hippo-memory 1.56.0 → 1.58.0

package/dist/goals.d.ts

@@ -79,12 +79,36 @@ export interface GetActiveGoalsOpts {
 }
 export declare function getActiveGoals(hippoRoot: string, opts: GetActiveGoalsOpts): Goal[];
 export declare function getActiveGoalsWithDb(db: DatabaseSyncLike, opts: GetActiveGoalsOpts): Goal[];
+/** One `goal_recall_log` row: a boosted local memory recalled while its goal was active. */
+export interface GoalRecallLogRow {
+    goalId: string;
+    memoryId: string;
+    tenantId: string;
+    sessionId: string;
+    recalledAt: string;
+    score: number;
+}
+/** Options shared by {@link computeGoalStackBoost} and {@link applyGoalStackBoost}. */
+export interface GoalStackBoostOpts {
+    sessionId: string;
+    tenantId: string;
+    limit: number;
+    /**
+     * Optional side-channel: one goal-boost `RerankStep` per boosted row, keyed by
+     * `entry.id`. A map rather than a row field because the helper re-spreads rows.
+     * Only populated when passed, so the default path allocates nothing.
+     */
+    trace?: Map<string, RerankStep>;
+}
+/** The boosted, re-sorted rows and the `goal_recall_log` rows they earn. */
+export interface GoalStackBoost<R> {
+    results: R[];
+    log: GoalRecallLogRow[];
+}
 /**
- * v1.7.4 -- dlPFC goal-stack boost helper. Applies the multi-goal boost to a
- * list of entry-backed scored rows when (tenant, session) has active goals.
- * Pre-v1.7.4 this logic lived inline in cmdRecall (src/cli.ts:988-1140);
- * lifting here lets api.recall (primary band only) AND MCP physics/hybrid
- * call it.
+ * dlPFC goal-stack boost. Applies the multi-goal boost to entry-backed scored
+ * rows when (tenant, session) has active goals and returns the log rows to
+ * write, without writing them; {@link writeGoalRecallLog} persists them.
  *
  * Caller responsibilities:
  *   - Do NOT call when an explicit `goalTag` is set (caller's gate)
@@ -94,31 +118,31 @@ export declare function getActiveGoalsWithDb(db: DatabaseSyncLike, opts: GetActi
  *   - Recompute `tokens` after if returned rows are projected to a budgeted
  *     shape
  *
- * Side effects:
- *   - INSERT OR IGNORE into `goal_recall_log` for each (boosted, goal) pair
- *   - Local memory id filter applied before INSERT (skips global-only ids
- *     to preserve FK invariant on goal_recall_log.memory_id)
+ * Log rows cover the top `limit` boosted rows that live in this store's
+ * `memories` table (global-only ids are skipped to keep the FK on
+ * goal_recall_log.memory_id valid).
  *
- * @internal v1.7.4 -- internal recall ranking helper. Subject to change.
+ * @internal Recall ranking helper. Subject to change.
+ */
+export declare function computeGoalStackBoost<R extends {
+    entry: MemoryEntry;
+    score: number;
+}>(db: DatabaseSyncLike, results: R[], opts: GoalStackBoostOpts): GoalStackBoost<R>;
+/**
+ * Writes goal-boost log rows. INSERT OR IGNORE because UNIQUE(memory_id, goal_id)
+ * makes a re-recall during the same goal life a no-op for outcome attribution.
+ */
+export declare function writeGoalRecallLog(db: DatabaseSyncLike, rows: readonly GoalRecallLogRow[]): void;
+/**
+ * {@link computeGoalStackBoost} plus {@link writeGoalRecallLog} in one call, for
+ * pipelines that boost and log on the same handle.
+ *
+ * @internal Recall ranking helper. Subject to change.
  */
 export declare function applyGoalStackBoost<R extends {
     entry: MemoryEntry;
     score: number;
-}>(db: DatabaseSyncLike, results: R[], opts: {
-    sessionId: string;
-    tenantId: string;
-    limit: number;
-    /**
-     * A7 recall-trace (optional side-channel). When supplied, the helper
-     * records one goal-boost `RerankStep` per ACTUALLY-boosted row, keyed by
-     * `entry.id`. This is a SEPARATE accumulator, NOT a field on the result
-     * row — the helper re-spreads rows and strips internal markers
-     * (`_goalMatches` below), so a row field would be dropped. The score-mul
-     * + re-sort math is untouched; the trace is only populated when this map
-     * is passed (default path never allocates → byte-identical).
-     */
-    trace?: Map<string, RerankStep>;
-}): R[];
+}>(db: DatabaseSyncLike, results: R[], opts: GoalStackBoostOpts): R[];
 export interface CompleteGoalOpts {
     outcomeScore?: number;
     /**

