hippo-memory 1.48.0 → 1.50.0

package/dist/server.js

@@ -22,7 +22,7 @@ export function __resetSessionRecallHistoryHttp() {
 import { PACKAGE_VERSION } from './version.js';
 import { validateApiKey } from './auth.js';
 import { createRateLimiter } from './rate-limit.js';
-import { remember, retrieve, RecallContractError, ForbiddenError, drillDown, assemble, forget, promote, supersede, archiveRaw, authCreate, authList, authRevoke, auditList, outcome, outcomeForLastRecall, getContext, sleep, adminActor, recordTokens, } from './api.js';
+import { remember, retrieve, RecallContractError, ForbiddenError, drillDown, assemble, forget, promote, supersede, archiveRaw, authCreate, authList, authRevoke, auditList, outcome, outcomeForLastRecall, getContext, sleep, adminActor, recordTokens, quarantineList, quarantineApprove, quarantineReject, } from './api.js';
 import { buildGraphModel } from './graph-view.js';
 import { MAX_ENTITY_NAME_LEN } from './graph.js';
 import { savePrediction, closePrediction, loadPredictionById, loadPredictionsByClass, loadOpenPredictions, computePredictionBaserate, VALID_CLOSURE_STATES, } from './predictions.js';
@@ -116,6 +116,11 @@ const VALID_AUDIT_OPS = new Set([
     'conflict_resolve', // AT1 — emitted by resolveConflict on every resolution path; lockstep
     'half_life_migrate', // Decay default change — emitted by migrateDefaultHalfLife; lockstep with AuditOp union
     'dormant_restore', // Dormant memories — emitted by api.restoreDormant; lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS
+    'auth_grant', // EI2: emitted by api.authGrant; lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS
+    'auth_ungrant', // EI2: emitted by api.authUngrant; lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS
+    'quarantine', // CD5: emitted by recordQuarantine; lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS
+    'quarantine_approve', // CD5: emitted by api.quarantineApprove; lockstep
+    'quarantine_reject', // CD5: emitted by api.quarantineReject; lockstep
 ]);
 // Cap on GET /v1/audit?limit=. Matches docs/api.md (when written) and is large
 // enough to dump a small deployment's full audit log without paginating, but
@@ -469,6 +474,7 @@ function buildContextWithAuth(req, hippoRoot) {
                 actor: {
                     subject: `api_key:${result.keyId}`,
                     role: result.role,
+                    scopes: result.scopes,
                 },
             };
         }
@@ -1160,6 +1166,61 @@ async function handleRequest(req, res, opts, startedAt, limiter) {
         sendJson(res, 200, result);
         return;
     }
+    // GET /v1/quarantine?status=: CD5 review queue. quarantineList carries no role gate itself, so it's checked here.
+    if (method === 'GET' && path === '/v1/quarantine') {
+        const ctx = buildContextWithAuth(req, opts.hippoRoot);
+        if (ctx.actor.role !== 'admin') {
+            throw new HttpError(403, '/v1/quarantine requires admin role');
+        }
+        const statusRaw = query.get('status');
+        let status = 'pending';
+        if (statusRaw !== null) {
+            if (statusRaw !== 'pending' && statusRaw !== 'approved' && statusRaw !== 'rejected' && statusRaw !== 'all') {
+                throw new HttpError(400, 'status must be one of: pending | approved | rejected | all');
+            }
+            status = statusRaw;
+        }
+        sendJson(res, 200, { quarantine: quarantineList(ctx, { status }) });
+        return;
+    }
+    // POST /v1/quarantine/:id/approve: admin only; ForbiddenError falls through to mapApiError's 403.
