hippo-memory 1.49.0 → 1.50.0

package/dist/api.d.ts

@@ -11,6 +11,7 @@ import { deleteEntry, loadAllEntries, type TaskSnapshot, type SessionEvent } fro
 import { type RejectedValueRow } from './rejection.js';
 import { type DormantMemory, type ListDormantOpts } from './dormant.js';
 import { type TokenSummary, type TokenSurface } from './token-ledger.js';
+import { type QuarantineStatus } from './quarantine.js';
 import { type FailureSummary } from './failure-log.js';
 import { type SessionHandoff } from './handoff.js';
 import { type MemoryKind, type MemoryEntry } from './memory.js';
@@ -110,11 +111,17 @@ export interface RememberOpts {
      * back and the error is rethrown.
      */
     afterWrite?: (db: DatabaseSyncLike, memoryId: string) => void;
+    /** CD5: connector-ingested content an agent doesn't control; gates detectInstruction. CLI/HTTP/MCP never set this. */
+    untrusted?: boolean;
 }
 export interface RememberResult {
     id: string;
     kind: MemoryKind;
     tenantId: string;
+    /** Set only when untrusted content was flagged and quarantined instead of stored under its requested scope. */
+    quarantined?: {
+        reason: string;
+    };
 }
 export declare function remember(ctx: Context, opts: RememberOpts): RememberResult;
 export interface RecallOpts {
@@ -1061,6 +1068,25 @@ export declare function restoreDormant(ctx: Context, id: string): MemoryEntry;
 export declare function forgetDormant(ctx: Context, id: string): void;
 /** Whether the tenant holds a dormant memory with this id (for "not found" hints). */
 export declare function isDormant(ctx: Context, id: string): boolean;
+export interface QuarantineListItem {
+    id: string;
+    originalScope: string | null;
+    reason: string;
+    status: QuarantineStatus;
+    quarantinedAt: string;
+    decidedAt: string | null;
+    decidedBy: string | null;
+    contentPreview: string;
+}
+/** A tenant's quarantined memories, newest first. Default `status` is 'pending' (the review queue). */
+export declare function quarantineList(ctx: Context, opts?: {
+    status?: QuarantineStatus | 'all';
+    limit?: number;
+}): QuarantineListItem[];
+/** Release a quarantined memory to its original scope. Admin only; the scope guard refuses a row moved since (mirrors restoreDormant). */
+export declare function quarantineApprove(ctx: Context, id: string): void;
+/** Keep a quarantined memory hidden for good. Admin only; the raw row is untouched (append-only). */
+export declare function quarantineReject(ctx: Context, id: string): void;
 export interface SleepResult {
     active: number;
     removed: number;

