hippo-memory 1.24.0 → 1.24.1

package/dist/cli.d.ts

@@ -29,6 +29,11 @@ import { MemoryEntry } from './memory.js';
 import * as api from './api.js';
 /** Test-only: reset the module-level recall-history Map. Call from beforeEach. */
 export declare function __resetSessionRecallHistoryCli(): void;
+/**
+ * Scan for Claude Code MEMORY.md files and import new entries into hippo.
+ * Looks in ~/.claude/projects/<project>/memory/ for .md files with YAML frontmatter.
+ */
+export declare function learnFromMemoryMd(hippoRoot: string, homeDir?: string): number;
 /**
  * Render an api.sleep result as console output, byte-identical to the
  * pre-extraction inline implementation in cmdSleepCore.

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAyBH,OAAO,EASL,WAAW,EAEZ,MAAM,aAAa,CAAC;AAqGrB,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AA4ChC,kFAAkF;AAClF,wBAAgB,8BAA8B,IAAI,IAAI,CAErD;AAu4ED;;;GAGG;AACH,oHAAoH;AACpH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,GAAG,IAAI,CAkD/D;AA8vFD,oHAAoH;AACpH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,KAAK,CAAC;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,EACtF,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,MAAkB,GAC1B,IAAI,CA6BN"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAyBH,OAAO,EASL,WAAW,EAEZ,MAAM,aAAa,CAAC;AAsGrB,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AA4ChC,kFAAkF;AAClF,wBAAgB,8BAA8B,IAAI,IAAI,CAErD;AAguED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,MAAqB,GAAG,MAAM,CAyE3F;AAyGD;;;GAGG;AACH,oHAAoH;AACpH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,GAAG,IAAI,CAkD/D;AA8vFD,oHAAoH;AACpH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,KAAK,CAAC;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,EACtF,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,MAAkB,GAC1B,IAAI,CA6BN"}

package/dist/cli.js

@@ -34,6 +34,7 @@ import { execFileSync, execSync, spawn } from 'child_process';
 import { installJsonHooks, uninstallJsonHooks, resolveJsonHookPaths, detectInstalledTools, defaultSleepLogPath, ensureCodexWrapperInstalled, installCodexWrapper, uninstallCodexWrapper, resolveCodexSessionTranscript, resolveCodexWrapperPaths, installOpencodePlugin, uninstallOpencodePlugin, resolveOpencodePluginPath, } from './hooks.js';
 import { createMemory, calculateStrength, calculateRewardFactor, deriveHalfLife, resolveConfidence, computeSchemaFit, Layer, } from './memory.js';
 import { resolveProjectIdentity } from './project-identity.js';
+import { detectSecret } from './secret-detect.js';
 import { getHippoRoot, isInitialized, initStore, writeEntry, readEntry, deleteEntry, loadAllEntries, loadSearchEntries, loadIndex, saveIndex, loadStats, updateStats, saveActiveTaskSnapshot, loadActiveTaskSnapshot, clearActiveTaskSnapshot, appendSessionEvent, listSessionEvents, listMemoryConflicts, resolveConflict, saveSessionHandoff, loadLatestHandoff, loadHandoffById, RECALL_DEFAULT_DENY_SCOPES, } from './store.js';
 import { markRetrieved, hybridSearch, physicsSearch, explainMatch, textOverlap } from './search.js';
 import { renderTraceContent, parseSteps } from './trace.js';
@@ -2224,8 +2225,8 @@ async function cmdRefine(hippoRoot, flags) {
  * Scan for Claude Code MEMORY.md files and import new entries into hippo.
  * Looks in ~/.claude/projects/<project>/memory/ for .md files with YAML frontmatter.
  */
-function learnFromMemoryMd(hippoRoot) {
-    const home = os.homedir();
+export function learnFromMemoryMd(hippoRoot, homeDir = os.homedir()) {
+    const home = homeDir;
     const memoryDirs = [];
     // Claude Code project memories
     const claudeProjectsDir = path.join(home, '.claude', 'projects');
@@ -2243,6 +2244,7 @@ function learnFromMemoryMd(hippoRoot) {
         return 0;
     const existing = loadAllEntries(hippoRoot);
     let imported = 0;
+    let skippedSecret = 0;
     for (const memDir of memoryDirs) {
         try {
             const files = fs.readdirSync(memDir).filter(f => f.endsWith('.md') && f !== 'MEMORY.md');
@@ -2257,6 +2259,15 @@ function learnFromMemoryMd(hippoRoot) {
                     continue;
                 // Truncate to reasonable size
                 const content = body.length > 1500 ? body.slice(0, 1500) + ' [truncated]' : body;
+                // Never ingest secret-bearing memory files. Some Claude Code memory
+                // files exist purely to hold a live credential (e.g. an API-key
+                // reference). The scope-isolation secret veto (v1.24.0) gated
+                // share/promote/sync/ambient but missed this import path, so a live
+                // key could land in the store here. Veto it at ingest. (v1.24.1)
+                if (detectSecret({ content, tags: ['claude-code-memory'] }).flagged) {
+                    skippedSecret++;
+                    continue;
+                }
                 // Dedup: check if substantially similar content already exists
                 const isDup = existing.some(e => {
                     const overlap = textOverlap(content.slice(0, 200), e.content.slice(0, 200));
@@ -2277,6 +2288,9 @@ function learnFromMemoryMd(hippoRoot) {
         }
         catch { /* skip broken dirs */ }
     }
+    if (skippedSecret > 0) {
+        console.log(`Skipped ${skippedSecret} secret-bearing memory file${skippedSecret === 1 ? '' : 's'} (not ingested).`);
+    }
     return imported;
 }
 function cmdDedup(hippoRoot, flags) {