hippo-memory 1.47.0 → 1.48.0

package/README.md

@@ -256,7 +256,7 @@ hippo recall "data pipeline" --why --limit 5
 
 Input enters the buffer. Important things get encoded into episodic memory. During "sleep," repeated episodes compress into semantic patterns. Weak memories decay and disappear.
 
-The store is SQLite (`.hippo/hippo.db`). The markdown files and `index.json` are mirrors written after each change. From 1.46.0, `index.json` is no longer refreshed on every write; it comes only from an explicit export, so read the store through the CLI, the MCP server or the HTTP API.
+The store is SQLite (`.hippo/hippo.db`). The markdown files are mirrors written after each change. `index.json` is no longer refreshed by writes, deletes or recalls: it is written only when you call `rebuildIndex()` from the package, so a copy an older version left on disk goes stale. Read the store through the CLI, the MCP server or the HTTP API.
 
 ```mermaid
 flowchart TD
@@ -629,6 +629,7 @@ hippo watch "npm run build"
 | `hippo dormant restore <id>` | Bring a dormant memory back to active memory |
 | `hippo dormant forget <id>` | Delete a dormant memory permanently |
 | `hippo doctor [--json]` | Check the install: Node, store, schema, sleep, agent hooks; each problem names its fix |
+| `hippo support-bundle [--out <file>] [--include-logs]` | Write a redacted JSON file for a support ticket: versions, doctor checks, config, store counts and log names, never memory text; `--include-logs` adds each log's last 200 lines, which can quote it |
 | `hippo tokens [--days n]` | Estimated tokens of memory text handed to agents, per surface, and what skipping unchanged hook blocks saved |
 | `hippo failures [--days n]` | Failed tool calls the capture-error hook saw, by outcome, and how many errors first happened in another session |
 | `hippo embed` | Embed all memories for semantic search |

package/dist/api.js

@@ -1216,11 +1216,11 @@ export function supersede(ctx, oldId, newContent) {
         }
         // Mirrors after COMMIT, while the db handle is still open. Same
         // invariant as the original writeEntry: a mirror failure leaves disk
-        // MISSING the markdown for the new memory (self-heals on next backfill
-        // via writeIndexMirror reading the DB) but DOES NOT desync the DB or
+        // MISSING the markdown for the new memory (rebuildIndex rewrites every
+        // markdown mirror from the DB) but DOES NOT desync the DB or
         // roll back the supersede. Logged + swallowed, non-fatal.
         try {
-            writeEntryMirrors(ctx.hippoRoot, db, newEntry);
+            writeEntryMirrors(ctx.hippoRoot, newEntry);
         }
         catch (mirrorErr) {
             console.error('supersede: mirror write failed (non-fatal, will self-heal):', mirrorErr);
@@ -1998,7 +1998,7 @@ export function restoreDormant(ctx, id) {
             }
             throw err;
         }
-        writeEntryMirrors(ctx.hippoRoot, db, restored);
+        writeEntryMirrors(ctx.hippoRoot, restored);
         return restored;
     }
     finally {

package/dist/cli.js

@@ -60,6 +60,8 @@ import { computeSystemEnergy, vecNorm } from './physics.js';
 import { loadConfig } from './config.js';
 import { openHippoDb, closeHippoDb } from './db.js';
 import { runDoctor, formatDoctor } from './doctor.js';
+import { buildSupportBundle, TAIL_MAX_LINES } from './support-bundle.js';
+import { PACKAGE_VERSION } from './version.js';
 import { captureToolFailure } from './capture-error.js';
 import { blockHash, hookPayloadSessionId, lastSentState, recordTokenUse, shouldSkipUnchanged } from './token-ledger.js';
 import { FAILURE_LOG_RETENTION_DAYS } from './failure-log.js';
@@ -264,7 +266,7 @@ export const BOOLEAN_FLAGS = new Set([
     'all', 'all-tenants', 'archive', 'auto', 'bad', 'bootstrap', 'classic', 'continuity',
     'cross-project', 'dry-run', 'equal-sources', 'error', 'evc-adaptive', 'extract',
     'filter-conflicts', 'fix', 'force', 'forget', 'git', 'global', 'good', 'graph-stream',
-    'help', 'include-superseded', 'inferred', 'json', 'last-session', 'multihop', 'no-hooks',
+    'help', 'include-logs', 'include-superseded', 'inferred', 'json', 'last-session', 'multihop', 'no-hooks',
     'no-learn', 'no-mmr', 'no-propagate', 'no-schedule', 'no-share', 'no-summarize-older',
     'observed', 'open', 'physics', 'pin', 'pinned-only', 'reject-loser', 'rerank-utility',
     'reset-physics', 'save-baseline', 'show-cases', 'stats', 'stdin',
@@ -488,7 +490,7 @@ function cmdInit(hippoRoot, flags) {
         initStore(hippoRoot);
         console.log('Initialized Hippo at', hippoRoot);
         console.log('   Directories: buffer/ episodic/ semantic/ conflicts/');
-        console.log('   Files: hippo.db index.json stats.json');
+        console.log('   Files: hippo.db stats.json');
     }
     const globalRoot = getGlobalRoot();
     registerWorkspace(globalRoot, path.dirname(hippoRoot));
@@ -8675,6 +8677,10 @@ Commands:
                            PostToolUseFailure hook payload on stdin; skips routine failures)
   doctor                   Check the install: Node, store, schema, sleep, agent hooks
     --json                 Machine-readable report (exit code 1 on any failure)
+  support-bundle           Write a redacted JSON file for a support ticket: versions, doctor,
+                           config without secrets, store counts, log names; never memory text
+    --out <file>           Where to write it (default: hippo-support-<time>.json here)
+    --include-logs         Add the last ${TAIL_MAX_LINES} lines of each hippo log, known secret shapes removed
   tokens                   Tokens of memory text hippo handed agents, per surface
                            (hook, context, recall, MCP, HTTP), and what skipping
                            unchanged hook blocks saved
@@ -9433,6 +9439,38 @@ async function main(command, args, flags, hippoRoot) {
                 process.exit(1);
             break;
         }
+        case 'support-bundle': {
+            const outFlag = cardStringFlag(flags, 'out');
+            if (outFlag === '') {
+                console.error('--out requires a file path.');
+                process.exit(1);
+            }
+            const includeLogs = flags['include-logs'] === true;
+            const home = process.env.HOME || process.env.USERPROFILE || os.homedir();
+            const now = new Date();
+            const bundle = buildSupportBundle({ cwd: process.cwd(), home, version: PACKAGE_VERSION, includeLogs, now });
+            const stamp = now.toISOString().replace(/[:.]/g, '-');
+            const file = outFlag ?? path.join(process.cwd(), `hippo-support-${stamp}.json`);
+            const json = JSON.stringify(bundle, null, 2);
+            try {
+                fs.writeFileSync(file, `${json}\n`, { flag: 'wx', mode: 0o600 });
+            }
+            catch (err) {
