@ -184,7 +185,7 @@ async function buildLessonsBlock(project) {
  * plugin sends every turn and carries no tuning constants. A 404 flips the
  * module-level guard so an old server is probed once per gateway process.
  */
-async function fetchRecallIndexBlock(sessionId, prompt) {
+async function fetchRecallIndexBlock(sessionId, prompt, project) {
     if (recallIndexLatched())
         return null;
     if (!sessionId || !prompt) {
@@ -201,7 +202,16 @@ async function fetchRecallIndexBlock(sessionId, prompt) {
         }
         return null;
     }
-    const { ok, status, data } = await serverPost("/recall-index", { session_id: sessionId, prompt }, RECALL_TIMEOUT_MS);
+    // #203 scope: send the gateway-supplied project so retrieval can apply a soft
+    // project-affinity boost (no hard filter — "no hard filters in brains").
+    // Absent ⇒ no scope sent ⇒ no-op (preserves pre-#203 behavior).
+    const body = {
+        session_id: sessionId,
+        prompt,
+    };
+    if (project)
+        body.project = project;
+    const { ok, status, data } = await serverPost("/recall-index", body, RECALL_TIMEOUT_MS);
     if (status === 404) {
         recallIndexRetryAtMs = Date.now() + RECALL_REPROBE_INTERVAL_MS;
         return null;
@@ -317,7 +327,7 @@ exports.default = {
                 const [contextBlock, lessonsBlock, recallBlock] = await Promise.all([
                     fetchOcContextBlock(agentId).catch(() => null),
                     buildLessonsBlock(ctx?.project).catch(() => null),
-                    fetchRecallIndexBlock(ctx?.sessionId, event?.prompt).catch(() => null),
+                    fetchRecallIndexBlock(ctx?.sessionId, event?.prompt, ctx?.project).catch(() => null),
                 ]);
                 const blocks = [contextBlock, lessonsBlock, recallBlock].filter((b) => b !== null && b !== "");
                 if (blocks.length === 0)
@@ -378,7 +388,7 @@ exports.default = {
         }), { name: "hicortex_search" });
         api.registerTool((_ctx) => ({
             name: "hicortex_get",
-            description: "Fetch ONE memory's full content by id — use this to lazy-load entries from the '## Memory recall (auto)' index or from search results whose snippet was not enough. Fetching a memory marks it as used (strengthens it), so fetch entries that could change your action — not every shown one. When the memory shapes your answer, cite it as given in the response.",
+            description: "Fetch ONE memory's full content by id — use this to lazy-load entries from the '## Memory recall (auto)' index or from search results whose snippet was not enough. Fetching a memory marks it as used (strengthens it), so fetch entries that could change your action — not every shown one. When the memory shapes your answer, cite it as given in the response — mark a fetched memory `FETCHED` and a one-line entry cited unread `SNIPPET`; don't pass SNIPPET off as established.",
             parameters: {
                 type: "object",
                 properties: {

package/dist/init.d.ts

@@ -13,7 +13,7 @@
  *   - Register MCP server in CC settings
  *   - Install CC SessionStart hook for query-time lessons
  *   - Strip old static CLAUDE.md learnings block if present
- *   - Install CC custom commands (/learn, /hicortex-activate)
+ *   - Remove legacy pre-0.10 CC commands (/learn, /hicortex-activate) if present
  */
 import type { DomainDef } from "./types.js";
 /**