package/dist/api.js

@@ -13,6 +13,8 @@ import { RejectedValueError } from './rejection.js';
 import { rejectValue, unrejectValue, listRejectionsForTenant } from './reject-flow.js';
 import { listDormantRows, readDormantSnapshot, deleteDormantRow, hasDormantRow, } from './dormant.js';
 import { recordTokenUse, summarizeTokenUse } from './token-ledger.js';
+import { detectInstruction } from './instruction-detect.js';
+import { quarantineScopeFor, recordQuarantine, getQuarantineRow, listQuarantineRows, approveQuarantineRow, rejectQuarantineRow, } from './quarantine.js';
 import { summarizeFailures } from './failure-log.js';
 import { formatHandoffEvidenceLine } from './handoff.js';
 import { createMemory, applyOutcome, calculateStrength, Layer, } from './memory.js';
@@ -140,9 +142,11 @@ function loadAmbientEntries(hippoRoot, tenantId, pinnedOnly, includeRecent, admi
     return loadAmbientCandidates(hippoRoot, tenantId, includeRecent, admitAmbient);
 }
 export function remember(ctx, opts) {
+    const detection = opts.untrusted ? detectInstruction(opts.content) : { flagged: false, reason: null };
+    const requestedScope = opts.scope ?? null;
     const entry = createMemory(opts.content, {
         kind: opts.kind ?? 'distilled',
-        scope: opts.scope ?? null,
+        scope: detection.flagged ? quarantineScopeFor(requestedScope) : requestedScope,
         owner: opts.owner ?? null,
         artifact_ref: opts.artifactRef ?? null,
         tags: opts.tags,
@@ -151,8 +155,23 @@ export function remember(ctx, opts) {
     });
     // writeEntry threads ctx.actor.subject into its internal audit hook, so exactly
     // one 'remember' event lands in the log with the supplied actor.
-    writeEntry(ctx.hippoRoot, entry, { actor: ctx.actor.subject, afterWrite: opts.afterWrite });
-    return { id: entry.id, kind: entry.kind, tenantId: ctx.tenantId };
+    const afterWrite = detection.flagged
+        ? (db, memoryId) => {
+            recordQuarantine(db, {
+                tenantId: ctx.tenantId,
+                memoryId,
+                originalScope: requestedScope,
+                reason: detection.reason ?? 'unknown',
+                actor: ctx.actor.subject,
+            });
+            opts.afterWrite?.(db, memoryId);
+        }
+        : opts.afterWrite;
+    writeEntry(ctx.hippoRoot, entry, { actor: ctx.actor.subject, afterWrite });
+    const result = { id: entry.id, kind: entry.kind, tenantId: ctx.tenantId };
+    if (detection.flagged)
+        result.quarantined = { reason: detection.reason ?? 'unknown' };
+    return result;
 }
 /**
  * Shared construction helper for `RecallSuppressionSummary`. Used by
@@ -2090,6 +2109,118 @@ export function isDormant(ctx, id) {
         closeHippoDb(db);
     }
 }
+const QUARANTINE_PREVIEW_CHARS = 200;
+/** A tenant's quarantined memories, newest first. Default `status` is 'pending' (the review queue). */
+export function quarantineList(ctx, opts = {}) {
+    const db = openHippoDb(ctx.hippoRoot);
+    try {
+        const rows = listQuarantineRows(db, ctx.tenantId, opts.status ?? 'pending', opts.limit);
+        return rows.map((row) => {
+            const entry = readEntry(ctx.hippoRoot, row.memoryId, ctx.tenantId);
+            return {
+                id: row.memoryId,
+                originalScope: row.originalScope,
+                reason: row.reason,
+                status: row.status,
+                quarantinedAt: row.quarantinedAt,
+                decidedAt: row.decidedAt,
+                decidedBy: row.decidedBy,
+                contentPreview: entry ? entry.content.slice(0, QUARANTINE_PREVIEW_CHARS) : '',
+            };
+        });
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+function loadPendingQuarantineRow(db, tenantId, id) {
+    const row = getQuarantineRow(db, tenantId, id);
+    if (!row)
+        throw new Error(`not quarantined: ${id}`);
+    if (row.status !== 'pending')
+        throw new Error(`${id} is already ${row.status}`);
+    return row;
+}
+/** Release a quarantined memory to its original scope. Admin only; the scope guard refuses a row moved since (mirrors restoreDormant). */
+export function quarantineApprove(ctx, id) {
+    if (ctx.actor.role !== 'admin') {
+        throw new ForbiddenError('Only an admin key can approve a quarantined memory');
+    }
+    const db = openHippoDb(ctx.hippoRoot);
+    try {
+        db.exec('BEGIN IMMEDIATE');
+        try {
+            const row = loadPendingQuarantineRow(db, ctx.tenantId, id);
+            const quarantineScope = quarantineScopeFor(row.originalScope);
+            const updated = db
+                .prepare(`UPDATE memories SET scope = ? WHERE id = ? AND tenant_id = ? AND scope = ?`)
+                .run(row.originalScope, id, ctx.tenantId, quarantineScope);
+            if (Number(updated.changes ?? 0) !== 1) {
+                throw new Error(`memory ${id} scope changed since quarantine; refusing to approve`);
+            }
+            approveQuarantineRow(db, ctx.tenantId, id, ctx.actor.subject);
+            appendAuditEvent(db, {
+                tenantId: ctx.tenantId,
+                actor: ctx.actor.subject,
+                op: 'quarantine_approve',
+                targetId: id,
+                metadata: { originalScope: row.originalScope },
+            });
+            db.exec('COMMIT');
+        }
+        catch (err) {
+            try {
+                db.exec('ROLLBACK');
+            }
+            catch { /* already rolled back */ }
+            throw err;
+        }
+    }
+    finally {
+        closeHippoDb(db);
+    }
+    // Post-commit, best-effort: a failed rewrite leaves the mirror showing the quarantine scope (fail-closed).
+    try {
+        const restored = readEntry(ctx.hippoRoot, id, ctx.tenantId);
+        if (restored)
+            writeEntryMirrors(ctx.hippoRoot, restored);
+    }
+    catch (err) {
+        console.error(`quarantine: mirror rewrite failed for ${id}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+/** Keep a quarantined memory hidden for good. Admin only; the raw row is untouched (append-only). */
+export function quarantineReject(ctx, id) {
+    if (ctx.actor.role !== 'admin') {
+        throw new ForbiddenError('Only an admin key can reject a quarantined memory');
+    }
+    const db = openHippoDb(ctx.hippoRoot);
+    try {
+        db.exec('BEGIN IMMEDIATE');
+        try {
+            loadPendingQuarantineRow(db, ctx.tenantId, id);
+            rejectQuarantineRow(db, ctx.tenantId, id, ctx.actor.subject);
+            appendAuditEvent(db, {
+                tenantId: ctx.tenantId,
+                actor: ctx.actor.subject,
+                op: 'quarantine_reject',
+                targetId: id,
+                metadata: {},
+            });
+            db.exec('COMMIT');
+        }
+        catch (err) {
+            try {
+                db.exec('ROLLBACK');
+            }
+            catch { /* already rolled back */ }
+            throw err;
+        }
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
 const DEFAULT_SLEEP_PHASES = {
     consolidate,
     deduplicateStore,

