@gamaze/hicortex 0.16.7 → 0.16.8

package/README.md

@@ -199,9 +199,12 @@ Config at `~/.hicortex/config.json`. Created by `init`. Key options:
 |-------|-------------|
 | `mode` | `"server"` (default) or `"client"` |
 | `serverUrl` | Remote server URL (client mode) |
-| `llmModel` | The one model the whole pipeline uses (server mode). One model is the happy path; route individual stages with `models` — see [Advanced: per-stage models](#advanced-per-stage-models) |
-| `models` | Optional nested per-stage model overrides (`score`/`distill`/`reflect`/`classify`) — see [Advanced: per-stage models](#advanced-per-stage-models) |
-| `distillFallback` | `"strict"` (default) — abort on remote distill failure, retry next run; `"local"` — fall back to base model (lower quality, 0.9.0 behaviour) |
+| `llmModel` | The one model used by all phases (distill, score, classify, reflect). Set via `init`. |
+| `numCtx` | Context window for ollama (default 8192, one value for all phases). Scoring uses ~850 tokens, so 2048 is ample; distill/reflect/classify need more for `detectChunkSize`'s chunk sizing. |
+| `enableThinking` | Toggle the model's internal reasoning ("thinking") stream for OpenAI-compatible endpoints (default false). Only meaningful for local chat-template-aware servers (ollama, mlx-lm); leave unset for cloud OpenAI/OpenRouter/Groq endpoints (they 400 on the unknown `chat_template_kwargs` field). |
+| `maxTokens` | Max output tokens for all phases (default 8192). A ceiling, not a target — the model stops early when done. |
+| `ollamaFlushEvery` | Flush ollama's accumulated memory every N scoring calls (default 0 = off). Workaround for ollama's memory-growth bug (~171 MB/call). N=15 caps a cycle at ~2.5 GB. Scoped to the fast tier (scoring) only. |
+| `ollamaFlushWaitMs` | Milliseconds to wait after an ollama flush for the runner to exit + release memory (default 180000 = 3 min). |
 | `authToken` | Bearer token for endpoint auth. Generated on first `init` in server mode. Find the active token with `hicortex status` or in `~/.hicortex/config.json`. |
 | `corsAllowedOrigins` | Browser origins allowed to read cross-origin responses, e.g. `["https://ui.example.com"]`. **Empty by default** — the server sends no `Access-Control-Allow-Origin` and never `Allow-Credentials`, so no external web page can read its data. The bundled `/viz` and `/context/ui` pages are same-origin and need no entry. |
 | `licenseKey` | Commercial license key (optional; for display in `hicortex status`) |
@@ -295,30 +298,6 @@ LLM selection is **user-controlled**: `npx @gamaze/hicortex init` detects candid
 
 If no LLM is configured, the server starts in **recall-only mode**: search, lessons, and context work; `/distill` and consolidation are disabled. Run `npx @gamaze/hicortex init` to configure.
 
-### Advanced: per-stage models
-
-The happy path is **one model** (`llmModel`) for the whole pipeline. If you want to route the four pipeline stages to different models or endpoints, add a nested `models` block to `~/.hicortex/config.json`:
-
-```json
-{
-  "llmBackend": "ollama",
-  "llmModel": "qwen3.5:4b",
-  "models": {
-    "score":    { "model": "qwen3.5:4b" },
-    "distill":  { "model": "qwen3.5:35b-a3b", "baseUrl": "http://gpu-box:11434" },
-    "reflect":  { "model": "qwen3.5:35b-a3b", "baseUrl": "http://gpu-box:11434" },
-    "classify": { "model": "gemma4-31b",      "baseUrl": "http://gpu-box:11434" }
-  }
-}
-```
-
-The four tiers: `score` (importance scoring — this **is** the base model), `distill` (session distillation, 9b+ recommended), `reflect` (nightly reflection, largest available), `classify` (memory-domain tagging). Each accepts `model`, `baseUrl`, `apiKey`, and `provider`. Omitting a tier inherits: `distill` and `reflect` fall back to the **base** (`score`) model; **`classify` falls back to the `reflect` tier** (not the base — `classify` delegates to the reflect path when unset).
-
-- **Flat keys still work.** `distillModel`/`distillBaseUrl`/`reflectModel`/`reflectBaseUrl`/`classifyModel`/`classifyBaseUrl` remain supported at **lower precedence** — a `models` entry wins over the flat key of the same name.
-- **A tier's `apiKey`/`provider` require the tier's own `baseUrl`.** They only take effect when the tier sets `baseUrl`; set on a tier without a `baseUrl` they are **ignored with a warning** (a bare `models.reflect: { model, apiKey }` would otherwise silently bill to the base key). Set `provider` when a tier's `baseUrl` points at a different provider type than the base (e.g. an OpenAI-compatible API while the base is Ollama); set `apiKey` for an API-provider tier over an Ollama base, whose base key is empty (`""`).
-- **`init` writes a flat `llmModel`.** The already-configured guard now recognizes a nested-only config (`models.score`), so re-running `init` on one is a no-op. But if a config has **both** a flat `llmModel` and a `models.score.model`, the nested value **shadows** the flat one (nested > flat) — keep the model in one place.
-- **`score.provider` (and `score.apiKey` on an Ollama base) are ignored** (a warning is logged): the base provider comes from `llmBackend` (or is auto-detected from the base endpoint), and the Ollama base path sends no api key.
-
 ## Database
 