+                if (err instanceof Error && 'code' in err && err.code === 'EEXIST') {
+                    console.error(`${file} already exists; pass --out to choose another file. Nothing was written.`);
+                }
+                else {
+                    console.error(err instanceof Error ? err.message : String(err));
+                }
+                process.exit(1);
+            }
+            const kb = Math.round(Buffer.byteLength(json) / 1024);
+            console.log(`Wrote ${file} (${kb} KB).`);
+            console.log(includeLogs
+                ? `It holds versions, doctor checks, config with secrets removed, store counts, and the last ${TAIL_MAX_LINES} lines of each hippo log with known secret shapes removed. Those log lines can quote memory text. Read it before you attach it to a ticket.`
+                : 'It holds versions, doctor checks, config with secrets removed, store counts and log file names. It never holds memory text. Read it before you attach it to a ticket.');
+            break;
+        }
         case 'snapshot':
             cmdSnapshot(hippoRoot, args, flags);
             break;

package/dist/db.d.ts

@@ -13,11 +13,18 @@ export interface DatabaseSyncLike {
 }
 export declare function getHippoDbPath(hippoRoot: string): string;
 export declare function getCurrentSchemaVersion(): number;
+/** Thrown by {@link assertBinaryCompatible}; doctor uses it to pick the upgrade fix over a generic permissions fix. */
+export declare class IncompatibleBinaryError extends Error {
+}
 export declare function openHippoDb(hippoRoot: string): DatabaseSyncLike;
+/** Open an existing store without changing it: no mkdir, WAL switch, migration or mirror cleanup. Throws when hippo.db is missing. */
+export declare function openHippoDbReadOnly(hippoRoot: string): DatabaseSyncLike;
 export declare function getSchemaVersion(db: DatabaseSyncLike): number;
 export declare function closeHippoDb(db: DatabaseSyncLike): void;
 export declare function getMeta(db: DatabaseSyncLike, key: string, fallback?: string): string;
 export declare function setMeta(db: DatabaseSyncLike, key: string, value: string): void;
+/** Row count of one table; null when the table is missing or unreadable, which callers show as unknown. */
+export declare function countTableRows(db: DatabaseSyncLike, table: string): number | null;
 export declare function isFtsAvailable(db: DatabaseSyncLike): boolean;
 export declare function pruneConsolidationRuns(db: DatabaseSyncLike, keep?: number): void;
 export {};

package/dist/db.js

@@ -2469,11 +2469,14 @@ export function getHippoDbPath(hippoRoot) {
 export function getCurrentSchemaVersion() {
     return CURRENT_SCHEMA_VERSION;
 }
+/** Thrown by {@link assertBinaryCompatible}; doctor uses it to pick the upgrade fix over a generic permissions fix. */
+export class IncompatibleBinaryError extends Error {
+}
 /** Refuse a store stamped for a newer binary. Fails closed: runMigrations creates meta first, so a failed read is a real error. */
 function assertBinaryCompatible(db) {
     const minRequired = getMeta(db, 'min_compatible_binary');
     if (minRequired && compareSemver(minRequired, PACKAGE_VERSION) > 0) {
-        throw new Error(`hippo-memory: this database requires hippo-memory >= ${minRequired}, but the running binary is ${PACKAGE_VERSION}. ` +
+        throw new IncompatibleBinaryError(`hippo-memory: this database requires hippo-memory >= ${minRequired}, but the running binary is ${PACKAGE_VERSION}. ` +
             `Upgrade hippo-memory to open it; an older binary does not know this schema and could expose private rows or damage the store.`);
     }
 }
@@ -2530,6 +2533,25 @@ export function openHippoDb(hippoRoot) {
         throw error;
     }
 }
+/** Open an existing store without changing it: no mkdir, WAL switch, migration or mirror cleanup. Throws when hippo.db is missing. */
+export function openHippoDbReadOnly(hippoRoot) {
+    const db = new DatabaseSync(getHippoDbPath(hippoRoot), { readOnly: true });
+    try {
+        db.exec('PRAGMA busy_timeout = 5000');
+        if (tableExists(db, 'meta'))
+            assertBinaryCompatible(db);
+        return db;
+    }
+    catch (error) {
+        try {
+            db.close();
+        }
+        catch {
+            // Best effort only.
+        }
+        throw error;
+    }
+}
 function runMigrations(db, hippoRoot) {
     ensureMetaTable(db);
     // Before anything writes, so a stale binary never repairs or migrates a store it does not understand.
@@ -2578,6 +2600,8 @@ function ensureMetaTable(db) {
   `);
 }
 export function getSchemaVersion(db) {
+    if (!tableExists(db, 'meta'))
+        return 0;
     // SAFETY: row's shape matches the single `value` column named in the
     // SELECT above.
     const row = db.prepare(`SELECT value FROM meta WHERE key = 'schema_version'`).get();
@@ -2784,6 +2808,18 @@ export function getMeta(db, key, fallback = '') {
 export function setMeta(db, key, value) {
     db.prepare(`INSERT INTO meta(key, value) VALUES(?, ?) ON CONFLICT(key) DO UPDATE SET value=excluded.value`).run(key, value);
 }
+/** Row count of one table; null when the table is missing or unreadable, which callers show as unknown. */
+export function countTableRows(db, table) {
+    try {
+        // SAFETY: COUNT(*) returns one row with one numeric column.
+        const row = db.prepare(`SELECT COUNT(*) AS n FROM "${table.replace(/"/g, '""')}"`).get();
+        return Number(row?.n ?? 0);
+    }
+    catch {
+        // Callers treat an uncountable table as unknown; the bundle and doctor still finish.
+        return null;
+    }
+}
 export function isFtsAvailable(db) {
     return getMeta(db, 'fts5_available', '0') === '1';
 }

package/dist/doctor.js

@@ -9,8 +9,8 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import { findHippoStoreDir } from './project-identity.js';
 import { getGlobalRoot } from './shared.js';
-import { isInitialized, loadStats } from './store.js';
-import { openHippoDb, closeHippoDb, getSchemaVersion, getCurrentSchemaVersion } from './db.js';
+import { isInitialized } from './store.js';
+import { openHippoDbReadOnly, closeHippoDb, getSchemaVersion, getCurrentSchemaVersion, countTableRows, IncompatibleBinaryError } from './db.js';
 import { isEmbeddingAvailable } from './embeddings.js';
 /** Minimum Node.js version hippo supports (package.json engines). */
 export const MIN_NODE = '22.16.0';
@@ -34,14 +34,42 @@ function readJson(file) {
         return null;
     }
 }
-function countRows(db, table) {
+// Migration 46 creates failure_log; a read-only open no longer creates it on an older store.
+const FAILURE_LOG_SCHEMA = 46;
+/** The failed-tool-call count over the last 7 days, or why it could not be read. */
+function failuresCheck(db, since, schemaVersion) {
     try {
-        // SAFETY: COUNT(*) returns one row with one numeric column.
