hippo-memory 1.23.0 → 1.24.1

package/dist/cli.d.ts

@@ -29,6 +29,11 @@ import { MemoryEntry } from './memory.js';
 import * as api from './api.js';
 /** Test-only: reset the module-level recall-history Map. Call from beforeEach. */
 export declare function __resetSessionRecallHistoryCli(): void;
+/**
+ * Scan for Claude Code MEMORY.md files and import new entries into hippo.
+ * Looks in ~/.claude/projects/<project>/memory/ for .md files with YAML frontmatter.
+ */
+export declare function learnFromMemoryMd(hippoRoot: string, homeDir?: string): number;
 /**
  * Render an api.sleep result as console output, byte-identical to the
  * pre-extraction inline implementation in cmdSleepCore.

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAwBH,OAAO,EASL,WAAW,EAEZ,MAAM,aAAa,CAAC;AAmGrB,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AA4ChC,kFAAkF;AAClF,wBAAgB,8BAA8B,IAAI,IAAI,CAErD;AAi4ED;;;GAGG;AACH,oHAAoH;AACpH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,GAAG,IAAI,CAkD/D;AA2tFD,oHAAoH;AACpH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,KAAK,CAAC;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,EACtF,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,MAAkB,GAC1B,IAAI,CA6BN"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAyBH,OAAO,EASL,WAAW,EAEZ,MAAM,aAAa,CAAC;AAsGrB,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AA4ChC,kFAAkF;AAClF,wBAAgB,8BAA8B,IAAI,IAAI,CAErD;AAguED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,MAAqB,GAAG,MAAM,CAyE3F;AAyGD;;;GAGG;AACH,oHAAoH;AACpH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,GAAG,IAAI,CAkD/D;AA8vFD,oHAAoH;AACpH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,KAAK,CAAC;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,EACtF,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,MAAkB,GAC1B,IAAI,CA6BN"}

package/dist/cli.js

@@ -25,6 +25,7 @@
  *   hippo decide "<decision>" [--context "<why>"] [--supersedes <id>]
  *   hippo wm <push|read|clear|flush>
  */
+import { evalNow, isRecallBoostAblated } from './ablation.js';
 import * as path from 'path';
 import * as fs from 'fs';
 import * as os from 'os';
@@ -32,6 +33,8 @@ import { fileURLToPath } from 'node:url';
 import { execFileSync, execSync, spawn } from 'child_process';
 import { installJsonHooks, uninstallJsonHooks, resolveJsonHookPaths, detectInstalledTools, defaultSleepLogPath, ensureCodexWrapperInstalled, installCodexWrapper, uninstallCodexWrapper, resolveCodexSessionTranscript, resolveCodexWrapperPaths, installOpencodePlugin, uninstallOpencodePlugin, resolveOpencodePluginPath, } from './hooks.js';
 import { createMemory, calculateStrength, calculateRewardFactor, deriveHalfLife, resolveConfidence, computeSchemaFit, Layer, } from './memory.js';
+import { resolveProjectIdentity } from './project-identity.js';
+import { detectSecret } from './secret-detect.js';
 import { getHippoRoot, isInitialized, initStore, writeEntry, readEntry, deleteEntry, loadAllEntries, loadSearchEntries, loadIndex, saveIndex, loadStats, updateStats, saveActiveTaskSnapshot, loadActiveTaskSnapshot, clearActiveTaskSnapshot, appendSessionEvent, listSessionEvents, listMemoryConflicts, resolveConflict, saveSessionHandoff, loadLatestHandoff, loadHandoffById, RECALL_DEFAULT_DENY_SCOPES, } from './store.js';
 import { markRetrieved, hybridSearch, physicsSearch, explainMatch, textOverlap } from './search.js';
 import { renderTraceContent, parseSteps } from './trace.js';
@@ -50,7 +53,7 @@ import { extractPathTags } from './path-context.js';
 import { detectScope } from './scope.js';
 import { getGlobalRoot, initGlobal, shareMemory, listPeers, autoShare, transferScore, searchBothHybrid, syncGlobalToLocal, } from './shared.js';
 import { DAILY_TASK_NAME, buildDailyRunnerCommand, listRegisteredWorkspaces, registerWorkspace, runDailyMaintenance, } from './scheduler.js';
-import { importChatGPT, importClaude, importCursor, importGenericFile, importMarkdown, } from './importers.js';
