hippo-memory 1.44.0 → 1.46.0

package/dist/mcp/server.js

@@ -10,17 +10,18 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { createMemory, Layer, calculateStrength, } from '../memory.js';
-import { hybridSearch, physicsSearch, markRetrieved } from '../search.js';
-import { isRecallBoostAblated, evalNow } from '../ablation.js';
-import { loadAllEntries, writeEntry, readEntry, loadFreshActiveTaskSnapshot, listMemoryConflicts, resolveConflict, RECALL_DEFAULT_DENY_SCOPES } from '../store.js';
-import { shareMemory, listPeers, getGlobalRoot } from '../shared.js';
+import { hybridSearch, physicsSearch, estimateTokens } from '../search.js';
+import { evalNow } from '../ablation.js';
+import { loadAllEntries, writeEntry, strengthenRetrieved, readEntry, loadFreshActiveTaskSnapshot, listMemoryConflicts, resolveConflict, RECALL_DEFAULT_DENY_SCOPES, countCreatedSinceLastSleep } from '../store.js';
+import { shareMemory, listPeers, getGlobalRoot, initGlobal } from '../shared.js';
 import { consolidate } from '../consolidate.js';
 import { execSync } from 'child_process';
 import { fetchGitLog, extractLessons, partitionLessons, deduplicateLesson, isGitRepo } from '../autolearn.js';
 import { loadConfig } from '../config.js';
 import { confidenceLabel } from '../memory.js';
 import { resolveTenantId } from '../tenant.js';
-import { recall as apiRecall, remember as apiRemember, outcome as apiOutcome, drillDown as apiDrillDown, assemble as apiAssemble, isPrivateScope, passesScopeFilterForRecall, adminActor, buildSuppressionSummary, ambientSecretAdmit } from '../api.js';
+import { recall as apiRecall, remember as apiRemember, outcome as apiOutcome, drillDown as apiDrillDown, assemble as apiAssemble, isPrivateScope, passesScopeFilterForRecall, buildSuppressionSummary, ambientSecretAdmit } from '../api.js';
+import { assertScopeRequestAllowed } from '../recall-scope.js';
 import { resolveProjectIdentity, classifyOriginProject, findHippoStoreDir } from '../project-identity.js';
 import { computePredictionBaserate } from '../predictions.js';
 import { appendAuditEvent } from '../audit.js';
@@ -38,6 +39,7 @@ export function __resetSessionRecallHistoryMcp() {
 }
 import { applyGoalStackBoost } from '../goals.js';
 import { openHippoDb, closeHippoDb } from '../db.js';
+import { recordTokenUse } from '../token-ledger.js';
 import { PACKAGE_VERSION } from '../version.js';
 // ── Find hippo root ──
 /** Same bounded walk as the CLI (ends at home, so HIPPO_HOME wins over ~/.hippo); cwd/opts are the test seam. */
@@ -49,6 +51,14 @@ export function findHippoRoot(cwd = process.cwd(), opts) {
     const global = getGlobalRoot();
     return fs.existsSync(global) ? global : null;
 }
+/**
+ * The api-layer actor for a tool call. Stdio (no ctx) is the local operator
+ * and runs as admin; over HTTP the transport's authenticated role is used, so
+ * a member key never acts as admin through MCP.
+ */
+function mcpActor(ctx) {
+    return { subject: ctx?.actor ?? 'mcp', role: ctx?.role ?? 'admin' };
+}
 // MCP stdio transport spec: messages are newline-delimited JSON-RPC, no embedded newlines.
 // https://modelcontextprotocol.io/specification/.../basic/transports#stdio
 function send(msg) {
@@ -136,7 +146,7 @@ const TOOLS = [
             type: 'object',
             properties: {
                 query: { type: 'string', description: 'What to search for in memory (natural language)' },
-                budget: { type: 'number', description: 'Max tokens to return (default: 1500)' },
+                budget: { type: 'number', description: 'Max tokens to return (default: config.defaultBudget, 4000)' },
                 include_continuity: {
                     type: 'boolean',
                     description: 'Append continuity context (active snapshot + handoff + last 5 session events) below the memory results. Useful at session boot.',
@@ -265,7 +275,7 @@ const TOOLS = [
         inputSchema: {
             type: 'object',
             properties: {
-                budget: { type: 'number', minimum: 0, description: 'Max tokens (default: 1500)' },
+                budget: { type: 'number', minimum: 0, description: 'Max tokens (default: config.defaultContextBudget, 3000)' },
                 scope: {
                     type: 'string',
                     description: 'Restrict memories and snapshot to this scope exactly. When omitted, default-deny applies to ANY <source>:private:* (slack, github, ...) and unknown-legacy rows.',
@@ -359,6 +369,7 @@ const TOOLS = [
 // `${tenantId}:default` if a McpContext is constructed in tests without a
 // pid-bound transport.
 const lastRecalledIds = new Map();
+const autoSleepInFlight = new Set();
 function resolveClientKey(ctx) {
     if (ctx?.clientKey)
         return ctx.clientKey;
@@ -366,6 +377,53 @@ function resolveClientKey(ctx) {
         return `stdio-${process.pid}:${ctx.tenantId}`;
     return `stdio-${process.pid}:default`;
 }
+/**