package/dist/goals.js

@@ -142,11 +142,9 @@ export function getActiveGoalsWithDb(db, opts) {
     return rows.map(rowToGoal);
 }
 /**
- * v1.7.4 -- dlPFC goal-stack boost helper. Applies the multi-goal boost to a
- * list of entry-backed scored rows when (tenant, session) has active goals.
- * Pre-v1.7.4 this logic lived inline in cmdRecall (src/cli.ts:988-1140);
- * lifting here lets api.recall (primary band only) AND MCP physics/hybrid
- * call it.
+ * dlPFC goal-stack boost. Applies the multi-goal boost to entry-backed scored
+ * rows when (tenant, session) has active goals and returns the log rows to
+ * write, without writing them; {@link writeGoalRecallLog} persists them.
  *
  * Caller responsibilities:
  *   - Do NOT call when an explicit `goalTag` is set (caller's gate)
@@ -156,18 +154,17 @@ export function getActiveGoalsWithDb(db, opts) {
  *   - Recompute `tokens` after if returned rows are projected to a budgeted
  *     shape
  *
- * Side effects:
- *   - INSERT OR IGNORE into `goal_recall_log` for each (boosted, goal) pair
- *   - Local memory id filter applied before INSERT (skips global-only ids
- *     to preserve FK invariant on goal_recall_log.memory_id)
+ * Log rows cover the top `limit` boosted rows that live in this store's
+ * `memories` table (global-only ids are skipped to keep the FK on
+ * goal_recall_log.memory_id valid).
  *
- * @internal v1.7.4 -- internal recall ranking helper. Subject to change.
+ * @internal Recall ranking helper. Subject to change.
  */
-export function applyGoalStackBoost(db, results, opts) {
+export function computeGoalStackBoost(db, results, opts) {
     const { sessionId, tenantId, limit, trace } = opts;
     const active = getActiveGoalsWithDb(db, { sessionId, tenantId });
     if (active.length === 0)
-        return results;
+        return { results, log: [] };
     const goalsByTag = new Map(active.map((g) => [g.goalName, g]));
     // Load retrieval_policy rows for active goals so per-policy multipliers
     // can compose onto the base goal-tag boost. Composed result is hard-capped
@@ -271,15 +268,8 @@ export function applyGoalStackBoost(db, results, opts) {
         for (const row of localRows)
             localIds.add(row.id);
     }
-    // Log top-K boosted recalls. INSERT OR IGNORE because
-    // UNIQUE(memory_id, goal_id) means a re-recall during the same goal life
-    // is a no-op for outcome attribution.
     const recalledAt = new Date().toISOString();
-    const insertLog = db.prepare(`
-    INSERT OR IGNORE INTO goal_recall_log
-      (goal_id, memory_id, tenant_id, session_id, recalled_at, score)
-    VALUES (?, ?, ?, ?, ?, ?)
-  `);
+    const log = [];
     for (const r of boosted.slice(0, limit)) {
         if (!localIds.has(r.entry.id))
             continue; // global -> skip log insert
@@ -290,10 +280,37 @@ export function applyGoalStackBoost(db, results, opts) {
             const goal = goalsByTag.get(tag);
             if (!goal)
                 continue;
-            insertLog.run(goal.id, r.entry.id, tenantId, sessionId, recalledAt, r.score);
+            log.push({ goalId: goal.id, memoryId: r.entry.id, tenantId, sessionId, recalledAt, score: r.score });
         }
     }
-    return boosted;
+    return { results: boosted, log };
+}
+/**
+ * Writes goal-boost log rows. INSERT OR IGNORE because UNIQUE(memory_id, goal_id)
+ * makes a re-recall during the same goal life a no-op for outcome attribution.
+ */
+export function writeGoalRecallLog(db, rows) {
+    if (rows.length === 0)
+        return;
+    const insertLog = db.prepare(`
+    INSERT OR IGNORE INTO goal_recall_log
+      (goal_id, memory_id, tenant_id, session_id, recalled_at, score)
+    VALUES (?, ?, ?, ?, ?, ?)
+  `);
+    for (const row of rows) {
+        insertLog.run(row.goalId, row.memoryId, row.tenantId, row.sessionId, row.recalledAt, row.score);
+    }
+}
+/**
+ * {@link computeGoalStackBoost} plus {@link writeGoalRecallLog} in one call, for
+ * pipelines that boost and log on the same handle.
+ *
+ * @internal Recall ranking helper. Subject to change.
+ */
+export function applyGoalStackBoost(db, results, opts) {
+    const boost = computeGoalStackBoost(db, results, opts);
+    writeGoalRecallLog(db, boost.log);
+    return boost.results;
 }
 const POSITIVE_OUTCOME_THRESHOLD = 0.7;
 const NEGATIVE_OUTCOME_THRESHOLD = 0.3;

