@gamaze/hicortex 0.20.0 → 0.20.2

package/README.md

@@ -1,10 +1,14 @@
-# @gamaze/hicortex — Self-Learning Memory for AI Agents
+# @gamaze/hicortex — Shared Fleet Memory for AI Agents
 
 <img src="https://raw.githubusercontent.com/gamaze-labs/hicortex/main/docs/dashboard-composition.png" alt="Hicortex dashboard — live screenshot: memory-type composition (episodes / lessons / facts / decisions)" width="800">
 
-Your agents learn from every session — successes and mistakes. Hicortex captures experiences, distills lessons, and applies them automatically. Connect multiple agents to shared memory and they improve together, overnight.
+**Many agents. One shared memory. Wisdom compounds.**
 
-Works with **Hermes**, **OpenClaw**, **Claude Code**, **Pi**, **opencode**, and any MCP-compatible agent.
+Hicortex is shared long-term memory for AI agents. Install once, and every agent you run — Claude Code, Hermes, OpenClaw, Pi, OpenCode, any MCP client — draws on one memory: sessions are captured automatically, distilled into knowledge, decisions and learnings overnight, and a compact recall index is pushed into each prompt in every supported coding agent. What one agent learns, the whole fleet knows.
+
+**Install — one command, ~2 minutes:** `npx @gamaze/hicortex init`
+
+Self-hosted: raw sessions never leave your machine. Zero LLM calls at recall. Free for personal use.
 
 **Website:** [hicortex.gamaze.com](https://hicortex.gamaze.com) · **Docs:** [hicortex.gamaze.com/docs](https://hicortex.gamaze.com/docs/)
 

package/dist/consolidate.js

@@ -293,11 +293,16 @@ function parseJsonLenient(text, fallback) {
 // ---------------------------------------------------------------------------
 // Stage 1: Pre-check
 // ---------------------------------------------------------------------------
-function readLastConsolidated() {
-    return (0, state_js_1.loadState)().lastConsolidated ?? "";
+function readLastConsolidated(stateDir) {
+    // stateDir-optional for backcompat; runConsolidation threads its own
+    // stateDir so the skip decision reads the SAME state the run writes
+    // (previously this read the ambient home — a split-brain where a test or
+    // CLI caller with an isolated stateDir decided "skip" from the operator's
+    // real ~/.hicortex watermark).
+    return (0, state_js_1.loadState)(stateDir).lastConsolidated ?? "";
 }
-function stagePrecheck(db) {
-    const lastTs = readLastConsolidated();
+function stagePrecheck(db, stateDir) {
+    const lastTs = readLastConsolidated(stateDir);
     const lastDt = lastTs || "1970-01-01T00:00:00.000Z";
     const newMemories = storage.getMemoriesSince(db, lastDt);
     if (newMemories.length === 0) {
@@ -1372,7 +1377,7 @@ memorySoftCap) {
         stages: {},
     };
     // Stage 1: Pre-check
-    const precheck = stagePrecheck(db);
+    const precheck = stagePrecheck(db, stateDir);
     // Also check for unscored memories
     const unscored = storage.getUnscoredMemories(db);
     const newIds = new Set(precheck.newMemories.map((m) => m.id));
@@ -1380,7 +1385,15 @@ memorySoftCap) {
         ...precheck.newMemories,
         ...unscored.filter((m) => !newIds.has(m.id)),
     ];
-    const skip = scoreMemories.length === 0;
+    // #194 no-fit scope: untagged rows (domain IS NULL) stay in the
+    // re-evaluation scope — the decay/re-attempt contract ("re-halves once per
+    // run while still below the floor") is work even on a quiet night with
+    // nothing new. The skip below gated on new+unscored only, which the tests
+    // never caught because stagePrecheck used to read the AMBIENT (always
+    // empty in the suite) state instead of the run's own watermark — threading
+    // stateDir (#357) exposed the divergence between test and production.
+    const nofitInScope = db.prepare("SELECT COUNT(*) AS n FROM memories WHERE domain IS NULL").get().n;
+    const skip = scoreMemories.length === 0 && nofitInScope === 0;
     report.stages.precheck = {
         skip,
         reason: skip
@@ -1450,8 +1463,18 @@ memorySoftCap) {
         report.status = "failed";
         console.error("[hicortex] Consolidation pipeline error:", err);
     }
-    // Update last-consolidated timestamp
-    if (!dryRun && report.status === "completed") {
+    // Update last-consolidated timestamp. #357: the stages fail SOFT, so a run
+    // against an endpoint that died mid-way still reports status "completed"
+    // here — advancing the timestamp made state.json disagree with the
+    // nightly's breaker-open override to endpoint_down (observed 0.20.0 soak:
+    // endpoint_down reported, lastConsolidated advanced anyway). Gate on the
+    // SAME signal the nightly's override reads (llm.breakerOpen) so the two
+    // sites agree for the breaker case — keep this condition and the override
+    // in nightly.ts in sync if either ever grows. (Sibling soft-fail paths —
+    // e.g. a sustained-429 run, which never accrues to the breaker because a
+    // 429 proves the endpoint answers — still advance; that is the #337
+    // taxonomy working as designed.)
+    if (!dryRun && report.status === "completed" && !llm.breakerOpen) {
         (0, state_js_1.updateState)((s) => {
             s.lastConsolidated = new Date().toISOString();
             return s;

