hippo-memory 1.52.2 → 1.52.3

package/README.md

@@ -628,7 +628,7 @@ hippo watch "npm run build"
 | `hippo dormant [<query>]` | List faded memories sleep kept instead of deleting |
 | `hippo dormant restore <id>` | Bring a dormant memory back to active memory |
 | `hippo dormant forget <id>` | Delete a dormant memory permanently |
-| `hippo doctor [--json]` | Check the install: Node, store, schema, sleep, agent hooks; each problem names its fix |
+| `hippo doctor [--json]` | Check the install: Node, store, schema, sleep, agent hooks; each problem names its fix. It never changes `hippo.db`, though SQLite may leave empty `hippo.db-wal` and `hippo.db-shm` files beside it |
 | `hippo support-bundle [--out <file>] [--include-logs]` | Write a redacted JSON file for a support ticket: versions, doctor checks, config, store counts and log names, never memory text; `--include-logs` adds each log's last 200 lines, which can quote it |
 | `hippo tokens [--days n]` | Estimated tokens of memory text handed to agents, per surface, and what skipping unchanged hook blocks saved |
 | `hippo failures [--days n]` | Failed tool calls the capture-error hook saw, by outcome, and how many errors first happened in another session |
@@ -963,6 +963,12 @@ The interesting problems:
 - **MemPalace-style spatial organization.** Could spatial structure (wings/halls/rooms) improve hippo's semantic layer?
 - **AAAK-style compression for semantic memories.** Lossless token compression for context injection.
 
+## Open source and commercial
+
+Hippo is open core, and the line is drawn by who pays. Everything an individual developer or a self-hosted team needs is in this repository under MIT: the CLI, the MCP server, hooks, connectors, the dashboard, tenants, API keys, roles, per-key scope grants, the audit log and zero-touch memory. Code published here stays MIT and stays here.
+
+A commercial edition for larger companies ships as a separate package under a commercial licence from KITFUNSO LTD. It adds SSO (OIDC and SAML sign-in), SCIM, an org admin view, the pilot report and telemetry join, SIEM export of the audit log, offline licence keys, hosted SaaS, and support with an SLA. Pull requests for those features belong there, not here; see [CONTRIBUTING.md](CONTRIBUTING.md).
+
 ## License
 
 MIT

package/dist/secret-detect.d.ts

@@ -38,6 +38,6 @@ export declare function detectSecret(entry: {
  * CS1 pre-compact snapshot fields — can scrub it in place instead.
  */
 export declare function redactSecrets(text: string): string;
-/** Stricter redaction for text that leaves the machine: no co-occurrence guard, plus Bearer headers and JWTs. */
+/** Stricter redaction for text that leaves the machine: no co-occurrence guard, plus Bearer and Basic auth headers and JWTs. */
 export declare function redactSecretsStrict(text: string): string;
 //# sourceMappingURL=secret-detect.d.ts.map

package/dist/secret-detect.js

@@ -28,6 +28,13 @@ const SECRET_PATTERNS = [
     { name: 'slack-token', re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/ },
     { name: 'stripe-key', re: /\b[sr]k_(?:live|test)_[A-Za-z0-9]{16,}\b/ },
     { name: 'google-api-key', re: /\bAIza[0-9A-Za-z_-]{35}\b/ },
+    // hk_ is hippo's own API key (src/auth.ts); npm, Hugging Face, GitLab and Slack webhook shapes follow gitleaks' rules.
+    { name: 'hippo-api-key', re: /\bhk_[a-z2-7]{24}\.[a-z2-7]{32}\b/ },
+    { name: 'npm-token', re: /\bnpm_[A-Za-z0-9]{36}\b/ },
+    { name: 'huggingface-token', re: /\bhf_[A-Za-z]{34}\b/ },
+    { name: 'gitlab-token', re: /\bglpat-[\w-]{20,}/ },
+    { name: 'google-oauth-token', re: /\bya29\.[\w-]{20,}/ },
+    { name: 'slack-webhook', re: /\bhooks\.slack\.com\/(?:services|workflows|triggers)\/[A-Za-z0-9+/]{43,56}/ },
     { name: 'private-key-block', re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
     // sk-... (OpenAI/Anthropic style) and sk_<vendor>_... shapes. Both require
     // a key-ish noun somewhere in the content (co-occurrence guard) so prose
@@ -51,6 +58,7 @@ const CO_OCCURRENCE_GUARDED = new Set(['sk-style-key', 'sk-underscore-key']);
 // redactSecretsStrict-only: too noisy for whole-entry memory scanning, worth hiding once text leaves the machine.
 const STRICT_ONLY_PATTERNS = [
     /\bbearer\s+[A-Za-z0-9._~+/-]{16,}=*/gi,
+    /\bauthorization["']?\s*[:=]\s*["']?basic\s+[A-Za-z0-9+/]{8,}={0,2}/gi,
     /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]*/g,
 ];
 /**
@@ -82,7 +90,7 @@ export function detectSecret(entry) {
 export function redactSecrets(text) {
     return redactText(text, false);
 }
-/** Stricter redaction for text that leaves the machine: no co-occurrence guard, plus Bearer headers and JWTs. */
+/** Stricter redaction for text that leaves the machine: no co-occurrence guard, plus Bearer and Basic auth headers and JWTs. */
 export function redactSecretsStrict(text) {
     return redactText(text, true);
 }