+ * Zero-install first run (`npx -y hippo-memory mcp` with no store anywhere):
+ * create the global store instead of failing every tool call, and say so on
+ * stderr (stdout carries the protocol). `hippo init` in a project later adds
+ * a project store, which then takes precedence.
+ */
+function createGlobalStoreOnFirstRun() {
+    initGlobal();
+    const root = getGlobalRoot();
+    console.error(`hippo: no memory store found; created the global store at ${root}. Run \`hippo init\` in a project for a project store.`);
+    return root;
+}
+// ── Token ledger (ROADMAP TE0) ──
+const MCP_TOKEN_SURFACES = new Map([
+    ['hippo_recall', 'mcp_recall'],
+    ['hippo_context', 'mcp_context'],
+]);
+/**
+ * Record the memory text a recall or context tool returned. Best-effort: a
+ * ledger failure never fails the tool call. Other tools are not recorded.
+ */
+function recordMcpTokens(toolName, output, ctx) {
+    const surface = MCP_TOKEN_SURFACES.get(toolName);
+    if (!surface || !output)
+        return;
+    try {
+        const hippoRoot = ctx?.hippoRoot ?? findHippoRoot();
+        if (!hippoRoot)
+            return;
+        const db = openHippoDb(hippoRoot);
+        try {
+            recordTokenUse(db, {
+                tenantId: ctx?.tenantId ?? resolveTenantId({}),
+                surface,
+                event: 'inject',
+                items: 0,
+                tokens: estimateTokens(output),
+            });
+        }
+        finally {
+            closeHippoDb(db);
+        }
+    }
+    catch {
+        // Ledger is best-effort.
+    }
+}
 // ── Tool execution ──
 async function executeTool(name, args, ctx) {
     // When a transport hands us a context (HTTP path), trust it: the HTTP
@@ -373,9 +431,7 @@ async function executeTool(name, args, ctx) {
     // from the Bearer token (or the loopback fallback). The stdio path
     // continues to walk from cwd / fall back to the global root, and to
     // resolve tenant from HIPPO_TENANT.
-    const hippoRoot = ctx?.hippoRoot ?? findHippoRoot();
-    if (!hippoRoot)
-        return 'No .hippo/ store found. Run: hippo init';
+    const hippoRoot = ctx?.hippoRoot ?? findHippoRoot() ?? createGlobalStoreOnFirstRun();
     const config = loadConfig(hippoRoot);
     // A5: every loadAllEntries() in this server returns to the caller and is
     // tenant-isolated. Resolved once per tool call: prefer the transport's
@@ -422,7 +478,7 @@ async function executeTool(name, args, ctx) {
             const apiCtx = {
                 hippoRoot,
                 tenantId,
-                actor: adminActor(ctx?.actor ?? 'mcp'),
+                actor: mcpActor(ctx),
             };
             // Route through api.recall for audit + (when requested) continuity block.
             // api.recall already applies the same default-deny / exact-match rules
@@ -527,15 +583,9 @@ async function executeTool(name, args, ctx) {
                     closeHippoDb(dbForBoost);
                 }
             }
-            // Mark retrieved and persist
-            const retrieved = markRetrieved(results.map((r) => r.entry));
-            // EVAL-ONLY ablation (see ablation.ts): skip persistence under the recall
-            // flag; ids below stay populated for outcome attribution.
-            if (!isRecallBoostAblated()) {
-                for (const entry of retrieved)
-                    writeEntry(hippoRoot, entry, { actor: ctx?.actor ?? 'mcp' });
-            }
-            lastRecalledIds.set(resolveClientKey(ctx), retrieved.map((e) => e.id));
+            const retrievedIds = results.map((r) => r.entry.id);
+            strengthenRetrieved(hippoRoot, retrievedIds);
+            lastRecalledIds.set(resolveClientKey(ctx), retrievedIds);
             // v0.33 / J1 — MCP per-pipeline anchoring detector. UNLIKE J3.2's
             // planningFallacyHint (which is pipeline-invariant because it
             // depends only on queryText + predictions table state), the
@@ -776,7 +826,7 @@ async function executeTool(name, args, ctx) {
             const apiCtx = {
                 hippoRoot,
                 tenantId,
-                actor: adminActor(ctx?.actor ?? 'mcp'),
+                actor: mcpActor(ctx),
             };
             const explicitScope = isJsonString(args.scope) && args.scope.length > 0
                 ? args.scope
@@ -820,7 +870,7 @@ async function executeTool(name, args, ctx) {
             const apiCtx = {
                 hippoRoot,
                 tenantId,
-                actor: adminActor(ctx?.actor ?? 'mcp'),
+                actor: mcpActor(ctx),
             };
             const drillExtra = {};
             if (Number.isFinite(limit) && limit > 0)
@@ -895,29 +945,24 @@ async function executeTool(name, args, ctx) {
             const apiCtx = {
                 hippoRoot,
                 tenantId,
-                actor: adminActor(ctx?.actor ?? 'mcp'),
