hippo-memory 1.46.0 → 1.48.0

package/dist/doctor.js

@@ -9,8 +9,8 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import { findHippoStoreDir } from './project-identity.js';
 import { getGlobalRoot } from './shared.js';
-import { isInitialized, loadStats } from './store.js';
-import { openHippoDb, closeHippoDb, getSchemaVersion, getCurrentSchemaVersion } from './db.js';
+import { isInitialized } from './store.js';
+import { openHippoDbReadOnly, closeHippoDb, getSchemaVersion, getCurrentSchemaVersion, countTableRows, IncompatibleBinaryError } from './db.js';
 import { isEmbeddingAvailable } from './embeddings.js';
 /** Minimum Node.js version hippo supports (package.json engines). */
 export const MIN_NODE = '22.16.0';
@@ -34,14 +34,42 @@ function readJson(file) {
         return null;
     }
 }
-function countRows(db, table) {
+// Migration 46 creates failure_log; a read-only open no longer creates it on an older store.
+const FAILURE_LOG_SCHEMA = 46;
+/** The failed-tool-call count over the last 7 days, or why it could not be read. */
+function failuresCheck(db, since, schemaVersion) {
     try {
-        // SAFETY: COUNT(*) returns one row with one numeric column.
-        const row = db.prepare(`SELECT COUNT(*) AS n FROM ${table}`).get();
-        return Number(row?.n ?? 0);
+        // SAFETY: COUNT aggregate row.
+        const row = db.prepare(`SELECT COUNT(*) AS n FROM failure_log WHERE ts >= ?`).get(since);
+        return { id: 'failures', status: 'info', detail: `${Number(row?.n ?? 0)} failed tool calls logged in 7 days (hippo failures for detail)` };
     }
-    catch {
-        return null;
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (!message.includes('no such table')) {
+            return { id: 'failures', status: 'warn', detail: `cannot read the failure log: ${message}` };
+        }
+        return schemaVersion < FAILURE_LOG_SCHEMA
+            ? { id: 'failures', status: 'info', detail: 'no failure log yet (hippo creates it on the next write)' }
+            : { id: 'failures', status: 'warn', detail: 'the failure_log table is missing, so failed tool calls are not being logged' };
+    }
+}
+/** How long ago the store last slept (consolidated), or why that history could not be read. */
+function sleepCheck(db, now) {
+    try {
+        // SAFETY: row's shape matches the single `timestamp` column named in the SELECT above.
+        const row = db.prepare(`SELECT timestamp FROM consolidation_runs ORDER BY timestamp DESC, id DESC LIMIT 1`).get();
+        const when = row?.timestamp !== undefined ? Date.parse(row.timestamp) : Number.NaN;
+        if (Number.isNaN(when)) {
+            return { id: 'sleep', status: 'warn', detail: 'hippo has never slept (consolidated) in this store', fix: 'hippo sleep   (the session-end hook runs it automatically)' };
+        }
+        const days = Math.floor((now.getTime() - when) / 86_400_000);
+        return days > 7
+            ? { id: 'sleep', status: 'warn', detail: `last sleep ${days} days ago`, fix: 'hippo sleep, and check the session-end hook is installed' }
+            : { id: 'sleep', status: 'pass', detail: `last sleep ${days === 0 ? 'today' : `${days} day${days === 1 ? '' : 's'} ago`}` };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return { id: 'sleep', status: 'info', detail: `sleep history unavailable (${message})` };
     }
 }
 /** Run every check. Never throws for a broken install; broken parts become failed checks. */
@@ -58,10 +86,14 @@ export function runDoctor(opts) {
     const globalRoot = getGlobalRoot();
     const hasGlobal = isInitialized(globalRoot);
     let store = null;
-    if (local !== null) {
+    if (local !== null && isInitialized(local)) {
         store = local;
         checks.push({ id: 'store', status: 'pass', detail: `project store at ${local}${hasGlobal ? ` (global store at ${globalRoot} too)` : ''}` });
     }
+    else if (local !== null) {
+        // The walk stops at the first .hippo it finds, so a bare one (no hippo.db) blocks a parent or global store too.