 Canonical location: `~/.hicortex/hicortex.db`. The OC plugin no longer owns its own database — it is a thin client to the server. Previously, OC installations at `~/.openclaw/data/hicortex.db` were migrated automatically on upgrade; this migration path remains in the server's `resolveDbPath` for any pre-0.10.0 installations.
@@ -334,7 +313,7 @@ npm test
 
 ## Troubleshooting
 
-**`init` fails with "Refusing to write ~/.hicortex/config.json":** the file exists but is not valid JSON — usually a hand-edit slip (a trailing comma, a truncated write). `init` refuses rather than overwriting it, because overwriting would lose `authToken`, `licenseKey`, `distillApiKey`, and your `domains` list. Two ways out:
+**`init` fails with "Refusing to write ~/.hicortex/config.json":** the file exists but is not valid JSON — usually a hand-edit slip (a trailing comma, a truncated write). `init` refuses rather than overwriting it, because overwriting would lose `authToken`, `licenseKey`, and your `domains` list. Two ways out:
 
 1. **Preferred — fix the JSON.** The error names the parse failure and its position. Correct it and re-run `init`. Nothing is lost.
 2. **`npx @gamaze/hicortex init --repair-config`.** Moves the broken file to `config.json.corrupt-<timestamp>` and rebuilds from scratch. Nothing is deleted, and it prints the top-level key names it found (names only — never secret values) so you know what to copy back. **This mints a new `authToken`**, so every thin client pointing at this server must be updated or its recall will silently 401 (recall is fail-soft — you will see no error, just no memories).