package/dist/audit.d.ts

@@ -16,7 +16,7 @@ export interface AuditResult {
 export declare function auditMemory(entry: MemoryEntry): AuditIssue | null;
 export declare function auditMemories(entries: MemoryEntry[]): AuditResult;
 export declare function isContentWorthStoring(content: string): boolean;
-export type AuditOp = 'remember' | 'recall' | 'promote' | 'supersede' | 'forget' | 'archive_raw' | 'auth_revoke' | 'auth_create' | 'outcome' | 'consolidate' | 'audit_prune' | 'summary_marked_dirty' | 'summary_marked_clean' | 'summary_rebuilt' | 'predict_create' | 'predict_close' | 'predict_baserate' | 'recall_autodebias_hint' | 'recall_autodebias_hint_no_class_match' | 'recall_autodebias_hint_tiebreak' | 'recall_anchor_detected_query_repeat' | 'recall_anchor_detected_memory_dominance' | 'recall_anchor_skipped_no_session' | 'recall_availability_detected' | 'decision_create' | 'decision_supersede' | 'decision_close' | 'incident_open' | 'incident_resolve' | 'incident_close' | 'process_create' | 'process_supersede' | 'process_close' | 'policy_create' | 'policy_supersede' | 'policy_close' | 'skill_create' | 'skill_supersede' | 'skill_close' | 'project_brief_create' | 'project_brief_supersede' | 'project_brief_close' | 'customer_note_create' | 'customer_note_supersede' | 'customer_note_close' | 'mv_rescue' | 'reject_value' | 'reject_refusal' | 'unreject_value' | 'half_life_migrate' | 'dormant_restore' | 'conflict_resolve' | 'auth_grant' | 'auth_ungrant';
+export type AuditOp = 'remember' | 'recall' | 'promote' | 'supersede' | 'forget' | 'archive_raw' | 'auth_revoke' | 'auth_create' | 'outcome' | 'consolidate' | 'audit_prune' | 'summary_marked_dirty' | 'summary_marked_clean' | 'summary_rebuilt' | 'predict_create' | 'predict_close' | 'predict_baserate' | 'recall_autodebias_hint' | 'recall_autodebias_hint_no_class_match' | 'recall_autodebias_hint_tiebreak' | 'recall_anchor_detected_query_repeat' | 'recall_anchor_detected_memory_dominance' | 'recall_anchor_skipped_no_session' | 'recall_availability_detected' | 'decision_create' | 'decision_supersede' | 'decision_close' | 'incident_open' | 'incident_resolve' | 'incident_close' | 'process_create' | 'process_supersede' | 'process_close' | 'policy_create' | 'policy_supersede' | 'policy_close' | 'skill_create' | 'skill_supersede' | 'skill_close' | 'project_brief_create' | 'project_brief_supersede' | 'project_brief_close' | 'customer_note_create' | 'customer_note_supersede' | 'customer_note_close' | 'mv_rescue' | 'reject_value' | 'reject_refusal' | 'unreject_value' | 'half_life_migrate' | 'dormant_restore' | 'conflict_resolve' | 'auth_grant' | 'auth_ungrant' | 'quarantine' | 'quarantine_approve' | 'quarantine_reject';
 export interface AppendAuditOpts {
     tenantId: string;
     actor: string;

package/dist/cli.js

@@ -3897,6 +3897,56 @@ function cmdDormant(hippoRoot, args, flags) {
     }
     console.log('Bring one back: hippo dormant restore <id>   Delete for good: hippo dormant forget <id>');
 }
+/** `hippo quarantine [list] [--all] [--json] [--global]`, `quarantine approve <id>`, `quarantine reject <id>` (CD5 poisoning defence). */
+function cmdQuarantine(hippoRoot, args, flags) {
+    const root = resolveAuthRoot(hippoRoot, flags);
+    const ctx = {
+        hippoRoot: root,
+        tenantId: resolveTenantId({}),
+        actor: api.adminActor('cli'),
+    };
+    const sub = args[0];
+    if (sub === 'approve' || sub === 'reject') {
+        const id = (args[1] ?? '').trim();
+        if (!id) {
+            console.error(`Usage: hippo quarantine ${sub} <id>`);
+            process.exit(1);
+        }
+        try {
+            if (sub === 'approve') {
+                api.quarantineApprove(ctx, id);
+                console.log(`Approved ${id}: restored to its original scope.`);
+            }
+            else {
+                api.quarantineReject(ctx, id);
+                console.log(`Rejected ${id}: stays quarantined.`);
+            }
+        }
+        catch (err) {
+            console.error(`Could not ${sub} ${id}: ${err instanceof Error ? err.message : String(err)}`);
+            process.exit(1);
+        }
+        return;
+    }
+    const status = flags['all'] ? 'all' : 'pending';
+    const rows = api.quarantineList(ctx, { status });
+    if (flags['json']) {
+        console.log(JSON.stringify({ quarantine: rows }, null, 2));
+        return;
+    }
+    if (rows.length === 0) {
+        console.log(status === 'all' ? 'No quarantined memories.' : 'No pending quarantined memories.');
+        return;
+    }
+    console.log(`${rows.length} quarantined memor${rows.length === 1 ? 'y' : 'ies'} (newest first):\n`);
+    for (const row of rows) {
+        console.log(`--- ${row.id} [${row.status}]`);
+        console.log(`    ${row.contentPreview}`);
+        console.log(`    ${row.reason}, original scope ${row.originalScope ?? '(none)'}, quarantined ${row.quarantinedAt.slice(0, 10)}`);
+        console.log('');
+    }
+    console.log('Approve: hippo quarantine approve <id>   Reject: hippo quarantine reject <id>');
+}
 /**
  * `hippo tokens [--days <n>] [--json] [--global]`: the token ledger
  * (ROADMAP TE0). Tokens of memory text handed to agents per surface, blocks
@@ -7979,6 +8029,9 @@ const VALID_AUDIT_OPS = new Set([
     'dormant_restore', // Dormant memories — emitted by api.restoreDormant; lockstep with AuditOp union + server.ts VALID_AUDIT_OPS
     'auth_grant', // EI2: emitted by api.authGrant; lockstep with AuditOp union + server.ts VALID_AUDIT_OPS
     'auth_ungrant', // EI2: emitted by api.authUngrant; lockstep with AuditOp union + server.ts VALID_AUDIT_OPS
+    'quarantine', // CD5: emitted by recordQuarantine; lockstep with AuditOp union + server.ts VALID_AUDIT_OPS
+    'quarantine_approve', // CD5: emitted by api.quarantineApprove; lockstep
+    'quarantine_reject', // CD5: emitted by api.quarantineReject; lockstep
 ]);
 function formatAuditRow(ev) {
     const target = ev.targetId ?? '-';
@@ -8721,6 +8774,12 @@ Commands:
     --global               Operate on the global store
     dormant restore <id>   Bring a dormant memory back to active memory
     dormant forget <id>    Delete a dormant memory permanently
+  quarantine [list]        List memories a connector flagged as an instruction attempt, pending review
+    --all                  Include approved and rejected rows too (default: pending only)
+    --json                 Output as JSON
+    --global               Operate on the global store
+    quarantine approve <id> Restore a quarantined memory to its original scope
+    quarantine reject <id>  Keep a quarantined memory hidden for good
   capture-error            Store a failed tool call as an error memory (reads the Claude Code
                            PostToolUseFailure hook payload on stdin; skips routine failures)
   doctor                   Check the install: Node, store, schema, sleep, agent hooks
@@ -9478,6 +9537,9 @@ async function main(command, args, flags, hippoRoot) {
         case 'dormant':
             cmdDormant(hippoRoot, args, flags);
             break;
+        case 'quarantine':
+            cmdQuarantine(hippoRoot, args, flags);
+            break;
         case 'tokens':
             cmdTokens(hippoRoot, flags);
             break;

