hippo-memory 1.47.0 → 1.49.0

package/dist/db.js

@@ -11,7 +11,7 @@ const require = createRequire(import.meta.url);
 // runtime (Node's built-in synchronous SQLite module); there are no bundled
 // types for it here, so this require + cast is the module's documented boundary.
 const { DatabaseSync } = require('node:sqlite');
-const CURRENT_SCHEMA_VERSION = 46;
+const CURRENT_SCHEMA_VERSION = 47;
 const MIGRATIONS = [
     {
         version: 1,
@@ -2447,6 +2447,22 @@ const MIGRATIONS = [
       `);
         },
     },
+    {
+        version: 47,
+        up: (db) => {
+            // Scope grants (src/auth.ts, ROADMAP EI2): a member key reads a
+            // restricted scope only by an explicit row here. Additive only: no
+            // min_compatible_binary bump.
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS api_key_scope_grants (
+          key_id     TEXT NOT NULL,
+          scope      TEXT NOT NULL,
+          granted_at TEXT NOT NULL,
+          PRIMARY KEY(key_id, scope)
+        );
+      `);
+        },
+    },
 ];
 function tableHasColumn(db, tableName, columnName) {
     if (!/^[a-z_]+$/i.test(tableName))
@@ -2469,11 +2485,14 @@ export function getHippoDbPath(hippoRoot) {
 export function getCurrentSchemaVersion() {
     return CURRENT_SCHEMA_VERSION;
 }
+/** Thrown by {@link assertBinaryCompatible}; doctor uses it to pick the upgrade fix over a generic permissions fix. */
+export class IncompatibleBinaryError extends Error {
+}
 /** Refuse a store stamped for a newer binary. Fails closed: runMigrations creates meta first, so a failed read is a real error. */
 function assertBinaryCompatible(db) {
     const minRequired = getMeta(db, 'min_compatible_binary');
     if (minRequired && compareSemver(minRequired, PACKAGE_VERSION) > 0) {
-        throw new Error(`hippo-memory: this database requires hippo-memory >= ${minRequired}, but the running binary is ${PACKAGE_VERSION}. ` +
+        throw new IncompatibleBinaryError(`hippo-memory: this database requires hippo-memory >= ${minRequired}, but the running binary is ${PACKAGE_VERSION}. ` +
             `Upgrade hippo-memory to open it; an older binary does not know this schema and could expose private rows or damage the store.`);
     }
 }
@@ -2530,6 +2549,25 @@ export function openHippoDb(hippoRoot) {
         throw error;
     }
 }
+/** Open an existing store without changing it: no mkdir, WAL switch, migration or mirror cleanup. Throws when hippo.db is missing. */
+export function openHippoDbReadOnly(hippoRoot) {
+    const db = new DatabaseSync(getHippoDbPath(hippoRoot), { readOnly: true });
+    try {
+        db.exec('PRAGMA busy_timeout = 5000');
+        if (tableExists(db, 'meta'))
+            assertBinaryCompatible(db);
+        return db;
+    }
+    catch (error) {
+        try {
+            db.close();
+        }
+        catch {
+            // Best effort only.
+        }
+        throw error;
+    }
+}
 function runMigrations(db, hippoRoot) {
     ensureMetaTable(db);
     // Before anything writes, so a stale binary never repairs or migrates a store it does not understand.
@@ -2578,6 +2616,8 @@ function ensureMetaTable(db) {
   `);
 }
 export function getSchemaVersion(db) {
+    if (!tableExists(db, 'meta'))
+        return 0;
     // SAFETY: row's shape matches the single `value` column named in the
     // SELECT above.
     const row = db.prepare(`SELECT value FROM meta WHERE key = 'schema_version'`).get();
@@ -2784,6 +2824,18 @@ export function getMeta(db, key, fallback = '') {
 export function setMeta(db, key, value) {
     db.prepare(`INSERT INTO meta(key, value) VALUES(?, ?) ON CONFLICT(key) DO UPDATE SET value=excluded.value`).run(key, value);
 }
+/** Row count of one table; null when the table is missing or unreadable, which callers show as unknown. */
+export function countTableRows(db, table) {
+    try {
+        // SAFETY: COUNT(*) returns one row with one numeric column.
+        const row = db.prepare(`SELECT COUNT(*) AS n FROM "${table.replace(/"/g, '""')}"`).get();
+        return Number(row?.n ?? 0);
+    }
+    catch {
+        // Callers treat an uncountable table as unknown; the bundle and doctor still finish.
+        return null;
+    }
+}
 export function isFtsAvailable(db) {
     return getMeta(db, 'fts5_available', '0') === '1';
 }