package/dist/classify-domains.d.ts

@@ -12,11 +12,10 @@
  *     state.json after each batch. Interruption never loses more than the
  *     current batch. `--reset` restarts from rowid 0.
  *   - Classification: one constrained MULTI-TAG LLM call per memory via the
- *     CLASSIFY tier (classifyBaseUrl/classifyModel when configured, else the
- *     reflect tier), same as the nightly. The LLM emits ONLY the ordered tag
- *     set; per-tag weights come from the domain prototypes (computed once at
- *     run start) and the PRIMARY (memories.domain) is derived (argmax weight,
- *     LLM order breaking ties) inside
+ *     one model (#231 — same as the nightly's reflect/classify/scoring). The
+ *     LLM emits ONLY the ordered tag set; per-tag weights come from the domain
+ *     prototypes (computed once at run start) and the PRIMARY (memories.domain)
+ *     is derived (argmax weight, LLM order breaking ties) inside
  *     storage.setMemoryTags. After a completed (non-aborted) run the
  *     prototypes, all weights, and all primaries are recomputed from the
  *     final tag sets — same reconsolidation pass as the nightly.
@@ -25,11 +24,8 @@
  *     a WEAK primary (argmax prototype cosine, when >= weakPrimaryFloor) or,
  *     below the floor, accelerated decay (base_strength halved, domain left
  *     NULL so later runs re-attempt it). See nofit.ts.
- *   - LLM pre-flight: the endpoint classification will actually use (when a
- *     separate Ollama) is probed before any work. If unreachable, abort
- *     cleanly (nothing written, cursor untouched) — strict, like distill.
  *   - Infra-error abort (issue #150): if the classifier returns null mid-run
- *     (endpoint died AFTER preflight), the run aborts after committing
+ *     (endpoint died mid-run), the run aborts after committing
  *     the last full batch. The failing memory is left completely untouched; the
  *     cursor sits at the last committed batch so a re-run resumes cleanly.
  *   - Server-mode only: needs the local DB.
@@ -50,7 +46,7 @@ export interface ClassifyDomainsOptions {
     dbPath?: string;
     /** State dir override (tests). Defaults to ~/.hicortex. */
     stateDir?: string;
-    /** LLM override (tests). Bypasses config resolution + preflight. */
+    /** LLM override (tests). Bypasses config resolution. */
     llm?: LlmClient;
     /** Config override (tests). Defaults to reading stateDir/config.json. */
     config?: Record<string, unknown> | null;
@@ -91,8 +87,11 @@ export interface ClassifyDomainsReport {
 }
 /**
  * Run the classify-domains pass. Returns a structured report.
- * Throws on unrecoverable setup errors (client mode, no domains, no LLM,
- * classification endpoint down) — the cursor always reflects the last
- * committed batch.
+ * Throws on unrecoverable setup errors (client mode, no domains, no LLM) —
+ * the cursor always reflects the last committed batch. Per-memory
+ * classification failures are handled gracefully inside the classifier
+ * (returns null → memory left unclassified, retried next run via the cursor);
+ * a totally-down model costs latency, not data (#231 removed the pre-flight
+ * probe in favor of complete()'s internal 30s/60s/120s retries).
  */
 export declare function runClassifyDomains(options?: ClassifyDomainsOptions): Promise<ClassifyDomainsReport>;