-        const row = db.prepare(`SELECT COUNT(*) AS n FROM ${table}`).get();
-        return Number(row?.n ?? 0);
+        // SAFETY: COUNT aggregate row.
+        const row = db.prepare(`SELECT COUNT(*) AS n FROM failure_log WHERE ts >= ?`).get(since);
+        return { id: 'failures', status: 'info', detail: `${Number(row?.n ?? 0)} failed tool calls logged in 7 days (hippo failures for detail)` };
     }
-    catch {
-        return null;
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (!message.includes('no such table')) {
+            return { id: 'failures', status: 'warn', detail: `cannot read the failure log: ${message}` };
+        }
+        return schemaVersion < FAILURE_LOG_SCHEMA
+            ? { id: 'failures', status: 'info', detail: 'no failure log yet (hippo creates it on the next write)' }
+            : { id: 'failures', status: 'warn', detail: 'the failure_log table is missing, so failed tool calls are not being logged' };
+    }
+}
+/** How long ago the store last slept (consolidated), or why that history could not be read. */
+function sleepCheck(db, now) {
+    try {
+        // SAFETY: row's shape matches the single `timestamp` column named in the SELECT above.
+        const row = db.prepare(`SELECT timestamp FROM consolidation_runs ORDER BY timestamp DESC, id DESC LIMIT 1`).get();
+        const when = row?.timestamp !== undefined ? Date.parse(row.timestamp) : Number.NaN;
+        if (Number.isNaN(when)) {
+            return { id: 'sleep', status: 'warn', detail: 'hippo has never slept (consolidated) in this store', fix: 'hippo sleep   (the session-end hook runs it automatically)' };
+        }
+        const days = Math.floor((now.getTime() - when) / 86_400_000);
+        return days > 7
+            ? { id: 'sleep', status: 'warn', detail: `last sleep ${days} days ago`, fix: 'hippo sleep, and check the session-end hook is installed' }
+            : { id: 'sleep', status: 'pass', detail: `last sleep ${days === 0 ? 'today' : `${days} day${days === 1 ? '' : 's'} ago`}` };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return { id: 'sleep', status: 'info', detail: `sleep history unavailable (${message})` };
     }
 }
 /** Run every check. Never throws for a broken install; broken parts become failed checks. */
@@ -58,10 +86,14 @@ export function runDoctor(opts) {
     const globalRoot = getGlobalRoot();
     const hasGlobal = isInitialized(globalRoot);
     let store = null;
-    if (local !== null) {
+    if (local !== null && isInitialized(local)) {
         store = local;
         checks.push({ id: 'store', status: 'pass', detail: `project store at ${local}${hasGlobal ? ` (global store at ${globalRoot} too)` : ''}` });
     }
+    else if (local !== null) {
+        // The walk stops at the first .hippo it finds, so a bare one (no hippo.db) blocks a parent or global store too.
+        checks.push({ id: 'store', status: 'fail', detail: `${local} has no hippo.db, so hippo commands run here stop at it`, fix: `run hippo init in ${path.dirname(local)}, or remove that .hippo folder` });
+    }
     else if (hasGlobal) {
         store = globalRoot;
         checks.push({ id: 'store', status: 'warn', detail: `no project store here; using the global store at ${globalRoot}`, fix: 'hippo init   (in the project root)' });
@@ -72,7 +104,7 @@ export function runDoctor(opts) {
     if (store !== null) {
         let db = null;
         try {
-            db = openHippoDb(store);
+            db = openHippoDbReadOnly(store);
             const have = getSchemaVersion(db);
             const want = getCurrentSchemaVersion();
             checks.push(have === want
@@ -80,8 +112,8 @@ export function runDoctor(opts) {
                 : have > want
                     ? { id: 'schema', status: 'fail', detail: `database schema v${have} is newer than this hippo (v${want})`, fix: 'npm install -g hippo-memory@latest' }
                     : { id: 'schema', status: 'info', detail: `database schema v${have}; hippo migrates it to v${want} on the next write` });
-            const memories = countRows(db, 'memories');
-            const dormant = countRows(db, 'dormant_memories');
+            const memories = countTableRows(db, 'memories');
+            const dormant = countTableRows(db, 'dormant_memories');
             const memoryCheck = { id: 'memories', status: 'info', detail: `${memories ?? '?'} memories${dormant !== null ? `, ${dormant} dormant` : ''}` };
             if (memories === 0) {
                 memoryCheck.status = 'warn';
@@ -97,42 +129,21 @@ export function runDoctor(opts) {
             catch {
                 checks.push({ id: 'tokens', status: 'info', detail: 'no token ledger yet (created on the next write)' });
             }
-            try {
-                // SAFETY: COUNT aggregate row.
-                const row = db.prepare(`SELECT COUNT(*) AS n FROM failure_log WHERE ts >= ?`).get(since);
-                checks.push({ id: 'failures', status: 'info', detail: `${Number(row?.n ?? 0)} failed tool calls logged in 7 days (hippo failures for detail)` });
-            }
-            catch {
-                // Opening the store migrates it, so a missing table was dropped: the hook is logging nothing.
-                checks.push({ id: 'failures', status: 'warn', detail: 'the failure_log table is missing, so failed tool calls are not being logged' });
-            }
+            checks.push(failuresCheck(db, since, have));
+            checks.push(sleepCheck(db, now));
         }
         catch (err) {
-            checks.push({ id: 'schema', status: 'fail', detail: `cannot open the database: ${err instanceof Error ? err.message : String(err)}`, fix: 'check file permissions on the .hippo folder' });
+            checks.push({
+                id: 'schema',
+                status: 'fail',
+                detail: `cannot open the database: ${err instanceof Error ? err.message : String(err)}`,
+                fix: err instanceof IncompatibleBinaryError ? 'npm install -g hippo-memory@latest' : 'check file permissions on the .hippo folder',
+            });
         }
         finally {
             if (db !== null)
                 closeHippoDb(db);
         }
-        try {
-            const runs = loadStats(store)['consolidation_runs'];
-            const last = Array.isArray(runs) && runs.length > 0 ? runs[runs.length - 1] : null;
-            // SAFETY: the constructor check above narrows `last` to a plain JSON object.