package/dist/init.d.ts

@@ -25,6 +25,13 @@ import type { DomainDef } from "./types.js";
  *   - "registered" — listed but connection not confirmed (server down / not restarted)
  */
 export declare function parseMcpListStatus(mcpListOutput: string): "connected" | "registered" | "missing";
+/**
+ * The client config's serverUrl BEFORE this run re-points it — the value init
+ * last wrote into the Hermes plugin's config (so the plugin step can tell an
+ * init-owned URL from a user-set one). Exported for tests.
+ */
+export declare function readPreviousServerUrl(configPath: string): string | undefined;
+export declare function setupHermes(serverUrl: string, authToken: string, previousServerUrl?: string): void;
 /**
  * Parse a KEY=VALUE env file (e.g. ~/.hermes/.env or ~/.claude/settings.json env block).
  * Handles: comments (#), quoted values, empty lines.

package/dist/init.js

@@ -21,6 +21,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GENERIC_DEFAULT_DOMAINS = void 0;
 exports.parseMcpListStatus = parseMcpListStatus;
+exports.readPreviousServerUrl = readPreviousServerUrl;
+exports.setupHermes = setupHermes;
 exports.parseEnvFile = parseEnvFile;
 exports.isLlmConfigured = isLlmConfigured;
 exports.persistLlmConfig = persistLlmConfig;
@@ -399,7 +401,21 @@ function setupOpencode() {
 // ---------------------------------------------------------------------------
 // Hermes setup
 // ---------------------------------------------------------------------------
-function setupHermes(serverUrl, authToken) {
+/**
+ * The client config's serverUrl BEFORE this run re-points it — the value init
+ * last wrote into the Hermes plugin's config (so the plugin step can tell an
+ * init-owned URL from a user-set one). Exported for tests.
+ */
+function readPreviousServerUrl(configPath) {
+    try {
+        const { config: prev } = loadConfigStrict(configPath);
+        if (typeof prev.serverUrl === "string" && prev.serverUrl)
+            return prev.serverUrl;
+    }
+    catch { /* no prior config, or unreadable — nothing init-owned to carry */ }
+    return undefined;
+}
+function setupHermes(serverUrl, authToken, previousServerUrl) {
     const pluginSource = (0, node_path_1.join)(__dirname, "..", "hermes-plugin", "hicortex");
     if (!(0, node_fs_1.existsSync)(pluginSource)) {
         console.log("  ⚠ Hermes plugin not found in package — skipping Hermes setup");
@@ -407,23 +423,86 @@ function setupHermes(serverUrl, authToken) {
     }
     const pluginsDir = (0, node_path_1.join)(HERMES_HOME, "plugins", "hicortex");
     (0, node_fs_1.mkdirSync)(pluginsDir, { recursive: true });
-    // Copy plugin files
-    const pluginFiles = (0, node_fs_1.readdirSync)(pluginSource);
-    for (const f of pluginFiles) {
-        const src = (0, node_path_1.join)(pluginSource, f);
-        if ((0, node_fs_1.statSync)(src).isFile()) {
-            (0, node_fs_1.copyFileSync)(src, (0, node_path_1.join)(pluginsDir, f));
-        }
+    // If the plugin was installed via `hermes plugins install` (a git checkout
+    // that actually contains the plugin — .git alone could be an empty/partial
+    // dir), do NOT copy over it — that would mix a managed checkout with
+    // copied files and break its own update path. The config below is still
+    // written: Hermes' own `memory setup` writes config.json into that tree
+    // too, so the file is expected there regardless of install path.
+    const isGitInstall = (0, node_fs_1.existsSync)((0, node_path_1.join)(pluginsDir, ".git")) && (0, node_fs_1.existsSync)((0, node_path_1.join)(pluginsDir, "plugin.yaml"));
+    if (isGitInstall) {
+        console.log("  ✓ Hermes plugin already installed (git checkout) — leaving its files, updating config only");
     }
-    console.log(`  ✓ Copied Hermes plugin to ${pluginsDir}`);
-    // Write plugin config.json (server URL only). The auth token is a SECRET and