package/dist/classify-domains.js

@@ -13,11 +13,10 @@
  *     state.json after each batch. Interruption never loses more than the
  *     current batch. `--reset` restarts from rowid 0.
  *   - Classification: one constrained MULTI-TAG LLM call per memory via the
- *     CLASSIFY tier (classifyBaseUrl/classifyModel when configured, else the
- *     reflect tier), same as the nightly. The LLM emits ONLY the ordered tag
- *     set; per-tag weights come from the domain prototypes (computed once at
- *     run start) and the PRIMARY (memories.domain) is derived (argmax weight,
- *     LLM order breaking ties) inside
+ *     one model (#231 — same as the nightly's reflect/classify/scoring). The
+ *     LLM emits ONLY the ordered tag set; per-tag weights come from the domain
+ *     prototypes (computed once at run start) and the PRIMARY (memories.domain)
+ *     is derived (argmax weight, LLM order breaking ties) inside
  *     storage.setMemoryTags. After a completed (non-aborted) run the
  *     prototypes, all weights, and all primaries are recomputed from the
  *     final tag sets — same reconsolidation pass as the nightly.
@@ -26,11 +25,8 @@
  *     a WEAK primary (argmax prototype cosine, when >= weakPrimaryFloor) or,
  *     below the floor, accelerated decay (base_strength halved, domain left
  *     NULL so later runs re-attempt it). See nofit.ts.
- *   - LLM pre-flight: the endpoint classification will actually use (when a
- *     separate Ollama) is probed before any work. If unreachable, abort
- *     cleanly (nothing written, cursor untouched) — strict, like distill.
  *   - Infra-error abort (issue #150): if the classifier returns null mid-run
- *     (endpoint died AFTER preflight), the run aborts after committing
+ *     (endpoint died mid-run), the run aborts after committing
  *     the last full batch. The failing memory is left completely untouched; the
  *     cursor sits at the last committed batch so a re-run resumes cleanly.
  *   - Server-mode only: needs the local DB.
@@ -93,33 +89,14 @@ function readConfig(stateDir) {
         return null;
     }
 }
-/**
- * Pre-flight the endpoint classification will ACTUALLY use — the classify
- * tier (classifyModel/classifyBaseUrl) when configured, else the reflect tier.
- * Target resolution is the pure resolveClassifyProbeTarget (llm.ts), the same
- * source of truth as the nightly's contentDomainsReady gate.
- *
- * Returns null when ready, or a reason string when it is unreachable (caller
- * aborts clean). Only a separate Ollama endpoint can go unreachable mid-run;
- * API providers are cloud-reachable.
- */
-async function preflightClassify(config) {
-    const target = (0, llm_js_1.resolveClassifyProbeTarget)(config);
-    if (!target)
-        return null;
-    const health = await (0, llm_js_1.probeOllamaModel)(target.baseUrl, target.model);
-    if (!health.ok) {
-        return health.reason === "unreachable"
-            ? `${target.tier} endpoint unreachable (${target.baseUrl})`
-            : `${target.tier} model not loaded (${target.model} missing on ${target.baseUrl})`;
-    }
-    return null;
-}
 /**
  * Run the classify-domains pass. Returns a structured report.
- * Throws on unrecoverable setup errors (client mode, no domains, no LLM,
- * classification endpoint down) — the cursor always reflects the last
- * committed batch.
+ * Throws on unrecoverable setup errors (client mode, no domains, no LLM) —
+ * the cursor always reflects the last committed batch. Per-memory
+ * classification failures are handled gracefully inside the classifier
+ * (returns null → memory left unclassified, retried next run via the cursor);
+ * a totally-down model costs latency, not data (#231 removed the pre-flight
+ * probe in favor of complete()'s internal 30s/60s/120s retries).
  */
 async function runClassifyDomains(options = {}) {
     const batchSize = options.batchSize ?? 200;
@@ -142,7 +119,7 @@ async function runClassifyDomains(options = {}) {
             "No fallback bucket is needed — no-fit memories are handled automatically.");
     }
     const weakPrimaryFloor = (0, nofit_js_1.resolveWeakPrimaryFloor)(config);
-    // Resolve the LLM (classify tier does the classifying; falls back to reflect).
+    // Resolve the LLM (one model serves all phases — #231).
     let llm;
     if (options.llm) {
         llm = options.llm;
@@ -152,11 +129,6 @@ async function runClassifyDomains(options = {}) {
         if (!resolved.config) {
             throw new Error("[hicortex] classify-domains: no LLM configured — run `npx @gamaze/hicortex init`.");
         }
-        const classifyDown = await preflightClassify(resolved.config);
-        if (classifyDown) {
-            throw new Error(`[hicortex] classify-domains aborted: ${classifyDown}. ` +
-                "Nothing written, cursor untouched — retry when the endpoint is up.");
-        }
         llm = new llm_js_1.LlmClient(resolved.config);
     }
     const dbPath = (0, db_js_1.resolveDbPath)(options.dbPath);

package/dist/consolidate.d.ts

@@ -198,11 +198,11 @@ export declare function stageDecayPrune(db: Database.Database, dryRun: boolean):
  * Options controlling how the domain-assignment stage runs.
  *
  * When `domains` is a non-empty list, the pipeline uses content-based
- * classification (config-owned) INSTEAD of project grouping — provided the
- * classification endpoint (classify tier when configured, else reflect) passed
- * pre-flight (`contentDomainsReady`). If that endpoint is unreachable, the
- * caller sets `contentDomainsReady: false` and the stage is SKIPPED entirely
- * (strict — no fall-back to a weak model or to project grouping). When
+ * classification (config-owned) INSTEAD of project grouping. The single
+ * model serves all phases; if it's unavailable, `complete()` retries
+ * internally (30s/60s/120s) and the phase fails soft on persistence —
+ * the nightly retries on the next run. No pre-flight health checks; the
+ * phase either answers or is skipped until the next scheduled run. When
  * `domains` is absent/empty, the legacy project-grouping curation runs
  * unchanged.
  */