package/dist/init.js

@@ -14,7 +14,7 @@
  *   - Register MCP server in CC settings
  *   - Install CC SessionStart hook for query-time lessons
  *   - Strip old static CLAUDE.md learnings block if present
- *   - Install CC custom commands (/learn, /hicortex-activate)
+ *   - Remove legacy pre-0.10 CC commands (/learn, /hicortex-activate) if present
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GENERIC_DEFAULT_DOMAINS = void 0;
@@ -255,98 +255,50 @@ function allowHicortexTools() {
         console.log(`  ✓ Added Hicortex tool permissions to ${CC_SETTINGS}`);
     }
 }
-function installCcCommands() {
-    (0, node_fs_1.mkdirSync)(CC_COMMANDS_DIR, { recursive: true });
-    // /learn command
-    const learnContent = `---
-name: learn
-description: Save an explicit learning/insight to Hicortex long-term memory. Immediate storage, no nightly wait. Use when you discover something worth remembering across sessions.
-argument-hint: <learning to save>
-allowed-tools: mcp__hicortex__hicortex_ingest, mcp__hicortex__hicortex_search, mcp__hicortex__hicortex_recent, mcp__hicortex__hicortex_lessons
----
-
-# Save Learning to Hicortex
-
-When invoked with \`/learn <text>\`, store the learning in long-term memory via the Hicortex MCP tool.
-
-## Steps
-
-1. Parse the text after \`/learn\`
-2. Clean it up into a clear, self-contained statement that will make sense months from now
-3. Include the "why" when relevant
-4. Add today's date for temporal context
-5. Call the \`hicortex_ingest\` tool with:
-   - \`content\`: The learning text prefixed with "LEARNING: " and suffixed with the date
-   - \`project\`: "global" (unless clearly project-specific)
-   - \`memory_type\`: "lesson"
-6. Confirm what was saved (brief, one line)
-
-## Example
-
-\`/learn always check provider docs before assuming an API uses the same auth scheme as OpenAI\`
-
-Becomes a call to hicortex_ingest with:
-- content: "LEARNING: always check provider docs before assuming an API uses the same auth scheme as OpenAI — header names and token formats vary widely (Bearer vs x-api-key vs custom)."
-- memory_type: "lesson"
-`;
-    const learnPath = (0, node_path_1.join)(CC_COMMANDS_DIR, "learn.md");
-    if ((0, node_fs_1.existsSync)(learnPath)) {
-        // Check if it's ours (contains hicortex_ingest)
-        const existing = (0, node_fs_1.readFileSync)(learnPath, "utf-8");
-        if (!existing.includes("hicortex_ingest") && !existing.includes("hicortex")) {
-            console.log(`  ⚠ Skipping /learn — existing command found (not Hicortex). Won't overwrite.`);
+function cleanupLegacyCcCommands() {
+    // Pre-0.10 installs wrote two CC slash commands that are now RETIRED:
+    //   - /learn            : manual immediate ingest. Capture has been automatic
+    //                         (nightly-from-logs) since 0.9; hicortex_ingest
+    //                         remains for *explicitly requested* learnings, but
+    //                         no longer warrants a slash command.
+    //   - /hicortex-activate : registered a commercial license key. licenseKey
+    //                         gates nothing now (the per-install auth TOKEN is
+    //                         the credential, auto-generated at init), so the
+    //                         command is dead.
+    // Remove stale copies so upgraders don't keep dead commands. Idempotent —
+    // a best-effort cleanup of our own files; never throws.
+    for (const name of ["learn.md", "hicortex-activate.md"]) {
+        const p = (0, node_path_1.join)(CC_COMMANDS_DIR, name);
+        if (!(0, node_fs_1.existsSync)(p))
+            continue;
+        // Ownership guard: only remove a file we actually wrote. `learn.md` is a
+        // generic command name a user may own independently — deleting by filename
+        // alone would silently destroy their file. The retired writer always
+        // embedded "hicortex" (the ingest tool + prose); mirror the same marker the
+        // old installer used before overwriting. Skip + warn on anything else.
+        try {
+            if (!(0, node_fs_1.readFileSync)(p, "utf-8").toLowerCase().includes("hicortex")) {
+                console.log(`  ⚠ Skipping ${name} in ${CC_COMMANDS_DIR} — not a Hicortex file, left untouched`);
+                continue;
+            }
         }
-        else {
-            (0, node_fs_1.writeFileSync)(learnPath, learnContent);
+        catch {
+            // Unreadable — do not delete blind; leave it and move on.
+            continue;
+        }
+        try {
+            (0, node_fs_1.rmSync)(p);
+            console.log(`  ✓ Removed legacy command ${name} from ${CC_COMMANDS_DIR} (retired pre-0.10)`);
+        }
+        catch (err) {
+            // ENOENT = already gone (fine, idempotent). Anything else (EACCES, EBUSY)
+            // is worth a line so a stuck stale file is diagnosable — but never fatal