+        checks.push({ id: 'store', status: 'fail', detail: `${local} has no hippo.db, so hippo commands run here stop at it`, fix: `run hippo init in ${path.dirname(local)}, or remove that .hippo folder` });
+    }
     else if (hasGlobal) {
         store = globalRoot;
         checks.push({ id: 'store', status: 'warn', detail: `no project store here; using the global store at ${globalRoot}`, fix: 'hippo init   (in the project root)' });
@@ -72,7 +104,7 @@ export function runDoctor(opts) {
     if (store !== null) {
         let db = null;
         try {
-            db = openHippoDb(store);
+            db = openHippoDbReadOnly(store);
             const have = getSchemaVersion(db);
             const want = getCurrentSchemaVersion();
             checks.push(have === want
@@ -80,8 +112,8 @@ export function runDoctor(opts) {
                 : have > want
                     ? { id: 'schema', status: 'fail', detail: `database schema v${have} is newer than this hippo (v${want})`, fix: 'npm install -g hippo-memory@latest' }
                     : { id: 'schema', status: 'info', detail: `database schema v${have}; hippo migrates it to v${want} on the next write` });
-            const memories = countRows(db, 'memories');
-            const dormant = countRows(db, 'dormant_memories');
+            const memories = countTableRows(db, 'memories');
+            const dormant = countTableRows(db, 'dormant_memories');
             const memoryCheck = { id: 'memories', status: 'info', detail: `${memories ?? '?'} memories${dormant !== null ? `, ${dormant} dormant` : ''}` };
             if (memories === 0) {
                 memoryCheck.status = 'warn';
@@ -97,33 +129,21 @@ export function runDoctor(opts) {
             catch {
                 checks.push({ id: 'tokens', status: 'info', detail: 'no token ledger yet (created on the next write)' });
             }
+            checks.push(failuresCheck(db, since, have));
+            checks.push(sleepCheck(db, now));
         }
         catch (err) {
-            checks.push({ id: 'schema', status: 'fail', detail: `cannot open the database: ${err instanceof Error ? err.message : String(err)}`, fix: 'check file permissions on the .hippo folder' });
+            checks.push({
+                id: 'schema',
+                status: 'fail',
+                detail: `cannot open the database: ${err instanceof Error ? err.message : String(err)}`,
+                fix: err instanceof IncompatibleBinaryError ? 'npm install -g hippo-memory@latest' : 'check file permissions on the .hippo folder',
+            });
         }
         finally {
             if (db !== null)
                 closeHippoDb(db);
         }
-        try {
-            const runs = loadStats(store)['consolidation_runs'];
-            const last = Array.isArray(runs) && runs.length > 0 ? runs[runs.length - 1] : null;
-            // SAFETY: the constructor check above narrows `last` to a plain JSON object.
-            const ts = last !== null && last !== undefined && !Array.isArray(last) && last.constructor === Object ? last.timestamp : undefined;
-            const when = ts !== undefined && ts !== null ? Date.parse(String(ts)) : Number.NaN;
-            if (Number.isNaN(when)) {
-                checks.push({ id: 'sleep', status: 'warn', detail: 'hippo has never slept (consolidated) in this store', fix: 'hippo sleep   (the session-end hook runs it automatically)' });
-            }
-            else {
-                const days = Math.floor((now.getTime() - when) / 86_400_000);
-                checks.push(days > 7
-                    ? { id: 'sleep', status: 'warn', detail: `last sleep ${days} days ago`, fix: 'hippo sleep, and check the session-end hook is installed' }
-                    : { id: 'sleep', status: 'pass', detail: `last sleep ${days === 0 ? 'today' : `${days} day${days === 1 ? '' : 's'} ago`}` });
-            }
-        }
-        catch {
-            checks.push({ id: 'sleep', status: 'info', detail: 'sleep history unavailable' });
-        }
     }
     const claudeDir = path.join(home, '.claude');
     if (fs.existsSync(claudeDir)) {