+                actor: mcpActor(ctx),
             };
             const result = apiRemember(apiCtx, {
                 content: text,
                 tags,
             });
             const entry = readEntry(hippoRoot, result.id, tenantId);
-            // Auto-sleep check
-            if (config.autoSleep.enabled) {
-                const allEntries = loadAllEntries(hippoRoot, tenantId);
-                const recentCount = allEntries.filter((e) => {
-                    const age = (Date.now() - new Date(e.created).getTime()) / (1000 * 60 * 60);
-                    return age < 24; // created in last 24 hours
-                }).length;
-                if (recentCount >= config.autoSleep.threshold) {
-                    // Fire-and-forget by design (never block the remember response), but
-                    // an unhandled rejection here can kill the MCP server process — any
-                    // consolidate error (DB contention, or the memoryValue fail-loud
-                    // throw) must land as a logged line, not a crash.
-                    consolidate(hippoRoot).catch((err) => {
-                        console.error(`auto-sleep consolidate failed: ${err instanceof Error ? err.message : err}`);
-                    });
-                }
+            // Auto-sleep: one run per store at a time, triggered by what arrived since the last one.
+            if (config.autoSleep.enabled &&
+                !autoSleepInFlight.has(hippoRoot) &&
+                countCreatedSinceLastSleep(hippoRoot, tenantId) >= config.autoSleep.threshold) {
+                autoSleepInFlight.add(hippoRoot);
+                // Fire-and-forget (never block the response); an unhandled rejection would kill the server, so log it.
+                consolidate(hippoRoot)
+                    .catch((err) => {
+                    console.error(`auto-sleep consolidate failed (tenant ${tenantId}): ${err instanceof Error ? err.message : err}`);
+                })
+                    .finally(() => autoSleepInFlight.delete(hippoRoot));
             }
             const halfLife = entry?.half_life_days ?? config.defaultHalfLifeDays;
             const tagStr = entry?.tags.join(', ') || tags.join(', ') || 'none';
@@ -936,7 +981,7 @@ async function executeTool(name, args, ctx) {
             const apiCtx = {
                 hippoRoot,
                 tenantId,
-                actor: adminActor(ctx?.actor ?? 'mcp'),
+                actor: mcpActor(ctx),
             };
             const { applied } = apiOutcome(apiCtx, ids, good);
             return `Applied ${good ? 'positive' : 'negative'} outcome to ${applied} memories`;
@@ -967,6 +1012,7 @@ async function executeTool(name, args, ctx) {
             // results and the snapshot. Pre-v1.2 this surface returned all memories
             // and the snapshot unfiltered, which would have leaked private-channel
             // content to no-scope MCP callers once scope writers shipped.
+            assertScopeRequestAllowed(mcpActor(ctx).role, explicitScope);
             const allEntries = loadAllEntries(hippoRoot, tenantId);
             // v39 memory scope isolation: this surface reads the LOCAL store only,
             // but synced-down or legacy rows can still carry another project's
@@ -1000,14 +1046,9 @@ async function executeTool(name, args, ctx) {
             const results = usePhysicsCtx
                 ? await physicsSearch(query, entries, { budget, hippoRoot, physicsConfig: config.physics })
                 : await hybridSearch(query, entries, { budget, hippoRoot });
-            const retrieved = markRetrieved(results.map((r) => r.entry));
-            // EVAL-ONLY ablation (see ablation.ts): skip persistence under the recall
-            // flag; ids below stay populated for outcome attribution.
-            if (!isRecallBoostAblated()) {
-                for (const entry of retrieved)
-                    writeEntry(hippoRoot, entry, { actor: ctx?.actor ?? 'mcp' });
-            }
-            lastRecalledIds.set(resolveClientKey(ctx), retrieved.map((e) => e.id));
+            const retrievedIds = results.map((r) => r.entry.id);
+            strengthenRetrieved(hippoRoot, retrievedIds);
+            lastRecalledIds.set(resolveClientKey(ctx), retrievedIds);
             // DF1 (docs/plans/2026-08-23-df1-snapshot-lifecycle.md, T2): bounded
             // read, no session id available on this surface (freshness bound
             // only) — an orphaned snapshot must age out here too, not just on the
@@ -1199,6 +1240,7 @@ export async function handleMcpRequest(req, ctx) {
             const argumentsValue = params?.arguments;
             const toolArgs = isJsonObjectRecord(argumentsValue) ? argumentsValue : {};
             const output = await executeTool(toolName, toolArgs, ctx);
+            recordMcpTokens(toolName, output, ctx);
             return {
                 jsonrpc: '2.0',
                 id,