+    const quarantineApproveMatch = matchPath('/v1/quarantine/:id/approve', path);
+    if (method === 'POST' && quarantineApproveMatch) {
+        validateIdSegment(quarantineApproveMatch.id, 'memory id');
+        const ctx = buildContextWithAuth(req, opts.hippoRoot);
+        try {
+            quarantineApprove(ctx, quarantineApproveMatch.id);
+            sendJson(res, 200, { approved: quarantineApproveMatch.id });
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            if (msg.includes('not quarantined'))
+                throw new HttpError(404, msg);
+            if (msg.includes('is already') || msg.includes('scope changed'))
+                throw new HttpError(409, msg);
+            throw e;
+        }
+        return;
+    }
+    // POST /v1/quarantine/:id/reject: admin only; ForbiddenError falls through to mapApiError's 403.
+    const quarantineRejectMatch = matchPath('/v1/quarantine/:id/reject', path);
+    if (method === 'POST' && quarantineRejectMatch) {
+        validateIdSegment(quarantineRejectMatch.id, 'memory id');
+        const ctx = buildContextWithAuth(req, opts.hippoRoot);
+        try {
+            quarantineReject(ctx, quarantineRejectMatch.id);
+            sendJson(res, 200, { rejected: quarantineRejectMatch.id });
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            if (msg.includes('not quarantined'))
+                throw new HttpError(404, msg);
+            if (msg.includes('is already'))
+                throw new HttpError(409, msg);
+            throw e;
+        }
+        return;
+    }
     // GET /v1/audit?op=&since=&limit= — read audit events. All three filters
     // validated at the route boundary so an invalid value lands a 400 before
     // we hit the DB.
@@ -1191,16 +1252,13 @@ async function handleRequest(req, res, opts, startedAt, limiter) {
             limit = parsed;
         }
         const ctx = buildContextWithAuth(req, opts.hippoRoot);
-        // D2 v1.12.10: optional ?tenant=<t> param. Defaults to ctx.tenantId
-        // (caller's own tenant). Lets admins query the '__host__' synthetic
-        // tenant where host-wide ops like 'consolidate' are recorded. Today
-        // the audit route inherits the auth gate on /v1/audit (Bearer auth);
-        // a future per-tenant authz check should ensure non-admin Bearers
-        // can only pass their own tenant_id here.
+        // ?tenant=<t> reads another tenant (e.g. '__host__' for consolidate rows); admin only.
         const tenantOverride = query.get('tenant');
-        const effectiveCtx = tenantOverride !== null && tenantOverride !== ''
-            ? { ...ctx, tenantId: tenantOverride }
-            : ctx;
+        const crossTenant = tenantOverride !== null && tenantOverride !== '' && tenantOverride !== ctx.tenantId;
+        if (crossTenant && ctx.actor.role !== 'admin') {
+            throw new HttpError(403, '/v1/audit?tenant= for another tenant requires admin role');
+        }
+        const effectiveCtx = crossTenant ? { ...ctx, tenantId: tenantOverride } : ctx;
         const result = auditList(effectiveCtx, { op, since, limit });
         sendJson(res, 200, result);
         return;
@@ -3021,6 +3079,7 @@ async function handleRequest(req, res, opts, startedAt, limiter) {
                 actor: ctx.actor.subject,
                 // The caller's real role: MCP tools must not run a member key as admin.
                 role: ctx.actor.role,
+                scopes: ctx.actor.scopes,
                 clientKey: buildMcpClientKey(req),
             });
         }