package/dist/failure-log.d.ts

@@ -0,0 +1,49 @@
+/** Failure log (ROADMAP CD13): every failed tool call the capture-error hook sees, stored or not. */
+import type { CaptureErrorOutcome, RoutineRule } from './capture-error.js';
+import type { DatabaseSyncLike } from './db.js';
+/** Rows older than this are pruned on write, which also bounds how far back a repeat can be found. */
+export declare const FAILURE_LOG_RETENTION_DAYS = 90;
+/** A capture-error outcome, or `store-failed` when storing the lesson threw. */
+export type FailureOutcome = CaptureErrorOutcome | 'store-failed';
+/** One failed tool call, for {@link recordFailure}. Never the failure text: it can carry paths and secrets. */
+export interface FailureEvent {
+    tenantId: string;
+    /** Host session id from the hook payload; null when it had none. */
+    sessionId?: string | null;
+    tool?: string | null;
+    outcome: FailureOutcome;
+    /** The routine check that skipped it, for `skipped-routine`. */
+    rule?: RoutineRule | null;
+    /** Hash of the lesson text's signature, the key dedupe uses; null when the payload had no readable error. */
+    sigHash?: string | null;
+    /** Hash of the untruncated error plus the command's first two words, finer than `sigHash`. */
+    detailHash?: string | null;
+    /** Override the timestamp (tests). ISO string. */
+    now?: string;
+}
+/** Append one failure row and prune rows past {@link FAILURE_LOG_RETENTION_DAYS}. */
+export declare function recordFailure(db: DatabaseSyncLike, event: FailureEvent): void;
+/** Rated failures and repeats in one session, for {@link failuresBySession}. */
+export interface SessionFailures {
+    sessionId: string;
+    /** Failures hippo treats as lessons (stored, duplicate or store-failed) in the window. */
+    failures: number;
+    /** Of those, failures whose signature another session hit first. */
+    repeats: number;
+}
+/** Rated failures per session since `sinceIso`, the input for repeat-error rate per arm (CD11, CD12). */
+export declare function failuresBySession(db: DatabaseSyncLike, tenantId: string, sinceIso: string): SessionFailures[];
+/** Failure log totals over a window, for {@link summarizeFailures}. Counts only: a rate needs a holdout arm (CD11). */
+export interface FailureSummary {
+    /** ISO start of the window (inclusive). */
+    since: string;
+    outcomes: Record<FailureOutcome, number>;
+    total: number;
+    /** Rated failures from sessions with an id: the failures a repeat is counted among. */
+    rated: number;
+    repeats: number;
+    sessions: number;
+}
+/** Sum the failure log for one tenant since `sinceIso`. */
+export declare function summarizeFailures(db: DatabaseSyncLike, tenantId: string, sinceIso: string): FailureSummary;
+//# sourceMappingURL=failure-log.d.ts.map