package/dist/dedupe.js

@@ -24,6 +24,7 @@ import { textOverlap } from './search.js';
 import { loadAllEntries, deleteEntry } from './store.js';
 import { compareEntryIdentity } from './compare.js';
 import { canAutoDelete } from './memory.js';
+import { derivationPartitionKey } from './recall-scope.js';
 /** Quantization step for strength-tie comparisons. The historical 0.01
  *  epsilon (see `strengthBucket` below) applied via rounding instead of a
  *  raw abs-diff threshold, so the tiebreak is transitive. */
@@ -76,11 +77,13 @@ export function deduplicateStore(hippoRoot, options = {}) {
     // pre-fix global pass.
     const entriesByTenant = new Map();
     for (const entry of entries) {
-        const bucket = entriesByTenant.get(entry.tenantId);
+        // EI2: also split by restricted scope, else a private copy can delete the readable one.
+        const key = derivationPartitionKey(entry.tenantId, entry.scope);
+        const bucket = entriesByTenant.get(key);
         if (bucket)
             bucket.push(entry);
         else
-            entriesByTenant.set(entry.tenantId, [entry]);
+            entriesByTenant.set(key, [entry]);
     }
     // finiteCount mirrors strengthBucket's non-finite hardening on the
     // retrieval leg: a NaN retrieval_count would make the comparator return