package/dist/connectors/github/ingest.js

@@ -108,6 +108,7 @@ export function ingestEvent(ctx, input) {
         // v1.12.0: drop the legacy `|| 'connector:github'` fallback (see slack/ingest.ts:73 for rationale).
         const result = remember(ctx, {
             ...opts,
+            untrusted: true,
             afterWrite: (innerDb, memoryId) => {
                 if (input.__testInjectBeforeLog) {
                     input.__testInjectBeforeLog(innerDb, idempotencyKey);

package/dist/connectors/slack/ingest.js

@@ -61,6 +61,7 @@ export function ingestMessage(ctx, input) {
         // ever missing); explicit reliance on the caller is safer.
         const result = remember(ctx, {
             ...opts,
+            untrusted: true,
             afterWrite: (innerDb, memoryId) => {
                 const inserted = innerDb
                     .prepare(`INSERT OR IGNORE INTO slack_event_log (event_id, ingested_at, memory_id) VALUES (?, ?, ?)`)

package/dist/consolidate.js

@@ -26,6 +26,7 @@ import { MEMORY_VALUE_WEIGHTS, SOURCE_ARTIFACT_SHA256 } from './memory-value-wei
 import { appendAuditEvent } from './audit.js';
 import { migrateDefaultHalfLife } from './half-life-migration.js';
 import { derivationScope, commonDerivationScope, derivationPartitionKey } from './recall-scope.js';
+import { isQuarantineScope } from './quarantine.js';
 const DECAY_THRESHOLD = 0.05;
 const MERGE_OVERLAP_THRESHOLD = 0.35; // Jaccard similarity for "related"
 const MERGE_MIN_CLUSTER = 2; // minimum cluster size to merge
@@ -945,6 +946,8 @@ function detectConflicts(entries, now, decayOpts = {},
 // Default empty set: flag-off behavior is unchanged.
 rescuedIds = new Set()) {
     const survivors = entries.filter((entry) => entry.layer !== Layer.Semantic
+        // CD5: an unreviewed quarantined row must not taint a visible memory as conflicted.
+        && !isQuarantineScope(entry.scope ?? null)
         && (rescuedIds.has(entry.id) || calculateStrength(entry, now, decayOpts) >= DECAY_THRESHOLD));
     const detected = [];
     for (let i = 0; i < survivors.length; i++) {