package/dist/memory.d.ts

@@ -141,6 +141,12 @@ export declare function _resetLossAversionRatioCacheForTests(): void;
  * decay slower; consistent negative outcomes decay faster.
  */
 export declare function calculateRewardFactor(entry: MemoryEntry): number;
+/**
+ * Net wrongness: bad outcome marks past good ones, never below zero.
+ * Strength halves per unit (capped at 3) and recall stops strengthening
+ * the memory, so a correction outranks pinning, error tags and heavy recall.
+ */
+export declare function netWrong(entry: MemoryEntry): number;
 /**
  * Options for decay basis.
  * - clock: wall-clock time (default pre-v0.15)
@@ -163,7 +169,7 @@ export interface DecayOptions {
  * - session: decay by sleep cycles instead of days (sessionsSince / halfLife)
  * - adaptive: wall-clock decay with half-life scaled by session frequency
  *
- * Pinned memories always return 1.0 (no decay).
+ * Pinned memories skip time decay; being marked wrong still fades them (netWrong).
  */
 export declare function calculateStrength(entry: MemoryEntry, now?: Date, options?: DecayOptions): number;
 /**
@@ -203,6 +209,17 @@ export declare function confidenceLabel(entry: MemoryEntry, now?: Date): {
  * returns 'stale'. Otherwise returns the stored confidence value.
  */
 export declare function resolveConfidence(entry: MemoryEntry, now?: Date): ConfidenceLevel;
+/**
+ * Base half-life for a new memory, in days, before `deriveHalfLife`'s
+ * write-time multipliers. 365 since 1.46.0: the pre-registered E1 decision
+ * (docs/evals/2026-09-24-decay-default-result.md and prereg-2) found 7 days
+ * lost the current fact far more often (29% vs 75% in the top five), and
+ * 730 days and decay off tied with 365. `hippo sleep` moves memories still
+ * on an older base (src/half-life-migration.ts).
+ */
+export declare const DEFAULT_HALF_LIFE_DAYS = 365;
+export declare const AUTO_DELETABLE_SQL = "pinned = 0 AND kind != 'raw'";
+export declare function canAutoDelete(entry: Pick<MemoryEntry, 'pinned' | 'kind'>): boolean;
 /**
  * Create a new memory entry with defaults.
  */