+            // to init (best-effort cleanup of our own file).
+            if (err?.code !== "ENOENT") {
+                console.log(`  ⚠ Could not remove legacy command ${name}: ${err?.message ?? err}`);
+            }
         }
     }
-    else {
-        (0, node_fs_1.writeFileSync)(learnPath, learnContent);
-    }
-    // /hicortex-activate command — registers a commercial license key for display in status
-    const activateContent = `---
-name: hicortex-activate
-description: Register a Hicortex commercial license key. Personal and noncommercial use is free; commercial use requires a per-seat license from hicortex.gamaze.com.
-argument-hint: <license-key>
-allowed-tools: Bash(mkdir:*), Bash(echo:*), Bash(launchctl:*), Bash(systemctl:*), Bash(curl:*), mcp__hicortex__hicortex_ingest, mcp__hicortex__hicortex_search, mcp__hicortex__hicortex_recent, mcp__hicortex__hicortex_lessons
----
-
-# Register Hicortex Commercial License
-
-## If key provided (e.g. /hicortex-activate hctx-abc123)
-
-1. Write the key to the config file:
-
-\`\`\`bash
-mkdir -p ~/.hicortex
-echo '{ "licenseKey": "THE_KEY_HERE" }' > ~/.hicortex/config.json
-\`\`\`
-
-2. Restart the server to apply:
-
-On macOS:
-\`\`\`bash
-launchctl kickstart -k gui/$(id -u)/com.gamaze.hicortex
-\`\`\`
-
-On Linux:
-\`\`\`bash
-systemctl --user restart hicortex
-\`\`\`
-
-3. Verify the key is recognised:
-\`\`\`bash
-hicortex status
-\`\`\`
-
-4. Tell the user: "Commercial license registered. The license tier will appear in \`hicortex status\`."
-
-## If no key provided
-
-Tell them: "Hicortex is free for personal and noncommercial use. Commercial use requires a per-seat license — see https://hicortex.gamaze.com/. After purchase you will receive a key; pass it here and I'll register it."
-`;
-    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(CC_COMMANDS_DIR, "hicortex-activate.md"), activateContent);
-    console.log(`  ✓ Installed /learn and /hicortex-activate commands in ${CC_COMMANDS_DIR}`);
 }
 // ---------------------------------------------------------------------------
 // Hermes setup
@@ -1211,7 +1163,6 @@ async function runInit(options = {}) {
         actions.push("Register MCP server in CC settings");
     if (d.hermesFound)
         actions.push("Install Hermes plugin + configure");
-    actions.push("Install /learn and /hicortex-activate commands");
     actions.push("Install SessionStart hook (query-time lessons)");
     if (actions.length === 0) {
         console.log("Everything is already configured. Nothing to do.");
@@ -1294,8 +1245,8 @@ async function runInit(options = {}) {
     }
     // Ensure tool permissions are set (also needed for users upgrading from older versions)
     allowHicortexTools();
-    // Install CC commands
-    installCcCommands();
+    // Remove legacy pre-0.10 CC commands (/learn, /hicortex-activate) if present
+    cleanupLegacyCcCommands();
     // Setup Hermes if detected
     if (d.hermesFound) {
         // localhost bypass makes the token optional for co-located installs;
@@ -1325,13 +1276,15 @@ async function runInit(options = {}) {
     // failures are swallowed inside sendLifecycleEvent.
     await (0, telemetry_js_1.sendLifecycleEvent)("install", HICORTEX_HOME, readHomeConfig(HICORTEX_HOME), pkgVersion());
     console.log("Next steps:");
-    console.log("  1. Restart Claude Code to pick up the new MCP server and SessionStart hook");
+    // Counter-based so the list stays contiguous (1,2,3,4) whether or not Hermes
+    // was detected — a conditional middle step used to leave a "1, 3, 4" gap.
+    let step = 1;
+    console.log(`  ${step++}. Restart Claude Code to pick up the new MCP server and SessionStart hook`);
     if (d.hermesFound) {
-        console.log("  2. Activate the Hermes plugin: run `hermes memory setup`, select 'hicortex', then restart the gateway(s)");
+        console.log(`  ${step++}. Activate the Hermes plugin: run \`hermes memory setup\`, select 'hicortex', then restart the gateway(s)`);
     }
-    console.log("  3. Ask your agent: 'What Hicortex tools do you have?'");
-    console.log("  4. Try /learn to save something to long-term memory");
-    console.log(`  5. Check server: curl ${serverUrl}/health`);
+    console.log(`  ${step++}. Ask your agent: 'What Hicortex tools do you have?'`);
+    console.log(`  ${step++}. Check server: curl ${serverUrl}/health`);
 }
 // ---------------------------------------------------------------------------
 // Client Mode Init
@@ -1470,8 +1423,8 @@ async function runClientInit(serverUrl, agentName) {
         registerCcMcp(serverUrl);
     }
     allowHicortexTools();
-    // Step 5: Install CC commands
-    installCcCommands();
+    // Step 5: Remove legacy pre-0.10 CC commands if present
+    cleanupLegacyCcCommands();
     // Step 6: Install SessionStart hook for query-time lessons + the #192
     // per-prompt pushed-recall hooks.
     installSessionStartHook();