package/dist/db.js

@@ -11,7 +11,7 @@ const require = createRequire(import.meta.url);
 // runtime (Node's built-in synchronous SQLite module); there are no bundled
 // types for it here, so this require + cast is the module's documented boundary.
 const { DatabaseSync } = require('node:sqlite');
-const CURRENT_SCHEMA_VERSION = 47;
+const CURRENT_SCHEMA_VERSION = 48;
 const MIGRATIONS = [
     {
         version: 1,
@@ -2463,6 +2463,14 @@ const MIGRATIONS = [
       `);
         },
     },
+    {
+        version: 48,
+        up: (db) => {
+            // Quarantine (src/quarantine.ts, CD5): a poisoned or suspect memory sits here pending
+            // admin review instead of being hidden with no record. Additive only: no min_compatible_binary bump.
+            db.exec(MEMORY_QUARANTINE_DDL);
+        },
+    },
 ];
 function tableHasColumn(db, tableName, columnName) {
     if (!/^[a-z_]+$/i.test(tableName))
@@ -2628,6 +2636,22 @@ function setSchemaVersion(db, version) {
     db.prepare(`INSERT INTO meta(key, value) VALUES('schema_version', ?) ON CONFLICT(key) DO UPDATE SET value=excluded.value`).run(String(version));
     db.exec(`PRAGMA user_version = ${Math.max(0, Math.trunc(version))}`);
 }
+// Shared by migration v48 and the stamped-store self-heal below.
+const MEMORY_QUARANTINE_DDL = `
+    CREATE TABLE IF NOT EXISTS memory_quarantine (
+      tenant_id      TEXT NOT NULL DEFAULT 'default',
+      memory_id      TEXT NOT NULL,
+      original_scope TEXT,
+      reason         TEXT NOT NULL,
+      status         TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending','approved','rejected')),
+      quarantined_at TEXT NOT NULL,
+      decided_at     TEXT,
+      decided_by     TEXT,
+      PRIMARY KEY (tenant_id, memory_id)
+    ) WITHOUT ROWID;
+    CREATE INDEX IF NOT EXISTS idx_memory_quarantine_status
+      ON memory_quarantine(tenant_id, status, quarantined_at DESC);
+`;
 // Before the loop on stamped stores: a table lost after its migration stamped (2026-08-15
 // incident) is never re-migrated, and v4/v16/v22 ALTER or read it. Fresh stores use the chain.
 function ensureContinuityTables(db) {
@@ -2729,6 +2753,7 @@ function ensureContinuityTables(db) {
       tenant_id TEXT NOT NULL DEFAULT 'default'
     )
   `);
+    db.exec(MEMORY_QUARANTINE_DDL);
 }
 // After the loop: tenant_id (v16) and scope (v23) do not exist yet on a genuine old store.
 function ensureContinuityIndexes(db) {

package/dist/instruction-detect.d.ts

@@ -0,0 +1,7 @@
+/** Prompt-injection detection for untrusted memory content (CD5). Same shape as secret-detect.ts; leaf module, no store/api/shared imports. */
+export interface InstructionDetection {
+    flagged: boolean;
+    reason: string | null;
+}
+export declare function detectInstruction(content: string): InstructionDetection;
+//# sourceMappingURL=instruction-detect.d.ts.map

package/dist/instruction-detect.js

@@ -0,0 +1,27 @@
+/** Prompt-injection detection for untrusted memory content (CD5). Same shape as secret-detect.ts; leaf module, no store/api/shared imports. */
+const INSTRUCTION_PATTERNS = [
+    { name: 'override-instructions', re: /\b(?:ignore|disregard|forget)\b[^.\n]{0,40}\b(?:previous|prior|above)\b[^.\n]{0,40}\binstructions?\b/i },
+    { name: 'role-reassignment', re: /\b(?:you are now|act as|pretend to be)\b[^.\n]{0,40}\b(?:an?\s+)?(?:ai|assistant|agent|system)\b/i },
+    { name: 'chat-role-markup', re: /<\|im_start\|>|<\|system\|>|\[INST\]|<\/?system>|###\s*system\s*:/i },
+    { name: 'system-prompt-reference', re: /\b(?:(?:override|ignore|bypass|replace|reveal)\b[^.\n]{0,40}\b(?:system prompt|developer message)|(?:system prompt|developer message)\b[^.\n]{0,40}\b(?:override|ignore|bypass|replace|reveal))\b/i },
+    // "always"/"never" alone (ordinary PR prose) doesn't flag without an agent-facing target nearby too.
+    { name: 'standing-order', re: /\b(?:from now on|whenever you|always|never)\b[^.\n]{0,50}\b(?:you must|(?:the ai|the assistant|the agent|claude|copilot)\s+(?:must|should|will)\b)/i },
+    { name: 'concealment', re: /\b(?:do not|never|don't)\b[^.\n]{0,40}\b(?:tell|mention|reveal)\b[^.\n]{0,40}\bthe user\b/i },
+    { name: 'remote-script-exec', re: /\b(?:curl|wget)\b[^\n|]{0,80}\|\s*(?:sudo\s+)?(?:sh|bash|zsh)\b|\biex\s*\(\s*(?:iwr|invoke-webrequest|new-object\s+net\.webclient)/i },
+    { name: 'exfiltration', re: /\b(?:send|post|upload|exfiltrate)\b[^.\n]{0,40}\b(?:secrets?|tokens?|api[- ]?keys?|credentials?|env(?:ironment)? variables?)\b/i },
+    { name: 'unicode-tag-chars', re: /[\u{E0000}-\u{E007F}]/u },
+];
+// A stray zero-width char has legitimate uses (ZWJ); only a run of 3+ adjacent ones reads as smuggling.
+const ZERO_WIDTH_RUN_RE = /[\u200B-\u200F\u2060-\u2064]{3,}/;
+export function detectInstruction(content) {
+    for (const { name, re } of INSTRUCTION_PATTERNS) {
+        if (re.test(content)) {
+            return { flagged: true, reason: `pattern:${name}` };
+        }
+    }
+    if (ZERO_WIDTH_RUN_RE.test(content)) {
+        return { flagged: true, reason: 'pattern:zero-width-smuggling' };
+    }
+    return { flagged: false, reason: null };
+}
+//# sourceMappingURL=instruction-detect.js.map

