hippo-memory 1.24.0 → 1.24.1

package/dist/src/cli.js

@@ -34,6 +34,7 @@ import { execFileSync, execSync, spawn } from 'child_process';
 import { installJsonHooks, uninstallJsonHooks, resolveJsonHookPaths, detectInstalledTools, defaultSleepLogPath, ensureCodexWrapperInstalled, installCodexWrapper, uninstallCodexWrapper, resolveCodexSessionTranscript, resolveCodexWrapperPaths, installOpencodePlugin, uninstallOpencodePlugin, resolveOpencodePluginPath, } from './hooks.js';
 import { createMemory, calculateStrength, calculateRewardFactor, deriveHalfLife, resolveConfidence, computeSchemaFit, Layer, } from './memory.js';
 import { resolveProjectIdentity } from './project-identity.js';
+import { detectSecret } from './secret-detect.js';
 import { getHippoRoot, isInitialized, initStore, writeEntry, readEntry, deleteEntry, loadAllEntries, loadSearchEntries, loadIndex, saveIndex, loadStats, updateStats, saveActiveTaskSnapshot, loadActiveTaskSnapshot, clearActiveTaskSnapshot, appendSessionEvent, listSessionEvents, listMemoryConflicts, resolveConflict, saveSessionHandoff, loadLatestHandoff, loadHandoffById, RECALL_DEFAULT_DENY_SCOPES, } from './store.js';
 import { markRetrieved, hybridSearch, physicsSearch, explainMatch, textOverlap } from './search.js';
 import { renderTraceContent, parseSteps } from './trace.js';
@@ -2224,8 +2225,8 @@ async function cmdRefine(hippoRoot, flags) {
  * Scan for Claude Code MEMORY.md files and import new entries into hippo.
  * Looks in ~/.claude/projects/<project>/memory/ for .md files with YAML frontmatter.
  */
-function learnFromMemoryMd(hippoRoot) {
-    const home = os.homedir();
+export function learnFromMemoryMd(hippoRoot, homeDir = os.homedir()) {
+    const home = homeDir;
     const memoryDirs = [];
     // Claude Code project memories
     const claudeProjectsDir = path.join(home, '.claude', 'projects');
@@ -2243,6 +2244,7 @@ function learnFromMemoryMd(hippoRoot) {
         return 0;
     const existing = loadAllEntries(hippoRoot);
     let imported = 0;
+    let skippedSecret = 0;
     for (const memDir of memoryDirs) {
         try {
             const files = fs.readdirSync(memDir).filter(f => f.endsWith('.md') && f !== 'MEMORY.md');
@@ -2257,6 +2259,15 @@ function learnFromMemoryMd(hippoRoot) {
                     continue;
                 // Truncate to reasonable size
                 const content = body.length > 1500 ? body.slice(0, 1500) + ' [truncated]' : body;
+                // Never ingest secret-bearing memory files. Some Claude Code memory
+                // files exist purely to hold a live credential (e.g. an API-key
+                // reference). The scope-isolation secret veto (v1.24.0) gated
+                // share/promote/sync/ambient but missed this import path, so a live
+                // key could land in the store here. Veto it at ingest. (v1.24.1)
+                if (detectSecret({ content, tags: ['claude-code-memory'] }).flagged) {
+                    skippedSecret++;
+                    continue;
+                }
                 // Dedup: check if substantially similar content already exists
                 const isDup = existing.some(e => {
                     const overlap = textOverlap(content.slice(0, 200), e.content.slice(0, 200));
@@ -2277,6 +2288,9 @@ function learnFromMemoryMd(hippoRoot) {
         }
         catch { /* skip broken dirs */ }
     }
+    if (skippedSecret > 0) {
+        console.log(`Skipped ${skippedSecret} secret-bearing memory file${skippedSecret === 1 ? '' : 's'} (not ingested).`);
+    }
     return imported;
 }
 function cmdDedup(hippoRoot, flags) {