package/dist/doctor.js

@@ -9,8 +9,8 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import { findHippoStoreDir } from './project-identity.js';
 import { getGlobalRoot } from './shared.js';
-import { isInitialized, loadStats } from './store.js';
-import { openHippoDb, closeHippoDb, getSchemaVersion, getCurrentSchemaVersion } from './db.js';
+import { isInitialized } from './store.js';
+import { openHippoDbReadOnly, closeHippoDb, getSchemaVersion, getCurrentSchemaVersion, countTableRows, IncompatibleBinaryError } from './db.js';
 import { isEmbeddingAvailable } from './embeddings.js';
 /** Minimum Node.js version hippo supports (package.json engines). */
 export const MIN_NODE = '22.16.0';
@@ -34,14 +34,42 @@ function readJson(file) {
         return null;
     }
 }
-function countRows(db, table) {
+// Migration 46 creates failure_log; a read-only open no longer creates it on an older store.
+const FAILURE_LOG_SCHEMA = 46;
+/** The failed-tool-call count over the last 7 days, or why it could not be read. */
+function failuresCheck(db, since, schemaVersion) {
     try {
-        // SAFETY: COUNT(*) returns one row with one numeric column.
-        const row = db.prepare(`SELECT COUNT(*) AS n FROM ${table}`).get();
-        return Number(row?.n ?? 0);
+        // SAFETY: COUNT aggregate row.
+        const row = db.prepare(`SELECT COUNT(*) AS n FROM failure_log WHERE ts >= ?`).get(since);
+        return { id: 'failures', status: 'info', detail: `${Number(row?.n ?? 0)} failed tool calls logged in 7 days (hippo failures for detail)` };
     }
-    catch {
-        return null;
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (!message.includes('no such table')) {
+            return { id: 'failures', status: 'warn', detail: `cannot read the failure log: ${message}` };
+        }
+        return schemaVersion < FAILURE_LOG_SCHEMA
+            ? { id: 'failures', status: 'info', detail: 'no failure log yet (hippo creates it on the next write)' }
+            : { id: 'failures', status: 'warn', detail: 'the failure_log table is missing, so failed tool calls are not being logged' };
+    }
+}
+/** How long ago the store last slept (consolidated), or why that history could not be read. */
+function sleepCheck(db, now) {
+    try {
+        // SAFETY: row's shape matches the single `timestamp` column named in the SELECT above.
+        const row = db.prepare(`SELECT timestamp FROM consolidation_runs ORDER BY timestamp DESC, id DESC LIMIT 1`).get();
+        const when = row?.timestamp !== undefined ? Date.parse(row.timestamp) : Number.NaN;
+        if (Number.isNaN(when)) {
+            return { id: 'sleep', status: 'warn', detail: 'hippo has never slept (consolidated) in this store', fix: 'hippo sleep   (the session-end hook runs it automatically)' };
+        }
+        const days = Math.floor((now.getTime() - when) / 86_400_000);
+        return days > 7
+            ? { id: 'sleep', status: 'warn', detail: `last sleep ${days} days ago`, fix: 'hippo sleep, and check the session-end hook is installed' }
+            : { id: 'sleep', status: 'pass', detail: `last sleep ${days === 0 ? 'today' : `${days} day${days === 1 ? '' : 's'} ago`}` };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return { id: 'sleep', status: 'info', detail: `sleep history unavailable (${message})` };
     }
 }
 /** Run every check. Never throws for a broken install; broken parts become failed checks. */
@@ -58,10 +86,14 @@ export function runDoctor(opts) {
     const globalRoot = getGlobalRoot();
     const hasGlobal = isInitialized(globalRoot);
     let store = null;
-    if (local !== null) {
+    if (local !== null && isInitialized(local)) {
         store = local;
         checks.push({ id: 'store', status: 'pass', detail: `project store at ${local}${hasGlobal ? ` (global store at ${globalRoot} too)` : ''}` });
     }
+    else if (local !== null) {
+        // The walk stops at the first .hippo it finds, so a bare one (no hippo.db) blocks a parent or global store too.
+        checks.push({ id: 'store', status: 'fail', detail: `${local} has no hippo.db, so hippo commands run here stop at it`, fix: `run hippo init in ${path.dirname(local)}, or remove that .hippo folder` });
+    }
     else if (hasGlobal) {
         store = globalRoot;
         checks.push({ id: 'store', status: 'warn', detail: `no project store here; using the global store at ${globalRoot}`, fix: 'hippo init   (in the project root)' });