package/dist/memory.js

@@ -143,6 +143,18 @@ export function calculateRewardFactor(entry) {
     const ratio = (pos - neg) / (pos + neg + 1);
     return 1 + 0.5 * ratio;
 }
+/** Bad marks alone never push a memory under sleep's 0.05 retire line; supersede is the hard correction. */
+const MAX_WRONG_HALVINGS = 3;
+/**
+ * Net wrongness: bad outcome marks past good ones, never below zero.
+ * Strength halves per unit (capped at 3) and recall stops strengthening
+ * the memory, so a correction outranks pinning, error tags and heavy recall.
+ */
+export function netWrong(entry) {
+    if (isOutcomeSlowAblated() || isDecayAblated())
+        return 0;
+    return Math.max(0, (entry.outcome_negative ?? 0) - (entry.outcome_positive ?? 0));
+}
 /**
  * Calculate current strength at a given time.
  * strength(t) = base_strength * decay * retrieval_boost * emotional_multiplier
@@ -152,14 +164,16 @@ export function calculateRewardFactor(entry) {
  * - session: decay by sleep cycles instead of days (sessionsSince / halfLife)
  * - adaptive: wall-clock decay with half-life scaled by session frequency
  *
- * Pinned memories always return 1.0 (no decay).
+ * Pinned memories skip time decay; being marked wrong still fades them (netWrong).
  */
 export function calculateStrength(entry, 
 // evalNow(): the real clock unless HIPPO_FAKE_NOW is set (eval-only,
 // simulated-time protocols; see ablation.ts). Explicit `now` always wins.
 now = evalNow(), options = {}) {
+    // Being marked wrong outranks every shield: pinning, error tags, heavy recall.
+    const wrongPenalty = Math.pow(0.5, Math.min(netWrong(entry), MAX_WRONG_HALVINGS));
     if (entry.pinned)
-        return 1.0;
+        return wrongPenalty;
     // EVAL-ONLY ablation (see ablation.ts): with recall-strengthening ablated,
     // anchor decay at CREATION, not last_retrieved. A never-strengthened memory
     // decays from when it was made; using last_retrieved would let clock resets
@@ -205,7 +219,7 @@ now = evalNow(), options = {}) {
     // the READ side too, so a store with PRIOR retrieval history (counts > 0
     // written before the flag was set) does not leak strengthening into an
     // ablated arm's rankings (codex P2).
-    const retrievalBoost = isRecallBoostAblated()
+    const retrievalBoost = isRecallBoostAblated() || netWrong(entry) > 0
         ? 1.0
         : 1 + 0.1 * Math.log2(entry.retrieval_count + 1);
     // Emotional multiplier
@@ -218,7 +232,7 @@ now = evalNow(), options = {}) {
     const raw = decay * retrievalBoost * emotionalMultiplier;
     // Clamp to [0, 1] with NaN guard
     const clamped = Math.min(1.0, Math.max(0.0, raw));
-    return Number.isFinite(clamped) ? clamped : 0.0;
+    return Number.isFinite(clamped) ? clamped * wrongPenalty : 0.0;
 }
 /**
  * Derive half-life based on signals, as per PLAN.md table.
@@ -296,6 +310,20 @@ export function confidenceLabel(entry, now = evalNow()) {
 export function resolveConfidence(entry, now = evalNow()) {
     return isAgedOut(entry, now) ? 'stale' : entry.confidence;
 }
+/**
+ * Base half-life for a new memory, in days, before `deriveHalfLife`'s
+ * write-time multipliers. 365 since 1.46.0: the pre-registered E1 decision
+ * (docs/evals/2026-09-24-decay-default-result.md and prereg-2) found 7 days
+ * lost the current fact far more often (29% vs 75% in the top five), and
+ * 730 days and decay off tied with 365. `hippo sleep` moves memories still
+ * on an older base (src/half-life-migration.ts).
+ */
+export const DEFAULT_HALF_LIFE_DAYS = 365;
+// Pinned means keep; raw rows leave only through archiveRawMemory. The SQL twin guards the DELETE itself.
+export const AUTO_DELETABLE_SQL = "pinned = 0 AND kind != 'raw'";
+export function canAutoDelete(entry) {
+    return !entry.pinned && entry.kind !== 'raw';
+}
 /**
  * Create a new memory entry with defaults.
  */
@@ -314,7 +342,7 @@ export function createMemory(content, options = {}) {
     const emotional_valence = options.emotional_valence ?? inferValence(tags);
     const schema_fit = options.schema_fit ?? 0.5;
     const partial = { tags, schema_fit };
-    const half_life_days = deriveHalfLife(options.baseHalfLifeDays ?? 7, partial);
+    const half_life_days = deriveHalfLife(options.baseHalfLifeDays ?? DEFAULT_HALF_LIFE_DAYS, partial);
     const entry = {
         id: generateId(layer === Layer.Semantic ? 'sem' : 'mem'),
         created: now,