-    // is deliberately NOT written here — `hermes memory setup` routes it to
-    // $HERMES_HOME/.env, and localhost bypasses auth entirely. Capture threshold
-    // omitted → the plugin's own default applies.
-    const config = { hicortex_url: serverUrl };
+    else {
+        const pluginFiles = (0, node_fs_1.readdirSync)(pluginSource);
+        for (const f of pluginFiles) {
+            // NEVER copy a bundled config.json over the user's: a stray one in a
+            // developer tree ships via prepack, and clobbering here would defeat
+            // the merge logic below (it runs AFTER this loop).
+            if (f === "config.json")
+                continue;
+            const src = (0, node_path_1.join)(pluginSource, f);
+            if ((0, node_fs_1.statSync)(src).isFile()) {
+                (0, node_fs_1.copyFileSync)(src, (0, node_path_1.join)(pluginsDir, f));
+            }
+        }
+        console.log(`  ✓ Copied Hermes plugin to ${pluginsDir}`);
+    }
+    // Plugin config.json: MERGE, never blindly clobber. The URL is overwritten
+    // when it is INIT-OWNED — unset, a local default (either host spelling:
+    // init has written both `localhost` and `127.0.0.1` variants historically),
+    // or exactly what init last wrote (previousServerUrl — the client config's
+    // serverUrl BEFORE this run re-pointed it). A value the USER set by hand to
+    // something else is preserved WITH A LOUD DIVERGENCE WARNING — silently
+    // keeping a stale endpoint on a re-point is the failure this guards
+    // (CR: re-point must reach the plugin like it reaches CC's MCP entry).
+    // The auth token is a SECRET and is deliberately NOT written here —
+    // `hermes memory setup` routes it to $HERMES_HOME/.env, and localhost
+    // bypasses auth entirely.
+    const stripTrailingSlash = (v) => v.replace(/\/+$/, "");
+    const localDefaults = [`http://localhost:${DEFAULT_PORT}`, `http://127.0.0.1:${DEFAULT_PORT}`];
+    // Normalize before comparing (trailing-slash variants of the same URL must
+    // not read as user-set — the client flow strips, the env-var flow does not).
+    const normalizedPrevious = previousServerUrl ? stripTrailingSlash(previousServerUrl) : undefined;
+    const isInitOwnedUrl = (v) => {
+        if (typeof v !== "string" || v === "")
+            return true;
+        const nv = stripTrailingSlash(v);
+        return localDefaults.includes(nv) || nv === normalizedPrevious;
+    };
     const configPath = (0, node_path_1.join)(pluginsDir, "config.json");
-    (0, node_fs_1.writeFileSync)(configPath, JSON.stringify(config, null, 2));
-    console.log(`  ✓ Plugin config → ${serverUrl}`);
+    let config = {};
+    if ((0, node_fs_1.existsSync)(configPath)) {
+        try {
+            config = loadConfigStrict(configPath).config;
+        }
+        catch {
+            // Corrupt/unreadable plugin config: REPLACE (this file holds no secrets
+            // by design — only URL/knobs; reset to defaults) — loudly, never
+            // silently, never fatally. (The underlying error's copy speaks of
+            // ~/.hicortex config semantics that do not apply to this file, so it
+            // is deliberately not echoed.)
+            console.log("  ⚠ Plugin config.json unreadable — replacing it (URL re-prefilled; optional knobs reset to defaults; no secrets live in this file)");
+            config = {};
+        }
+    }
+    const normalizedServerUrl = stripTrailingSlash(serverUrl);
+    let keptExistingUrl = false;
+    if (isInitOwnedUrl(config.hicortex_url)) {
+        config.hicortex_url = normalizedServerUrl;
+    }
+    else if (stripTrailingSlash(config.hicortex_url) !== normalizedServerUrl) {
+        keptExistingUrl = true;
+        console.log(`  ℹ Kept existing plugin URL ${config.hicortex_url} (differs from this install's ${normalizedServerUrl})`);
+        console.log("    Edit ~/.hermes/plugins/hicortex/config.json if that is not what you want.");