package/dist/graph-extract.js

@@ -25,7 +25,7 @@ import { loadDecisions } from './decisions.js';
 import { loadPolicies } from './policies.js';
 import { loadCustomerNotes } from './customer-notes.js';
 import { loadProjectBriefs } from './project-briefs.js';
-import { assertTenantId } from './store.js';
+import { assertTenantId } from './tenant.js';
 /** Per-type load cap (the loaders default to 100). A type whose active or superseded
  *  set exceeds this is truncated; `ExtractResult.truncated` records it so the
  *  incompleteness is observable rather than silent. */

package/dist/graph-recall.d.ts

@@ -1,4 +1,4 @@
-import { type ResultCost, type SearchResult } from './search.js';
+import type { ResultCost, SearchResult } from './search.js';
 /** Hard cap on `--hops` (a higher value just walks more of a finite graph; this bounds
  *  worst-case work and keeps the flag honest). */
 export declare const MAX_HOPS = 3;

package/dist/graph-recall.js

@@ -37,7 +37,7 @@
  * check-graph-writes lint permits this module living outside graph.ts.
  */
 import { loadEntriesByIds } from './store.js';
-import { estimateTokens } from './search.js';
+import { estimateTokens } from './token-ledger.js';
 import { compareEntryIdentity } from './compare.js';
 import { loadEntitiesByMemoryId, loadEntitiesByIds, loadNeighborRelations, } from './graph.js';
 import { passesCliRecallScopeFilter, passesScopeFilterForRecall } from './recall-scope.js';

package/dist/graph.js

@@ -18,7 +18,7 @@
  * until E3.2 multi-hop recall.
  */
 import { openHippoDb, closeHippoDb } from './db.js';
-import { assertTenantId } from './store.js';
+import { assertTenantId } from './tenant.js';
 const SOURCE_OBJECT_TABLE = {
     decision: 'decisions',
     policy: 'policies',

package/dist/hooks.d.ts

@@ -45,8 +45,8 @@ export interface CodexWrapperPaths {
     wrapperShPath: string;
     logFile: string;
     runsDir: string;
+    codexHome: string;
     historyPath: string;
-    sessionsDir: string;
 }
 export interface CodexWrapperInstallResult {
     installed: boolean;
@@ -63,8 +63,6 @@ export interface CodexWrapperMetadata {
     backupPath: string;
     installMode: 'same-path' | 'cmd-shim';
     logFile: string;
-    historyPath: string;
-    sessionsDir: string;
     installedAt: string;
 }
 export interface EnsureCodexWrapperResult {

package/dist/hooks.js

@@ -154,7 +154,7 @@ export function defaultPreCompactLogPath() {
 }
 export function resolveCodexWrapperPaths() {
     const home = homeDir();
-    const codexHome = path.join(home, '.codex');
+    const codexHome = codexHomeDir(home);
     const wrapperDir = path.join(home, '.hippo', 'bin');
     return {
         wrapperDir,
@@ -164,8 +164,8 @@ export function resolveCodexWrapperPaths() {
         wrapperShPath: path.join(wrapperDir, 'codex'),
         logFile: path.join(home, '.hippo', 'logs', 'codex-sleep.log'),
         runsDir: path.join(home, '.hippo', 'runs', 'codex'),
+        codexHome,
         historyPath: path.join(codexHome, 'history.jsonl'),
-        sessionsDir: path.join(codexHome, 'sessions'),
     };
 }
 function pathEquals(a, b) {
@@ -348,8 +348,6 @@ export function installCodexWrapper(realCodexPath) {
         backupPath: plan.backupPath,
         installMode: plan.installMode,
         logFile: paths.logFile,
-        historyPath: paths.historyPath,
-        sessionsDir: paths.sessionsDir,
         installedAt: new Date().toISOString(),
     };
     fs.writeFileSync(paths.metadataPath, JSON.stringify(metadata, null, 2) + '\n', 'utf8');