package/dist/failure-log.js

@@ -0,0 +1,58 @@
+/** Rows older than this are pruned on write, which also bounds how far back a repeat can be found. */
+export const FAILURE_LOG_RETENTION_DAYS = 90;
+/** Longest session id or tool name kept; the hook payload is not trusted to be short. */
+const MAX_FIELD = 128;
+/** Append one failure row and prune rows past {@link FAILURE_LOG_RETENTION_DAYS}. */
+export function recordFailure(db, event) {
+    // Normalised, because the window and prune compare timestamps as strings.
+    const now = new Date(event.now ?? Date.now()).toISOString();
+    db.prepare(`INSERT INTO failure_log (ts, tenant_id, session_id, tool, outcome, skip_rule, sig_hash, detail_hash)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(now, event.tenantId, event.sessionId?.slice(0, MAX_FIELD) ?? null, event.tool?.slice(0, MAX_FIELD) ?? null, event.outcome, event.rule ?? null, event.sigHash ?? null, event.detailHash ?? null);
+    const cutoff = new Date(Date.parse(now) - FAILURE_LOG_RETENTION_DAYS * 86_400_000).toISOString();
+    db.prepare(`DELETE FROM failure_log WHERE ts < ?`).run(cutoff);
+}
+/** Rated failures per session since `sinceIso`, the input for repeat-error rate per arm (CD11, CD12). */
+export function failuresBySession(db, tenantId, sinceIso) {
+    // SAFETY: the SELECT names exactly these three TEXT columns.
+    const rows = db.prepare(`SELECT ts, session_id, sig_hash FROM failure_log
+     WHERE tenant_id = ? AND session_id IS NOT NULL AND sig_hash IS NOT NULL
+       AND outcome IN ('stored', 'duplicate', 'store-failed')
+     ORDER BY id`).all(tenantId);
+    const firstSession = new Map();
+    const bySession = new Map();
+    for (const row of rows) {
+        if (!firstSession.has(row.sig_hash))
+            firstSession.set(row.sig_hash, row.session_id);
+        // Rows before the window are not counted but still decide which session hit a signature first.
+        if (row.ts < sinceIso)
+            continue;
+        const repeat = firstSession.get(row.sig_hash) !== row.session_id;
+        const s = bySession.get(row.session_id) ?? { sessionId: row.session_id, failures: 0, repeats: 0 };
+        bySession.set(row.session_id, { ...s, failures: s.failures + 1, repeats: s.repeats + (repeat ? 1 : 0) });
+    }
+    return [...bySession.values()];
+}
+/** Sum the failure log for one tenant since `sinceIso`. */
+export function summarizeFailures(db, tenantId, sinceIso) {
+    // SAFETY: the SELECT names exactly these two columns, TEXT and an aggregate.
+    const rows = db.prepare(`SELECT outcome, COUNT(*) AS n FROM failure_log WHERE tenant_id = ? AND ts >= ? GROUP BY outcome`).all(tenantId, sinceIso);
+    const counts = new Map(rows.map((r) => [r.outcome, Number(r.n)]));
+    const outcomes = {
+        stored: counts.get('stored') ?? 0,
+        duplicate: counts.get('duplicate') ?? 0,
+        'store-failed': counts.get('store-failed') ?? 0,
+        'skipped-interrupt': counts.get('skipped-interrupt') ?? 0,
+        'skipped-routine': counts.get('skipped-routine') ?? 0,
+        'skipped-invalid': counts.get('skipped-invalid') ?? 0,
+    };
+    const sessions = failuresBySession(db, tenantId, sinceIso);
+    return {
+        since: sinceIso,
+        outcomes,
+        total: Object.values(outcomes).reduce((sum, n) => sum + n, 0),
+        rated: sessions.reduce((sum, s) => sum + s.failures, 0),
+        repeats: sessions.reduce((sum, s) => sum + s.repeats, 0),
+        sessions: sessions.length,
+    };
+}
+//# sourceMappingURL=failure-log.js.map

package/dist/reject-flow.d.ts

@@ -41,8 +41,8 @@ export interface RejectFlowResult {
  * normalized digest matches (kind-aware), one aggregate `reject_value`
  * audit, COMMIT. Then post-commit (mirrors the existing purge+reaper
  * pattern verbatim from api.archiveRaw, api.ts:1913-1938): best-effort
- * mirror purge per removed id, `mirror_cleaned_at` stamps for raw ids, one
- * index mirror rewrite.
+ * mirror purge per removed id, `mirror_cleaned_at` stamps for raw ids.
+ * index.json itself is only refreshed by `rebuildIndex()`.
  */
 export declare function rejectValue(opts: RejectFlowOpts): RejectFlowResult;
 export type UnrejectOutcome = {

package/dist/reject-flow.js

@@ -15,7 +15,7 @@ import { openHippoDb, closeHippoDb } from './db.js';
 import { appendAuditEvent } from './audit.js';
 import { archiveRawMemory } from './raw-archive.js';
 import { purgeDormantByDigest } from './dormant.js';
-import { initStore, deleteEntryCore, purgeMirrorBestEffort, writeIndexMirror, buildIndexFromDb, } from './store.js';
+import { initStore, deleteEntryCore, purgeMirrorBestEffort, } from './store.js';
 import { rejectionDigest, normalizeValueForRejection, insertRejectedValue, deleteRejectedValue, listRejectedValues, } from './rejection.js';
 /**
  * `hippo reject` / `api.reject` core flow. ONE connection, one transaction:
@@ -23,8 +23,8 @@ import { rejectionDigest, normalizeValueForRejection, insertRejectedValue, delet
  * normalized digest matches (kind-aware), one aggregate `reject_value`
  * audit, COMMIT. Then post-commit (mirrors the existing purge+reaper
  * pattern verbatim from api.archiveRaw, api.ts:1913-1938): best-effort
- * mirror purge per removed id, `mirror_cleaned_at` stamps for raw ids, one
- * index mirror rewrite.
+ * mirror purge per removed id, `mirror_cleaned_at` stamps for raw ids.
+ * index.json itself is only refreshed by `rebuildIndex()`.
  */
 export function rejectValue(opts) {
     if (!opts.reason.trim()) {
@@ -138,7 +138,7 @@ export function rejectValue(opts) {
         }
         // Post-commit, db handle still open (same pattern as api.archiveRaw):
         // best-effort mirror purge per removed id, reaper-backstop stamp for
-        // raw ids, one index mirror rewrite.
+        // raw ids.
         for (const id of removedIds) {
             // AT1 fix: purgeMirrorBestEffort retries once, then — for non-raw ids,
             // which cleanupArchivedMirrors' reaper never scans — reports the
@@ -150,9 +150,6 @@ export function rejectValue(opts) {
                 db.prepare(`UPDATE raw_archive SET mirror_cleaned_at = ? WHERE memory_id = ?`).run(new Date().toISOString(), id);
             }
         }
-        if (removedIds.length > 0) {
-            writeIndexMirror(opts.hippoRoot, buildIndexFromDb(db));
-        }
         return { digest, content, removedIds, removedRawIds };
     }
     finally {