package/dist/consolidate.js

@@ -862,7 +862,7 @@ const SUPERSESSION_BATCH_SIZE = 500;
  * A memory whose content/type marks it as a SUPERSEDABLE claim — one a newer
  * memory about the same subject can replace. Decisions and corrections were the
  * original scope; plain facts and project-state updates were added because an
- * updated fact ("distillModel is X" → later "is Y") otherwise never gets a
+ * updated fact ("scoring model is X" → later "is Y") otherwise never gets a
  * superseded_by link and both versions compete in recall forever. Ordinary
  * episodic chatter and problem/solution history stay excluded: they record
  * events, not mutable state, so there is nothing to supersede.
@@ -1148,9 +1148,8 @@ async function runConsolidation(db, llm, embedFn, dryRun = false, skipReflection
         }
         // Stage 2.7: Domain assignment.
         // Content-based (config-owned domains) REPLACES project grouping when a
-        // domain list is configured AND the reflect endpoint passed pre-flight.
-        // If the list is configured but the reflect endpoint is down, SKIP the
-        // stage (strict) — do not fall back to project grouping.
+        // domain list is configured. The single model serves all phases; if it's
+        // down, the phase skips and retries on the next nightly run (no fallback).
         const cfgDomains = domainOptions?.domains;
         if (cfgDomains && cfgDomains.length > 0) {
             if (domainOptions?.contentDomainsReady === false) {

package/dist/distiller.d.ts

@@ -8,12 +8,20 @@ import { type RedactionConfig } from "./redact.js";
 /**
  * Estimate a safe chunk size in chars based on the LLM provider and model.
  * - API providers (Anthropic, OpenAI, claude-cli): no chunking needed (large context windows)
- * - Ollama: query /api/show for context_length AND parameter_count, cap based on both
- * - Small models (<8B params): max 20K chars (~5K tokens) — keeps CPU inference under ~60s
- * - Larger models: up to 60K chars (~15K tokens)
+ * - Ollama: chunk size derives from the resolved `numCtx` (the request's actual
+ *   context window), capped by parameter-count-derived speed limits:
+ *   - Small models (<8B params): max 20K chars (~5K tokens) — keeps CPU inference under ~60s
+ *   - Larger models: up to 60K chars (~15K tokens)
  * - Fallback: 20K chars
+ *
+ * `numCtx` is the single source of truth for the context constraint (#231): it is
+ * the value completeOllama will actually send as `num_ctx`, so chunking against it
+ * keeps the chunker and the request in agreement (kills the silent-truncation bug
+ * #228, where chunks were sized from the model's ADVERTISED context while the
+ * request used a smaller `numCtx`). The `/api/show` query is KEPT — but only for
+ * the parameter-count speed cap (`maxBySpeed`, SMALL vs LARGE), NOT for context.
  */
-export declare function detectChunkSize(provider: string, model: string, baseUrl?: string): Promise<number>;
+export declare function detectChunkSize(provider: string, model: string, baseUrl?: string, numCtx?: number): Promise<number>;
 /**
  * Convert session messages to a filtered transcript string.
  * Handles OC hook format, CC JSONL, and Pi JSONL.