+    }
+    try {
+        (0, node_fs_1.writeFileSync)(configPath, JSON.stringify(config, null, 2));
+        console.log(keptExistingUrl ? `  ℹ Plugin config stays on ${config.hicortex_url}` : `  ✓ Plugin config → ${config.hicortex_url}`);
+    }
+    catch (e) {
+        console.log(`  ⚠ Could not write plugin config (${e instanceof Error ? e.message : e}) — Hermes setup skipped config pre-fill`);
+    }
     // For profile-based setups, symlink the shared plugin into each profile's
     // plugin dir (non-destructive). Discovery scans $HERMES_HOME/plugins/, so
     // this is belt-and-suspenders for profile-scoped installs.
@@ -460,14 +539,26 @@ function setupHermes(serverUrl, authToken) {
     // Activation is left to Hermes' own tooling. We NEVER edit config.yaml —
     // Hermes' `memory setup` discovers this plugin automatically and writes the
     // config with its own YAML-aware writer (routing the token to .env).
-    const isRemote = !(serverUrl.includes("127.0.0.1") || serverUrl.includes("localhost"));
-    console.log("  → Activate with:  hermes memory setup   (select 'hicortex')");
+    // The token is PRINTED here for the remote case (the user's own terminal —
+    // same visibility as `hicortex status`); Hermes has no non-interactive
+    // setup path, so one paste is the floor. When a user-set URL was KEPT, the
+    // token hint names that server's token requirement instead (this install's
+    // token belongs to a different server).
+    console.log("  → Activate with:  hermes memory setup hicortex");
     if ((0, node_fs_1.existsSync)(profilesDir)) {
         console.log("    Run once per profile if you use Hermes profiles.");
     }
-    if (isRemote) {
-        console.log("    Remote server: enter the auth token when prompted (stored in $HERMES_HOME/.env).");
+    if (keptExistingUrl) {
+        console.log("    The kept URL's server needs ITS token — run `hicortex status` on that machine if you don't have it.");
+    }
+    else if (authToken) {
+        console.log(`    When prompted for the token, paste:  ${authToken}`);
+        console.log("    (stored by Hermes in $HERMES_HOME/.env — never in the plugin's config.json)");
+    }
+    else {
+        console.log("    Local server: leave the token blank — localhost bypasses auth.");
     }
+    console.log("    Installed Hermes AFTER Hicortex? Re-running `npx @gamaze/hicortex init` redoes this step.");
 }
 /**
  * Parse a KEY=VALUE env file (e.g. ~/.hermes/.env or ~/.claude/settings.json env block).
@@ -1850,6 +1941,11 @@ async function runClientInit(serverUrl, agentName) {
     // writeClientConfig: strict-load → apply overrides → save. Throws on a
     // malformed existing config (0.16.x BLOCKER — never wipe the client's
     // authToken/licenseKey). ENOENT → fresh client config.
+    // The PRE-overwrite serverUrl is captured first: it is what init last
+    // wrote into the Hermes plugin's config, so the plugin step can tell an
+    // init-owned URL (update it — re-point must reach Hermes like it reaches
+    // CC's MCP entry) from a user-set one (keep + warn).
+    const previousServerUrl = readPreviousServerUrl(configPath);
     const { config } = writeClientConfig(configPath, { serverUrl, authToken }, nameDecision);
     console.log(`  ✓ Client config saved to ${configPath}`);
     if (typeof config.agentName === "string") {
@@ -1906,7 +2002,7 @@ async function runClientInit(serverUrl, agentName) {
     // Step 8: Setup Hermes if detected
     if ((0, node_fs_1.existsSync)(HERMES_HOME)) {
         console.log("\nHermes detected — installing plugin...");
-        setupHermes(serverUrl, authToken);
+        setupHermes(serverUrl, authToken, previousServerUrl);
     }
     // Step 8b: Setup the Pi extension if detected (self-resolving — no config write)
     if ((0, node_fs_1.existsSync)(PI_AGENT_DIR)) {