@@ -72,7 +104,7 @@ export function runDoctor(opts) {
     if (store !== null) {
         let db = null;
         try {
-            db = openHippoDb(store);
+            db = openHippoDbReadOnly(store);
             const have = getSchemaVersion(db);
             const want = getCurrentSchemaVersion();
             checks.push(have === want
@@ -80,8 +112,8 @@ export function runDoctor(opts) {
                 : have > want
                     ? { id: 'schema', status: 'fail', detail: `database schema v${have} is newer than this hippo (v${want})`, fix: 'npm install -g hippo-memory@latest' }
                     : { id: 'schema', status: 'info', detail: `database schema v${have}; hippo migrates it to v${want} on the next write` });
-            const memories = countRows(db, 'memories');
-            const dormant = countRows(db, 'dormant_memories');
+            const memories = countTableRows(db, 'memories');
+            const dormant = countTableRows(db, 'dormant_memories');
             const memoryCheck = { id: 'memories', status: 'info', detail: `${memories ?? '?'} memories${dormant !== null ? `, ${dormant} dormant` : ''}` };
             if (memories === 0) {
                 memoryCheck.status = 'warn';
@@ -97,42 +129,21 @@ export function runDoctor(opts) {
             catch {
                 checks.push({ id: 'tokens', status: 'info', detail: 'no token ledger yet (created on the next write)' });
             }
-            try {
-                // SAFETY: COUNT aggregate row.
-                const row = db.prepare(`SELECT COUNT(*) AS n FROM failure_log WHERE ts >= ?`).get(since);
-                checks.push({ id: 'failures', status: 'info', detail: `${Number(row?.n ?? 0)} failed tool calls logged in 7 days (hippo failures for detail)` });
-            }
-            catch {
-                // Opening the store migrates it, so a missing table was dropped: the hook is logging nothing.
-                checks.push({ id: 'failures', status: 'warn', detail: 'the failure_log table is missing, so failed tool calls are not being logged' });
-            }
+            checks.push(failuresCheck(db, since, have));
+            checks.push(sleepCheck(db, now));
         }
         catch (err) {
-            checks.push({ id: 'schema', status: 'fail', detail: `cannot open the database: ${err instanceof Error ? err.message : String(err)}`, fix: 'check file permissions on the .hippo folder' });
+            checks.push({
+                id: 'schema',
+                status: 'fail',
+                detail: `cannot open the database: ${err instanceof Error ? err.message : String(err)}`,
+                fix: err instanceof IncompatibleBinaryError ? 'npm install -g hippo-memory@latest' : 'check file permissions on the .hippo folder',
+            });
         }
         finally {
             if (db !== null)
                 closeHippoDb(db);
         }
-        try {
-            const runs = loadStats(store)['consolidation_runs'];
-            const last = Array.isArray(runs) && runs.length > 0 ? runs[runs.length - 1] : null;
-            // SAFETY: the constructor check above narrows `last` to a plain JSON object.
-            const ts = last !== null && last !== undefined && !Array.isArray(last) && last.constructor === Object ? last.timestamp : undefined;
-            const when = ts !== undefined && ts !== null ? Date.parse(String(ts)) : Number.NaN;
-            if (Number.isNaN(when)) {
-                checks.push({ id: 'sleep', status: 'warn', detail: 'hippo has never slept (consolidated) in this store', fix: 'hippo sleep   (the session-end hook runs it automatically)' });
-            }
-            else {
-                const days = Math.floor((now.getTime() - when) / 86_400_000);
-                checks.push(days > 7
-                    ? { id: 'sleep', status: 'warn', detail: `last sleep ${days} days ago`, fix: 'hippo sleep, and check the session-end hook is installed' }
-                    : { id: 'sleep', status: 'pass', detail: `last sleep ${days === 0 ? 'today' : `${days} day${days === 1 ? '' : 's'} ago`}` });
-            }
-        }
-        catch {
-            checks.push({ id: 'sleep', status: 'info', detail: 'sleep history unavailable' });
-        }
     }
     const claudeDir = path.join(home, '.claude');
     if (fs.existsSync(claudeDir)) {