package/dist/http-retry.d.ts

@@ -0,0 +1,21 @@
+/** One retry policy for outbound HTTP: a timeout on every attempt, and backoff on 429 and 5xx only. */
+export interface RetryPolicy {
+    /** Per-attempt limit; a stalled peer ends as a thrown `TimeoutError`, never a hang. */
+    timeoutMs: number;
+    /** Total attempts including the first. */
+    attempts?: number;
+    baseDelayMs?: number;
+    /** A Retry-After longer than this hands the response back, so a caller with its own long pause keeps it. */
+    maxDelayMs?: number;
+    fetchFn?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    random?: () => number;
+}
+/** LLM calls (consolidation refine, DAG summaries, fact extraction) share one budget; `HIPPO_LLM_TIMEOUT_MS` overrides it. */
+export declare function llmTimeoutMs(): number;
+export declare function isRetryableStatus(status: number): boolean;
+/** Retry-After as milliseconds: delta-seconds or an HTTP date; null when absent or unreadable. */
+export declare function parseRetryAfterMs(header: string | null, now?: number): number | null;
+/** `fetch` with a per-attempt timeout and up to `attempts` tries on 429 and 5xx; the last response comes back as is and transport errors throw at once. */
+export declare function fetchWithRetry(url: string | URL, init: RequestInit, policy: RetryPolicy): Promise<Response>;
+//# sourceMappingURL=http-retry.d.ts.map

package/dist/http-retry.js

@@ -0,0 +1,50 @@
+/** One retry policy for outbound HTTP: a timeout on every attempt, and backoff on 429 and 5xx only. */
+const DEFAULT_ATTEMPTS = 3;
+const DEFAULT_BASE_DELAY_MS = 250;
+const DEFAULT_MAX_DELAY_MS = 8_000;
+const DEFAULT_LLM_TIMEOUT_MS = 60_000;
+/** LLM calls (consolidation refine, DAG summaries, fact extraction) share one budget; `HIPPO_LLM_TIMEOUT_MS` overrides it. */
+export function llmTimeoutMs() {
+    const parsed = Number.parseInt(process.env.HIPPO_LLM_TIMEOUT_MS ?? '', 10);
+    return parsed > 0 ? parsed : DEFAULT_LLM_TIMEOUT_MS;
+}
+export function isRetryableStatus(status) {
+    return status === 429 || (status >= 500 && status <= 599);
+}
+/** Retry-After as milliseconds: delta-seconds or an HTTP date; null when absent or unreadable. */
+export function parseRetryAfterMs(header, now = Date.now()) {
+    if (header === null || header.trim() === '')
+        return null;
+    const seconds = Number(header);
+    if (Number.isFinite(seconds))
+        return Math.max(0, seconds * 1000);
+    const at = Date.parse(header);
+    return Number.isNaN(at) ? null : Math.max(0, at - now);
+}
+const realSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** `fetch` with a per-attempt timeout and up to `attempts` tries on 429 and 5xx; the last response comes back as is and transport errors throw at once. */
+export async function fetchWithRetry(url, init, policy) {
+    const fetchFn = policy.fetchFn ?? fetch;
+    const attempts = Math.max(1, policy.attempts ?? DEFAULT_ATTEMPTS);
+    const baseDelayMs = policy.baseDelayMs ?? DEFAULT_BASE_DELAY_MS;
+    const maxDelayMs = policy.maxDelayMs ?? DEFAULT_MAX_DELAY_MS;
+    const sleep = policy.sleep ?? realSleep;
+    const random = policy.random ?? Math.random;
+    for (let attempt = 1;; attempt++) {
+        const timeout = AbortSignal.timeout(policy.timeoutMs);
+        const signal = init.signal ? AbortSignal.any([init.signal, timeout]) : timeout;
+        const res = await fetchFn(url, { ...init, signal });
+        if (!isRetryableStatus(res.status) || attempt >= attempts)
+            return res;
+        const retryAfter = parseRetryAfterMs(res.headers.get('retry-after'));
+        if (retryAfter !== null && retryAfter > maxDelayMs)
+            return res;
+        // Jitter over the upper half keeps parallel callers from retrying in lockstep.
+        const ceiling = Math.min(maxDelayMs, baseDelayMs * 2 ** (attempt - 1));
+        const delay = retryAfter ?? ceiling / 2 + random() * (ceiling / 2);
+        // Frees the pooled socket before the next attempt.
+        await res.body?.cancel();
+        await sleep(delay);
+    }
+}
+//# sourceMappingURL=http-retry.js.map

