hippo-memory 1.58.0 → 1.59.0

package/dist/rerankers/jev.d.ts

@@ -1,5 +1,16 @@
 import type { RerankerFn } from './types.js';
+import type { SearchResult } from '../search.js';
 export declare const JEV_DEFAULT_TOP_K = 40;
+/** The System One `state` and one `noul` question per candidate (`c1`..`cN`). */
+export interface RelevanceRequest {
+    state: string;
+    questions: Record<string, {
+        type: 'noul';
+        instructions: string;
+    }>;
+}
+/** Redacted query plus numbered, redacted, truncated candidates. Shared with CLEF so both arms see matched input. */
+export declare function buildRelevanceRequest(query: string, head: readonly SearchResult[]): RelevanceRequest;
 /** Builds a Jev reranker around the reranker it degrades to. Exported so a test can pass a stand-in. */
 export declare function createJevReranker(localFallback: RerankerFn): RerankerFn;
 /** Track 4 reranker: hosted TypeSafe Jev, opt-in and paid (TYPESAFE_API_KEY), one batched call per recall.

package/dist/rerankers/jev.js

@@ -28,11 +28,8 @@ function parseScores(answers, n) {
     }
     return out;
 }
-/** One batched request for the whole candidate list. Rejects with the reason when there are no usable scores. */
-async function requestScores(query, head) {
-    const key = process.env.TYPESAFE_API_KEY;
-    if (!key)
-        throw new Error('TYPESAFE_API_KEY not set');
+/** Redacted query plus numbered, redacted, truncated candidates. Shared with CLEF so both arms see matched input. */
+export function buildRelevanceRequest(query, head) {
     const lines = head.map((r, i) => `[${i + 1}] ${truncate(redactSecrets(r.entry.content), TRUNCATE_CHARS)}`);
     const state = `Query: ${redactSecrets(query)}\n\nNumbered candidate memories from an AI coding agent's project store:\n\n${lines.join('\n\n')}`;
     const questions = {};
@@ -42,6 +39,14 @@ async function requestScores(query, head) {
             instructions: `Probability that candidate ${i} (numbered in the state above) helps answer the query.`,
         };
     }
+    return { state, questions };
+}
+/** One batched request for the whole candidate list. Rejects with the reason when there are no usable scores. */
+async function requestScores(query, head) {
+    const key = process.env.TYPESAFE_API_KEY;
+    if (!key)
+        throw new Error('TYPESAFE_API_KEY not set');
+    const { state, questions } = buildRelevanceRequest(query, head);
     const parsed = Number.parseInt(process.env.HIPPO_JEV_TIMEOUT_MS ?? '', 10);
     const timeoutMs = parsed > 0 ? parsed : DEFAULT_TIMEOUT_MS;
     const controller = new AbortController();

package/dist/rerankers/types.d.ts

@@ -26,6 +26,20 @@ export interface RerankerOptions {
     /** Per-track config blob; opaque to the seam. */
     config?: Record<string, RerankerConfigValue>;
 }
+/** Which backend and model produced a rerank, or why it fell back. */
+export interface RerankProvenance {
+    /** `cloudflare`, `private-endpoint`, or `native` when the input order was kept. */
+    backend: 'cloudflare' | 'private-endpoint' | 'native';
+    /** Model the caller asked for. */
+    requestedModel: string;
+    /** Model the provider says scored the request, when it reports one. */
+    actualModel?: string;
+    /** Set when the input order was kept instead of a model ranking. */
+    fallbackReason?: string;
+    /** Provider-reported token usage, when sent. */
+    inputTokens?: number;
+    outputTokens?: number;
+}
 export interface RerankResult extends SearchResult {
     /** Score assigned by the reranker. Replaces `score` for downstream
      *  ordering; original `score` preserved on the SearchResult. */
@@ -34,5 +48,7 @@ export interface RerankResult extends SearchResult {
     preRerankRank: number;
     /** 1-indexed rank in the reranker output. */
     postRerankRank: number;
+    /** Recorded by rerankers that track model identity (the CLEF rerankers). */
+    rerankProvenance?: RerankProvenance;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/server.d.ts

