hippo-memory 1.57.0 → 1.59.0

package/dist/search.js

@@ -17,7 +17,13 @@ import { openHippoDb, closeHippoDb } from './db.js';
 import { rrfFuse } from './rrf.js';
 import { graphRankStream, selectGraphSeeds, DEFAULT_GRAPH_SEED_COUNT } from './graph-stream.js';
 import { compareEntryIdentity, compareScoredResults } from './compare.js';
+import { log } from './log.js';
+import { redactSecretsStrict } from './secret-detect.js';
 export const CHURN_STALE_RANK_MULTIPLIER = 0.5; // SHORTCUT: untuned; FE3 measures before any default.
+// Search runs on every hook prompt, so one line per reason per process says why vectors went unused without flooding stderr.
+function warnBm25Fallback(reason, detail) {
+    log.once(`search.bm25-fallback.${reason}`, 'warn', `hybrid search fell back to BM25 only: ${redactSecretsStrict(detail)}`);
+}
 export function churnStaleFactor(entry) {
     return entry.tags.includes(CHURN_STALE_TAG) ? CHURN_STALE_RANK_MULTIPLIER : 1.0;
 }
@@ -267,11 +273,17 @@ export async function hybridSearch(query, entries, options = {}) {
                         embeddingIndex = idx;
                         useEmbeddings = true;
                     }
+                    else {
+                        warnBm25Fallback('empty-query-vector', 'the embedding provider returned no vector for the query');
+                    }
                 }
             }
+            else if (provider.isAvailable()) {
+                warnBm25Fallback('reindex', "the embedding index was built by another model or is being rebuilt; run 'hippo embed'");
+            }
         }
-        catch {
-            // Fall through to BM25-only
+        catch (err) {
+            warnBm25Fallback('error', err instanceof Error ? err.message : String(err));
         }
     }
     // Compute cosine similarities for RRF ranking (need all before scoring)

package/dist/secret-detect.d.ts

@@ -12,7 +12,8 @@
  *    a deliberate act.
  *
  * This is deliberately a thin slice of the A4 lifecycle-compliance item
- * (no write-time scrubbing, no PII detection).
+ * (no PII detection). Write-time scrubbing covers only text no person
+ * typed into hippo; see `vetSecrets`.
  *
  * Leaf module: keep free of imports from store/api/shared so all of them
  * can import it without cycles.
@@ -42,4 +43,15 @@ export declare function redactSecrets(text: string): string;
 export declare function maskEmails(text: string): string;
 /** Stricter redaction for text that leaves the machine: no co-occurrence guard, plus Bearer and Basic auth headers and JWTs. */
 export declare function redactSecretsStrict(text: string): string;
+/** The text a write keeps, plus what to tell its caller about secret material in it. */
+export interface SecretVet {
+    content: string;
+    warnings: string[];
+}
+/** Write-time veto: `scrub` text no person typed gets capture's strict redaction; typed text is a person's own call, so it is kept and flagged. */
+export declare function vetSecrets(content: string, tags: readonly string[], scrub: boolean): SecretVet;
+/** Appended to a dead-letter row's error when `redactPayload` changed its body. */
+export declare const DLQ_REDACTED_NOTE = "secret-shaped text redacted, signature dropped; replay needs --force";
+/** `vetSecrets` redaction for a raw webhook body: JSON stays valid for replay, and an untouched body stays byte-identical so its signature still verifies. */
+export declare function redactPayload(raw: string): string;
 //# sourceMappingURL=secret-detect.d.ts.map