package/dist/physics-config.js

@@ -3,7 +3,11 @@
  * All constants are tunable; defaults calibrated for ~500 memory corpus.
  */
 export const DEFAULT_PHYSICS_CONFIG = {
-    enabled: 'auto',
+    // Off by default: the paired ablation (benchmarks/physics-ablation/) found
+    // physics worse than classic hybrid on every metric, CI excluding zero
+    // (MRR 0.68 vs 0.84, R@5 74% vs 84%). Opt in with physics.enabled 'auto'
+    // or true.
+    enabled: false,
     G_query: 2.0,
     G_memory: 0.01,
     K_repulsion: 0.5,

package/dist/recall-scope.d.ts

@@ -57,4 +57,28 @@ export declare function passesScopeFilterForRecall(scope: string | null, request
  * denied.
  */
 export declare function passesCliRecallScopeFilter(scope: string | null, requested: string | undefined): boolean;
+/**
+ * Thrown when a caller requests a scope its role may not read. The HTTP layer
+ * maps it to 403.
+ */
+export declare class ScopeForbiddenError extends Error {
+    readonly scope: string;
+    constructor(scope: string);
+}
+/**
+ * True for scopes that default-deny hides: `<source>:private:*` and the
+ * quarantine buckets. Naming one explicitly is what unlocks it, so naming one
+ * is the act that needs authorization.
+ */
+export declare function isRestrictedScope(scope: string | null | undefined): boolean;
+/**
+ * Authorize an explicitly requested scope before any read honours it.
+ *
+ * An admin (tenant owner, the local CLI, loopback without a key) may unlock
+ * any scope in its tenant. A member key may not unlock a restricted scope by
+ * naming it: before this check, any key in a tenant could read every private
+ * channel or repo by passing its scope string. Per-scope grants for member
+ * keys belong to ROADMAP Part VIII EI2 (permission-aware recall).
+ */
+export declare function assertScopeRequestAllowed(role: 'admin' | 'member', requested: string | undefined): void;
 //# sourceMappingURL=recall-scope.d.ts.map