@@ -1,6 +1,9 @@
 import { type IncomingMessage } from 'node:http';
 /** Test-only: reset the module-level recall-history Map. Call from beforeEach. */
 export declare function __resetSessionRecallHistoryHttp(): void;
+import { authRevoke, type Actor, type Context } from './api.js';
+import { ForbiddenError } from './api-errors.js';
+export { authRevoke, ForbiddenError, type Context, type Actor };
 export interface ServerHandle {
     port: number;
     url: string;
@@ -15,7 +18,7 @@ export interface ServerHandle {
 export interface ResolvedBearer {
     tenantId: string;
     subject: string;
-    /** Not 'admin' means 'member'. Admin is tenant-only, yet can mint member API keys (POST /v1/auth/keys) that outlive IdP deprovisioning. */
+    /** Not 'admin' means 'member'. Admin is tenant-only, yet can mint member API keys (POST /v1/auth/keys); an add-on revokes them through the exported authRevoke when the IdP deprovisions the minter. */
     role: 'admin' | 'member';
     scopes?: readonly string[];
 }
@@ -56,6 +59,8 @@ export declare function isCrossSite(req: IncomingMessage): boolean;
  * bucket per request and bypass the limiter entirely.
  */
 export declare function clientIpForRateLimit(req: IncomingMessage): string;
+/** Add-ons call this to refuse a subject that would collide with a built-in actor. */
+export declare function isReservedActor(subject: string): boolean;
 /**
  * Boot the HTTP daemon on host:port and write the pidfile under hippoRoot.
  *

package/dist/server.js

@@ -39,7 +39,9 @@ import { handleMcpRequest } from './mcp/server.js';
 import { handleSlackEventsWebhook } from './connectors/slack/webhook.js';
 import { handleGitHubEventsWebhook } from './connectors/github/webhook.js';
 import { HttpError, JSON_HEADERS, BodyTooLargeError, isHeaderString, isJsonObjectRecord, mapApiError, readBody, sendJson, } from './http-util.js';
-import { NotFoundError } from './api-errors.js';
+import { ForbiddenError, NotFoundError } from './api-errors.js';
+// Add-on packages revoke keys through these without importing the whole api surface.
+export { authRevoke, ForbiddenError };
 // Review patch #2: explicit allow-list for unauthenticated /v1/* routes.
 // New unauth routes MUST be added here AND get a corresponding entry in
 // tests/server-bearer-lockdown.test.ts. Do not gate auth elsewhere by
@@ -364,6 +366,11 @@ export function clientIpForRateLimit(req) {
 const RESERVED_ACTOR_NAMES = [
     'api_key', 'localhost', 'cli', 'system', 'mcp', 'connector', 'sleep', 'post-compact', 'recall', 'agent-memories',
 ];
+/** Add-ons call this to refuse a subject that would collide with a built-in actor. */
+export function isReservedActor(subject) {
+    const lower = subject.toLowerCase();
+    return RESERVED_ACTOR_NAMES.some((n) => lower === n || lower.startsWith(`${n}:`));
+}
 function hasControlChar(s) {
     for (let i = 0; i < s.length; i++) {
         const c = s.charCodeAt(i);
@@ -388,8 +395,7 @@ function sanitiseResolved(r) {
     // Padding would let "system " pass the reserved-name check yet read as `system` in an audit log.
     if (hasControlChar(subject) || subject !== subject.trim())
         return null;
-    const lower = subject.toLowerCase();
-    if (RESERVED_ACTOR_NAMES.some((n) => lower === n || lower.startsWith(`${n}:`)))
+    if (isReservedActor(subject))
         return null;
     const clean = { tenantId: tenant, subject, role: role === 'admin' ? 'admin' : 'member' };
     if (Array.isArray(scopes))