package/dist/distiller.js

@@ -21,17 +21,25 @@ const LARGE_MODEL_MAX_CHUNK_CHARS = 60_000; // ~15K tokens — ok for 8B+ on GPU
 /**
  * Estimate a safe chunk size in chars based on the LLM provider and model.
  * - API providers (Anthropic, OpenAI, claude-cli): no chunking needed (large context windows)
- * - Ollama: query /api/show for context_length AND parameter_count, cap based on both
- * - Small models (<8B params): max 20K chars (~5K tokens) — keeps CPU inference under ~60s
- * - Larger models: up to 60K chars (~15K tokens)
+ * - Ollama: chunk size derives from the resolved `numCtx` (the request's actual
+ *   context window), capped by parameter-count-derived speed limits:
+ *   - Small models (<8B params): max 20K chars (~5K tokens) — keeps CPU inference under ~60s
+ *   - Larger models: up to 60K chars (~15K tokens)
  * - Fallback: 20K chars
+ *
+ * `numCtx` is the single source of truth for the context constraint (#231): it is
+ * the value completeOllama will actually send as `num_ctx`, so chunking against it
+ * keeps the chunker and the request in agreement (kills the silent-truncation bug
+ * #228, where chunks were sized from the model's ADVERTISED context while the
+ * request used a smaller `numCtx`). The `/api/show` query is KEPT — but only for
+ * the parameter-count speed cap (`maxBySpeed`, SMALL vs LARGE), NOT for context.
  */
-async function detectChunkSize(provider, model, baseUrl) {
+async function detectChunkSize(provider, model, baseUrl, numCtx) {
     // API-based providers handle large contexts natively — no chunking needed
     if (provider !== "ollama") {
         return MAX_TRANSCRIPT_CHARS;
     }
-    // Query Ollama for model metadata
+    // Query Ollama for model metadata (parameter count → speed cap)
     if (baseUrl) {
         try {
             const resp = await fetch(`${baseUrl}/api/show`, {
@@ -49,21 +57,18 @@ async function detectChunkSize(provider, model, baseUrl) {
                     ? info[paramKey]
                     : 0;
                 const isSmallModel = paramCount > 0 && paramCount < SMALL_MODEL_PARAMS;
-                // Extract context length for context-aware capping
-                const ctxKey = Object.keys(info).find((k) => k.endsWith("context_length") || k.endsWith("context_window"));
-                const contextTokens = ctxKey && typeof info[ctxKey] === "number"
-                    ? info[ctxKey]
-                    : 0;
                 // Determine max chunk size based on model size (speed constraint)
                 // Unknown param count defaults to conservative (small model) — safe for any hardware
                 const maxBySpeed = !isSmallModel && paramCount > 0 ? LARGE_MODEL_MAX_CHUNK_CHARS : SMALL_MODEL_MAX_CHUNK_CHARS;
-                // Determine max chunk size based on context window (fits-in-context constraint)
-                const maxByContext = contextTokens > 0
-                    ? Math.floor(contextTokens * 0.6 * 4) // 60% of context, ~4 chars/token
-                    : MAX_TRANSCRIPT_CHARS;
+                // Determine max chunk size from the resolved numCtx (the request's ACTUAL
+                // context window), NOT the model's advertised context_length. 60% of context,
+                // ~4 chars/token. Falls back to MAX_TRANSCRIPT_CHARS when numCtx is unknown
+                // (caller didn't pass it) — but the mcp-server call site always passes it.
+                const resolvedCtx = numCtx ?? 8192;
+                const maxByContext = Math.floor(resolvedCtx * 0.6 * 4);
                 const chunkChars = Math.min(maxBySpeed, maxByContext);
                 console.log(`[hicortex]     Model: ${paramCount > 0 ? `${(paramCount / 1e9).toFixed(1)}B params` : "unknown size"}, ` +
-                    `context: ${contextTokens > 0 ? `${contextTokens} tokens` : "unknown"}, ` +
+                    `numCtx: ${resolvedCtx}, ` +
                     `chunk size: ${chunkChars} chars${isSmallModel ? " (small model cap)" : ""}`);
                 return chunkChars;
             }

package/dist/domain-classify.d.ts

@@ -33,9 +33,9 @@
  * project only breaks ties). This rescues terse technical memories from
  * projects whose content alone reads as ambiguous.
  *
- * The classifier makes ONE constrained LLM call per memory (via the classify
- * tier — classifyModel/classifyBaseUrl when configured, else the reflect
- * tier), validates every returned name against the configured vocabulary
+ * The classifier makes ONE constrained LLM call per memory (via the one model
+ * #231 — completeClassify, a thin wrapper over the shared complete()),
+ * validates every returned name against the configured vocabulary
  * (case-insensitive), and retries once on an invalid/unparseable reply.
  *
  * ROBUSTNESS (folds in issue #150):
@@ -141,10 +141,10 @@ export declare function parseTagReply(reply: string, domains: DomainDef[]): TagR
 /**
  * Multi-tag classify one memory's content against the configured vocabulary.
  *
- * Uses the classify tier (`completeClassify` → classifyBaseUrl/classifyModel
- * when configured, else the reflect tier) — the caller is responsible for
- * having pre-flighted that endpoint via resolveClassifyProbeTarget (strict:
- * skip classification entirely if it is unreachable).
+ * Uses the one model (`completeClassify` — a thin wrapper over the shared
+ * complete(), #231). Per-memory classification failures return null (issue
+ * #150): the caller leaves the memory unclassified and the cursor advances,
+ * so a re-run retries it.
  *
  * Behaviour:
  *   - Valid JSON reply with ≥1 vocabulary tag → {tags} (ordered,