package/dist/extract.js

@@ -92,6 +92,7 @@ export function storeExtractedFacts(hippoRoot, source, facts) {
             confidence: 'inferred',
             source: source.source,
             extracted_from: source.id,
+            scope: source.scope,
             // T1 executor check (2026-08-15 hardening pass): same defect as the
             // consolidate.ts merge/trace passes — createMemory with no tenantId
             // option stamps 'default' (memory.ts:535) regardless of the source

package/dist/mcp/server.d.ts

@@ -48,6 +48,8 @@ export interface McpContext {
      * assuming admin, or a member key over HTTP-MCP would act as admin.
      */
     role?: 'admin' | 'member';
+    /** EI2: scope grants for the HTTP-MCP caller's key. Absent for stdio (admin, needs none). */
+    scopes?: readonly string[];
     /**
      * Per-client key for state isolation under HTTP-MCP. For stdio: 'stdio-${pid}'
      * (one process = one client). For HTTP-SSE / HTTP MCP: hash(bearer + remoteAddr)

package/dist/mcp/server.js

@@ -12,7 +12,7 @@ import * as path from 'path';
 import { createMemory, Layer, calculateStrength, } from '../memory.js';
 import { hybridSearch, physicsSearch, estimateTokens } from '../search.js';
 import { evalNow } from '../ablation.js';
-import { loadAllEntries, writeEntry, strengthenRetrieved, readEntry, loadFreshActiveTaskSnapshot, listMemoryConflicts, resolveConflict, RECALL_DEFAULT_DENY_SCOPES, countCreatedSinceLastSleep } from '../store.js';
+import { loadAllEntries, writeEntry, strengthenRetrieved, readEntry, loadFreshActiveTaskSnapshot, listMemoryConflicts, resolveConflict, countCreatedSinceLastSleep } from '../store.js';
 import { shareMemory, listPeers, getGlobalRoot, initGlobal } from '../shared.js';
 import { consolidate } from '../consolidate.js';
 import { execSync } from 'child_process';
@@ -20,7 +20,7 @@ import { fetchGitLog, extractLessons, partitionLessons, deduplicateLesson, isGit
 import { loadConfig } from '../config.js';
 import { confidenceLabel } from '../memory.js';
 import { resolveTenantId } from '../tenant.js';
-import { recall as apiRecall, remember as apiRemember, outcome as apiOutcome, drillDown as apiDrillDown, assemble as apiAssemble, isPrivateScope, passesScopeFilterForRecall, buildSuppressionSummary, ambientSecretAdmit } from '../api.js';
+import { recall as apiRecall, remember as apiRemember, outcome as apiOutcome, drillDown as apiDrillDown, assemble as apiAssemble, passesScopeFilterForRecall, buildSuppressionSummary, ambientSecretAdmit } from '../api.js';
 import { assertScopeRequestAllowed } from '../recall-scope.js';
 import { resolveProjectIdentity, classifyOriginProject, findHippoStoreDir } from '../project-identity.js';
 import { computePredictionBaserate } from '../predictions.js';
@@ -57,7 +57,7 @@ export function findHippoRoot(cwd = process.cwd(), opts) {
  * a member key never acts as admin through MCP.
  */
 function mcpActor(ctx) {
-    return { subject: ctx?.actor ?? 'mcp', role: ctx?.role ?? 'admin' };
+    return { subject: ctx?.actor ?? 'mcp', role: ctx?.role ?? 'admin', scopes: ctx?.scopes };
 }
 // MCP stdio transport spec: messages are newline-delimited JSON-RPC, no embedded newlines.
 // https://modelcontextprotocol.io/specification/.../basic/transports#stdio
@@ -518,7 +518,7 @@ async function executeTool(name, args, ctx) {
             // ordering and the strength bump on retrieval. Apply the same scope
             // rule as api.recall: explicit scope = exact match; no scope =
             // default-deny on ANY `<source>:private:*` AND 'unknown:legacy'.
-            // v1.2.1: generic-private check via api.isPrivateScope.
+            // EI2: one shared predicate (passesScopeFilterForRecall) so MCP never admits what SQL hides.
             const allEntries = loadAllEntries(hippoRoot, tenantId);
             // v1.12.13 / C5 — WYSIATI counters for the MCP physics/hybrid pipeline.
             // Per the plan-eng-critic round 1 CRIT resolution: MCP's user-visible
@@ -530,18 +530,7 @@ async function executeTool(name, args, ctx) {
             const totalCandidatesCountMcp = allEntries.length;
             const entries = explicitScope
                 ? allEntries.filter((e) => e.scope === explicitScope)
-                : allEntries.filter((e) => {
-                    const s = e.scope ?? null;
-                    if (s === null)
-                        return true;
-                    if (isPrivateScope(s))
-                        return false;
-                    // v1.7.2: read from RECALL_DEFAULT_DENY_SCOPES (single source of truth
-                    // shared with SQL clause + passesScopeFilterForRecall).
-                    if (RECALL_DEFAULT_DENY_SCOPES.some((deny) => deny === s))
-                        return false;
-                    return true;
-                });
+                : allEntries.filter((e) => passesScopeFilterForRecall(e.scope ?? null, undefined));
             const droppedPreRankCountMcp = allEntries.length - entries.length;
             const usePhysics = config.physics?.enabled !== false;
             let results = usePhysics
@@ -1012,7 +1001,7 @@ async function executeTool(name, args, ctx) {
             // results and the snapshot. Pre-v1.2 this surface returned all memories
             // and the snapshot unfiltered, which would have leaked private-channel
             // content to no-scope MCP callers once scope writers shipped.
-            assertScopeRequestAllowed(mcpActor(ctx).role, explicitScope);
+            assertScopeRequestAllowed(mcpActor(ctx), explicitScope);
             const allEntries = loadAllEntries(hippoRoot, tenantId);
             // v39 memory scope isolation: this surface reads the LOCAL store only,
             // but synced-down or legacy rows can still carry another project's

package/dist/project-briefs.js

@@ -22,7 +22,7 @@
  * closed (retired).
  */
 import { openHippoDb, closeHippoDb } from './db.js';
-import { writeEntry, assertTenantId } from './store.js';
+import { writeEntry, assertTenantId, RECALL_DEFAULT_DENY_SCOPES } from './store.js';
 import { markGraphDirty, removeGraphEntitiesForObject } from './graph.js';
 import { createMemory, Layer, PROJECT_BRIEF_HALF_LIFE_DAYS } from './memory.js';
 import { appendAuditEvent } from './audit.js';
@@ -386,6 +386,7 @@ export function assembleBriefFromReceipts(hippoRoot, tenantId, repo) {
     }
     const tag = `path:${normalizedRepo.toLowerCase()}`;
     const likeParam = `%"${escapeLike(tag)}"%`;
+    const denyPlaceholders = RECALL_DEFAULT_DENY_SCOPES.map(() => '?').join(', ');
     const db = openHippoDb(hippoRoot);
     let receipts;
     try {
@@ -396,9 +397,10 @@ export function assembleBriefFromReceipts(hippoRoot, tenantId, repo) {
       WHERE tenant_id = ?
         AND source != 'project_brief'
         AND LOWER(tags_json) LIKE ? ESCAPE '\\'
+        AND (scope IS NULL OR (scope NOT IN (${denyPlaceholders}) AND scope NOT LIKE '%:private:%'))
       ORDER BY created DESC, id DESC
       LIMIT ?
-    `).all(tenantId, likeParam, MAX_BRIEF_RECEIPTS);
+    `).all(tenantId, likeParam, ...RECALL_DEFAULT_DENY_SCOPES, MAX_BRIEF_RECEIPTS);
     }
     finally {
         closeHippoDb(db);