package/dist/secret-detect.d.ts

@@ -38,4 +38,6 @@ export declare function detectSecret(entry: {
  * CS1 pre-compact snapshot fields — can scrub it in place instead.
  */
 export declare function redactSecrets(text: string): string;
+/** Stricter redaction for text that leaves the machine: no co-occurrence guard, plus Bearer headers and JWTs. */
+export declare function redactSecretsStrict(text: string): string;
 //# sourceMappingURL=secret-detect.d.ts.map

package/dist/secret-detect.js

@@ -48,6 +48,11 @@ const SECRET_PATTERNS = [
 ];
 const KEYISH_CONTEXT_RE = /key|token|secret|credential|bearer|auth|password/i;
 const CO_OCCURRENCE_GUARDED = new Set(['sk-style-key', 'sk-underscore-key']);
+// redactSecretsStrict-only: too noisy for whole-entry memory scanning, worth hiding once text leaves the machine.
+const STRICT_ONLY_PATTERNS = [
+    /\b[Bb]earer\s+[A-Za-z0-9._~+/-]{16,}=*/g,
+    /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]*/g,
+];
 /**
  * Scan a memory's tags + content for secret material.
  * Pure and deterministic; no filesystem or store access.
@@ -75,21 +80,28 @@ export function detectSecret(entry) {
  * CS1 pre-compact snapshot fields — can scrub it in place instead.
  */
 export function redactSecrets(text) {
+    return redactText(text, false);
+}
+/** Stricter redaction for text that leaves the machine: no co-occurrence guard, plus Bearer headers and JWTs. */
+export function redactSecretsStrict(text) {
+    return redactText(text, true);
+}
+function redactText(text, strict) {
     if (!text)
         return text;
     let result = text;
-    // PEM/OpenSSH blocks first: the pattern-table entry matches only the
-    // BEGIN delimiter, which is fine for detectSecret's flag-or-not decision
-    // but would leave the base64 payload behind here. Consume through the
-    // matching END delimiter; a truncated block with no END is redacted to
-    // the end of the text (codex round 3).
+    // PEM/OpenSSH blocks first: SECRET_PATTERNS only matches BEGIN; consume through END, or to the end of a truncated block.
     result = result.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----(?:[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----|[\s\S]*$)/g, '[REDACTED]');
     for (const { name, re } of SECRET_PATTERNS) {
-        if (CO_OCCURRENCE_GUARDED.has(name) && !KEYISH_CONTEXT_RE.test(text))
+        if (!strict && CO_OCCURRENCE_GUARDED.has(name) && !KEYISH_CONTEXT_RE.test(text))
             continue;
         const flags = re.flags.includes('g') ? re.flags : `${re.flags}g`;
         result = result.replace(new RegExp(re.source, flags), '[REDACTED]');
     }
+    if (strict) {
+        for (const re of STRICT_ONLY_PATTERNS)
+            result = result.replace(re, '[REDACTED]');
+    }
     return result;
 }
 //# sourceMappingURL=secret-detect.js.map