-            const ts = last !== null && last !== undefined && !Array.isArray(last) && last.constructor === Object ? last.timestamp : undefined;
-            const when = ts !== undefined && ts !== null ? Date.parse(String(ts)) : Number.NaN;
-            if (Number.isNaN(when)) {
-                checks.push({ id: 'sleep', status: 'warn', detail: 'hippo has never slept (consolidated) in this store', fix: 'hippo sleep   (the session-end hook runs it automatically)' });
-            }
-            else {
-                const days = Math.floor((now.getTime() - when) / 86_400_000);
-                checks.push(days > 7
-                    ? { id: 'sleep', status: 'warn', detail: `last sleep ${days} days ago`, fix: 'hippo sleep, and check the session-end hook is installed' }
-                    : { id: 'sleep', status: 'pass', detail: `last sleep ${days === 0 ? 'today' : `${days} day${days === 1 ? '' : 's'} ago`}` });
-            }
-        }
-        catch {
-            checks.push({ id: 'sleep', status: 'info', detail: 'sleep history unavailable' });
-        }
     }
     const claudeDir = path.join(home, '.claude');
     if (fs.existsSync(claudeDir)) {

package/dist/reject-flow.d.ts

@@ -41,8 +41,8 @@ export interface RejectFlowResult {
  * normalized digest matches (kind-aware), one aggregate `reject_value`
  * audit, COMMIT. Then post-commit (mirrors the existing purge+reaper
  * pattern verbatim from api.archiveRaw, api.ts:1913-1938): best-effort
- * mirror purge per removed id, `mirror_cleaned_at` stamps for raw ids, one
- * index mirror rewrite.
+ * mirror purge per removed id, `mirror_cleaned_at` stamps for raw ids.
+ * index.json itself is only refreshed by `rebuildIndex()`.
  */
 export declare function rejectValue(opts: RejectFlowOpts): RejectFlowResult;
 export type UnrejectOutcome = {

package/dist/reject-flow.js

@@ -15,7 +15,7 @@ import { openHippoDb, closeHippoDb } from './db.js';
 import { appendAuditEvent } from './audit.js';
 import { archiveRawMemory } from './raw-archive.js';
 import { purgeDormantByDigest } from './dormant.js';
-import { initStore, deleteEntryCore, purgeMirrorBestEffort, writeIndexMirror, buildIndexFromDb, } from './store.js';
+import { initStore, deleteEntryCore, purgeMirrorBestEffort, } from './store.js';
 import { rejectionDigest, normalizeValueForRejection, insertRejectedValue, deleteRejectedValue, listRejectedValues, } from './rejection.js';
 /**
  * `hippo reject` / `api.reject` core flow. ONE connection, one transaction:
@@ -23,8 +23,8 @@ import { rejectionDigest, normalizeValueForRejection, insertRejectedValue, delet
  * normalized digest matches (kind-aware), one aggregate `reject_value`
  * audit, COMMIT. Then post-commit (mirrors the existing purge+reaper
  * pattern verbatim from api.archiveRaw, api.ts:1913-1938): best-effort
- * mirror purge per removed id, `mirror_cleaned_at` stamps for raw ids, one
- * index mirror rewrite.
+ * mirror purge per removed id, `mirror_cleaned_at` stamps for raw ids.
+ * index.json itself is only refreshed by `rebuildIndex()`.
  */
 export function rejectValue(opts) {
     if (!opts.reason.trim()) {
@@ -138,7 +138,7 @@ export function rejectValue(opts) {
         }
         // Post-commit, db handle still open (same pattern as api.archiveRaw):
         // best-effort mirror purge per removed id, reaper-backstop stamp for
-        // raw ids, one index mirror rewrite.
+        // raw ids.
         for (const id of removedIds) {
             // AT1 fix: purgeMirrorBestEffort retries once, then — for non-raw ids,
             // which cleanupArchivedMirrors' reaper never scans — reports the
@@ -150,9 +150,6 @@ export function rejectValue(opts) {
                 db.prepare(`UPDATE raw_archive SET mirror_cleaned_at = ? WHERE memory_id = ?`).run(new Date().toISOString(), id);
             }
         }
-        if (removedIds.length > 0) {
-            writeIndexMirror(opts.hippoRoot, buildIndexFromDb(db));
-        }
         return { digest, content, removedIds, removedRawIds };
     }
     finally {

package/dist/secret-detect.d.ts

@@ -38,4 +38,6 @@ export declare function detectSecret(entry: {
  * CS1 pre-compact snapshot fields — can scrub it in place instead.
  */
 export declare function redactSecrets(text: string): string;
+/** Stricter redaction for text that leaves the machine: no co-occurrence guard, plus Bearer headers and JWTs. */
+export declare function redactSecretsStrict(text: string): string;
 //# sourceMappingURL=secret-detect.d.ts.map

package/dist/secret-detect.js

@@ -48,6 +48,11 @@ const SECRET_PATTERNS = [
 ];
 const KEYISH_CONTEXT_RE = /key|token|secret|credential|bearer|auth|password/i;
 const CO_OCCURRENCE_GUARDED = new Set(['sk-style-key', 'sk-underscore-key']);
+// redactSecretsStrict-only: too noisy for whole-entry memory scanning, worth hiding once text leaves the machine.
+const STRICT_ONLY_PATTERNS = [
+    /\b[Bb]earer\s+[A-Za-z0-9._~+/-]{16,}=*/g,
+    /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]*/g,
+];
 /**
  * Scan a memory's tags + content for secret material.
  * Pure and deterministic; no filesystem or store access.
@@ -75,21 +80,28 @@ export function detectSecret(entry) {
  * CS1 pre-compact snapshot fields — can scrub it in place instead.
  */
 export function redactSecrets(text) {
+    return redactText(text, false);
+}
+/** Stricter redaction for text that leaves the machine: no co-occurrence guard, plus Bearer headers and JWTs. */
+export function redactSecretsStrict(text) {
+    return redactText(text, true);
+}
+function redactText(text, strict) {
     if (!text)
         return text;
     let result = text;
-    // PEM/OpenSSH blocks first: the pattern-table entry matches only the
-    // BEGIN delimiter, which is fine for detectSecret's flag-or-not decision
-    // but would leave the base64 payload behind here. Consume through the
-    // matching END delimiter; a truncated block with no END is redacted to
-    // the end of the text (codex round 3).
+    // PEM/OpenSSH blocks first: SECRET_PATTERNS only matches BEGIN; consume through END, or to the end of a truncated block.
     result = result.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----(?:[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----|[\s\S]*$)/g, '[REDACTED]');
     for (const { name, re } of SECRET_PATTERNS) {
-        if (CO_OCCURRENCE_GUARDED.has(name) && !KEYISH_CONTEXT_RE.test(text))
+        if (!strict && CO_OCCURRENCE_GUARDED.has(name) && !KEYISH_CONTEXT_RE.test(text))
             continue;
         const flags = re.flags.includes('g') ? re.flags : `${re.flags}g`;
         result = result.replace(new RegExp(re.source, flags), '[REDACTED]');
     }
+    if (strict) {
+        for (const re of STRICT_ONLY_PATTERNS)
+            result = result.replace(re, '[REDACTED]');
+    }
     return result;
 }
 //# sourceMappingURL=secret-detect.js.map

package/dist/store.d.ts

@@ -190,23 +190,13 @@ interface LegacyStats {
     total_forgotten: JsonValue;
     consolidation_runs: JsonValue;
 }
-/**
- * Derive the current `HippoIndex` (entries + last-retrieval/trace lockstep
- * meta) from SQLite, the source of truth. Exported (AT1) for the same
- * reason as `writeIndexMirror` below: `src/reject-flow.ts` needs to rebuild
- * the index mirror post-commit after a (possibly multi-row) reject removal,
- * without duplicating this query.