package/dist/quarantine.d.ts

@@ -0,0 +1,31 @@
+/** Quarantine tier (CD5, AT3): pending/approved/rejected record for a memory `remember` flagged as untrusted. */
+import type { DatabaseSyncLike } from './db.js';
+export declare const QUARANTINE_SCOPE_PREFIX = "quarantine:private:";
+/** Scope a quarantined memory is stored under; matches PRIVATE_SCOPE_RE so every default-deny site hides it. */
+export declare function quarantineScopeFor(original: string | null): string;
+export declare function isQuarantineScope(scope: string | null | undefined): boolean;
+export type QuarantineStatus = 'pending' | 'approved' | 'rejected';
+export interface QuarantineRow {
+    tenantId: string;
+    memoryId: string;
+    originalScope: string | null;
+    reason: string;
+    status: QuarantineStatus;
+    quarantinedAt: string;
+    decidedAt: string | null;
+    decidedBy: string | null;
+}
+export interface RecordQuarantineOpts {
+    tenantId: string;
+    memoryId: string;
+    originalScope: string | null;
+    reason: string;
+    actor: string;
+}
+/** Insert the quarantine row + its audit event; caller runs this inside the memory's own write transaction. */
+export declare function recordQuarantine(db: DatabaseSyncLike, opts: RecordQuarantineOpts): void;
+export declare function getQuarantineRow(db: DatabaseSyncLike, tenantId: string, memoryId: string): QuarantineRow | null;
+export declare function listQuarantineRows(db: DatabaseSyncLike, tenantId: string, status?: QuarantineStatus | 'all', limit?: number): QuarantineRow[];
+export declare function approveQuarantineRow(db: DatabaseSyncLike, tenantId: string, memoryId: string, decidedBy: string): void;
+export declare function rejectQuarantineRow(db: DatabaseSyncLike, tenantId: string, memoryId: string, decidedBy: string): void;
+//# sourceMappingURL=quarantine.d.ts.map

package/dist/quarantine.js

@@ -0,0 +1,63 @@
+/** Quarantine tier (CD5, AT3): pending/approved/rejected record for a memory `remember` flagged as untrusted. */
+import { appendAuditEvent } from './audit.js';
+export const QUARANTINE_SCOPE_PREFIX = 'quarantine:private:';
+/** Scope a quarantined memory is stored under; matches PRIVATE_SCOPE_RE so every default-deny site hides it. */
+export function quarantineScopeFor(original) {
+    return `${QUARANTINE_SCOPE_PREFIX}${original ?? 'unscoped'}`;
+}
+export function isQuarantineScope(scope) {
+    return scope != null && scope.startsWith(QUARANTINE_SCOPE_PREFIX);
+}
+const SELECT_COLUMNS = 'tenant_id, memory_id, original_scope, reason, status, quarantined_at, decided_at, decided_by';
+function fromDbRow(row) {
+    return {
+        tenantId: row.tenant_id,
+        memoryId: row.memory_id,
+        originalScope: row.original_scope,
+        reason: row.reason,
+        // SAFETY: this module's own INSERT/UPDATE statements are the only writers of status.
+        status: row.status,
+        quarantinedAt: row.quarantined_at,
+        decidedAt: row.decided_at,
+        decidedBy: row.decided_by,
+    };
+}
+/** Insert the quarantine row + its audit event; caller runs this inside the memory's own write transaction. */
+export function recordQuarantine(db, opts) {
+    db.prepare(`INSERT INTO memory_quarantine (tenant_id, memory_id, original_scope, reason, status, quarantined_at)
+     VALUES (?, ?, ?, ?, 'pending', ?)`).run(opts.tenantId, opts.memoryId, opts.originalScope, opts.reason, new Date().toISOString());
+    appendAuditEvent(db, {
+        tenantId: opts.tenantId,
+        actor: opts.actor,
+        op: 'quarantine',
+        targetId: opts.memoryId,
+        metadata: { reason: opts.reason, originalScope: opts.originalScope },
+    });
+}
+export function getQuarantineRow(db, tenantId, memoryId) {
+    const row = db.prepare(`SELECT ${SELECT_COLUMNS} FROM memory_quarantine WHERE tenant_id = ? AND memory_id = ?`)
+        .get(tenantId, memoryId);
+    return row ? fromDbRow(row) : null;
+}
+export function listQuarantineRows(db, tenantId, status = 'pending', limit = 100) {
+    // A pending row whose memory was deleted (e.g. Slack message_deleted) is dead; keep its history, drop it from the queue.
+    const live = status === 'pending'
+        ? ' AND EXISTS (SELECT 1 FROM memories m WHERE m.id = memory_quarantine.memory_id AND m.tenant_id = memory_quarantine.tenant_id)'
+        : '';
+    const rows = status === 'all'
+        ? db.prepare(`SELECT ${SELECT_COLUMNS} FROM memory_quarantine WHERE tenant_id = ? ORDER BY quarantined_at DESC LIMIT ?`)
+            .all(tenantId, limit)
+        : db.prepare(`SELECT ${SELECT_COLUMNS} FROM memory_quarantine WHERE tenant_id = ? AND status = ?${live} ORDER BY quarantined_at DESC LIMIT ?`)
+            .all(tenantId, status, limit);
+    // SAFETY: both branches select SELECT_COLUMNS, matching QuarantineDbRow's field set.
+    return rows.map(fromDbRow);
+}
+export function approveQuarantineRow(db, tenantId, memoryId, decidedBy) {
+    db.prepare(`UPDATE memory_quarantine SET status = 'approved', decided_at = ?, decided_by = ? WHERE tenant_id = ? AND memory_id = ?`)
+        .run(new Date().toISOString(), decidedBy, tenantId, memoryId);
+}
+export function rejectQuarantineRow(db, tenantId, memoryId, decidedBy) {
+    db.prepare(`UPDATE memory_quarantine SET status = 'rejected', decided_at = ?, decided_by = ? WHERE tenant_id = ? AND memory_id = ?`)
+        .run(new Date().toISOString(), decidedBy, tenantId, memoryId);
+}
+//# sourceMappingURL=quarantine.js.map