package/dist/recall-scope.d.ts

@@ -71,14 +71,26 @@ export declare class ScopeForbiddenError extends Error {
  * is the act that needs authorization.
  */
 export declare function isRestrictedScope(scope: string | null | undefined): boolean;
-/**
- * Authorize an explicitly requested scope before any read honours it.
- *
- * An admin (tenant owner, the local CLI, loopback without a key) may unlock
- * any scope in its tenant. A member key may not unlock a restricted scope by
- * naming it: before this check, any key in a tenant could read every private
- * channel or repo by passing its scope string. Per-scope grants for member
- * keys belong to ROADMAP Part VIII EI2 (permission-aware recall).
- */
-export declare function assertScopeRequestAllowed(role: 'admin' | 'member', requested: string | undefined): void;
+/** The identity a scope check runs against: a role plus any scope grants. */
+export interface ScopeActor {
+    role: 'admin' | 'member';
+    scopes?: readonly string[];
+}
+/** True when `actor` may read `scope`: admin always; member needs an exact grant on a restricted scope. */
+export declare function canReadScope(actor: ScopeActor, scope: string): boolean;
+/** Authorize an explicitly requested scope before any read honours it (ROADMAP Part VIII EI2: member scope grants). */
+export declare function assertScopeRequestAllowed(actor: ScopeActor, requested: string | undefined): void;
+/** Scope a derived row keeps from one source: the restricted scope itself, else null. */
+export declare function derivationScope(scope: string | null | undefined): string | null;
+/** The one derivation scope shared by every source, or `{ ok: false }` when
+ *  two disagree, so the caller skips the derived row instead of under-scoping it. */
+export declare function commonDerivationScope(scopes: readonly (string | null | undefined)[]): {
+    ok: true;
+    scope: string | null;
+} | {
+    ok: false;
+};
+/** Map-partition key for consolidate/dag producers: tenant + derivation scope,
+ *  so a derived row never blends two restricted scopes or a mixed pair. */
+export declare function derivationPartitionKey(tenantId: string, scope: string | null | undefined): string;
 //# sourceMappingURL=recall-scope.d.ts.map