package/dist/lessons-context.js

@@ -90,10 +90,11 @@ async function fetchLessonsBlock(cfg) {
     const project = (0, node_path_1.basename)(process.cwd()) || null;
     const selected = await (0, extensions_js_1.getLessonSelector)().select(data.lessons, { maxLessons, moduleIndex, project });
     const lessonLines = selected.map((l) => {
-        const titleMatch = l.content.match(/## Lesson: (.+)/);
         const typeMatch = l.content.match(/\*\*Type:\*\* (\w+)/);
         const severityMatch = l.content.match(/\*\*Severity:\*\* (\w+)/);
-        const title = titleMatch ? titleMatch[1] : l.content.slice(0, 150);
+        // First line, with any legacy `## Lesson:` prefix stripped — new lessons
+        // are stored topic-first without the prefix (memory_type carries the type).
+        const title = l.content.replace(/^##\s*Lesson:\s*/i, "").split("\n")[0].slice(0, 150);
         const meta = [severityMatch?.[1], typeMatch?.[1]].filter(Boolean).join(", ");
         return `- ${title}${meta ? ` (${meta})` : ""}`;
     });

package/dist/llm.d.ts

@@ -191,8 +191,10 @@ export declare class RateLimitError extends Error {
 }
 export declare class LlmClient {
     private config;
-    private rateLimitedUntil;
     constructor(config: LlmConfig);
+    /** Endpoint identity for shared rate-limit state (provider + base URL). */
+    private get endpointKey();
+    private get rateLimitedUntil();
     /** Check if we're currently rate limited */
     get isRateLimited(): boolean;
     private handleRateLimit;

package/dist/llm.js

@@ -466,12 +466,25 @@ class RateLimitError extends Error {
     }
 }
 exports.RateLimitError = RateLimitError;
+// Rate-limit backoff is shared across all LlmClient instances that target the
+// same endpoint, keyed by provider@baseUrl. completeWithOverride() spins up a
+// throwaway client per call for the distill/reflect/classify override tiers;
+// with per-instance state each throwaway started un-rate-limited and re-hit a
+// 429'd provider immediately, defeating the backoff on exactly the configs
+// (e.g. z.ai via distillBaseUrl/reflectBaseUrl) that route through those tiers.
+const rateLimitedUntilByEndpoint = new Map();
 class LlmClient {
     config;
-    rateLimitedUntil = 0;
     constructor(config) {
         this.config = config;
     }
+    /** Endpoint identity for shared rate-limit state (provider + base URL). */
+    get endpointKey() {
+        return `${this.config.provider}@${this.config.baseUrl ?? ""}`;
+    }
+    get rateLimitedUntil() {
+        return rateLimitedUntilByEndpoint.get(this.endpointKey) ?? 0;
+    }
     /** Check if we're currently rate limited */
     get isRateLimited() {
         return Date.now() < this.rateLimitedUntil;
@@ -482,9 +495,10 @@ class LlmClient {
         const retryMs = retryAfter
             ? parseInt(retryAfter, 10) * 1000
             : DEFAULT_RATE_LIMIT_RETRY_MS;
-        this.rateLimitedUntil = Date.now() + retryMs;
-        console.log(`[hicortex] Rate limited by LLM provider. ` +
-            `Will retry after ${new Date(this.rateLimitedUntil).toISOString()}`);
+        const until = Date.now() + retryMs;
+        rateLimitedUntilByEndpoint.set(this.endpointKey, until);
+        console.log(`[hicortex] Rate limited by LLM provider (${this.endpointKey}). ` +
+            `Will retry after ${new Date(until).toISOString()}`);
         throw new RateLimitError(retryMs);
     }
     /**