+import { importChatGPT, importClaude, importCursor, importGenericFile, importMarkdown, importVault, } from './importers.js';
 import { cmdCapture } from './capture.js';
 import { auditMemories, appendAuditEvent, } from './audit.js';
 import { listApiKeys, revokeApiKey } from './auth.js';
@@ -1482,9 +1485,15 @@ async function cmdRecall(hippoRoot, query, flags) {
     // Update retrieval metadata and persist
     const updated = markRetrieved(results.map((r) => r.entry));
     const localIndex = loadIndex(hippoRoot);
-    for (const u of updated) {
-        const targetRoot = localIndex.entries[u.id] ? hippoRoot : (isInitialized(globalRoot) ? globalRoot : hippoRoot);
-        writeEntry(targetRoot, u);
+    // EVAL-ONLY ablation (see ablation.ts): under the recall flag, markRetrieved
+    // returns unmutated entries (ids preserved for outcome attribution below)
+    // and persistence is skipped - writeEntry on identical rows still refreshes
+    // updated_at, rewrites mirrors, and marks DAG parents dirty.
+    if (!isRecallBoostAblated()) {
+        for (const u of updated) {
+            const targetRoot = localIndex.entries[u.id] ? hippoRoot : (isInitialized(globalRoot) ? globalRoot : hippoRoot);
+            writeEntry(targetRoot, u);
+        }
     }
     // Track last retrieval IDs for outcome command
     localIndex.last_retrieval_ids = updated.map((u) => u.id);
@@ -2091,7 +2100,7 @@ function cmdTrace(hippoRoot, id, flags) {
         console.error(`Memory not found: ${id}`);
         process.exit(1);
     }
-    const now = new Date();
+    const now = evalNow();
     const strength = calculateStrength(entry, now);
     const halfLife = deriveHalfLife(7, entry);
     const rewardFactor = calculateRewardFactor(entry);
@@ -2216,8 +2225,8 @@ async function cmdRefine(hippoRoot, flags) {
  * Scan for Claude Code MEMORY.md files and import new entries into hippo.
  * Looks in ~/.claude/projects/<project>/memory/ for .md files with YAML frontmatter.
  */
-function learnFromMemoryMd(hippoRoot) {
-    const home = os.homedir();
+export function learnFromMemoryMd(hippoRoot, homeDir = os.homedir()) {
+    const home = homeDir;
     const memoryDirs = [];
     // Claude Code project memories
     const claudeProjectsDir = path.join(home, '.claude', 'projects');
@@ -2235,6 +2244,7 @@ function learnFromMemoryMd(hippoRoot) {
         return 0;
     const existing = loadAllEntries(hippoRoot);
     let imported = 0;
+    let skippedSecret = 0;
     for (const memDir of memoryDirs) {
         try {
             const files = fs.readdirSync(memDir).filter(f => f.endsWith('.md') && f !== 'MEMORY.md');
@@ -2249,6 +2259,15 @@ function learnFromMemoryMd(hippoRoot) {
                     continue;
                 // Truncate to reasonable size
                 const content = body.length > 1500 ? body.slice(0, 1500) + ' [truncated]' : body;
+                // Never ingest secret-bearing memory files. Some Claude Code memory
+                // files exist purely to hold a live credential (e.g. an API-key
+                // reference). The scope-isolation secret veto (v1.24.0) gated
+                // share/promote/sync/ambient but missed this import path, so a live
+                // key could land in the store here. Veto it at ingest. (v1.24.1)
+                if (detectSecret({ content, tags: ['claude-code-memory'] }).flagged) {
+                    skippedSecret++;
+                    continue;
+                }
                 // Dedup: check if substantially similar content already exists
                 const isDup = existing.some(e => {
                     const overlap = textOverlap(content.slice(0, 200), e.content.slice(0, 200));
@@ -2269,6 +2288,9 @@ function learnFromMemoryMd(hippoRoot) {
         }
         catch { /* skip broken dirs */ }
     }
+    if (skippedSecret > 0) {
+        console.log(`Skipped ${skippedSecret} secret-bearing memory file${skippedSecret === 1 ? '' : 's'} (not ingested).`);
+    }
     return imported;
 }
 function cmdDedup(hippoRoot, flags) {
@@ -2705,7 +2727,7 @@ function cmdStatus(hippoRoot) {