package/dist/secret-detect.js

@@ -12,7 +12,8 @@
  *    a deliberate act.
  *
  * This is deliberately a thin slice of the A4 lifecycle-compliance item
- * (no write-time scrubbing, no PII detection).
+ * (no PII detection). Write-time scrubbing covers only text no person
+ * typed into hippo; see `vetSecrets`.
  *
  * Leaf module: keep free of imports from store/api/shared so all of them
  * can import it without cycles.
@@ -100,6 +101,37 @@ export function maskEmails(text) {
 export function redactSecretsStrict(text) {
     return redactText(text, true);
 }
+/** Write-time veto: `scrub` text no person typed gets capture's strict redaction; typed text is a person's own call, so it is kept and flagged. */
+export function vetSecrets(content, tags, scrub) {
+    const kept = scrub ? redactSecretsStrict(content) : content;
+    const warnings = [];
+    if (kept !== content) {
+        const found = detectSecret({ content, tags: [] }).reason;
+        warnings.push(`secret-shaped text was redacted before storing${found ? ` (${found})` : ''}`);
+    }
+    const left = detectSecret({ content: kept, tags: [...tags] });
+    if (left.flagged) {
+        warnings.push(`content looks like a secret (${left.reason}) and was stored as sent; forget it if it should not be kept`);
+    }
+    return { content: kept, warnings };
+}
+const JSON_STRING = /"(?:[^"\\]|\\.)*"/g;
+/** Appended to a dead-letter row's error when `redactPayload` changed its body. */
+export const DLQ_REDACTED_NOTE = 'secret-shaped text redacted, signature dropped; replay needs --force';
+/** `vetSecrets` redaction for a raw webhook body: JSON stays valid for replay, and an untouched body stays byte-identical so its signature still verifies. */
+export function redactPayload(raw) {
+    try {
+        JSON.parse(raw);
+    }
+    catch {
+        return redactSecretsStrict(raw);
+    }
+    return raw.replace(JSON_STRING, (literal) => {
+        const text = JSON.parse(literal);
+        const kept = redactSecretsStrict(text);
+        return kept === text ? literal : JSON.stringify(kept);
+    });
+}
 function redactText(text, strict) {
     if (!text)
         return text;

package/dist/server.d.ts

@@ -1,6 +1,9 @@
 import { type IncomingMessage } from 'node:http';
 /** Test-only: reset the module-level recall-history Map. Call from beforeEach. */
 export declare function __resetSessionRecallHistoryHttp(): void;
+import { authRevoke, type Actor, type Context } from './api.js';
+import { ForbiddenError } from './api-errors.js';
+export { authRevoke, ForbiddenError, type Context, type Actor };
 export interface ServerHandle {
     port: number;
     url: string;
@@ -15,7 +18,7 @@ export interface ServerHandle {
 export interface ResolvedBearer {
     tenantId: string;
     subject: string;
-    /** Not 'admin' means 'member'. Admin is tenant-only, yet can mint member API keys (POST /v1/auth/keys) that outlive IdP deprovisioning. */
+    /** Not 'admin' means 'member'. Admin is tenant-only, yet can mint member API keys (POST /v1/auth/keys); an add-on revokes them through the exported authRevoke when the IdP deprovisions the minter. */
     role: 'admin' | 'member';
     scopes?: readonly string[];
 }
@@ -56,6 +59,8 @@ export declare function isCrossSite(req: IncomingMessage): boolean;
  * bucket per request and bypass the limiter entirely.
  */
 export declare function clientIpForRateLimit(req: IncomingMessage): string;
+/** Add-ons call this to refuse a subject that would collide with a built-in actor. */
+export declare function isReservedActor(subject: string): boolean;
 /**
  * Boot the HTTP daemon on host:port and write the pidfile under hippoRoot.
  *
@@ -66,7 +71,9 @@ export declare function clientIpForRateLimit(req: IncomingMessage): string;
  * webhooks in PUBLIC_ROUTES, which are HMAC-gated by their own signing
  * secrets and 404 when those secrets are unset. But the loopback
  * no-auth fallback inside buildContextWithAuth still admits unauthenticated
- * requests from a loopback remote address, so binding to a non-loopback host
+ * requests from a loopback remote address (unless they carry Forwarded,
+ * X-Forwarded-For/-Host/-Proto, X-Real-IP, Cf-Connecting-Ip or True-Client-Ip, which mark a same-host proxy and get
+ * a 401 like any keyless remote request), so binding to a non-loopback host
  * is only safe once that fallback is disabled with HIPPO_REQUIRE_AUTH=1,
  * which forces every request (loopback or not) through Bearer-token
  * validation. Without that env var set, a non-loopback bind would expose the