package/dist/mcp-server.js

@@ -128,27 +128,18 @@ function createMcpServer() {
         }
     });
     // -- hicortex_get --
-    server.tool("hicortex_get", "Fetch ONE memory's full content by id — use this to lazy-load entries from the '## Memory recall (auto)' index or from search results whose snippet was not enough. Fetching a memory marks it as used (strengthens it), so fetch entries that could change your action — not every shown one. When the memory shapes your answer, cite it to the user (id + date + origin agent).", {
+    server.tool("hicortex_get", "Fetch ONE memory's full content by id — use this to lazy-load entries from the '## Memory recall (auto)' index or from search results whose snippet was not enough. Fetching a memory marks it as used (strengthens it), so fetch entries that could change your action — not every shown one. When the memory shapes your answer, cite it to the user (id + date + origin agent) — mark a fetched memory `FETCHED` and a one-line entry cited unread `SNIPPET`; don't pass SNIPPET off as established.", {
         id: zod_1.z.string().describe("Memory id (as shown in recall index/search results)"),
     }, async ({ id }) => {
         if (!db)
             return { content: [{ type: "text", text: "Hicortex not initialized" }], isError: true };
+        // Delegates to formatMemoryGetText → handleMemoryGet, so the citation
+        // (incl. the #204 FETCHED marker) is built in ONE place shared with the
+        // REST GET /memory path. CC reaches Hicortex through THIS MCP tool;
+        // before #207's fix it got a marker-less citation built inline here.
         try {
-            // Prefix ids resolve (F6): citations show the 8-char id, so this tool
-            // must accept it like /update and /delete do.
-            const fullId = storage.resolveMemoryId(db, id);
-            const mem = fullId ? storage.getMemory(db, fullId) : null;
-            if (!mem)
-                return { content: [{ type: "text", text: `No memory with id ${id}` }], isError: true };
-            // Real use → full strengthen (access_count + hardening + prune shield).
-            storage.strengthenMemory(db, mem.id, new Date().toISOString());
-            // Provenance header (built-in citing norm, 0.14.1): id, type, project,
-            // ORIGIN AGENT (shared brain — the memory may come from another
-            // agent's session), and date, plus the explicit citation instruction.
-            const date = (mem.created_at ?? "").slice(0, 10);
-            const header = `[memory ${mem.id} | ${mem.memory_type ?? "episode"} | ${mem.project ?? "-"} | from ${mem.source_agent ?? "unknown"} | ${date}]\n` +
-                `Cite as (memory ${String(mem.id).slice(0, 8)}, ${date}) where this shapes your answer; it may be stale — newer memories supersede older.`;
-            return { content: [{ type: "text", text: `${header}\n\n${mem.content ?? ""}` }] };
+            const r = (0, recall_index_js_1.formatMemoryGetText)(db, { id });
+            return { content: [{ type: "text", text: r.text }], isError: r.status !== 200 };
         }
         catch (err) {
             return { content: [{ type: "text", text: `Get failed: ${err instanceof Error ? err.message : String(err)}` }], isError: true };
@@ -503,6 +494,7 @@ async function startServer(options = {}) {
         minSimilarity: savedConfig?.recallMinSimilarity,
         maxItems: savedConfig?.recallMaxItems,
         minPromptLength: savedConfig?.recallMinPromptChars,
+        titleChars: savedConfig?.recallTitleChars,
     };
     memoryInstructionsEnabled = savedConfig?.memoryInstructions !== false;
     if (resolvedAgents.dropped.length > 0) {
@@ -513,14 +505,24 @@ async function startServer(options = {}) {
     const app = (0, express_1.default)();
     // Raise the body limit — whole-session denoised transcripts exceed the 100 kB default.
     app.use(express_1.default.json({ limit: "25mb" }));
-    // CORS: must be before auth so preflight OPTIONS requests get proper headers
+    // CORS: reflect ONLY explicitly-allowlisted origins (config.corsAllowedOrigins),
+    // and never send Access-Control-Allow-Credentials. Reflecting any origin with
+    // credentials — combined with the localhost auth bypass and the default 0.0.0.0
+    // bind — let any web page the user visits read/mutate the memory store via
+    // fetch() to localhost with no token (the browser connects from 127.0.0.1, so
+    // the bypass grants access, and the reflected Allow-Origin let the page read the
+    // response). The bundled UIs (/viz, /context/ui) are same-origin and need no CORS
+    // headers at all; cross-origin access is opt-in per the hosted plan (#110 §2).
+    // Must run before auth so allowlisted preflight OPTIONS get their headers.
+    const corsAllowedOrigins = Array.isArray(savedConfig?.corsAllowedOrigins)
+        ? savedConfig.corsAllowedOrigins.filter((o) => typeof o === "string")
+        : [];
     app.use((req, res, next) => {
         const origin = req.headers.origin;
-        if (origin) {
+        if (origin && corsAllowedOrigins.includes(origin)) {
             res.setHeader("Access-Control-Allow-Origin", origin);
             res.setHeader("Access-Control-Allow-Methods", "GET, PUT, POST, OPTIONS");
             res.setHeader("Access-Control-Allow-Headers", "Content-Type, Accept, Authorization");
-            res.setHeader("Access-Control-Allow-Credentials", "true");
             res.setHeader("Vary", "Origin");
         }
         if (req.method === "OPTIONS") {
@@ -689,8 +691,11 @@ async function startServer(options = {}) {
                 return retrieval.retrieve(db, embedder_js_1.embed, query, {
                     limit,
                     noStrengthen: true,
+                    // #203: project + mission_domains are SOFT affinity (zero-boost
+                    // neutral), threaded into computeScore. privacy stays a hard filter.
                     project: filters?.project,
                     privacy: filters?.privacy,
+                    missionDomains: filters?.mission_domains,
                     queryEmbedding: queryVec,
                 });
             },