package/dist/http-util.d.ts

@@ -0,0 +1,39 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+export type JsonValue = string | number | boolean | null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+export declare function isJsonObjectRecord(value: JsonValue | undefined): value is Record<string, JsonValue>;
+export declare function isHeaderString(value: string | string[] | undefined): value is string;
+export declare const JSON_HEADERS: {
+    readonly 'content-type': "application/json";
+};
+export declare class HttpError extends Error {
+    status: number;
+    constructor(status: number, message: string);
+}
+export declare class BodyTooLargeError extends Error {
+}
+/** The status and client-facing message for one failed request. */
+export interface ApiErrorReply {
+    status: number;
+    message: string;
+}
+export declare const INTERNAL_ERROR_MESSAGE = "internal server error";
+/** Maps by class so rewording a message never moves a status; an untyped error is a 500 whose text stays in the server log. */
+export declare function mapApiError<E>(err: E): ApiErrorReply;
+export declare function sendJson<T>(res: ServerResponse, status: number, body: T): void;
+/**
+ * Read the entire request body into a Buffer. Caps at MAX_BODY_BYTES to keep
+ * a malicious or buggy client from exhausting memory. The cap is enforced
+ * mid-stream so we don't wait for an attacker to finish before erroring out.
+ */
+export declare function readBody(req: IncomingMessage): Promise<string>;
+/** Per-request values a connector webhook receiver reads; ServeOpts and the /v1 RouteRequest both satisfy it. */
+export interface WebhookRequest {
+    req: IncomingMessage;
+    res: ServerResponse;
+    opts: {
+        hippoRoot: string;
+    };
+}
+//# sourceMappingURL=http-util.d.ts.map

package/dist/http-util.js

@@ -0,0 +1,56 @@
+import { ApiError } from './api-errors.js';
+export function isJsonObjectRecord(value) {
+    return value !== undefined && value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+// node:http header values are `string | string[] | undefined` (never a bare
+// unknown), so this gets its own predicate rather than reusing isJsonString.
+export function isHeaderString(value) {
+    return typeof value === 'string';
+}
+// 1 MB body cap. The CLI never sends payloads near this; anything bigger is
+// almost certainly a misconfigured client or a deliberate memory-blowup attempt.
+const MAX_BODY_BYTES = 1024 * 1024;
+export const JSON_HEADERS = { 'content-type': 'application/json' };
+export class HttpError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+export class BodyTooLargeError extends Error {
+}
+export const INTERNAL_ERROR_MESSAGE = 'internal server error';
+/** Maps by class so rewording a message never moves a status; an untyped error is a 500 whose text stays in the server log. */
+export function mapApiError(err) {
+    if (err instanceof HttpError || err instanceof ApiError)
+        return { status: err.status, message: err.message };
+    if (err instanceof BodyTooLargeError)
+        return { status: 413, message: err.message };
+    return { status: 500, message: INTERNAL_ERROR_MESSAGE };
+}
+export function sendJson(res, status, body) {
+    res.writeHead(status, JSON_HEADERS);
+    res.end(JSON.stringify(body));
+}
+/**
+ * Read the entire request body into a Buffer. Caps at MAX_BODY_BYTES to keep
+ * a malicious or buggy client from exhausting memory. The cap is enforced
+ * mid-stream so we don't wait for an attacker to finish before erroring out.
+ */
+export async function readBody(req) {
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of req) {
+        // SAFETY: IncomingMessage never runs setEncoding() here, so every
+        // streamed chunk is a Buffer, not a decoded string.
+        const buf = chunk;
+        total += buf.length;
+        if (total > MAX_BODY_BYTES) {
+            throw new BodyTooLargeError('request body exceeds 1MB');
+        }
+        chunks.push(buf);
+    }
+    return Buffer.concat(chunks).toString('utf8');
+}
+//# sourceMappingURL=http-util.js.map

package/dist/importers.d.ts

@@ -20,6 +20,8 @@ export interface ImportResult {
     /** K1 vault import: rows archived this run (changed + source-deleted). In a
      *  dryRun this is the would-be count (a true deletion-sync preview). */
     archived?: number;
+    /** Entries stored with secret-shaped text redacted; optional for the same published-surface reason as `rejected`. */
+    redacted?: number;
     entries: MemoryEntry[];
 }
 export interface ImportOptions {