package/dist/shared.js

@@ -13,6 +13,7 @@ import { search, hybridSearch } from './search.js';
 import { evalNow } from './ablation.js';
 import { deriveOriginProject, classifyOriginProject, resolveGlobalRootDir } from './project-identity.js';
 import { detectSecret } from './secret-detect.js';
+import { isQuarantineScope } from './quarantine.js';
 import { RejectedValueError } from './rejection.js';
 import { embedMemory, embedAll } from './embeddings.js';
 /**
@@ -46,6 +47,10 @@ export function promoteToGlobal(localRoot, id, opts) {
     const entry = readEntry(localRoot, id, opts?.tenantId);
     if (!entry)
         throw new Error(`Memory not found: ${id}`);
+    // CD5: same veto as shareMemory; a promoted copy would have no quarantine record to review.
+    if (isQuarantineScope(entry.scope)) {
+        throw new Error(`Refusing to promote ${id}: it is quarantined pending review. Approve it first via 'hippo quarantine approve ${id}'.`);
+    }
     // v39 S4 producer veto: promote is a producer path to the global store
     // exactly like shareMemory - same hard rule (codex gating review P2).
     const promoteSecret = detectSecret(entry);
@@ -272,6 +277,10 @@ export function shareMemory(localRoot, id, options = {}) {
         throw new Error(`Refusing to share ${id} to the global store: content matches secret material (${secret.reason}). ` +
             `Secrets stay in their owning project's store.`);
     }
+    // CD5: a quarantined row is unreviewed input, not a lesson; sharing it would spread poison globally.
+    if (isQuarantineScope(entry.scope)) {
+        throw new Error(`Refusing to share ${id}: it is quarantined pending review. Approve it first via 'hippo quarantine approve ${id}'.`);
+    }
     const score = transferScore(entry);
     if (score < 0.3 && !options.force)
         return null;
@@ -385,6 +394,9 @@ export function autoShare(localRoot, options = {}) {
     // Build set of global content hashes to avoid duplicates
     const globalContentSet = new Set(globalEntries.map((e) => e.content.toLowerCase().trim().slice(0, 200)));
     const candidates = localEntries.filter((entry) => {
+        // CD5: shareMemory refuses quarantined rows; filtering here keeps sleep from aborting on one.
+        if (isQuarantineScope(entry.scope ?? null))
+            return false;
         const score = transferScore(entry);
         if (score < minScore)
             return false;

package/dist/version.d.ts

@@ -16,7 +16,7 @@
  * an ESM `import` can resolve cleanly, and a hardcoded constant survives
  * any packager that drops .json files.
  */
-export declare const PACKAGE_VERSION = "1.48.0";
+export declare const PACKAGE_VERSION = "1.50.0";
 /** Compares plain x.y.z versions, positive if a > b; tags throw so the rollback guard never misfires silently. */
 export declare function compareSemver(a: string, b: string): number;
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -16,7 +16,7 @@
  * an ESM `import` can resolve cleanly, and a hardcoded constant survives
  * any packager that drops .json files.
  */
-export const PACKAGE_VERSION = '1.48.0';
+export const PACKAGE_VERSION = '1.50.0';
 /** Compares plain x.y.z versions, positive if a > b; tags throw so the rollback guard never misfires silently. */
 export function compareSemver(a, b) {
     const parse = (v) => {

package/extensions/openclaw-plugin/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "hippo-memory",
   "name": "Hippo Memory",
   "description": "Biologically-inspired memory for AI agents. Decay by default, retrieval strengthening, sleep consolidation.",
-  "version": "1.48.0",
+  "version": "1.50.0",
 
   "configSchema": {
     "type": "object",

package/extensions/openclaw-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hippo-memory",
-  "version": "1.48.0",
+  "version": "1.50.0",
   "type": "module",
   "description": "Hippo Memory plugin for OpenClaw - biologically-inspired agent memory",
   "main": "index.ts",

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "hippo-memory",
   "name": "Hippo Memory",
   "description": "Biologically-inspired memory for AI agents. Decay by default, retrieval strengthening, sleep consolidation.",
-  "version": "1.48.0",
+  "version": "1.50.0",
   "configSchema": {
     "type": "object",
     "additionalProperties": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hippo-memory",
-  "version": "1.48.0",
+  "version": "1.50.0",
   "description": "Biologically-inspired memory for AI agents. Zero runtime deps, SQLite, MCP server, and an opt-in hosted TypeSafe Jev reranker. Decay, retrieval strengthening, consolidation.",
   "mcpName": "io.github.kitfunso/hippo-memory",
   "type": "module",