package/dist/support-bundle.js

@@ -1,7 +1,8 @@
-/** `hippo support-bundle`: one redacted JSON snapshot for a support ticket. Read-only; never touches memory content. */
+/** `hippo support-bundle`: one redacted JSON snapshot for a support ticket. Read-only (SQLite may leave empty -wal and -shm files); never touches memory content. */
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
+import { pathToFileURL } from 'url';
 import { findHippoStoreDir, isGlobalStoreRoot, realpathOrResolve } from './project-identity.js';
 import { getGlobalRoot } from './shared.js';
 import { isInitialized } from './store.js';
@@ -189,18 +190,11 @@ function nativeRealPathKey(p) {
         return null;
     }
 }
-// Longest first: where one home form nests in another (a test home under the real one), swap the longer.
-function collectHomeForms(home, probes) {
-    const forms = new Set();
-    const add = (s) => { if (s.length >= 3)
-        forms.add(s); };
+function collectHomeAliases(home, probes) {
+    const aliases = new Set();
     for (const base of [home, realpathOrResolve(home), os.homedir(), realpathOrResolve(os.homedir())]) {
-        add(base);
-        add(path.resolve(base));
-        if (process.platform === 'win32') {
-            add(base.replace(/\\/g, '/'));
-            add(path.resolve(base).replace(/\\/g, '/'));
-        }
+        aliases.add(base);
+        aliases.add(path.resolve(base));
     }
     // The alias (e.g. a short-name temp root) can sit above the probe itself, so walk ancestors and
     // compare native realpaths rather than checking each probe alone.
@@ -209,34 +203,56 @@ function collectHomeForms(home, probes) {
         let dir = path.resolve(probe);
         for (;;) {
             const key = nativeRealPathKey(dir);
-            if (key !== null && homeKeys.has(key)) {
-                add(dir);
-                if (process.platform === 'win32')
-                    add(dir.replace(/\\/g, '/'));
-            }
+            if (key !== null && homeKeys.has(key))
+                aliases.add(dir);
             const parent = path.dirname(dir);
             if (parent === dir)
                 break;
             dir = parent;
         }
     }
-    const seen = new Set();
-    const deduped = [];
-    for (const f of [...forms].sort((a, b) => b.length - a.length)) {
-        const key = process.platform === 'win32' ? f.toLowerCase() : f;
-        if (seen.has(key))
-            continue;
-        seen.add(key);
-        deduped.push(f);
-    }
-    return deduped;
+    return aliases;
+}
+// Node's own encoding, so it matches file URLs and ESM stack frames; a drive path's URL gains a leading slash.
+function fileUrlPath(p) {
+    const pathname = pathToFileURL(p).pathname;
+    return /^\/[A-Za-z]:/.test(pathname) ? pathname.slice(1) : pathname;
+}
+// A home turns up as a path, as a file URL's percent-encoded path, and as a Claude Code project folder name.
+const HOME_SPELLINGS = [
+    (p) => p,
+    fileUrlPath,
+    (p) => p.replace(/[^A-Za-z0-9]/g, '-'),
+];
+// A Windows separator can be written \, / or JSON-escaped (\\ in a log line quoting JSON), so any of them matches.
+function spellingPattern(spelling) {
+    if (process.platform !== 'win32')
+        return escapeRegExp(spelling);
+    return spelling.split(/[\\/]+/).map(escapeRegExp).join('(?:\\\\+|/)');
 }
-function replaceHomeForms(text, forms) {
-    if (forms.length === 0)
-        return text;
-    // Stop only before another name character: "<home> now" and "<home>." swap, a longer user name ("<home>ty") does not.
-    const re = new RegExp(`(?:${forms.map(escapeRegExp).join('|')})(?![\\p{L}\\p{N}_])`, process.platform === 'win32' ? 'giu' : 'gu');
-    return text.replace(re, '~');
+/** One pattern for every alias of the home in every spelling, or null when none is long enough to swap safely. */
+function buildHomePattern(home, probes) {
+    const spellings = new Set();
+    for (const alias of collectHomeAliases(home, probes)) {
+        for (const spell of HOME_SPELLINGS) {
+            const s = spell(alias);
+            if (s.length >= 3)
+                spellings.add(s);
+        }
+    }
+    // Longest first: where one home nests in another (a test home under the real one), swap the longer.
+    const patterns = new Map();
+    for (const s of [...spellings].sort((a, b) => b.length - a.length)) {
+        const pattern = spellingPattern(s);
+        const key = process.platform === 'win32' ? pattern.toLowerCase() : pattern;
+        if (!patterns.has(key))
+            patterns.set(key, pattern);
+    }
+    if (patterns.size === 0)
+        return null;
+    // Whole names only: "<home> now" and "<home>." swap; "<home>ty", or "web-app" for a home of /app, do not.
+    const alternatives = [...patterns.values()].join('|');
+    return new RegExp(`(?<![\\p{L}\\p{N}_])(?:${alternatives})(?![\\p{L}\\p{N}_])`, process.platform === 'win32' ? 'giu' : 'gu');
 }
 const URL_RE = /\b[a-z][a-z0-9+.-]*:\/\/[^\s"'<>]+/gi;
 function redactUrlsInString(text) {
@@ -255,37 +271,40 @@ function redactUrlsInString(text) {
         }
     });
 }
-function redactString(text, homeForms) {
-    return replaceHomeForms(redactSecretsStrict(redactUrlsInString(text)), homeForms);
+function redactString(text, homePattern) {
+    const scrubbed = redactSecretsStrict(redactUrlsInString(text));
+    return homePattern === null ? scrubbed : scrubbed.replace(homePattern, '~');
 }
-function redactStrings(value, homeForms) {
+function redactStrings(value, homePattern) {
     if (isJsonString(value))
-        return redactString(value, homeForms);
+        return redactString(value, homePattern);
     if (Array.isArray(value))
-        return value.map((v) => redactStrings(v, homeForms));
+        return value.map((v) => redactStrings(v, homePattern));
     if (isJsonObject(value)) {
         const out = {};
         for (const [k, v] of Object.entries(value))
-            out[k] = redactStrings(v, homeForms);
+            out[k] = redactStrings(v, homePattern);
         return out;
     }
     return value;
 }
 /** Read-only: builds one redacted support-ticket snapshot. Never reads a memory content column. */
 export function buildSupportBundle(opts) {
+    // Before doctor: its read-only open leaves an empty -wal that the store's file list would then report.
+    const stores = buildStores(opts);
     const bundle = {
         format: 'hippo-support-bundle/1',
         createdAt: opts.now.toISOString(),
         hippo: opts.version,
         runtime: buildRuntime(),
         doctor: JSON.parse(JSON.stringify(runDoctor(opts))),
-        stores: buildStores(opts),
+        stores,
         env: listSetEnvNames(),
         logs: buildLogsSection(opts),
     };
     // Store paths found from the working folder arrive resolved; the global root arrives as HIPPO_HOME was typed, and log lines
     // often quote the temp folder, which usually sits under the home.
-    const redacted = redactStrings(bundle, collectHomeForms(opts.home, [getGlobalRoot(), os.tmpdir()]));
+    const redacted = redactStrings(bundle, buildHomePattern(opts.home, [getGlobalRoot(), os.tmpdir()]));
     // SAFETY: the value built above is always a JsonObject; redactStrings preserves object shape.
     return redacted;
 }