- */
+/** Derive the current `HippoIndex` from SQLite. Exported for `rebuildIndex`
+ *  (the only index.json writer) and the longmemeval benchmark. */
 export declare function buildIndexFromDb(db: ReturnType<typeof openHippoDb>): HippoIndex;
-/**
- * Write the `index.json` mirror file for a given (already-derived) index.
- * Exported (AT1) so `src/reject-flow.ts` can replicate `deleteEntry`'s exact
- * post-commit "removeEntryMirrors then rewrite the index once" sequence for
- * the reject verb's (possibly multi-row) removal, without duplicating
- * `buildIndexFromDb`'s query.
- */
+/** Write the `index.json` mirror file for an already-derived index. Exported for
+ *  `rebuildIndex` (the only index.json writer) and the longmemeval benchmark. */
 export declare function writeIndexMirror(hippoRoot: string, index: HippoIndex): void;
-/** Load the derived index from SQLite. Read-only: writers refresh index.json, so readers never race on it. */
+/** Load the derived index from SQLite. Read-only: index.json is only ever written by `rebuildIndex`. */
 export declare function loadIndex(hippoRoot: string): HippoIndex;
 /**
  * Persist mutable index metadata. Entry rows themselves are derived from SQLite.
@@ -215,10 +205,8 @@ export declare function loadIndex(hippoRoot: string): HippoIndex;
  * land atomically — callers (getContext, cmdRecall) fold a freshly-written
  * trace id into `index.last_trace_id` before calling this, relying on BOTH
  * meta keys committing together. Wrapped in BEGIN/COMMIT so a crash or a
- * mid-write failure can never advance one key without the other. The
- * filesystem mirror write stays AFTER commit — the DB is the source of
- * truth, the mirror is best-effort (matches every other per-call-handle
- * site's convention).
+ * mid-write failure can never advance one key without the other. index.json
+ * is left untouched; only `rebuildIndex` writes it.
  */
 export declare function saveIndex(hippoRoot: string, index: HippoIndex): void;
 /**
@@ -277,13 +265,8 @@ export declare function writeEntryDbOnly(db: DatabaseSyncLike, entry: MemoryEntr
     actor?: string;
     afterWrite?: (db: DatabaseSyncLike, memoryId: string) => void;
 }): void;
-/**
- * Filesystem mirrors path. Caller passes `hippoRoot` + an open `db` handle
- * (used by `buildIndexFromDb` to derive the index from the source of truth).
- * MUST be invoked AFTER the outer transaction commits — a mirror write
- * during a tx that subsequently rolls back would leave orphan markdown.
- */
-export declare function writeEntryMirrors(hippoRoot: string, db: DatabaseSyncLike, entry: MemoryEntry): void;
+/** Markdown mirror path, invoked AFTER commit (a rolled-back tx must leave no orphan markdown). */
+export declare function writeEntryMirrors(hippoRoot: string, entry: MemoryEntry): void;
 /**
  * Read a memory entry by ID.
  *

package/dist/store.js

@@ -940,6 +940,7 @@ function upsertEntryRow(db, entry, bypassRejectionGuard = false) {
     if (!bypassRejectionGuard) {
         checkRejectionGuard(db, entry.tenantId ?? 'default', entry.id, entry.content);
     }
+    const isNewRow = db.prepare(`SELECT 1 FROM memories WHERE id = ?`).get(entry.id) === undefined;
     db.prepare(`
     INSERT INTO memories(
       id, created, last_retrieved, retrieval_count, strength, half_life_days, layer,
@@ -996,13 +997,14 @@ function upsertEntryRow(db, entry, bypassRejectionGuard = false) {
       dag_level_3_built_at = excluded.dag_level_3_built_at,
       updated_at = datetime('now')
   `).run(entry.id, entry.created, entry.last_retrieved, entry.retrieval_count, entry.strength, entry.half_life_days, entry.layer, JSON.stringify(entry.tags ?? []), entry.emotional_valence, entry.schema_fit, entry.source, entry.outcome_score, entry.outcome_positive ?? 0, entry.outcome_negative ?? 0, JSON.stringify(entry.conflicts_with ?? []), entry.pinned ? 1 : 0, entry.confidence, entry.content, JSON.stringify(entry.parents ?? []), entry.starred ? 1 : 0, entry.trace_outcome ?? null, entry.source_session_id ?? null, entry.valid_from ?? entry.created, entry.superseded_by ?? null, entry.extracted_from ?? null, entry.dag_level ?? 0, entry.dag_parent_id ?? null, entry.kind ?? 'distilled', entry.scope ?? null, entry.owner ?? null, entry.artifact_ref ?? null, entry.tenantId ?? 'default', entry.origin_project ?? null, entry.descendant_count ?? 0, entry.earliest_at ?? null, entry.latest_at ?? null, entry.dag_level_3_built_at ?? null);
-    syncFtsRow(db, entry);
+    syncFtsRow(db, entry, isNewRow);
 }
-function syncFtsRow(db, entry) {
+function syncFtsRow(db, entry, isNewRow = false) {
     if (!isFtsAvailable(db))
         return;
     try {
-        db.prepare(`DELETE FROM memories_fts WHERE id = ?`).run(entry.id);
+        if (!isNewRow)
+            db.prepare(`DELETE FROM memories_fts WHERE id = ?`).run(entry.id);
         db.prepare(`INSERT INTO memories_fts(id, content, tags) VALUES (?, ?, ?)`).run(entry.id, entry.content, entry.tags.join(' '));
     }
     catch {
@@ -1019,13 +1021,8 @@ function deleteFtsRow(db, id) {
         // Best effort.
     }
 }
-/**
- * Derive the current `HippoIndex` (entries + last-retrieval/trace lockstep
- * meta) from SQLite, the source of truth. Exported (AT1) for the same
- * reason as `writeIndexMirror` below: `src/reject-flow.ts` needs to rebuild
- * the index mirror post-commit after a (possibly multi-row) reject removal,
- * without duplicating this query.
- */
+/** Derive the current `HippoIndex` from SQLite. Exported for `rebuildIndex`
+ *  (the only index.json writer) and the longmemeval benchmark. */
 export function buildIndexFromDb(db) {
     // SAFETY: rows' shape matches the seven columns named in the SELECT below.
     const rows = db.prepare(`SELECT id, created, last_retrieved, strength, layer, tags_json, pinned FROM memories ORDER BY created ASC, id ASC`).all();
@@ -1076,13 +1073,8 @@ function buildStatsFromDb(db) {
         })),
     };
 }
-/**
- * Write the `index.json` mirror file for a given (already-derived) index.