package/dist/recall-scope.js

@@ -86,4 +86,45 @@ export function passesCliRecallScopeFilter(scope, requested) {
     }
     return passesScopeFilterForRecall(scope, undefined);
 }
+/**
+ * Thrown when a caller requests a scope its role may not read. The HTTP layer
+ * maps it to 403.
+ */
+export class ScopeForbiddenError extends Error {
+    scope;
+    constructor(scope) {
+        super(`scope ${scope} requires admin role`);
+        this.name = 'ScopeForbiddenError';
+        this.scope = scope;
+    }
+}
+/**
+ * True for scopes that default-deny hides: `<source>:private:*` and the
+ * quarantine buckets. Naming one explicitly is what unlocks it, so naming one
+ * is the act that needs authorization.
+ */
+export function isRestrictedScope(scope) {
+    if (!isScopeString(scope))
+        return false;
+    // SAFETY: RECALL_DEFAULT_DENY_SCOPES is a readonly tuple of string
+    // literals; widening the array (not the input) lets .includes() take any scope.
+    return isPrivateScope(scope) || RECALL_DEFAULT_DENY_SCOPES.includes(scope);
+}
+/**
+ * Authorize an explicitly requested scope before any read honours it.
+ *
+ * An admin (tenant owner, the local CLI, loopback without a key) may unlock
+ * any scope in its tenant. A member key may not unlock a restricted scope by
+ * naming it: before this check, any key in a tenant could read every private
+ * channel or repo by passing its scope string. Per-scope grants for member
+ * keys belong to ROADMAP Part VIII EI2 (permission-aware recall).
+ */
+export function assertScopeRequestAllowed(role, requested) {
+    if (requested === undefined || requested === '')
+        return;
+    if (role === 'admin')
+        return;
+    if (isRestrictedScope(requested))
+        throw new ScopeForbiddenError(requested);
+}
 //# sourceMappingURL=recall-scope.js.map

package/dist/refine-llm.js

@@ -14,6 +14,7 @@
  */
 import { Layer } from './memory.js';
 import { loadAllEntries, readEntry, writeEntry } from './store.js';
+import { redactSecrets } from './secret-detect.js';
 const REFINED_TAG = 'llm-refined';
 const CONSOLIDATED_MARKERS = [
     '[Consolidated from',
@@ -29,7 +30,7 @@ export async function refineSemanticMemory(merged, sources, opts) {
     const fetchFn = opts.fetcher ?? fetch;
     const sourceBlock = sources
         .slice(0, 8)
-        .map((s, i) => `[source ${i + 1}] ${s.content.slice(0, 400)}`)
+        .map((s, i) => `[source ${i + 1}] ${redactSecrets(s.content).slice(0, 400)}`)
         .join('\n\n');
     const prompt = `You are refining a semantic memory in an agent's memory store. The rule-based consolidator merged several related episodic memories into one, but the output is clumsy. Produce a single coherent semantic memory that captures the underlying principle.
 
@@ -41,7 +42,7 @@ Rules:
 - Do NOT include the "[Consolidated from N ...]" marker.
 
 Current merged content:
-${merged}
+${redactSecrets(merged)}
 
 Source memories (up to 8 shown):
 ${sourceBlock}`;

package/dist/reject-flow.d.ts

@@ -7,9 +7,9 @@
  * SAME multi-step transaction + post-commit mirror-purge flow. Extracted
  * here (leaf module) so neither duplicates it.
  *
- * Module direction: this file imports from store.ts, rejection.ts, and
- * raw-archive.ts. Nothing imports FROM this file except cli.ts and api.ts,
- * so it introduces no cycle.
+ * Module direction: this file imports from store.ts, rejection.ts,
+ * raw-archive.ts and dormant.ts. Nothing imports FROM this file except
+ * cli.ts and api.ts, so it introduces no cycle.
  */
 import { type RejectedValueRow } from './rejection.js';
 export interface RejectFlowOpts {

package/dist/reject-flow.js

@@ -7,13 +7,14 @@
  * SAME multi-step transaction + post-commit mirror-purge flow. Extracted
  * here (leaf module) so neither duplicates it.
  *
- * Module direction: this file imports from store.ts, rejection.ts, and
- * raw-archive.ts. Nothing imports FROM this file except cli.ts and api.ts,
- * so it introduces no cycle.
+ * Module direction: this file imports from store.ts, rejection.ts,
+ * raw-archive.ts and dormant.ts. Nothing imports FROM this file except
+ * cli.ts and api.ts, so it introduces no cycle.
  */
 import { openHippoDb, closeHippoDb } from './db.js';
 import { appendAuditEvent } from './audit.js';
 import { archiveRawMemory } from './raw-archive.js';
+import { purgeDormantByDigest } from './dormant.js';
 import { initStore, deleteEntryCore, purgeMirrorBestEffort, writeIndexMirror, buildIndexFromDb, } from './store.js';
 import { rejectionDigest, normalizeValueForRejection, insertRejectedValue, deleteRejectedValue, listRejectedValues, } from './rejection.js';
 /**
@@ -102,6 +103,12 @@ export function rejectValue(opts) {
                 }
                 removedIds.push(row.id);
             }
+            // Dormant copies (src/dormant.ts) go too, in the same transaction: a
+            // rejected value may not linger where `hippo dormant restore` could
+            // bring it back. They have no markdown mirror, so the post-commit
+            // mirror purge below is a no-op for them; they join removedIds for the
+            // audit trail and the caller's report.
+            removedIds.push(...purgeDormantByDigest(db, opts.tenantId, digest));
             try {
                 appendAuditEvent(db, {
                     tenantId: opts.tenantId,