package/dist/store.d.ts

@@ -190,23 +190,13 @@ interface LegacyStats {
     total_forgotten: JsonValue;
     consolidation_runs: JsonValue;
 }
-/**
- * Derive the current `HippoIndex` (entries + last-retrieval/trace lockstep
- * meta) from SQLite, the source of truth. Exported (AT1) for the same
- * reason as `writeIndexMirror` below: `src/reject-flow.ts` needs to rebuild
- * the index mirror post-commit after a (possibly multi-row) reject removal,
- * without duplicating this query.
- */
+/** Derive the current `HippoIndex` from SQLite. Exported for `rebuildIndex`
+ *  (the only index.json writer) and the longmemeval benchmark. */
 export declare function buildIndexFromDb(db: ReturnType<typeof openHippoDb>): HippoIndex;
-/**
- * Write the `index.json` mirror file for a given (already-derived) index.
- * Exported (AT1) so `src/reject-flow.ts` can replicate `deleteEntry`'s exact
- * post-commit "removeEntryMirrors then rewrite the index once" sequence for
- * the reject verb's (possibly multi-row) removal, without duplicating
- * `buildIndexFromDb`'s query.
- */
+/** Write the `index.json` mirror file for an already-derived index. Exported for
+ *  `rebuildIndex` (the only index.json writer) and the longmemeval benchmark. */
 export declare function writeIndexMirror(hippoRoot: string, index: HippoIndex): void;
-/** Load the derived index from SQLite. Read-only: writers refresh index.json, so readers never race on it. */
+/** Load the derived index from SQLite. Read-only: index.json is only ever written by `rebuildIndex`. */
 export declare function loadIndex(hippoRoot: string): HippoIndex;
 /**
  * Persist mutable index metadata. Entry rows themselves are derived from SQLite.
@@ -215,10 +205,8 @@ export declare function loadIndex(hippoRoot: string): HippoIndex;
  * land atomically — callers (getContext, cmdRecall) fold a freshly-written
  * trace id into `index.last_trace_id` before calling this, relying on BOTH
  * meta keys committing together. Wrapped in BEGIN/COMMIT so a crash or a
- * mid-write failure can never advance one key without the other. The
- * filesystem mirror write stays AFTER commit — the DB is the source of
- * truth, the mirror is best-effort (matches every other per-call-handle
- * site's convention).
+ * mid-write failure can never advance one key without the other. index.json
+ * is left untouched; only `rebuildIndex` writes it.
  */
 export declare function saveIndex(hippoRoot: string, index: HippoIndex): void;
 /**
@@ -277,13 +265,8 @@ export declare function writeEntryDbOnly(db: DatabaseSyncLike, entry: MemoryEntr
     actor?: string;
     afterWrite?: (db: DatabaseSyncLike, memoryId: string) => void;
 }): void;
-/**
- * Filesystem mirrors path. Caller passes `hippoRoot` + an open `db` handle
- * (used by `buildIndexFromDb` to derive the index from the source of truth).
- * MUST be invoked AFTER the outer transaction commits — a mirror write
- * during a tx that subsequently rolls back would leave orphan markdown.
- */
-export declare function writeEntryMirrors(hippoRoot: string, db: DatabaseSyncLike, entry: MemoryEntry): void;
+/** Markdown mirror path, invoked AFTER commit (a rolled-back tx must leave no orphan markdown). */
+export declare function writeEntryMirrors(hippoRoot: string, entry: MemoryEntry): void;
 /**
  * Read a memory entry by ID.
  *