package/dist/importers.js

@@ -13,6 +13,7 @@ import { remember, archiveRaw, isPrivateScope } from './api.js';
 import { openHippoDb, closeHippoDb } from './db.js';
 import { RejectedValueError, checkRejectionGuard } from './rejection.js';
 import { loadConfig } from './config.js';
+import { vetSecrets } from './secret-detect.js';
 // ---------------------------------------------------------------------------
 // Shared core: dedup + write
 // ---------------------------------------------------------------------------
@@ -33,6 +34,7 @@ export function importEntries(chunks, source, tags, options) {
     let imported = 0;
     let skipped = 0;
     let rejected = 0;
+    let redacted = 0;
     const entries = [];
     // AT1 P2 fix: a dry-run preview never called writeEntry, so it never
     // checked tombstones either — every non-duplicate chunk counted as
@@ -42,7 +44,9 @@ export function importEntries(chunks, source, tags, options) {
     const dryRunDb = options.dryRun ? openHippoDb(targetRoot) : null;
     try {
         for (const raw of chunks) {
-            const trimmed = raw.trim();
+            const original = raw.trim();
+            const trimmed = vetSecrets(original, allTags, true).content;
+            const wasRedacted = trimmed !== original;
             if (trimmed.length > 1000) {
                 console.error(`Warning: imported memory truncated from ${trimmed.length} to 1000 chars`);
             }
@@ -109,8 +113,10 @@ export function importEntries(chunks, source, tags, options) {
             }
             entries.push(entry);
             imported++;
+            if (wasRedacted)
+                redacted++;
         }
-        return { total, imported, skipped, rejected, entries };
+        return { total, imported, skipped, rejected, redacted, entries };
     }
     finally {
         if (dryRunDb)
@@ -430,6 +436,7 @@ export function importMarkdown(filePath, options) {
             // AT1 P2 fix: `rejected` is now optional on ImportResult (compat) — tolerate
             // undefined on either side of the accumulation.
             rejected: (totalResult.rejected ?? 0) + (result.rejected ?? 0),
+            redacted: (totalResult.redacted ?? 0) + (result.redacted ?? 0),
             entries: [...totalResult.entries, ...result.entries],
         };
     }
@@ -695,6 +702,7 @@ export function importVault(folderPath, options) {
     let skipped = 0;
     let rejected = 0;
     let archived = 0;
+    let redacted = 0;
     const entries = [];
     const baseHalfLifeDays = loadConfig(hippoRoot).defaultHalfLifeDays;
     // AT1 P2 fix: dry-run never called remember(), so it never probed
@@ -796,7 +804,8 @@ export function importVault(folderPath, options) {
             // remember() owns the actual write. We build an `echo` of the SAME content +
             // tags via createMemory purely for the ImportResult, then reconcile its id to
             // remember()'s real row id so entries[] reflects the row that landed.
-            const echo = createMemory(body, {
+            const content = vetSecrets(body, tags, true).content;
+            const echo = createMemory(content, {
                 kind: 'raw',
                 tags,
                 scope,
@@ -815,7 +824,7 @@ export function importVault(folderPath, options) {
                 // loud each time via the rejected count.
                 try {
                     const result = remember(ctx, {
-                        content: body,
+                        content,
                         kind: 'raw',
                         artifactRef,
                         owner: 'agent:vault-import',
@@ -848,6 +857,8 @@ export function importVault(folderPath, options) {
             }
             entries.push(echo);
             imported++;
+            if (content !== body)
+                redacted++;
         }
     }
     finally {
@@ -867,7 +878,7 @@ export function importVault(folderPath, options) {
                 archiveRaw(ctx, row.id, `source_deleted:${artifactRef}`);
         }
     }
-    return { total, imported, skipped, rejected, archived, entries };
+    return { total, imported, skipped, rejected, archived, redacted, entries };
 }
 /** Local tolerant JSON-array parse for the loader's `tags_json` column. The
  *  store's own `parseJsonArray` is not exported; this matches its contract