package/dist/rerankers/jev.js

@@ -1,4 +1,5 @@
 import { crossEncoderReranker } from './cross-encoder.js';
+import { redactSecrets } from '../secret-detect.js';
 const ENDPOINT = 'https://api.typesafe.ai/v1/systemone';
 const DEFAULT_TIMEOUT_MS = 5_000;
 const TRUNCATE_CHARS = 1200;
@@ -32,8 +33,8 @@ async function requestScores(query, head) {
     const key = process.env.TYPESAFE_API_KEY;
     if (!key)
         throw new Error('TYPESAFE_API_KEY not set');
-    const lines = head.map((r, i) => `[${i + 1}] ${truncate(r.entry.content, TRUNCATE_CHARS)}`);
-    const state = `Query: ${query}\n\nNumbered candidate memories from an AI coding agent's project store:\n\n${lines.join('\n\n')}`;
+    const lines = head.map((r, i) => `[${i + 1}] ${truncate(redactSecrets(r.entry.content), TRUNCATE_CHARS)}`);
+    const state = `Query: ${redactSecrets(query)}\n\nNumbered candidate memories from an AI coding agent's project store:\n\n${lines.join('\n\n')}`;
     const questions = {};
     for (let i = 1; i <= head.length; i++) {
         questions[`c${i}`] = {

package/dist/rerankers/llm.js

@@ -1,3 +1,4 @@
+import { redactSecrets } from '../secret-detect.js';
 const DEFAULT_TIMEOUT_MS = 30_000;
 /**
  * Track 3 reranker: listwise LLM rerank. Uses a customer-supplied
@@ -21,8 +22,8 @@ export const llmReranker = async (query, results, options) => {
     const head = results.slice(0, topK);
     const prompt = [
         `Rerank the candidates below by relevance to the query. Output a JSON array of indices (zero-indexed) in best-first order.`,
-        `Query: ${query}`,
-        ...head.map((r, i) => `[${i}] ${r.entry.content}`),
+        `Query: ${redactSecrets(query)}`,
+        ...head.map((r, i) => `[${i}] ${redactSecrets(r.entry.content)}`),
         `Output format: [<int>, <int>, ...] with all ${head.length} indices.`,
     ].join('\n');
     const timeoutMs = Number.parseInt(process.env.HIPPO_LLM_RERANKER_TIMEOUT_MS ?? '', 10) || DEFAULT_TIMEOUT_MS;

package/dist/search.d.ts

@@ -2,6 +2,7 @@
  * BM25 search + optional embedding hybrid search for Hippo.
  * Zero external dependencies when embeddings are not available.
  */
+import { estimateTokens } from './token-ledger.js';
 import { MemoryEntry } from './memory.js';
 import type { PhysicsConfig } from './physics-config.js';
 export declare function tokenize(text: string): string[];
@@ -17,10 +18,9 @@ export interface BM25Corpus {
     N: number;
 }
 export declare function buildCorpus(texts: string[]): BM25Corpus;
-/**
- * Rough token estimate: characters / 4 (works well for English text).
- */
-export declare function estimateTokens(text: string): number;
+export { estimateTokens };
+/** Retrieval-time outcome nudge in [0.85, 1.15]; the E1 bm25-outcome baseline ranks with it too. */
+export declare function outcomeMultiplier(entry: MemoryEntry): number;
 export declare function detectTemporalDirection(query: string): 'recent' | 'oldest' | null;
 export interface TemporalRange {
     minTime: number;