package/dist/store.js

@@ -180,9 +180,9 @@ export function serializeEntry(entry) {
     if (tenantId !== 'default') {
         frontmatter['tenant_id'] = tenantId;
     }
-    // v39: origin_project '' (user-global) is meaningful and must round-trip;
-    // only undefined/null (legacy/unstamped) is omitted.
-    if (entry.origin_project !== undefined && entry.origin_project !== null) {
+    // v39: '' (user-global) and null (unknown, hidden by default) must both round-trip;
+    // only undefined (unstamped) is omitted, so a rebuild stamps nothing it can read.
+    if (entry.origin_project !== undefined) {
         frontmatter['origin_project'] = entry.origin_project;
     }
     // Spread into a fresh object literal: dumpFrontmatter's Record<string,
@@ -241,7 +241,7 @@ export function deserializeEntry(raw) {
         owner: data['owner'] === null || data['owner'] === undefined ? null : String(data['owner']),
         artifact_ref: data['artifact_ref'] === null || data['artifact_ref'] === undefined ? null : String(data['artifact_ref']),
         tenantId: data['tenant_id'] === null || data['tenant_id'] === undefined ? 'default' : String(data['tenant_id']),
-        origin_project: data['origin_project'] === null || data['origin_project'] === undefined ? null : String(data['origin_project']),
+        origin_project: !('origin_project' in data) ? undefined : data['origin_project'] === null ? null : String(data['origin_project']),
     };
 }
 function normalizeStringArray(value) {
@@ -1174,7 +1174,7 @@ export function stampOriginProject(hippoRoot, entry) {
     return { ...entry, origin_project: deriveOriginProject(path.dirname(hippoRoot)) };
 }
 /**
- * Import-time variant that ALSO stamps null: used only where evidence exists
+ * Import-time variant for a mirror with no origin field (an explicit null stays null): used only where evidence exists
  * for rows that predate the origin column - the legacy-markdown bootstrap and
  * rebuildIndex import, which are the markdown-store equivalent of the v39 SQL
  * backfill. Same evidence order as the migration: the provenance source
@@ -1183,7 +1183,7 @@ export function stampOriginProject(hippoRoot, entry) {
  * owning project instead of becoming user-global (codex gating round 3 P1).
  */
 function stampOriginProjectForImport(hippoRoot, entry) {
-    if (entry.origin_project !== undefined && entry.origin_project !== null)
+    if (entry.origin_project !== undefined)
         return entry;
     const fromSource = originFromSource(entry.source);
     return {

package/dist/version.d.ts

@@ -16,7 +16,7 @@
  * an ESM `import` can resolve cleanly, and a hardcoded constant survives
  * any packager that drops .json files.
  */
-export declare const PACKAGE_VERSION = "1.58.0";
+export declare const PACKAGE_VERSION = "1.59.0";
 /** Compares plain x.y.z versions, positive if a > b; tags throw so the rollback guard never misfires silently. */
 export declare function compareSemver(a: string, b: string): number;
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -16,7 +16,7 @@
  * an ESM `import` can resolve cleanly, and a hardcoded constant survives
  * any packager that drops .json files.
  */
-export const PACKAGE_VERSION = '1.58.0';
+export const PACKAGE_VERSION = '1.59.0';
 /** Compares plain x.y.z versions, positive if a > b; tags throw so the rollback guard never misfires silently. */
 export function compareSemver(a, b) {
     const parse = (v) => {

package/extensions/openclaw-plugin/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "hippo-memory",
   "name": "Hippo Memory",
   "description": "Memory for AI agents that learns what is wrong and ranks it down. Injects context at session start and captures errors.",
-  "version": "1.58.0",
+  "version": "1.59.0",
 
   "configSchema": {
     "type": "object",

package/extensions/openclaw-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hippo-memory",
-  "version": "1.58.0",
+  "version": "1.59.0",
   "type": "module",
   "description": "Hippo Memory plugin for OpenClaw - biologically-inspired agent memory",
   "main": "index.ts",

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "hippo-memory",
   "name": "Hippo Memory",
   "description": "Memory for AI agents that learns what is wrong and ranks it down. Injects context at session start and captures errors.",
-  "version": "1.58.0",
+  "version": "1.59.0",
   "configSchema": {
     "type": "object",
     "additionalProperties": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hippo-memory",
-  "version": "1.58.0",
+  "version": "1.59.0",
   "description": "Memory for AI agents that learns what is wrong and ranks it down. MCP server, hooks for Claude Code, OpenCode and Codex, AGENTS.md instructions for Codex, Cursor, OpenClaw and Pi. SQLite, zero runtime deps.",
   "mcpName": "io.github.kitfunso/hippo-memory",
   "type": "module",
@@ -34,6 +34,7 @@
     "pretest": "npm run build",
     "test": "vitest run",
     "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
     "test:delivery-ledger": "vitest run tests/delivery-ledger",
     "lint": "oxlint",
     "sbom": "node scripts/sbom.mjs",
@@ -90,9 +91,11 @@
   "devDependencies": {
     "@oxlint/plugins": "^1.78.0",
     "@types/node": "^22.16.0",
+    "@vitest/coverage-v8": "^5.0.3",
     "oxlint": "^1.78.0",
     "typescript": "^5.4.0",
-    "vitest": "^3.2.6"
+    "vite": "^8.3.2",
+    "vitest": "^5.0.3"
   },
   "peerDependenciesMeta": {
     "@xenova/transformers": {