package/dist/nightly.js

@@ -741,8 +741,11 @@ async function runNightly(options = {}) {
                         consolidationStatus = report.status;
                         // #337: the stages fail soft, so a run against an endpoint that died
                         // MID-run would otherwise report "completed". An open breaker is the
-                        // honest signal — override to endpoint_down (lastConsolidated still
-                        // only advances on a clean "completed", so the work is re-run).
+                        // honest signal — override to endpoint_down. lastConsolidated only
+                        // advances on a clean completed AND a closed breaker (the same
+                        // llm.breakerOpen signal, gated in consolidate.ts — keep the two
+                        // sites in lockstep), so the importance/reflection/domain work is
+                        // re-run on the next pass.
                         if (llm.breakerOpen) {
                             console.error(`[hicortex] LLM circuit breaker OPEN after consolidation — ` +
                                 `overriding "${report.status}" to endpoint_down (stages failed ` +

package/hermes-plugin/hicortex/README.md

@@ -78,7 +78,7 @@ hermes memory setup   # select "hicortex", enter the server URL/token when promp
 
 Run it once per profile if you use Hermes profiles. Hermes allows **one** external memory provider at a time, so disable Honcho (or any other) first, then restart the gateway.
 
-Config fields (`hicortex_url`, `default_project`, `recall_limit`, `privacy_filter`, `agent_name`) can also be written to `$HERMES_HOME/plugins/hicortex/config.json` directly. `agent_name` pins the per-agent context id for this profile (leave blank to auto-derive — see [Per-agent standing context](#per-agent-standing-context-013)). The auth token is a **secret** — set it via env, not the JSON file:
+Setup asks exactly two questions: the **server URL** and the **auth token**. Everything else has a correct default and is configured — if ever needed — directly in `$HERMES_HOME/plugins/hicortex/config.json`: `default_project` (blank = memories unattributed), `recall_limit` (default 5; sizes the tools and the legacy `/search` fallback only — the pushed recall index is sized by SERVER config `recallMaxItems`), `agent_name` (blank auto-derives from the running profile; pin it only for fleet re-installs — see [Per-agent standing context](#per-agent-standing-context-013)), and `mission_domains` (blank = off; an optional recall boost keyed to the server's domain vocabulary). The auth token is a **secret** — set it via env, not the JSON file:
 
 ```bash
 export HICORTEX_AUTH_TOKEN=hctx-<your-token>   # or your custom token
@@ -86,7 +86,7 @@ export HICORTEX_AUTH_TOKEN=hctx-<your-token>   # or your custom token
 
 Env overrides: `HICORTEX_URL`, `HICORTEX_AUTH_TOKEN`.
 
-> **`privacy_filter` is DEPRECATED** (plugin 0.7.2 / server 0.16.2). The server no longer filters on privacy — the `privacy` column is vestigial (stored, never filtered). The setting is still accepted for backward compatibility but is now a harmless no-op; setting it emits a one-time-per-process warning in the gateway log. For work/personal isolation, run a **separate Hicortex server** per scope rather than relying on in-server privacy filtering.