     requireInit(hippoRoot);
     const entries = loadAllEntries(hippoRoot);
     const stats = loadStats(hippoRoot);
-    const now = new Date();
+    const now = evalNow();
     const byLayer = {
         [Layer.Buffer]: 0,
         [Layer.Episodic]: 0,
@@ -2926,7 +2948,7 @@ function cmdInspect(hippoRoot, id) {
         console.error(`Memory not found: ${id}`);
         process.exit(1);
     }
-    const now = new Date();
+    const now = evalNow();
     const currentStrength = calculateStrength(entry, now);
     const lastRetrieved = new Date(entry.last_retrieved);
     const created = new Date(entry.created);
@@ -4911,6 +4933,9 @@ async function cmdContext(hippoRoot, args, flags) {
         tenantId: resolveTenantId({}),
         actor: api.adminActor('cli'),
     };
+    // v39 memory scope isolation: --cross-project re-includes other-project
+    // memories (rendered under a demarcated section below).
+    const crossProject = flags['cross-project'] === true;
     const opts = {
         q: query,
         budget,
@@ -4918,6 +4943,7 @@ async function cmdContext(hippoRoot, args, flags) {
         pinnedOnly,
         scope: ctxActiveScope ?? undefined,
         includeRecent: parseCountFlag(flags['include-recent']),
+        crossProject,
     };
     const result = await api.getContext(ctx, opts);
     // Early exit when there's nothing to render (matches pre-extraction behavior).
@@ -4930,8 +4956,13 @@ async function cmdContext(hippoRoot, args, flags) {
     // Format + framing are CLI rendering concerns; api.getContext doesn't see them.
     const format = String(flags['format'] ?? 'markdown');
     const framing = String(flags['framing'] ?? 'observe');
-    // Adapter: ContextResultEntry -> the print-helper input shape.
-    const renderItems = result.entries.map((r) => ({
+    // Adapter: ContextResultEntry -> the print-helper input shape. v39:
+    // cross-project inclusions (only present under --cross-project or with
+    // isolation disabled via crossProject) render in their own demarcated
+    // section so they can never masquerade as project memory.
+    const mainEntries = result.entries.filter((r) => r.category !== 'cross-project');
+    const crossEntries = result.entries.filter((r) => r.category === 'cross-project');
+    const renderItems = mainEntries.map((r) => ({
         entry: r.entry,
         score: r.score,
         tokens: r.tokens,
@@ -4946,6 +4977,8 @@ async function cmdContext(hippoRoot, args, flags) {
             confidence: r.entry.confidence,
             content: r.entry.content,
             global: r.isGlobal ?? false,
+            origin: r.origin ?? null,
+            category: r.category ?? null,
         }));
         console.log(JSON.stringify({
             query: query || '*',
@@ -4973,6 +5006,7 @@ async function cmdContext(hippoRoot, args, flags) {
             if (renderItems.length > 0) {
                 printContextMarkdown(renderItems, result.tokens, framing);
             }
+            printCrossProjectSection(crossEntries);
         }
         finally {
             console.log = realLog;
@@ -5002,6 +5036,7 @@ async function cmdContext(hippoRoot, args, flags) {
         if (renderItems.length > 0) {
             printContextMarkdown(renderItems, result.tokens, framing);
         }
+        printCrossProjectSection(crossEntries);
         // Ambient state summary (CLI-side: api.getContext doesn't load all entries
         // post-selection, so we re-load here for the landscape summary).
         const ambientConfig = loadConfig(hippoRoot);
@@ -5009,11 +5044,17 @@ async function cmdContext(hippoRoot, args, flags) {
             const tenantId = ctx.tenantId;
             const globalRoot = getGlobalRoot();
             const hasGlobalForAmbient = isInitialized(globalRoot);
+            // v39: the landscape summary must reflect the same admission policy as
+            // the injected entries - otherwise excluded rows leak back in as
+            // aggregate signal (codex P2-13).