package/dist/recall-scope.js

@@ -50,18 +50,7 @@ export function passesScopeFilterForRecall(scope, requested) {
     if (requested !== undefined && requested !== '') {
         return scope === requested;
     }
-    if (scope === null)
-        return true;
-    if (isPrivateScope(scope))
-        return false;
-    // SAFETY: RECALL_DEFAULT_DENY_SCOPES (v1.7.2, single source of truth
-    // shared with the SQL clause in loadSearchRows) is a readonly tuple of
-    // string literals. Cast the array to readonly string[] so .includes()
-    // accepts arbitrary string scopes without a cast on the input (codex
-    // P0-2: casting `scope` would defeat the constant's safety).
-    if (RECALL_DEFAULT_DENY_SCOPES.includes(scope))
-        return false;
-    return true;
+    return !isRestrictedScope(scope);
 }
 /**
  * v1.25.0 — the CLI `--scope` variant of the recall filter (JS half of the
@@ -108,23 +97,49 @@ export function isRestrictedScope(scope) {
         return false;
     // SAFETY: RECALL_DEFAULT_DENY_SCOPES is a readonly tuple of string
     // literals; widening the array (not the input) lets .includes() take any scope.
-    return isPrivateScope(scope) || RECALL_DEFAULT_DENY_SCOPES.includes(scope);
+    // `:private:` anywhere, any case, matches the store's SQL default-deny (store.ts:894) so JS never admits what SQL hides.
+    return isPrivateScope(scope) || /:private:/i.test(scope) || RECALL_DEFAULT_DENY_SCOPES.includes(scope);
 }
-/**
- * Authorize an explicitly requested scope before any read honours it.
- *
- * An admin (tenant owner, the local CLI, loopback without a key) may unlock
- * any scope in its tenant. A member key may not unlock a restricted scope by
- * naming it: before this check, any key in a tenant could read every private
- * channel or repo by passing its scope string. Per-scope grants for member
- * keys belong to ROADMAP Part VIII EI2 (permission-aware recall).
- */
-export function assertScopeRequestAllowed(role, requested) {
+/** True when `actor` may read `scope`: admin always; member needs an exact grant on a restricted scope. */
+export function canReadScope(actor, scope) {
+    if (actor.role === 'admin')
+        return true;
+    if (!isRestrictedScope(scope))
+        return true;
+    return (actor.scopes ?? []).includes(scope);
+}
+/** Authorize an explicitly requested scope before any read honours it (ROADMAP Part VIII EI2: member scope grants). */
+export function assertScopeRequestAllowed(actor, requested) {
     if (requested === undefined || requested === '')
         return;
-    if (role === 'admin')
+    if (canReadScope(actor, requested))
         return;
-    if (isRestrictedScope(requested))
-        throw new ScopeForbiddenError(requested);
+    throw new ScopeForbiddenError(requested);
+}
+/** Scope a derived row keeps from one source: the restricted scope itself, else null. */
+export function derivationScope(scope) {
+    return isRestrictedScope(scope) ? (scope ?? null) : null;
+}
+/** The one derivation scope shared by every source, or `{ ok: false }` when
+ *  two disagree, so the caller skips the derived row instead of under-scoping it. */
+export function commonDerivationScope(scopes) {
+    let common = null;
+    let seen = false;
+    for (const raw of scopes) {
+        const scope = derivationScope(raw);
+        if (!seen) {
+            common = scope;
+            seen = true;
+        }
+        else if (scope !== common) {
+            return { ok: false };
+        }
+    }
+    return { ok: true, scope: common };
+}
+/** Map-partition key for consolidate/dag producers: tenant + derivation scope,
+ *  so a derived row never blends two restricted scopes or a mixed pair. */
+export function derivationPartitionKey(tenantId, scope) {
+    return `${tenantId}\u0000${derivationScope(scope) ?? ''}`;
 }
 //# sourceMappingURL=recall-scope.js.map

package/dist/reject-flow.d.ts

@@ -41,8 +41,8 @@ export interface RejectFlowResult {
  * normalized digest matches (kind-aware), one aggregate `reject_value`
  * audit, COMMIT. Then post-commit (mirrors the existing purge+reaper
  * pattern verbatim from api.archiveRaw, api.ts:1913-1938): best-effort
- * mirror purge per removed id, `mirror_cleaned_at` stamps for raw ids, one
- * index mirror rewrite.
+ * mirror purge per removed id, `mirror_cleaned_at` stamps for raw ids.
+ * index.json itself is only refreshed by `rebuildIndex()`.
  */
 export declare function rejectValue(opts: RejectFlowOpts): RejectFlowResult;
 export type UnrejectOutcome = {