package/dist/memory-instructions.js

@@ -33,7 +33,7 @@ function renderMemoryInstructions() {
         "Your long-term memory is Hicortex — shared across all agents and sessions.",
         "- A `## Memory recall (auto)` index may arrive with prompts: it is a MENU, not content. Fetch a full memory with `hicortex_get(id)` when the entry could change how you handle the current task.",
         "- Recall before assuming: `hicortex_search` for prior decisions/facts/preferences, `hicortex_recent` to catch up on a project.",
-        "- Cite any memory you rely on (id, date); on conflicts, newer memories supersede older.",
+        "- Cite any memory you rely on by id + date, and mark it `FETCHED` (you read the full memory via `hicortex_get`) or `SNIPPET` (the one-line entry only). Don't present a SNIPPET citation as established. On conflicts, newer memories supersede older.",
         "- Capture is automatic (nightly). Do not manually ingest routine content — `hicortex_ingest` is for explicitly requested learnings only.",
         "- Never inspect, test, or modify memory/plugin/gateway infrastructure (configs, services, tokens). If a memory tool seems missing or broken, say so and stop.",
     ].join("\n");

package/dist/prompts.js

@@ -108,25 +108,39 @@ EXTRACT into this markdown format:
 ## Classification: [pick one: PUBLIC / WORK / PERSONAL / SENSITIVE]
 
 ### Decisions Made
-- [decision]: [reasoning] (${date})
+- [SUBJECT]: [decision] — [reasoning] (${date})
 
 ### Facts Learned
-- [fact]: [context/source] (${date})
+- [SUBJECT]: [fact] — [context/source] (${date})
 
 ### Problems & Solutions
-- [problem] → [solution that worked] (${date})
+- [SUBJECT]: [problem] → [solution that worked] (${date})
 