package/dist/domain-classify.js

@@ -34,9 +34,9 @@
  * project only breaks ties). This rescues terse technical memories from
  * projects whose content alone reads as ambiguous.
  *
- * The classifier makes ONE constrained LLM call per memory (via the classify
- * tier — classifyModel/classifyBaseUrl when configured, else the reflect
- * tier), validates every returned name against the configured vocabulary
+ * The classifier makes ONE constrained LLM call per memory (via the one model
+ * #231 — completeClassify, a thin wrapper over the shared complete()),
+ * validates every returned name against the configured vocabulary
  * (case-insensitive), and retries once on an invalid/unparseable reply.
  *
  * ROBUSTNESS (folds in issue #150):
@@ -238,10 +238,10 @@ function parseTagReply(reply, domains) {
 /**
  * Multi-tag classify one memory's content against the configured vocabulary.
  *
- * Uses the classify tier (`completeClassify` → classifyBaseUrl/classifyModel
- * when configured, else the reflect tier) — the caller is responsible for
- * having pre-flighted that endpoint via resolveClassifyProbeTarget (strict:
- * skip classification entirely if it is unreachable).
+ * Uses the one model (`completeClassify` — a thin wrapper over the shared
+ * complete(), #231). Per-memory classification failures return null (issue
+ * #150): the caller leaves the memory unclassified and the cursor advances,
+ * so a re-run retries it.
  *
  * Behaviour:
  *   - Valid JSON reply with ≥1 vocabulary tag → {tags} (ordered,

package/dist/init.d.ts

@@ -31,10 +31,9 @@ export declare function parseMcpListStatus(mcpListOutput: string): "connected" |
 export declare function parseEnvFile(content: string): Record<string, string>;
 /**
  * True when an LLM is already persisted and `init` must NOT re-run provider
- * selection: a named/flat backend, a flat baseUrl+apiKey pair, OR a nested-only
- * `models.score` (model or baseUrl). The last clause (0.13.1) stops init from
- * walking a nested-only config back through selection and writing flat keys that
- * a `models.score` would then silently shadow (nested > flat).
+ * selection: a named backend (llmBackend) or a flat baseUrl+apiKey pair.
+ * (The nested `models` per-tier block was removed in #231 — one model serves
+ * all phases, configured via the flat `llm*` keys only.)
  */
 export declare function isLlmConfigured(config: Record<string, unknown>): boolean;
 /**
@@ -58,7 +57,7 @@ export declare function persistLlmConfig(configPath?: string): Promise<void>;
  * and the writer then OVERWROTE the file — `persistAuthToken` minted a fresh
  * token (fleet-wide 401), `scaffoldDefaultDomains` re-seeded the generic
  * vocabulary over the owner list, etc. `authToken` / `licenseKey` /
- * `distillApiKey` / `domains` / `weakPrimaryFloor` / `contextClients` all gone.
+ * `llmApiKey` / `domains` / `weakPrimaryFloor` / `contextClients` all gone.
  * The early-return guards (existing-key checks) did NOT save them: those only
  * fire on a VALID parse that reads the key, not on a corrupted file.
  *
@@ -89,7 +88,7 @@ export declare function loadConfigStrict(configPath: string): {
  * Why this exists: refusing to overwrite a corrupt config is right (it closed
  * the 0.16.x wipe BLOCKER), but it leaves the operator stuck — `init` is the
  * natural repair action and it now refuses to run. Deleting the file by hand
- * works but silently loses `licenseKey` / `authToken` / `distillApiKey`.
+ * works but silently loses `licenseKey` / `authToken` / `llmApiKey`.
  *
  * Why it is OPT-IN and never automatic: rebuilding mints a fresh `authToken`,
  * which 401s every thin client on the fleet until they are re-pointed. That is
@@ -101,10 +100,10 @@ export declare function loadConfigStrict(configPath: string): {
  *     Windows), and report the TOP-LEVEL KEY NAMES recovered from the raw text
  *     so the operator knows what to restore.
  *
- * SECURITY: key NAMES only, never values. `authToken`, `licenseKey`,
- * `distillApiKey` and `reflectApiKey` are secrets — printing them would leak
- * into terminal scrollback, CI logs, and screen shares. The operator reads the
- * values out of the backup file themselves.
+ * SECURITY: key NAMES only, never values. `authToken`, `licenseKey`, and
+ * `llmApiKey` are secrets — printing them would leak into terminal scrollback,
+ * CI logs, and screen shares. The operator reads the values out of the backup
+ * file themselves.
  *
  * Exported for testability.
  */