package/dist/reject-flow.js

@@ -15,7 +15,7 @@ import { openHippoDb, closeHippoDb } from './db.js';
 import { appendAuditEvent } from './audit.js';
 import { archiveRawMemory } from './raw-archive.js';
 import { purgeDormantByDigest } from './dormant.js';
-import { initStore, deleteEntryCore, purgeMirrorBestEffort, writeIndexMirror, buildIndexFromDb, } from './store.js';
+import { initStore, deleteEntryCore, purgeMirrorBestEffort, } from './store.js';
 import { rejectionDigest, normalizeValueForRejection, insertRejectedValue, deleteRejectedValue, listRejectedValues, } from './rejection.js';
 /**
  * `hippo reject` / `api.reject` core flow. ONE connection, one transaction:
@@ -23,8 +23,8 @@ import { rejectionDigest, normalizeValueForRejection, insertRejectedValue, delet
  * normalized digest matches (kind-aware), one aggregate `reject_value`
  * audit, COMMIT. Then post-commit (mirrors the existing purge+reaper
  * pattern verbatim from api.archiveRaw, api.ts:1913-1938): best-effort
- * mirror purge per removed id, `mirror_cleaned_at` stamps for raw ids, one
- * index mirror rewrite.
+ * mirror purge per removed id, `mirror_cleaned_at` stamps for raw ids.
+ * index.json itself is only refreshed by `rebuildIndex()`.
  */
 export function rejectValue(opts) {
     if (!opts.reason.trim()) {
@@ -138,7 +138,7 @@ export function rejectValue(opts) {
         }
         // Post-commit, db handle still open (same pattern as api.archiveRaw):
         // best-effort mirror purge per removed id, reaper-backstop stamp for
-        // raw ids, one index mirror rewrite.
+        // raw ids.
         for (const id of removedIds) {
             // AT1 fix: purgeMirrorBestEffort retries once, then — for non-raw ids,
             // which cleanupArchivedMirrors' reaper never scans — reports the
@@ -150,9 +150,6 @@ export function rejectValue(opts) {
                 db.prepare(`UPDATE raw_archive SET mirror_cleaned_at = ? WHERE memory_id = ?`).run(new Date().toISOString(), id);
             }
         }
-        if (removedIds.length > 0) {
-            writeIndexMirror(opts.hippoRoot, buildIndexFromDb(db));
-        }
         return { digest, content, removedIds, removedRawIds };
     }
     finally {

package/dist/secret-detect.d.ts

@@ -38,4 +38,6 @@ export declare function detectSecret(entry: {
  * CS1 pre-compact snapshot fields — can scrub it in place instead.
  */
 export declare function redactSecrets(text: string): string;
+/** Stricter redaction for text that leaves the machine: no co-occurrence guard, plus Bearer headers and JWTs. */
+export declare function redactSecretsStrict(text: string): string;
 //# sourceMappingURL=secret-detect.d.ts.map

package/dist/secret-detect.js

@@ -48,6 +48,11 @@ const SECRET_PATTERNS = [
 ];
 const KEYISH_CONTEXT_RE = /key|token|secret|credential|bearer|auth|password/i;
 const CO_OCCURRENCE_GUARDED = new Set(['sk-style-key', 'sk-underscore-key']);
+// redactSecretsStrict-only: too noisy for whole-entry memory scanning, worth hiding once text leaves the machine.
+const STRICT_ONLY_PATTERNS = [
+    /\bbearer\s+[A-Za-z0-9._~+/-]{16,}=*/gi,
+    /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]*/g,
+];
 /**
  * Scan a memory's tags + content for secret material.
  * Pure and deterministic; no filesystem or store access.
@@ -75,21 +80,28 @@ export function detectSecret(entry) {
  * CS1 pre-compact snapshot fields — can scrub it in place instead.
  */
 export function redactSecrets(text) {
+    return redactText(text, false);
+}
+/** Stricter redaction for text that leaves the machine: no co-occurrence guard, plus Bearer headers and JWTs. */
+export function redactSecretsStrict(text) {
+    return redactText(text, true);
+}
+function redactText(text, strict) {
     if (!text)
         return text;
     let result = text;
-    // PEM/OpenSSH blocks first: the pattern-table entry matches only the
-    // BEGIN delimiter, which is fine for detectSecret's flag-or-not decision
-    // but would leave the base64 payload behind here. Consume through the
-    // matching END delimiter; a truncated block with no END is redacted to
-    // the end of the text (codex round 3).
+    // PEM/OpenSSH blocks first: SECRET_PATTERNS only matches BEGIN; consume through END, or to the end of a truncated block.
     result = result.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----(?:[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----|[\s\S]*$)/g, '[REDACTED]');
     for (const { name, re } of SECRET_PATTERNS) {
-        if (CO_OCCURRENCE_GUARDED.has(name) && !KEYISH_CONTEXT_RE.test(text))
+        if (!strict && CO_OCCURRENCE_GUARDED.has(name) && !KEYISH_CONTEXT_RE.test(text))
             continue;
         const flags = re.flags.includes('g') ? re.flags : `${re.flags}g`;
         result = result.replace(new RegExp(re.source, flags), '[REDACTED]');
     }
+    if (strict) {
+        for (const re of STRICT_ONLY_PATTERNS)
+            result = result.replace(re, '[REDACTED]');
+    }
     return result;
 }
 //# sourceMappingURL=secret-detect.js.map