+> **`privacy_filter` is REMOVED from setup** (plugin 0.7.4; deprecated since 0.7.2 / server 0.16.2). The server no longer filters on privacy — the `privacy` column is vestigial (stored, never filtered) — so the setting was a no-op the setup flow still prompted for. New setups never see the question; existing config.json files that still carry the key are tolerated (one-time warning in the gateway log; safe to delete the line). For work/personal isolation, run a **separate Hicortex server** per scope rather than relying on in-server privacy filtering.
 
 ## Topology
 

package/hermes-plugin/hicortex/config.py

@@ -36,65 +36,25 @@ CONFIG_SCHEMA: list[dict[str, Any]] = [
         "key": "hicortex_auth_token",
         "label": "Auth token",
         "description": (
-            "Bearer token for the server. Omit (leave blank) when targeting "
-            "localhost — the server bypasses auth there. Default token: "
-            "hctx-default-token."
+            "Bearer token for the server. Leave blank when targeting "
+            "localhost — the server bypasses auth there. To find a remote "
+            "server's token, run `hicortex status` on the server machine "
+            "(or check ~/.hicortex/config.json there)."
         ),
         "secret": True,
         "env_var": "HICORTEX_AUTH_TOKEN",
     },
-    {
-        "key": "default_project",
-        "label": "Default project",
-        "description": "Optional project name to scope recall and capture.",
-        "required": False,
-    },
-    {
-        "key": "recall_limit",
-        "label": "Recall limit",
-        "description": (
-            "Max memories returned per recall (default 5). Applies to the "
-            "tools and the legacy pre-0.14 /search prefetch fallback only — "
-            "the pushed recall index is sized by SERVER config (recallMaxItems)."
-        ),
-        "default": "5",
-        "required": False,
-    },
-    {
-        "key": "privacy_filter",
-        "label": "Privacy filter (DEPRECATED)",
-        "description": (
-            "DEPRECATED since plugin 0.7.2 / server 0.16.2. The server no "
-            "longer filters on privacy — the column is vestigial. This setting "
-            "is now a harmless no-op: it is still accepted for backward "
-            "compat but ignored. For work/personal isolation, run a separate "
-            "Hicortex server per scope. (Historically: comma-separated privacy "
-            "levels to include, e.g. WORK,PERSONAL.)"
-        ),
-        "default": "WORK,PERSONAL",
-        "required": False,
-    },
-    {
-        "key": "agent_name",
-        "label": "Agent name (per-agent context)",
-        "description": (
-            "Identity sent as ?agent= when fetching the standing context layer, "
-            "so this profile gets its own context (0.13). Leave blank to "
-            "auto-derive from the running profile (HERMES_PROFILE / HERMES_HOME)."
-        ),
-        "required": False,
-    },
-    {
-        "key": "mission_domains",
-        "label": "Mission domains",
-        "description": (
-            "Comma-separated knowledge domains this agent works in (e.g. Health, "
-            "or Finance,Work). Recall boosts memories tagged into these domains "
-            "(soft — never excludes others). Pick from the domains in your "
-            "Hicortex config; leave blank for a general-purpose agent."
-        ),
-        "required": False,
-    },
+    # 0.7.6: setup asks ONLY url + token. default_project joined the
+    # config-only knobs (0.7.5 removed recall_limit / agent_name /
+    # mission_domains) after live-install feedback: "no human will understand