package/dist/store.js

@@ -940,6 +940,7 @@ function upsertEntryRow(db, entry, bypassRejectionGuard = false) {
     if (!bypassRejectionGuard) {
         checkRejectionGuard(db, entry.tenantId ?? 'default', entry.id, entry.content);
     }
+    const isNewRow = db.prepare(`SELECT 1 FROM memories WHERE id = ?`).get(entry.id) === undefined;
     db.prepare(`
     INSERT INTO memories(
       id, created, last_retrieved, retrieval_count, strength, half_life_days, layer,
@@ -996,13 +997,14 @@ function upsertEntryRow(db, entry, bypassRejectionGuard = false) {
       dag_level_3_built_at = excluded.dag_level_3_built_at,
       updated_at = datetime('now')
   `).run(entry.id, entry.created, entry.last_retrieved, entry.retrieval_count, entry.strength, entry.half_life_days, entry.layer, JSON.stringify(entry.tags ?? []), entry.emotional_valence, entry.schema_fit, entry.source, entry.outcome_score, entry.outcome_positive ?? 0, entry.outcome_negative ?? 0, JSON.stringify(entry.conflicts_with ?? []), entry.pinned ? 1 : 0, entry.confidence, entry.content, JSON.stringify(entry.parents ?? []), entry.starred ? 1 : 0, entry.trace_outcome ?? null, entry.source_session_id ?? null, entry.valid_from ?? entry.created, entry.superseded_by ?? null, entry.extracted_from ?? null, entry.dag_level ?? 0, entry.dag_parent_id ?? null, entry.kind ?? 'distilled', entry.scope ?? null, entry.owner ?? null, entry.artifact_ref ?? null, entry.tenantId ?? 'default', entry.origin_project ?? null, entry.descendant_count ?? 0, entry.earliest_at ?? null, entry.latest_at ?? null, entry.dag_level_3_built_at ?? null);
-    syncFtsRow(db, entry);
+    syncFtsRow(db, entry, isNewRow);
 }
-function syncFtsRow(db, entry) {
+function syncFtsRow(db, entry, isNewRow = false) {
     if (!isFtsAvailable(db))
         return;
     try {
-        db.prepare(`DELETE FROM memories_fts WHERE id = ?`).run(entry.id);
+        if (!isNewRow)
+            db.prepare(`DELETE FROM memories_fts WHERE id = ?`).run(entry.id);
         db.prepare(`INSERT INTO memories_fts(id, content, tags) VALUES (?, ?, ?)`).run(entry.id, entry.content, entry.tags.join(' '));
     }
     catch {
@@ -1019,13 +1021,8 @@ function deleteFtsRow(db, id) {
         // Best effort.
     }
 }
-/**
- * Derive the current `HippoIndex` (entries + last-retrieval/trace lockstep
- * meta) from SQLite, the source of truth. Exported (AT1) for the same
- * reason as `writeIndexMirror` below: `src/reject-flow.ts` needs to rebuild
- * the index mirror post-commit after a (possibly multi-row) reject removal,
- * without duplicating this query.
- */
+/** Derive the current `HippoIndex` from SQLite. Exported for `rebuildIndex`
+ *  (the only index.json writer) and the longmemeval benchmark. */
 export function buildIndexFromDb(db) {
     // SAFETY: rows' shape matches the seven columns named in the SELECT below.
     const rows = db.prepare(`SELECT id, created, last_retrieved, strength, layer, tags_json, pinned FROM memories ORDER BY created ASC, id ASC`).all();
@@ -1076,13 +1073,8 @@ function buildStatsFromDb(db) {
         })),
     };
 }
-/**
- * Write the `index.json` mirror file for a given (already-derived) index.
- * Exported (AT1) so `src/reject-flow.ts` can replicate `deleteEntry`'s exact
- * post-commit "removeEntryMirrors then rewrite the index once" sequence for
- * the reject verb's (possibly multi-row) removal, without duplicating
- * `buildIndexFromDb`'s query.
- */
+/** Write the `index.json` mirror file for an already-derived index. Exported for
+ *  `rebuildIndex` (the only index.json writer) and the longmemeval benchmark. */
 export function writeIndexMirror(hippoRoot, index) {
     mirrorBestEffort('index.json', () => fs.writeFileSync(path.join(hippoRoot, 'index.json'), JSON.stringify(index, null, 2), 'utf8'));
 }
@@ -1115,10 +1107,9 @@ function syncMirrorFiles(hippoRoot, db) {
     ORDER BY updated_at DESC, id DESC
   `).all();
     mirrorBestEffort('conflict mirrors', () => writeConflictMirrors(hippoRoot, conflicts.map(rowToMemoryConflict)));
-    writeIndexMirror(hippoRoot, buildIndexFromDb(db));
     writeStatsMirror(hippoRoot, buildStatsFromDb(db));