package/dist/incidents.js

@@ -25,8 +25,10 @@
  * the row, default `[]`. On save, every id must exist in the SAME tenant; a
  * cross-tenant or nonexistent id is rejected (throw) before the insert.
  */
+import { BadRequestError, ConflictError, NotFoundError } from './api-errors.js';
 import { openHippoDb, closeHippoDb } from './db.js';
-import { writeEntry, assertTenantId } from './store.js';
+import { writeEntry } from './store.js';
+import { assertTenantId } from './tenant.js';
 import { createMemory, Layer } from './memory.js';
 import { appendAuditEvent } from './audit.js';
 import { objectHalfLifeDays } from './half-life-migration.js';
@@ -88,7 +90,7 @@ const INCIDENT_COLS = `
 export function saveIncident(hippoRoot, tenantId, opts, actor = 'cli') {
     assertTenantId('saveIncident', tenantId);
     if (!opts.incidentText)
-        throw new Error('saveIncident: incidentText is required');
+        throw new BadRequestError('saveIncident: incidentText is required');
     const now = new Date().toISOString();
     const content = opts.context
         ? `${opts.incidentText}\n\nContext: ${opts.context}`
@@ -117,7 +119,7 @@ export function saveIncident(hippoRoot, tenantId, opts, actor = 'cli') {
                 // SAFETY: row shape matches the single `id` column named in the SELECT above.
                 const exists = db.prepare(`SELECT id FROM memories WHERE id = ? AND tenant_id = ?`).get(linkId, tenantId);
                 if (!exists) {
-                    throw new Error(`saveIncident: linked memory ${linkId} not found for tenant ${tenantId}`);
+                    throw new NotFoundError(`saveIncident: linked memory ${linkId} not found for tenant ${tenantId}`);
                 }
                 validated.push(linkId);
             }
@@ -163,7 +165,7 @@ export function saveIncident(hippoRoot, tenantId, opts, actor = 'cli') {
 export function resolveIncident(hippoRoot, tenantId, id, resolutionText, actor = 'cli') {
     assertTenantId('resolveIncident', tenantId);
     if (!resolutionText || !resolutionText.trim()) {
-        throw new Error('resolveIncident: resolutionText is required (non-empty)');
+        throw new BadRequestError('resolveIncident: resolutionText is required (non-empty)');
     }
     const now = new Date().toISOString();
     const db = openHippoDb(hippoRoot);
@@ -179,15 +181,15 @@ export function resolveIncident(hippoRoot, tenantId, id, resolutionText, actor =
                 // SAFETY: row shape matches the single `status` column named in the SELECT above.
                 const existing = db.prepare(`SELECT status FROM incidents WHERE id = ? AND tenant_id = ?`).get(id, tenantId);
                 if (!existing) {
-                    throw new Error(`resolveIncident: incident ${id} not found for tenant ${tenantId}`);
+                    throw new NotFoundError(`resolveIncident: incident ${id} not found for tenant ${tenantId}`);
                 }
-                throw new Error(`resolveIncident: incident ${id} is not open (status='${existing.status}'); only open incidents can be resolved.`);
+                throw new ConflictError(`resolveIncident: incident ${id} is not open (status='${existing.status}'); only open incidents can be resolved.`);
             }
             // SAFETY: row's shape matches the columns named in INCIDENT_COLS above.
             const row = db.prepare(`SELECT ${INCIDENT_COLS} FROM incidents WHERE id = ? AND tenant_id = ?`)
                 .get(id, tenantId);
             if (!row)
-                throw new Error(`resolveIncident: incident ${id} not found after UPDATE`);
+                throw new NotFoundError(`resolveIncident: incident ${id} not found after UPDATE`);
             appendAuditEvent(db, {
                 tenantId,
                 actor,
@@ -234,15 +236,15 @@ export function closeIncident(hippoRoot, tenantId, id, actor = 'cli') {
                 // SAFETY: row shape matches the single `status` column named in the SELECT above.
                 const existing = db.prepare(`SELECT status FROM incidents WHERE id = ? AND tenant_id = ?`).get(id, tenantId);
                 if (!existing) {
-                    throw new Error(`closeIncident: incident ${id} not found for tenant ${tenantId}`);
+                    throw new NotFoundError(`closeIncident: incident ${id} not found for tenant ${tenantId}`);
                 }
-                throw new Error(`closeIncident: incident ${id} is already closed (status='${existing.status}'); only open or resolved incidents can be closed.`);
+                throw new ConflictError(`closeIncident: incident ${id} is already closed (status='${existing.status}'); only open or resolved incidents can be closed.`);
             }
             // SAFETY: row's shape matches the columns named in INCIDENT_COLS above.
             const row = db.prepare(`SELECT ${INCIDENT_COLS} FROM incidents WHERE id = ? AND tenant_id = ?`)
                 .get(id, tenantId);
             if (!row)
-                throw new Error(`closeIncident: incident ${id} not found after UPDATE`);
+                throw new NotFoundError(`closeIncident: incident ${id} not found after UPDATE`);
             appendAuditEvent(db, {
                 tenantId,
                 actor,
@@ -288,7 +290,7 @@ export function loadIncidents(hippoRoot, tenantId, opts = {}) {
         let rows;
         if (opts.status) {
             if (!VALID_INCIDENT_STATES.has(opts.status)) {
-                throw new Error(`loadIncidents: status must be one of ${Array.from(VALID_INCIDENT_STATES).join('|')}; got ${opts.status}`);
+                throw new BadRequestError(`loadIncidents: status must be one of ${Array.from(VALID_INCIDENT_STATES).join('|')}; got ${opts.status}`);
             }
             // SAFETY: rows' shape matches the columns named in INCIDENT_COLS above.
             rows = db.prepare(`