+            const isolationOff = ambientConfig.contextProjectIsolation === false;
+            const ambientCurrentName = resolveProjectIdentity(process.cwd()).name;
+            const ambientAdmit = (e) => api.ambientAdmitEntry(e, ambientCurrentName, crossProject || isolationOff);
             const localForAmbient = isInitialized(hippoRoot)
-                ? loadAllEntries(hippoRoot, tenantId).filter(e => !e.superseded_by)
+                ? loadAllEntries(hippoRoot, tenantId).filter(e => !e.superseded_by).filter(ambientAdmit)
                 : [];
             const globalForAmbient = hasGlobalForAmbient
-                ? loadAllEntries(globalRoot, tenantId).filter(e => !e.superseded_by)
+                ? loadAllEntries(globalRoot, tenantId).filter(e => !e.superseded_by).filter(ambientAdmit)
                 : [];
             const allForAmbient = [...localForAmbient, ...globalForAmbient];
             if (allForAmbient.length > 0) {
@@ -5023,9 +5064,24 @@ async function cmdContext(hippoRoot, args, flags) {
         }
     }
 }
+/**
+ * v39: render cross-project inclusions under an explicit header so agents
+ * (and humans) can tell borrowed context from project memory. Only ever
+ * non-empty when the caller passed --cross-project or disabled isolation.
+ */
+function printCrossProjectSection(items) {
+    if (items.length === 0)
+        return;
+    console.log(`\n## Other-project memory (explicitly requested, ${items.length} entries)\n`);
+    for (const item of items) {
+        const originLabel = item.origin === null || item.origin === '' ? 'unknown-origin' : item.origin;
+        const tagStr = item.entry.tags.length > 0 ? ` [${item.entry.tags.join(', ')}]` : '';
+        console.log(`- **[${originLabel}]** ${item.entry.content}${tagStr}`);
+    }
+}
 /** @internal — exported for snapshot tests (tests/cli-context-render-snapshot.test.ts). NOT a stable public API. */
 export function printContextMarkdown(items, totalTokens, framing = 'observe') {
-    const now = new Date();
+    const now = evalNow();
     console.log(`## Project Memory (${items.length} entries, ${totalTokens} tokens)\n`);
     for (const item of items) {
         const e = item.entry;
@@ -5320,6 +5376,54 @@ function cmdImport(hippoRoot, args, flags) {
         extraTags,
         hippoRoot,
     };
+    // K1 vault import: a FOLDER importer that mirrors the connector pattern
+    // (kind='raw' + tag provenance + archiveRaw deletions), so it dispatches
+    // separately from the single-file `importer` function-pointer slot below.
+    // It writes through api.remember/archiveRaw which are tenant-scoped, so we
+    // resolve the tenant and pass it through. --global is not supported for
+    // vault import (the connector raw-archive path is tenant-local).
+    if (flags['vault']) {
+        const folderPath = String(flags['vault']);
+        if (!fs.existsSync(folderPath) || !fs.statSync(folderPath).isDirectory()) {
+            console.error(`Vault folder not found (or not a directory): ${folderPath}`);
+            process.exit(1);
+        }
+        if (useGlobal) {
+            console.error('hippo import --vault does not support --global (raw rows are tenant-local).');
+            process.exit(1);
+        }
+        if (typeof flags['name'] !== 'string' || !flags['name'].trim()) {
+            // --name is the vault identity key for the destructive source-deletion sync;
+            // inferring it from the folder basename let same-basename vaults collide and
+            // clobber each other (codex R10 P2). A valueless `--name` parses as boolean
+            // true, and String(true) === "true" would silently import under vault:true:*
+            // - reject a non-string so it fails fast instead (codex R11 P2).
+            console.error('hippo import --vault requires --name <vault> (a non-empty identity key for source-deletion sync).');
+            process.exit(1);
+        }
+        if (flags['scope'] !== undefined && (typeof flags['scope'] !== 'string' || !flags['scope'].trim())) {
+            // Same valueless-flag trap: a bare `--scope` must not become scope "true".
+            // Example uses the source-prefixed private form, since a bare `private` scope
+            // is NOT treated as private by recall and importVault rejects it (R13 P2).