 }
-/** Load the derived index from SQLite. Read-only: writers refresh index.json, so readers never race on it. */
+/** Load the derived index from SQLite. Read-only: index.json is only ever written by `rebuildIndex`. */
 export function loadIndex(hippoRoot) {
     initStore(hippoRoot);
     const db = openHippoDb(hippoRoot);
@@ -1136,10 +1127,8 @@ export function loadIndex(hippoRoot) {
  * land atomically — callers (getContext, cmdRecall) fold a freshly-written
  * trace id into `index.last_trace_id` before calling this, relying on BOTH
  * meta keys committing together. Wrapped in BEGIN/COMMIT so a crash or a
- * mid-write failure can never advance one key without the other. The
- * filesystem mirror write stays AFTER commit — the DB is the source of
- * truth, the mirror is best-effort (matches every other per-call-handle
- * site's convention).
+ * mid-write failure can never advance one key without the other. index.json
+ * is left untouched; only `rebuildIndex` writes it.
  */
 export function saveIndex(hippoRoot, index) {
     initStore(hippoRoot);
@@ -1158,7 +1147,6 @@ export function saveIndex(hippoRoot, index) {
             catch { /* already rolled back; keep the original error */ }
             throw error;
         }
-        writeIndexMirror(hippoRoot, buildIndexFromDb(db));
     }
     finally {
         closeHippoDb(db);
@@ -1222,7 +1210,7 @@ export function writeEntry(hippoRoot, entry, opts) {
     try {
         writeEntryDbOnly(db, stamped, opts);
         opts?.afterCommit?.();
-        writeEntryMirrors(hippoRoot, db, stamped);
+        writeEntryMirrors(hippoRoot, stamped);
     }
     catch (error) {
         // AT1 (plan §3): writeEntryDbOnly's own SAVEPOINT has already unwound by
@@ -1286,15 +1274,9 @@ export function writeEntryDbOnly(db, entry, opts) {
         throw e;
     }
 }
-/**
- * Filesystem mirrors path. Caller passes `hippoRoot` + an open `db` handle
- * (used by `buildIndexFromDb` to derive the index from the source of truth).
- * MUST be invoked AFTER the outer transaction commits — a mirror write
- * during a tx that subsequently rolls back would leave orphan markdown.
- */
-export function writeEntryMirrors(hippoRoot, db, entry) {
+/** Markdown mirror path, invoked AFTER commit (a rolled-back tx must leave no orphan markdown). */
+export function writeEntryMirrors(hippoRoot, entry) {
     mirrorBestEffort(`${entry.id}.md`, () => writeMarkdownMirror(hippoRoot, entry));
-    writeIndexMirror(hippoRoot, buildIndexFromDb(db));
 }
 /**
  * Read a memory entry by ID.
@@ -1611,7 +1593,6 @@ export function deleteEntry(hippoRoot, id, opts) {
         if (!result)
             return false;
         purgeMirrorBestEffort(hippoRoot, id, false, 'deleteEntry');
-        writeIndexMirror(hippoRoot, buildIndexFromDb(db));
         return true;
     }
     finally {
@@ -1786,7 +1767,6 @@ export function batchWriteAndDelete(hippoRoot, toWrite, toDeleteIds, opts) {
         });
         for (const id of removedIds)
             purgeMirrorBestEffort(hippoRoot, id, false, 'batchWriteAndDelete');
-        writeIndexMirror(hippoRoot, buildIndexFromDb(db));
         return removedIds;
     }
     catch (error) {
@@ -1978,7 +1958,9 @@ export function rebuildIndex(hippoRoot) {
             }
         }
         syncMirrorFiles(hippoRoot, db);
-        return buildIndexFromDb(db);
+        const index = buildIndexFromDb(db);
+        writeIndexMirror(hippoRoot, index);
+        return index;
     }
     finally {
         closeHippoDb(db);

package/dist/support-bundle.d.ts

@@ -0,0 +1,12 @@
+import { type DoctorOpts } from './doctor.js';
+import type { JsonObject } from './working-memory.js';
+export interface SupportBundleOpts extends DoctorOpts {
+    readonly cwd: string;
+    readonly home: string;
+    readonly now: Date;
+    readonly includeLogs: boolean;
+}
+export declare const TAIL_MAX_LINES = 200;
+/** Read-only: builds one redacted support-ticket snapshot. Never reads a memory content column. */
+export declare function buildSupportBundle(opts: SupportBundleOpts): JsonObject;
+//# sourceMappingURL=support-bundle.d.ts.map