package/dist/server.js

@@ -22,7 +22,7 @@ export function __resetSessionRecallHistoryHttp() {
 import { PACKAGE_VERSION } from './version.js';
 import { validateApiKey } from './auth.js';
 import { createRateLimiter } from './rate-limit.js';
-import { remember, retrieve, RecallContractError, ForbiddenError, drillDown, assemble, forget, promote, supersede, archiveRaw, authCreate, authList, authRevoke, auditList, outcome, outcomeForLastRecall, getContext, sleep, adminActor, recordTokens, } from './api.js';
+import { remember, retrieve, RecallContractError, ForbiddenError, drillDown, assemble, forget, promote, supersede, archiveRaw, authCreate, authList, authRevoke, auditList, outcome, outcomeForLastRecall, getContext, sleep, adminActor, recordTokens, quarantineList, quarantineApprove, quarantineReject, } from './api.js';
 import { buildGraphModel } from './graph-view.js';
 import { MAX_ENTITY_NAME_LEN } from './graph.js';
 import { savePrediction, closePrediction, loadPredictionById, loadPredictionsByClass, loadOpenPredictions, computePredictionBaserate, VALID_CLOSURE_STATES, } from './predictions.js';
@@ -118,6 +118,9 @@ const VALID_AUDIT_OPS = new Set([
     'dormant_restore', // Dormant memories — emitted by api.restoreDormant; lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS
     'auth_grant', // EI2: emitted by api.authGrant; lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS
     'auth_ungrant', // EI2: emitted by api.authUngrant; lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS
+    'quarantine', // CD5: emitted by recordQuarantine; lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS
+    'quarantine_approve', // CD5: emitted by api.quarantineApprove; lockstep
+    'quarantine_reject', // CD5: emitted by api.quarantineReject; lockstep
 ]);
 // Cap on GET /v1/audit?limit=. Matches docs/api.md (when written) and is large
 // enough to dump a small deployment's full audit log without paginating, but
@@ -1163,6 +1166,61 @@ async function handleRequest(req, res, opts, startedAt, limiter) {
         sendJson(res, 200, result);
         return;
     }
+    // GET /v1/quarantine?status=: CD5 review queue. quarantineList carries no role gate itself, so it's checked here.
+    if (method === 'GET' && path === '/v1/quarantine') {
+        const ctx = buildContextWithAuth(req, opts.hippoRoot);
+        if (ctx.actor.role !== 'admin') {
+            throw new HttpError(403, '/v1/quarantine requires admin role');
+        }
+        const statusRaw = query.get('status');
+        let status = 'pending';
+        if (statusRaw !== null) {
+            if (statusRaw !== 'pending' && statusRaw !== 'approved' && statusRaw !== 'rejected' && statusRaw !== 'all') {
+                throw new HttpError(400, 'status must be one of: pending | approved | rejected | all');
+            }
+            status = statusRaw;
+        }
+        sendJson(res, 200, { quarantine: quarantineList(ctx, { status }) });
+        return;
+    }
+    // POST /v1/quarantine/:id/approve: admin only; ForbiddenError falls through to mapApiError's 403.
+    const quarantineApproveMatch = matchPath('/v1/quarantine/:id/approve', path);
+    if (method === 'POST' && quarantineApproveMatch) {
+        validateIdSegment(quarantineApproveMatch.id, 'memory id');
+        const ctx = buildContextWithAuth(req, opts.hippoRoot);
+        try {
+            quarantineApprove(ctx, quarantineApproveMatch.id);
+            sendJson(res, 200, { approved: quarantineApproveMatch.id });
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            if (msg.includes('not quarantined'))
+                throw new HttpError(404, msg);
+            if (msg.includes('is already') || msg.includes('scope changed'))
+                throw new HttpError(409, msg);
+            throw e;
+        }
+        return;
+    }
+    // POST /v1/quarantine/:id/reject: admin only; ForbiddenError falls through to mapApiError's 403.
+    const quarantineRejectMatch = matchPath('/v1/quarantine/:id/reject', path);
+    if (method === 'POST' && quarantineRejectMatch) {
+        validateIdSegment(quarantineRejectMatch.id, 'memory id');
+        const ctx = buildContextWithAuth(req, opts.hippoRoot);
+        try {
+            quarantineReject(ctx, quarantineRejectMatch.id);
+            sendJson(res, 200, { rejected: quarantineRejectMatch.id });
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            if (msg.includes('not quarantined'))
+                throw new HttpError(404, msg);
+            if (msg.includes('is already'))
+                throw new HttpError(409, msg);
+            throw e;
+        }
+        return;
+    }
     // GET /v1/audit?op=&since=&limit= — read audit events. All three filters
     // validated at the route boundary so an invalid value lands a 400 before
     // we hit the DB.