package/dist/index.d.ts

@@ -5,10 +5,13 @@ import { type CreateMemoryOptions, type MemoryEntry } from './memory.js';
 export { MemoryEntry, Layer, EmotionalValence, ConfidenceLevel, DecayOptions, calculateStrength, resolveConfidence, confidenceFacets, type ConfidenceFacets, applyOutcome, generateId, computeSchemaFit } from './memory.js';
 /** Published signature, so `baseHalfLifeDays` stays optional here; hippo's own writers use the strict one in memory.ts. */
 export declare function createMemory(content: string, options?: Partial<CreateMemoryOptions>): MemoryEntry;
-export { search, hybridSearch, physicsSearch, markRetrieved, estimateTokens, textOverlap, tokenize, explainMatch, detectTemporalDirection, temporalBoost, computeTemporalRange, SearchResult, MatchExplanation } from './search.js';
+export { search, hybridSearch, physicsSearch, estimateTokens, textOverlap, explainMatch, detectTemporalDirection, temporalBoost, computeTemporalRange, SearchResult, MatchExplanation } from './search.js';
+export { tokenize } from './tokenize.js';
+export { markRetrieved } from './memory.js';
 export { multihopSearch } from './multihop.js';
 export { graphExpandRecall, MAX_HOPS, DEFAULT_MAX_NEIGHBORS, type GraphExpandOpts } from './graph-recall.js';
-export { initStore, loadAllEntries, loadSearchEntries, loadRecallSearchEntries, writeEntry, readEntry, deleteEntry, loadIndex, rebuildIndex, saveActiveTaskSnapshot, loadActiveTaskSnapshot, loadFreshActiveTaskSnapshot, SNAPSHOT_AMBIENT_MAX_AGE_MS, closeTaskSnapshotsForSession, clearActiveTaskSnapshot, appendSessionEvent, listSessionEvents, listMemoryConflicts, replaceDetectedConflicts, resolveConflict, saveSessionHandoff, loadLatestHandoff, loadHandoffById, stampHandoffOutcome, writeSessionEndHandoff, loadSessionDecayContext, SessionDecayContext, createCard, loadCard, listCards, loadCardDeps, loadCardRuns, loadCardComments, claimCard, heartbeatCard, blockCard, reviewCard, completeCard, reclaimExpiredCards, addCardComment, loadLatestHandoffForCard, } from './store.js';
+export { initStore, loadAllEntries, loadSearchEntries, loadRecallSearchEntries, writeEntry, readEntry, deleteEntry, loadIndex, rebuildIndex, saveActiveTaskSnapshot, loadActiveTaskSnapshot, loadFreshActiveTaskSnapshot, SNAPSHOT_AMBIENT_MAX_AGE_MS, closeTaskSnapshotsForSession, clearActiveTaskSnapshot, appendSessionEvent, listSessionEvents, listMemoryConflicts, replaceDetectedConflicts, resolveConflict, saveSessionHandoff, loadLatestHandoff, loadHandoffById, stampHandoffOutcome, writeSessionEndHandoff, loadSessionDecayContext, SessionDecayContext, } from './store.js';
+export { createCard, loadCard, listCards, loadCardDeps, loadCardRuns, loadCardComments, claimCard, heartbeatCard, blockCard, reviewCard, completeCard, reclaimExpiredCards, addCardComment, loadLatestHandoffForCard, } from './store-cards.js';
 export { SessionHandoff, HandoffOutcome, HandoffEvidence, isHandoffOutcome } from './handoff.js';
 export { Card, CardStatus, CardRun, CardComment, CardTransitions, isCardStatus, CARD_TRANSITIONS, CARD_LEASE_MS } from './card.js';
 export { consolidate, ConsolidationResult } from './consolidate.js';