hippo-memory 1.58.0 → 1.60.0

package/dist/extract.js

@@ -2,9 +2,10 @@ import { Layer, createMemory } from './memory.js';
 import { writeEntry } from './store.js';
 import { loadConfig } from './config.js';
 import { RejectedValueError } from './rejection.js';
-import { redactSecrets } from './secret-detect.js';
+import { redactSecretsStrict } from './secret-detect.js';
 import { fetchWithRetry, llmTimeoutMs } from './http-retry.js';
 import { neverAutoShareTags } from './shared.js';
+import { log } from './log.js';
 function isJsonString(value) {
     return typeof value === 'string';
 }
@@ -35,7 +36,7 @@ export async function extractFacts(text, opts) {
             body: JSON.stringify({
                 model,
                 max_tokens: 1200,
-                messages: [{ role: 'user', content: EXTRACTION_PROMPT + redactSecrets(text) }],
+                messages: [{ role: 'user', content: EXTRACTION_PROMPT + redactSecretsStrict(text) }],
             }),
         }, { timeoutMs: llmTimeoutMs(), fetchFn });
     }
@@ -92,22 +93,22 @@ export function storeExtractedFacts(hippoRoot, source, facts) {
     const baseHalfLifeDays = loadConfig(hippoRoot).defaultHalfLifeDays;
     for (const fact of facts) {
         const tags = ['extracted', ...inheritedTags, ...fact.tags];
-        const entry = createMemory(fact.content, {
-            layer: Layer.Semantic,
-            tags,
-            emotional_valence: fact.valence,
-            confidence: 'inferred',
-            source: source.source,
-            extracted_from: source.id,
-            scope: source.scope,
-            // T1 executor check (2026-08-15 hardening pass): same defect as the
-            // consolidate.ts merge/trace passes — createMemory with no tenantId
-            // option stamps 'default' (memory.ts:535) regardless of the source
-            // entry's own tenant. Thread it through so extracted facts land in
-            // the same tenant as the episodic memory they were extracted from.
-            tenantId: source.tenantId,
-            baseHalfLifeDays,
-        });
+        const entry = { ...createMemory(fact.content, {
+                layer: Layer.Semantic,
+                tags,
+                emotional_valence: fact.valence,
+                confidence: 'inferred',
+                source: source.source,
+                extracted_from: source.id,
+                scope: source.scope,
+                // T1 executor check (2026-08-15 hardening pass): same defect as the
+                // consolidate.ts merge/trace passes — createMemory with no tenantId
+                // option stamps 'default' (memory.ts:535) regardless of the source
+                // entry's own tenant. Thread it through so extracted facts land in
+                // the same tenant as the episodic memory they were extracted from.
+                tenantId: source.tenantId,
+                baseHalfLifeDays,
+            }), origin_project: source.origin_project };
         // AT1 containment: a refusal is per-VALUE — one rejected fact must not
         // drop the rest of this batch. writeEntry has already audited the
         // refusal (reject_refusal) before rethrowing, so skip-and-count here.
@@ -124,7 +125,7 @@ export function storeExtractedFacts(hippoRoot, source, facts) {
         entries.push(entry);
     }
     if (rejected > 0) {
-        console.error(`storeExtractedFacts: skipped ${rejected} rejected value(s)`);
+        log.warn(`storeExtractedFacts: skipped ${rejected} rejected value(s)`);
     }
     return entries;
 }

package/dist/graph.js

@@ -19,6 +19,7 @@
  */
 import { openHippoDb, closeHippoDb } from './db.js';
 import { assertTenantId } from './tenant.js';
+import { log } from './log.js';
 const SOURCE_OBJECT_TABLE = {
     decision: 'decisions',
     policy: 'policies',
@@ -665,10 +666,7 @@ export function markGraphDirty(hippoRoot, tenantId, memoryId) {
     catch (err) {
         // Logged (warn) so a SYSTEMATIC enqueue failure surfaces to operators, but
         // swallowed so the already-committed E2 write is never rolled back.
-        // SAFETY: this is a best-effort log message only; property access on any
-        // JS value is safe (undefined if absent), preserving the existing lenient
-        // formatting even when something non-Error was thrown.
-        console.warn(`markGraphDirty: enqueue failed for tenant=${tenantId} memory=${memoryId}: ${err.message}`);
+        log.warn(`markGraphDirty: enqueue failed for tenant=${tenantId} memory=${memoryId}: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
 /**
@@ -707,10 +705,7 @@ export function removeGraphEntitiesForObject(hippoRoot, tenantId, sourceObjectTy
         }
     }
     catch (err) {
-        // SAFETY: this is a best-effort log message only; property access on any
-        // JS value is safe (undefined if absent), preserving the existing lenient
-        // formatting even when something non-Error was thrown.
-        console.warn(`removeGraphEntitiesForObject: failed for tenant=${tenantId} ${sourceObjectType}#${sourceObjectId}: ${err.message}`);
+        log.warn(`removeGraphEntitiesForObject: failed for tenant=${tenantId} ${sourceObjectType}#${sourceObjectId}: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
 /**