- * Exported (AT1) so `src/reject-flow.ts` can replicate `deleteEntry`'s exact
- * post-commit "removeEntryMirrors then rewrite the index once" sequence for
- * the reject verb's (possibly multi-row) removal, without duplicating
- * `buildIndexFromDb`'s query.
- */
+/** Write the `index.json` mirror file for an already-derived index. Exported for
+ *  `rebuildIndex` (the only index.json writer) and the longmemeval benchmark. */
 export function writeIndexMirror(hippoRoot, index) {
     mirrorBestEffort('index.json', () => fs.writeFileSync(path.join(hippoRoot, 'index.json'), JSON.stringify(index, null, 2), 'utf8'));
 }
@@ -1115,10 +1107,9 @@ function syncMirrorFiles(hippoRoot, db) {
     ORDER BY updated_at DESC, id DESC
   `).all();
     mirrorBestEffort('conflict mirrors', () => writeConflictMirrors(hippoRoot, conflicts.map(rowToMemoryConflict)));
-    writeIndexMirror(hippoRoot, buildIndexFromDb(db));
     writeStatsMirror(hippoRoot, buildStatsFromDb(db));
 }
-/** Load the derived index from SQLite. Read-only: writers refresh index.json, so readers never race on it. */
+/** Load the derived index from SQLite. Read-only: index.json is only ever written by `rebuildIndex`. */
 export function loadIndex(hippoRoot) {
     initStore(hippoRoot);
     const db = openHippoDb(hippoRoot);
@@ -1136,10 +1127,8 @@ export function loadIndex(hippoRoot) {
  * land atomically — callers (getContext, cmdRecall) fold a freshly-written
  * trace id into `index.last_trace_id` before calling this, relying on BOTH
  * meta keys committing together. Wrapped in BEGIN/COMMIT so a crash or a
- * mid-write failure can never advance one key without the other. The
- * filesystem mirror write stays AFTER commit — the DB is the source of
- * truth, the mirror is best-effort (matches every other per-call-handle
- * site's convention).
+ * mid-write failure can never advance one key without the other. index.json
+ * is left untouched; only `rebuildIndex` writes it.
  */
 export function saveIndex(hippoRoot, index) {
     initStore(hippoRoot);
@@ -1158,7 +1147,6 @@ export function saveIndex(hippoRoot, index) {
             catch { /* already rolled back; keep the original error */ }
             throw error;
         }
-        writeIndexMirror(hippoRoot, buildIndexFromDb(db));
     }
     finally {
         closeHippoDb(db);
@@ -1222,7 +1210,7 @@ export function writeEntry(hippoRoot, entry, opts) {
     try {
         writeEntryDbOnly(db, stamped, opts);
         opts?.afterCommit?.();
-        writeEntryMirrors(hippoRoot, db, stamped);
+        writeEntryMirrors(hippoRoot, stamped);
     }
     catch (error) {
         // AT1 (plan §3): writeEntryDbOnly's own SAVEPOINT has already unwound by
@@ -1286,15 +1274,9 @@ export function writeEntryDbOnly(db, entry, opts) {
         throw e;
     }
 }
-/**
- * Filesystem mirrors path. Caller passes `hippoRoot` + an open `db` handle
- * (used by `buildIndexFromDb` to derive the index from the source of truth).
- * MUST be invoked AFTER the outer transaction commits — a mirror write
- * during a tx that subsequently rolls back would leave orphan markdown.
- */
-export function writeEntryMirrors(hippoRoot, db, entry) {
+/** Markdown mirror path, invoked AFTER commit (a rolled-back tx must leave no orphan markdown). */
+export function writeEntryMirrors(hippoRoot, entry) {
     mirrorBestEffort(`${entry.id}.md`, () => writeMarkdownMirror(hippoRoot, entry));
-    writeIndexMirror(hippoRoot, buildIndexFromDb(db));
 }
 /**
  * Read a memory entry by ID.
@@ -1611,7 +1593,6 @@ export function deleteEntry(hippoRoot, id, opts) {
         if (!result)
             return false;
         purgeMirrorBestEffort(hippoRoot, id, false, 'deleteEntry');
-        writeIndexMirror(hippoRoot, buildIndexFromDb(db));
         return true;
     }
     finally {
@@ -1786,7 +1767,6 @@ export function batchWriteAndDelete(hippoRoot, toWrite, toDeleteIds, opts) {
         });
         for (const id of removedIds)
             purgeMirrorBestEffort(hippoRoot, id, false, 'batchWriteAndDelete');
-        writeIndexMirror(hippoRoot, buildIndexFromDb(db));
         return removedIds;
     }
     catch (error) {
@@ -1978,7 +1958,9 @@ export function rebuildIndex(hippoRoot) {
             }
         }
         syncMirrorFiles(hippoRoot, db);
-        return buildIndexFromDb(db);
+        const index = buildIndexFromDb(db);
+        writeIndexMirror(hippoRoot, index);
+        return index;
     }
     finally {
         closeHippoDb(db);

package/dist/support-bundle.d.ts

@@ -0,0 +1,12 @@
+import { type DoctorOpts } from './doctor.js';
+import type { JsonObject } from './working-memory.js';
+export interface SupportBundleOpts extends DoctorOpts {
+    readonly cwd: string;
+    readonly home: string;
+    readonly now: Date;
+    readonly includeLogs: boolean;
+}
+export declare const TAIL_MAX_LINES = 200;
+/** Read-only: builds one redacted support-ticket snapshot. Never reads a memory content column. */
+export declare function buildSupportBundle(opts: SupportBundleOpts): JsonObject;
+//# sourceMappingURL=support-bundle.d.ts.map

package/dist/support-bundle.js

@@ -0,0 +1,292 @@
+/** `hippo support-bundle`: one redacted JSON snapshot for a support ticket. Read-only; never touches memory content. */
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { findHippoStoreDir, isGlobalStoreRoot, realpathOrResolve } from './project-identity.js';
+import { getGlobalRoot } from './shared.js';
+import { isInitialized } from './store.js';
+import { openHippoDbReadOnly, closeHippoDb, getSchemaVersion, getMeta, countTableRows } from './db.js';
+import { runDoctor } from './doctor.js';
+import { loadConfig } from './config.js';
+import { redactSecretsStrict } from './secret-detect.js';
+const TAIL_MAX_BYTES = 256 * 1024;
+export const TAIL_MAX_LINES = 200;
+const TAIL_MAX_LINE_CHARS = 2000;
+// Greedy on purpose: complete key blocks are redacted first, so any END left is an orphan and what precedes it may be key body.
+const ORPHAN_KEY_END_RE = /^[\s\S]*-----END [A-Z ]*PRIVATE KEY-----/;
+// The other env vars hippo reads outside the HIPPO_ prefix (src/embedding-provider.ts, connectors/*).