package/dist/init.js

@@ -475,15 +475,12 @@ function mergeByKey(candidates) {
 }
 /**
  * True when an LLM is already persisted and `init` must NOT re-run provider
- * selection: a named/flat backend, a flat baseUrl+apiKey pair, OR a nested-only
- * `models.score` (model or baseUrl). The last clause (0.13.1) stops init from
- * walking a nested-only config back through selection and writing flat keys that
- * a `models.score` would then silently shadow (nested > flat).
+ * selection: a named backend (llmBackend) or a flat baseUrl+apiKey pair.
+ * (The nested `models` per-tier block was removed in #231 — one model serves
+ * all phases, configured via the flat `llm*` keys only.)
  */
 function isLlmConfigured(config) {
-    const modelsScore = config.models?.score;
-    const hasModelsScore = Boolean(modelsScore?.model || modelsScore?.baseUrl);
-    return Boolean(config.llmBackend || (config.llmApiKey && config.llmBaseUrl) || hasModelsScore);
+    return Boolean(config.llmBackend || (config.llmApiKey && config.llmBaseUrl));
 }
 /**
  * Detect or ask for LLM config and persist to ~/.hicortex/config.json.
@@ -725,7 +722,7 @@ function saveConfig(configPath, config) {
  * and the writer then OVERWROTE the file — `persistAuthToken` minted a fresh
  * token (fleet-wide 401), `scaffoldDefaultDomains` re-seeded the generic
  * vocabulary over the owner list, etc. `authToken` / `licenseKey` /
- * `distillApiKey` / `domains` / `weakPrimaryFloor` / `contextClients` all gone.
+ * `llmApiKey` / `domains` / `weakPrimaryFloor` / `contextClients` all gone.
  * The early-return guards (existing-key checks) did NOT save them: those only
  * fire on a VALID parse that reads the key, not on a corrupted file.
  *
@@ -787,7 +784,7 @@ function loadConfigStrict(configPath) {
  * Why this exists: refusing to overwrite a corrupt config is right (it closed
  * the 0.16.x wipe BLOCKER), but it leaves the operator stuck — `init` is the
  * natural repair action and it now refuses to run. Deleting the file by hand
- * works but silently loses `licenseKey` / `authToken` / `distillApiKey`.
+ * works but silently loses `licenseKey` / `authToken` / `llmApiKey`.
  *
  * Why it is OPT-IN and never automatic: rebuilding mints a fresh `authToken`,
  * which 401s every thin client on the fleet until they are re-pointed. That is
@@ -799,10 +796,10 @@ function loadConfigStrict(configPath) {
  *     Windows), and report the TOP-LEVEL KEY NAMES recovered from the raw text
  *     so the operator knows what to restore.
  *
- * SECURITY: key NAMES only, never values. `authToken`, `licenseKey`,
- * `distillApiKey` and `reflectApiKey` are secrets — printing them would leak
- * into terminal scrollback, CI logs, and screen shares. The operator reads the
- * values out of the backup file themselves.
+ * SECURITY: key NAMES only, never values. `authToken`, `licenseKey`, and
+ * `llmApiKey` are secrets — printing them would leak into terminal scrollback,
+ * CI logs, and screen shares. The operator reads the values out of the backup
+ * file themselves.
  *
  * Exported for testability.
  */
@@ -828,7 +825,7 @@ function quarantineMalformedConfig(configPath) {
     if (keys.length > 0) {
         console.log(`    Keys found in the old file: ${keys.join(", ")}`);
     }
-    console.log(`    ACTION REQUIRED: copy any of licenseKey / distillApiKey / reflectApiKey /`);
+    console.log(`    ACTION REQUIRED: copy any of licenseKey / llmApiKey /`);
     console.log(`    domains / weakPrimaryFloor back from the backup by hand.`);
     console.log(`    A NEW authToken will be generated — every thin client pointing at this`);
     console.log(`    server must be updated, or their recall will 401 (silently, fail-soft).`);