+    # what it is" — a memory-attribution bucket is not a setup question.
+    # Config-only knobs (set directly in config.json, all have correct
+    # defaults): default_project (blank = unattributed), recall_limit (5;
+    # tools + legacy fallback only — the pushed index is SERVER-sized via
+    # recallMaxItems), agent_name (blank auto-derives from the running
+    # profile), mission_domains (blank = off).
+    # privacy_filter was removed outright in 0.7.4 (dead since server 0.16.2;
+    # tolerated at load with a one-time warning if an old file carries it).
     # NOTE: recall-only plugin — no capture config. Capture is handled by the
     # nightly server-side reader of each agent's session store.
 ]
@@ -130,7 +90,8 @@ def load_config() -> Dict[str, Any]:
     # Defaults
     cfg.setdefault("hicortex_url", "http://localhost:8787")
     cfg.setdefault("recall_limit", 5)
-    cfg.setdefault("privacy_filter", "WORK,PERSONAL")
+    # No privacy_filter default — the setting is dead (see schema note) and
+    # must not be injected into new configs.
 
     # 0.16.2 deprecation: privacy_filter is a no-op now (server ignores privacy
     # entirely). Warn once per process if the profile explicitly sets it.

package/hermes-plugin/hicortex/plugin.yaml

@@ -1,6 +1,6 @@
 name: hicortex
-version: 0.7.3
-description: "Self-learning memory for Hermes agents — every session is distilled into lessons overnight, and your agent wakes up wiser. Pushes a compact per-turn recall index (lazy-loaded with hicortex_get), injects fresh lessons plus a per-agent standing context block, and exposes the full 9-tool memory surface (search, get, recent, ingest, lessons, index, graph, update, delete) via a shared Hicortex server. Stdlib-only."
+version: 0.7.8
+description: "Self-learning memory for Hermes agents — every session is distilled into lessons overnight, and your agent wakes up wiser. Pushes a compact per-turn recall index (lazy-loaded with hicortex_get), injects fresh lessons plus a per-agent standing context block, and exposes the full 9-tool memory surface (search, get, recent, ingest, lessons, index, graph, update, delete) via a shared Hicortex server. Stdlib-only. AFTER INSTALL: run `hermes memory setup`, select hicortex, enter the server URL + token (see the token env var description for where to find it)."
 pip_dependencies: []
 hooks: []
 requires_env:

package/hermes-plugin/hicortex/provider.py

@@ -224,7 +224,10 @@ class HicortexProvider(MemoryProvider):
             self._recall_limit = int(cfg.get("recall_limit", 5))
         except (TypeError, ValueError):
             self._recall_limit = 5
-        self._privacy = cfg.get("privacy_filter", "WORK,PERSONAL")
+        # privacy_filter removed (0.7.4): the server ignores privacy entirely;
+        # the dead setting is no longer read. _privacy stays at its inert
+        # default for the (equally ignored) wire parameter.
+        self._privacy = "WORK,PERSONAL"
         # #203 scope: declared knowledge domains for this role-bound agent
         # (e.g. a health-focused agent → Health). Soft affinity boost on
         # recall; never excludes.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gamaze/hicortex",
-  "version": "0.20.0",
+  "version": "0.20.2",
   "description": "Persistent agent identity for AI agents \u2014 a hand-edited identity layer, nightly-distilled experience, and lessons injected every session, shared across your whole fleet. Works with Hermes, OpenClaw, Claude Code, Pi, and opencode.",
   "main": "dist/index.js",
   "bin": {