+const OTHER_ENV_NAMES = [
+    'ANTHROPIC_API_KEY', 'OPENAI_API_KEY', 'VOYAGE_API_KEY', 'COHERE_API_KEY', 'TYPESAFE_API_KEY',
+    'GITHUB_TOKEN', 'GITHUB_WEBHOOK_SECRET', 'GITHUB_WEBHOOK_SECRET_PREVIOUS',
+    'GITHUB_ALLOW_UNKNOWN_INSTALLATION_FALLBACK', 'SLACK_BOT_TOKEN', 'SLACK_TEAM_ID',
+    'SLACK_SIGNING_SECRET', 'SLACK_SIGNING_SECRET_PREVIOUS', 'SLACK_ALLOW_UNKNOWN_TEAM_FALLBACK',
+    'XDG_DATA_HOME', 'MCP_SSE_HEARTBEAT_MS', 'MCP_SSE_MAX_AGE_SEC',
+];
+const CONFIG_SECRET_KEY_RE = /key|token|secret|passw|credential|auth|cookie|bearer|signature|private/i;
+function isJsonObject(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+function isJsonString(v) {
+    return typeof v === 'string';
+}
+function buildRuntime() {
+    return {
+        node: process.versions.node,
+        sqlite: process.versions.sqlite ?? null,
+        platform: process.platform,
+        arch: process.arch,
+        osRelease: os.release(),
+    };
+}
+function listTableNames(db) {
+    // SAFETY: each row's shape matches the single `name` column named in the SELECT above.
+    const rows = db.prepare(`SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' AND sql NOT LIKE 'CREATE VIRTUAL TABLE%' ORDER BY name`).all();
+    return rows.map((r) => r.name);
+}
+function countTables(db) {
+    const tables = {};
+    for (const name of listTableNames(db))
+        tables[name] = countTableRows(db, name);
+    return tables;
+}
+function redactConfigValue(value) {
+    if (Array.isArray(value))
+        return value.map(redactConfigValue);
+    if (isJsonObject(value)) {
+        const out = {};
+        for (const [key, v] of Object.entries(value)) {
+            out[key] = CONFIG_SECRET_KEY_RE.test(key) ? '[REDACTED]' : redactConfigValue(v);
+        }
+        return out;
+    }
+    return value;
+}
+function readStoreConfig(storeDir) {
+    const configPath = path.join(storeDir, 'config.json');
+    let configFile = 'absent';
+    if (fs.existsSync(configPath)) {
+        try {
+            JSON.parse(fs.readFileSync(configPath, 'utf8'));
+            configFile = 'present';
+        }
+        catch {
+            configFile = 'invalid';
+        }
+    }
+    // loadConfig always returns the effective config: its own defaults on a missing or broken file.
+    const effective = JSON.parse(JSON.stringify(loadConfig(storeDir)));
+    return { configFile, config: redactConfigValue(effective) };
+}
+function buildStoreEntry(kind, storeDir) {
+    const dbPath = path.join(storeDir, 'hippo.db');
+    if (!fs.existsSync(dbPath)) {
+        return { kind, path: storeDir, error: 'no hippo.db here (hippo init has not run)' };
+    }
+    // Stat before opening: a read-only open leaves an empty -wal behind it.
+    const files = { 'hippo.db': fs.statSync(dbPath).size };
+    const walPath = `${dbPath}-wal`;
+    if (fs.existsSync(walPath))
+        files['hippo.db-wal'] = fs.statSync(walPath).size;
+    let db = null;
+    try {
+        db = openHippoDbReadOnly(storeDir);
+        const schemaVersion = getSchemaVersion(db);
+        const minCompatibleBinary = getMeta(db, 'min_compatible_binary', '') || null;
+        const tables = countTables(db);
+        const { configFile, config } = readStoreConfig(storeDir);
+        return { kind, path: storeDir, schemaVersion, minCompatibleBinary, files, tables, configFile, config };
+    }
+    catch (err) {
+        return { kind, path: storeDir, error: err instanceof Error ? err.message : String(err) };
+    }
+    finally {
+        if (db !== null)
+            closeHippoDb(db);
+    }
+}
+function buildStores(opts) {
+    const stores = [];
+    const projectDir = findHippoStoreDir(opts.cwd, { homeDir: opts.home });
+    if (projectDir !== null)
+        stores.push(buildStoreEntry('project', projectDir));
+    const globalDir = getGlobalRoot();
+    const alreadyListed = projectDir !== null && isGlobalStoreRoot(projectDir);
+    if (isInitialized(globalDir) && !alreadyListed)
+        stores.push(buildStoreEntry('global', globalDir));
+    return stores;
+}
+function listSetEnvNames() {
+    const names = new Set();
+    for (const key of Object.keys(process.env)) {
+        if (key.startsWith('HIPPO_'))
+            names.add(key);
+    }
+    for (const key of OTHER_ENV_NAMES) {
+        if (process.env[key] !== undefined)
+            names.add(key);
+    }
+    return [...names].sort();
+}
+function listLogFileNames(dir) {
+    if (!fs.existsSync(dir))
+        return [];
+    return fs.readdirSync(dir, { withFileTypes: true })
+        .filter((d) => d.isFile())
+        .map((d) => d.name)
+        .sort();
+}
+function tailLogFile(file) {
+    const size = fs.statSync(file).size;
+    const readSize = Math.min(size, TAIL_MAX_BYTES);
+    const startedMidFile = size > TAIL_MAX_BYTES;
+    const fd = fs.openSync(file, 'r');
+    let text;
+    try {
+        const buf = Buffer.alloc(readSize);
+        fs.readSync(fd, buf, 0, readSize, size - readSize);
+        text = buf.toString('utf8');
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    let lines = text.split(/\r?\n/);
+    // A tail read starting mid-file cuts its first piece off mid-line.
+    if (startedMidFile)
+        lines = lines.slice(1);
+    if (lines.length > 0 && lines[lines.length - 1] === '')
+        lines = lines.slice(0, -1);
+    // Redact before splitting: a private key spans lines. An END still left has lost its BEGIN to the window cut.
+    const redacted = redactSecretsStrict(lines.join('\n')).replace(ORPHAN_KEY_END_RE, '[REDACTED]');
+    return redacted.split('\n').slice(-TAIL_MAX_LINES).map((line) => line.length > TAIL_MAX_LINE_CHARS ? `${line.slice(0, TAIL_MAX_LINE_CHARS)} [truncated]` : line);
+}
+function buildLogsSection(opts) {
+    const dir = path.join(opts.home, '.hippo', 'logs');
+    const names = listLogFileNames(dir);
+    const files = names.map((name) => {
+        const stat = fs.statSync(path.join(dir, name));
+        return { name, bytes: stat.size, modified: stat.mtime.toISOString() };
+    });
+    const logs = { dir: '~/.hippo/logs', files };
+    if (opts.includeLogs) {
+        const tails = {};
+        for (const name of names)
+            tails[name] = tailLogFile(path.join(dir, name));
+        logs['tails'] = tails;
+    }
+    return logs;
+}
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+// The native realpath is the only form that exposes a short-name (8.3) or symlinked alias for what it is.