 ### Project State Changes
-- [what changed]: [from → to] (${date})
+- [SUBJECT]: [what changed], [from → to] (${date})
 
 ### Key Entities & Relationships
 - [entity A] → [relationship] → [entity B] (${date})
 
 ### Corrections & Rejections
-- [what AI proposed] → [why rejected/corrected] → [what user wanted instead] (${date})
+- [SUBJECT]: [what AI proposed] → [why rejected/corrected] → [what user wanted instead] (${date})
   (Include: tool use denials, "no/wrong/redo", style feedback, approach rejections,
    user corrections of AI assumptions, quality complaints like "too verbose")
 
+TOPIC-FIRST RULE (critical — read carefully):
+Every item MUST begin with its [SUBJECT]: the concrete thing it is about — the
+system, file, component, decision area, or entity. The subject is what a future
+reader would search for.
+- Write:  "Electrical load calculation: don't bundle unknown loads into one figure — user rejected the estimate"
+- NOT:    "User rejected AI's bundling of unknown loads"
+- Write:  "Nightly capture (Hermes): cron sessions are excluded — source='cron' is skipped before distillation"
+- NOT:    "Discovered that cron sessions are filtered out"
+Reason: each item's first words become the memory's one-line index entry AND
+dominate its search embedding. An item that opens with a category label, a
+sentiment ("Strong Negative"), or "User rejected…" is unfindable — it matches
+every emotionally-similar prompt and no topically-relevant one. Front-load the
+subject; put reaction, intensity and reasoning AFTER it.
+
 RULES:
 - Extract MAX 20 items total (quality over quantity)
 - Each must be useful if recalled in a future session
@@ -136,7 +150,9 @@ RULES:
 - PRIORITIZE Corrections & Rejections — these are high-value signals for learning
   what the user does NOT want. Even a single "no" or style correction is worth extracting.
 - Strong language or profanity from the user is a high-intensity signal — it indicates
-  the correction matters deeply. Note the intensity in the extraction.
+  the correction matters deeply. Note the intensity AFTER the subject, never before it
+  (e.g. "Pricing tiers: strongly rejected per-agent billing — …", not
+  "[Strong Negative] User rejected per-agent billing"). The subject always comes first.
 - PRIVACY CLASSIFICATION (one of):
   - PUBLIC: general tech knowledge, open-source patterns, publicly available info
   - WORK: project-specific decisions, architecture choices, client/business context

package/dist/recall-hook-cli.d.ts

@@ -23,6 +23,6 @@ interface HookPayload {
  * there is nothing to send (no session id, or an unhandled event). Exported
  * for tests.
  */
-export declare function buildHookRequest(payload: HookPayload): Record<string, unknown> | null;
+export declare function buildHookRequest(payload: HookPayload, cwd?: string): Record<string, unknown> | null;
 export declare function runRecallHook(): Promise<void>;
 export {};

package/dist/recall-hook-cli.js

@@ -17,6 +17,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildHookRequest = buildHookRequest;
 exports.runRecallHook = runRecallHook;
 const lessons_context_js_1 = require("./lessons-context.js");
+const node_path_1 = require("node:path");
 const FETCH_TIMEOUT_MS = 1000;
 /** Read all of stdin (CC pipes the hook payload JSON). */
 async function readStdin() {
@@ -31,7 +32,7 @@ async function readStdin() {
  * there is nothing to send (no session id, or an unhandled event). Exported
  * for tests.
  */
-function buildHookRequest(payload) {
+function buildHookRequest(payload, cwd = process.cwd()) {
     const sessionId = typeof payload.session_id === "string" && payload.session_id
         ? payload.session_id
         : null;
@@ -43,7 +44,11 @@ function buildHookRequest(payload) {
     const prompt = typeof payload.prompt === "string" ? payload.prompt : "";
     if (!prompt)
         return null;
-    return { session_id: sessionId, prompt };
+    // #203 scope: derive project from the session cwd so retrieval can apply a
+    // soft project-affinity boost. basename(cwd) matches capture's
+    // decodeProjectDirName for non-hyphenated dirs (the common case); a hyphen
+    // edge case is a pre-existing capture bug, filed separately.
+    return { session_id: sessionId, prompt, project: (0, node_path_1.basename)(cwd) };
 }
 async function runRecallHook() {
     const cfg = (0, lessons_context_js_1.resolveConfig)();