package/dist/version.d.ts

@@ -16,7 +16,7 @@
  * an ESM `import` can resolve cleanly, and a hardcoded constant survives
  * any packager that drops .json files.
  */
-export declare const PACKAGE_VERSION = "1.52.2";
+export declare const PACKAGE_VERSION = "1.52.3";
 /** Compares plain x.y.z versions, positive if a > b; tags throw so the rollback guard never misfires silently. */
 export declare function compareSemver(a: string, b: string): number;
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -16,7 +16,7 @@
  * an ESM `import` can resolve cleanly, and a hardcoded constant survives
  * any packager that drops .json files.
  */
-export const PACKAGE_VERSION = '1.52.2';
+export const PACKAGE_VERSION = '1.52.3';
 /** Compares plain x.y.z versions, positive if a > b; tags throw so the rollback guard never misfires silently. */
 export function compareSemver(a, b) {
     const parse = (v) => {

package/extensions/openclaw-plugin/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "hippo-memory",
   "name": "Hippo Memory",
   "description": "Biologically-inspired memory for AI agents. Decay by default, retrieval strengthening, sleep consolidation.",
-  "version": "1.52.2",
+  "version": "1.52.3",
 
   "configSchema": {
     "type": "object",

package/extensions/openclaw-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hippo-memory",
-  "version": "1.52.2",
+  "version": "1.52.3",
   "type": "module",
   "description": "Hippo Memory plugin for OpenClaw - biologically-inspired agent memory",
   "main": "index.ts",

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "hippo-memory",
   "name": "Hippo Memory",
   "description": "Biologically-inspired memory for AI agents. Decay by default, retrieval strengthening, sleep consolidation.",
-  "version": "1.52.2",
+  "version": "1.52.3",
   "configSchema": {
     "type": "object",
     "additionalProperties": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hippo-memory",
-  "version": "1.52.2",
+  "version": "1.52.3",
   "description": "Biologically-inspired memory for AI agents. Zero runtime deps, SQLite, MCP server, and an opt-in hosted TypeSafe Jev reranker. Decay, retrieval strengthening, consolidation.",
   "mcpName": "io.github.kitfunso/hippo-memory",
   "type": "module",