+function nativeRealPathKey(p) {
+    try {
+        const real = fs.realpathSync.native(p);
+        return process.platform === 'win32' ? real.toLowerCase() : real;
+    }
+    catch {
+        // A path that does not exist has no alias to find.
+        return null;
+    }
+}
+// Longest first: where one home form nests in another (a test home under the real one), swap the longer.
+function collectHomeForms(home, probes) {
+    const forms = new Set();
+    const add = (s) => { if (s.length >= 3)
+        forms.add(s); };
+    for (const base of [home, realpathOrResolve(home), os.homedir(), realpathOrResolve(os.homedir())]) {
+        add(base);
+        add(path.resolve(base));
+        if (process.platform === 'win32') {
+            add(base.replace(/\\/g, '/'));
+            add(path.resolve(base).replace(/\\/g, '/'));
+        }
+    }
+    // The alias (e.g. a short-name temp root) can sit above the probe itself, so walk ancestors and
+    // compare native realpaths rather than checking each probe alone.
+    const homeKeys = new Set([nativeRealPathKey(home), nativeRealPathKey(os.homedir())].filter((k) => k !== null));
+    for (const probe of probes) {
+        let dir = path.resolve(probe);
+        for (;;) {
+            const key = nativeRealPathKey(dir);
+            if (key !== null && homeKeys.has(key)) {
+                add(dir);
+                if (process.platform === 'win32')
+                    add(dir.replace(/\\/g, '/'));
+            }
+            const parent = path.dirname(dir);
+            if (parent === dir)
+                break;
+            dir = parent;
+        }
+    }
+    const seen = new Set();
+    const deduped = [];
+    for (const f of [...forms].sort((a, b) => b.length - a.length)) {
+        const key = process.platform === 'win32' ? f.toLowerCase() : f;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        deduped.push(f);
+    }
+    return deduped;
+}
+function replaceHomeForms(text, forms) {
+    if (forms.length === 0)
+        return text;
+    // Stop only before another name character: "<home> now" and "<home>." swap, a longer user name ("<home>ty") does not.
+    const re = new RegExp(`(?:${forms.map(escapeRegExp).join('|')})(?![\\p{L}\\p{N}_])`, process.platform === 'win32' ? 'giu' : 'gu');
+    return text.replace(re, '~');
+}
+const URL_RE = /\b[a-z][a-z0-9+.-]*:\/\/[^\s"'<>]+/gi;
+function redactUrlsInString(text) {
+    return text.replace(URL_RE, (match) => {
+        const scheme = match.slice(0, match.indexOf('://'));
+        try {
+            const url = new URL(match);
+            url.username = '';
+            url.password = '';
+            url.search = '';
+            url.hash = '';
+            return url.toString();
+        }
+        catch {
+            return `${scheme}://[REDACTED]`;
+        }
+    });
+}
+function redactString(text, homeForms) {
+    return replaceHomeForms(redactSecretsStrict(redactUrlsInString(text)), homeForms);
+}
+function redactStrings(value, homeForms) {
+    if (isJsonString(value))
+        return redactString(value, homeForms);
+    if (Array.isArray(value))
+        return value.map((v) => redactStrings(v, homeForms));
+    if (isJsonObject(value)) {
+        const out = {};
+        for (const [k, v] of Object.entries(value))
+            out[k] = redactStrings(v, homeForms);
+        return out;
+    }
+    return value;
+}
+/** Read-only: builds one redacted support-ticket snapshot. Never reads a memory content column. */
+export function buildSupportBundle(opts) {
+    const bundle = {
+        format: 'hippo-support-bundle/1',
+        createdAt: opts.now.toISOString(),
+        hippo: opts.version,
+        runtime: buildRuntime(),
+        doctor: JSON.parse(JSON.stringify(runDoctor(opts))),
+        stores: buildStores(opts),
+        env: listSetEnvNames(),
+        logs: buildLogsSection(opts),
+    };
+    // Store paths found from the working folder arrive resolved; the global root arrives as HIPPO_HOME was typed, and log lines
+    // often quote the temp folder, which usually sits under the home.
+    const redacted = redactStrings(bundle, collectHomeForms(opts.home, [getGlobalRoot(), os.tmpdir()]));
+    // SAFETY: the value built above is always a JsonObject; redactStrings preserves object shape.
+    return redacted;
+}
+//# sourceMappingURL=support-bundle.js.map

package/dist/version.d.ts

@@ -16,7 +16,7 @@
  * an ESM `import` can resolve cleanly, and a hardcoded constant survives
  * any packager that drops .json files.
  */
-export declare const PACKAGE_VERSION = "1.47.0";
+export declare const PACKAGE_VERSION = "1.48.0";
 /** Compares plain x.y.z versions, positive if a > b; tags throw so the rollback guard never misfires silently. */
 export declare function compareSemver(a: string, b: string): number;
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -16,7 +16,7 @@
  * an ESM `import` can resolve cleanly, and a hardcoded constant survives
  * any packager that drops .json files.
  */
-export const PACKAGE_VERSION = '1.47.0';
+export const PACKAGE_VERSION = '1.48.0';
 /** Compares plain x.y.z versions, positive if a > b; tags throw so the rollback guard never misfires silently. */
 export function compareSemver(a, b) {
     const parse = (v) => {

package/extensions/openclaw-plugin/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "hippo-memory",
   "name": "Hippo Memory",
   "description": "Biologically-inspired memory for AI agents. Decay by default, retrieval strengthening, sleep consolidation.",
-  "version": "1.47.0",
+  "version": "1.48.0",
 
   "configSchema": {
     "type": "object",

package/extensions/openclaw-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hippo-memory",
-  "version": "1.47.0",
+  "version": "1.48.0",
   "type": "module",
   "description": "Hippo Memory plugin for OpenClaw - biologically-inspired agent memory",
   "main": "index.ts",

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "hippo-memory",
   "name": "Hippo Memory",
   "description": "Biologically-inspired memory for AI agents. Decay by default, retrieval strengthening, sleep consolidation.",
-  "version": "1.47.0",
+  "version": "1.48.0",
   "configSchema": {
     "type": "object",
     "additionalProperties": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hippo-memory",
-  "version": "1.47.0",
+  "version": "1.48.0",
   "description": "Biologically-inspired memory for AI agents. Zero runtime deps, SQLite, MCP server, and an opt-in hosted TypeSafe Jev reranker. Decay, retrieval strengthening, consolidation.",
   "mcpName": "io.github.kitfunso/hippo-memory",
   "type": "module",
@@ -34,6 +34,7 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "lint": "oxlint",
+    "sbom": "node scripts/sbom.mjs",
     "audit:security": "npm audit --audit-level=high && npm --prefix ui audit --audit-level=high",
     "postinstall": "node scripts/postinstall.cjs",
     "smoke:pack": "node scripts/smoke-pack.mjs",