+            console.error('hippo import --vault: --scope requires a value (e.g. --scope vault:private:notes).');
+            process.exit(1);
+        }
+        const tenantId = resolveTenantId({});
+        const vaultOptions = {
+            ...importOptions,
+            tenantId,
+            name: flags['name'] ? String(flags['name']) : undefined,
+            scope: flags['scope'] ? String(flags['scope']) : undefined,
+        };
+        const vaultResult = importVault(folderPath, vaultOptions);
+        console.log(`\nImport Vault: ${folderPath}${dryRun ? ' (dry run - no writes)' : ''}`);
+        console.log(`  Notes found:           ${vaultResult.total}`);
+        console.log(`  ${dryRun ? 'Would import:         ' : 'Imported:             '}${vaultResult.imported}`);
+        console.log(`  Skipped (unchanged):   ${vaultResult.skipped}`);
+        console.log(`  ${dryRun ? 'Would archive:        ' : 'Archived (removed):   '}${vaultResult.archived ?? 0}`);
+        console.log(`  Store:                 ${hippoRoot}`);
+        return;
+    }
     // Determine which importer to use based on flag
     let filePath;
     let importer;
@@ -5356,7 +5460,7 @@ function cmdImport(hippoRoot, args, flags) {
         importerName = 'File';
     }
     if (!filePath || !importer) {
-        console.error('Usage: hippo import <--chatgpt|--claude|--cursor|--file|--markdown> <path>');
+        console.error('Usage: hippo import <--chatgpt|--claude|--cursor|--file|--markdown|--vault> <path>');
         process.exit(1);
     }
     if (!fs.existsSync(filePath)) {
@@ -5412,15 +5516,17 @@ function cmdPromote(hippoRoot, id) {
 // ---------------------------------------------------------------------------
 // Sync command
 // ---------------------------------------------------------------------------
-function cmdSync(hippoRoot) {
+function cmdSync(hippoRoot, flags = {}) {
     requireInit(hippoRoot);
     const globalRoot = getGlobalRoot();
     if (!isInitialized(globalRoot)) {
         console.log('No global store found. Run `hippo init --global` first.');
         return;
     }
-    const count = syncGlobalToLocal(hippoRoot, globalRoot);
-    console.log(`Synced ${count} global memories into local project.`);
+    // v39: other-project rows are skipped by default; secrets always are.
+    const includeCrossProject = flags['cross-project'] === true;
+    const count = syncGlobalToLocal(hippoRoot, globalRoot, { includeCrossProject });
+    console.log(`Synced ${count} global memories into local project.${includeCrossProject ? '' : ' (other-project rows skipped; use --cross-project to include them)'}`);
 }
 // ---------------------------------------------------------------------------
 // Hook install/uninstall
@@ -5436,7 +5542,11 @@ const HOOKS = {
         content: `
 ## Project Memory (Hippo)
 
-Before starting work, load relevant context:
+Pinned rules and recent writes auto-inject at every prompt via the installed
+UserPromptSubmit hook; never re-run that part manually. At the START of a
+task (not per prompt), additionally load task-specific context: git-aware
+recall over the full store that per-prompt injection does not cover. Also
+run it if the hook is not installed:
 \`\`\`bash
 hippo context --auto --budget 1500
 \`\`\`
@@ -7076,6 +7186,9 @@ Commands:
     --cursor <path>        Import from .cursorrules or .cursor/rules
     --file <path>          Import from any markdown or text file
     --markdown <path>      Import from structured MEMORY.md / AGENTS.md
+    --vault <path>         Import a markdown-vault FOLDER as kind='raw' notes
+                             (Obsidian/Foam/Dendron). Requires --name <vault>.
+                             [--scope <scope>]
     --dry-run              Preview without writing
     --global               Write to global store ($HIPPO_HOME or ~/.hippo/)
     --tag <tag>            Add extra tag (repeatable)
@@ -7670,7 +7783,7 @@ async function main() {
             break;
         }
         case 'sync':
-            cmdSync(hippoRoot);
+            cmdSync(hippoRoot, flags);
             break;
         case 'share': {
             const shareId = args[0];