package/dist/shared.js

@@ -13,6 +13,7 @@ import { search, hybridSearch } from './search.js';
 import { evalNow } from './ablation.js';
 import { deriveOriginProject, classifyOriginProject, resolveGlobalRootDir } from './project-identity.js';
 import { detectSecret } from './secret-detect.js';
+import { isQuarantineScope } from './quarantine.js';
 import { RejectedValueError } from './rejection.js';
 import { embedMemory, embedAll } from './embeddings.js';
 /**
@@ -46,6 +47,10 @@ export function promoteToGlobal(localRoot, id, opts) {
     const entry = readEntry(localRoot, id, opts?.tenantId);
     if (!entry)
         throw new Error(`Memory not found: ${id}`);
+    // CD5: same veto as shareMemory; a promoted copy would have no quarantine record to review.
+    if (isQuarantineScope(entry.scope)) {
+        throw new Error(`Refusing to promote ${id}: it is quarantined pending review. Approve it first via 'hippo quarantine approve ${id}'.`);
+    }
     // v39 S4 producer veto: promote is a producer path to the global store
     // exactly like shareMemory - same hard rule (codex gating review P2).
     const promoteSecret = detectSecret(entry);
@@ -272,6 +277,10 @@ export function shareMemory(localRoot, id, options = {}) {
         throw new Error(`Refusing to share ${id} to the global store: content matches secret material (${secret.reason}). ` +
             `Secrets stay in their owning project's store.`);
     }
+    // CD5: a quarantined row is unreviewed input, not a lesson; sharing it would spread poison globally.
+    if (isQuarantineScope(entry.scope)) {
+        throw new Error(`Refusing to share ${id}: it is quarantined pending review. Approve it first via 'hippo quarantine approve ${id}'.`);
+    }
     const score = transferScore(entry);
     if (score < 0.3 && !options.force)
         return null;
@@ -385,6 +394,9 @@ export function autoShare(localRoot, options = {}) {
     // Build set of global content hashes to avoid duplicates
     const globalContentSet = new Set(globalEntries.map((e) => e.content.toLowerCase().trim().slice(0, 200)));
     const candidates = localEntries.filter((entry) => {
+        // CD5: shareMemory refuses quarantined rows; filtering here keeps sleep from aborting on one.
+        if (isQuarantineScope(entry.scope ?? null))
+            return false;
         const score = transferScore(entry);
         if (score < minScore)
             return false;

package/dist/version.d.ts

@@ -16,7 +16,7 @@
  * an ESM `import` can resolve cleanly, and a hardcoded constant survives
  * any packager that drops .json files.
  */
-export declare const PACKAGE_VERSION = "1.49.0";
+export declare const PACKAGE_VERSION = "1.50.0";
 /** Compares plain x.y.z versions, positive if a > b; tags throw so the rollback guard never misfires silently. */
 export declare function compareSemver(a: string, b: string): number;
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -16,7 +16,7 @@
  * an ESM `import` can resolve cleanly, and a hardcoded constant survives
  * any packager that drops .json files.
  */
-export const PACKAGE_VERSION = '1.49.0';
+export const PACKAGE_VERSION = '1.50.0';
 /** Compares plain x.y.z versions, positive if a > b; tags throw so the rollback guard never misfires silently. */
 export function compareSemver(a, b) {
     const parse = (v) => {

package/extensions/openclaw-plugin/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "hippo-memory",
   "name": "Hippo Memory",
   "description": "Biologically-inspired memory for AI agents. Decay by default, retrieval strengthening, sleep consolidation.",
-  "version": "1.49.0",
+  "version": "1.50.0",
 
   "configSchema": {
     "type": "object",

package/extensions/openclaw-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hippo-memory",
-  "version": "1.49.0",
+  "version": "1.50.0",
   "type": "module",
   "description": "Hippo Memory plugin for OpenClaw - biologically-inspired agent memory",
   "main": "index.ts",

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "hippo-memory",
   "name": "Hippo Memory",
   "description": "Biologically-inspired memory for AI agents. Decay by default, retrieval strengthening, sleep consolidation.",
-  "version": "1.49.0",
+  "version": "1.50.0",
   "configSchema": {
     "type": "object",
     "additionalProperties": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hippo-memory",
-  "version": "1.49.0",
+  "version": "1.50.0",
   "description": "Biologically-inspired memory for AI agents. Zero runtime deps, SQLite, MCP server, and an opt-in hosted TypeSafe Jev reranker. Decay, retrieval strengthening, consolidation.",
   "mcpName": "io.github.kitfunso/hippo-memory",
   "type": "module",