package/dist/handoff.js

@@ -25,6 +25,7 @@ export function rowToSessionHandoff(row) {
         }
     }
     catch {
+        // A corrupt column degrades to empty instead of hiding the whole handoff.
         artifacts = [];
     }
     let constraints = [];
@@ -35,6 +36,7 @@ export function rowToSessionHandoff(row) {
         }
     }
     catch {
+        // Same degrade-to-empty rule as artifacts.
         constraints = [];
     }
     let evidence = null;
@@ -43,6 +45,7 @@ export function rowToSessionHandoff(row) {
         evidence = row.evidence_json ? JSON.parse(row.evidence_json) : null;
     }
     catch {
+        // Same degrade rule as artifacts: bad evidence reads as none.
         evidence = null;
     }
     return {

package/dist/hooks.js

@@ -183,6 +183,7 @@ function readCodexWrapperMetadata() {
         return parsed;
     }
     catch {
+        // Unreadable metadata is treated like the missing-file case above.
         return null;
     }
 }
@@ -191,6 +192,7 @@ function readTextFile(filePath) {
         return fs.readFileSync(filePath, 'utf8');
     }
     catch {
+        // Callers treat an unreadable file as absent.
         return null;
     }
 }
@@ -879,6 +881,7 @@ export function uninstallJsonHooks(target) {
         settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
     }
     catch {
+        // Never rewrite a settings file we cannot parse; report nothing uninstalled.
         return false;
     }
     if (!isJsonObject(settings) || !isJsonObject(settings.hooks))

package/dist/importers.js

@@ -14,6 +14,7 @@ import { openHippoDb, closeHippoDb } from './db.js';
 import { RejectedValueError, checkRejectionGuard } from './rejection.js';
 import { loadConfig } from './config.js';
 import { vetSecrets } from './secret-detect.js';
+import { log } from './log.js';
 // ---------------------------------------------------------------------------
 // Shared core: dedup + write
 // ---------------------------------------------------------------------------
@@ -48,7 +49,7 @@ export function importEntries(chunks, source, tags, options) {
             const trimmed = vetSecrets(original, allTags, true).content;
             const wasRedacted = trimmed !== original;
             if (trimmed.length > 1000) {
-                console.error(`Warning: imported memory truncated from ${trimmed.length} to 1000 chars`);
+                log.warn(`imported memory truncated from ${trimmed.length} to 1000 chars`);
             }
             const chunk = trimmed.slice(0, 1000);
             // Skip empty or too-short chunks
@@ -584,7 +585,8 @@ function realpathOrResolve(p) {
     try {
         return fs.realpathSync.native(p);
     }
-    catch {
+    catch (err) {
+        log.debug(`import: realpath fell back to resolve for ${p}: ${err instanceof Error ? err.message : String(err)}`);
         return path.resolve(p);
     }
 }
@@ -890,7 +892,8 @@ function parseJsonArrayLoose(value) {
         const parsed = JSON.parse(value);
         return Array.isArray(parsed) ? parsed.filter(isJsonString) : [];
     }
-    catch {
+    catch (err) {
+        log.debug(`import: unreadable tags_json read as no tags: ${err instanceof Error ? err.message : String(err)}`);
         return [];
     }
 }

package/dist/incidents.js

@@ -48,6 +48,7 @@ function parseLinkedMemoryIds(raw) {
         return [];
     }
     catch {
+        // A malformed list column reads as empty instead of failing the incident read.
         return [];
     }
 }

package/dist/judgment.js

@@ -2,6 +2,7 @@
  *  Regex picks WHAT is a candidate; it cannot say what is worth keeping, so
  *  every captured memory currently lands on a flat schema_fit of 0.5. */
 import { fetchWithRetry } from './http-retry.js';
+import { log } from './log.js';
 const ENDPOINT = 'https://api.typesafe.ai/v1/systemone';
 const DEFAULT_MODEL = 'jev-1.13.0';
 const MAX_CONCURRENCY = 8;
@@ -66,7 +67,8 @@ async function post(content, opts) {
             }),
         }, { timeoutMs: JUDGE_TIMEOUT_MS, fetchFn: opts.fetcher });
     }
-    catch {
+    catch (err) {
+        log.debug(`judge: request failed: ${err instanceof Error ? err.message : String(err)}`);
         return null;
     }
     return res.ok ? res : null;
@@ -87,7 +89,8 @@ export async function judge(content, opts) {
         // optional-chained and range-checked before use, so a lie here returns null.
         data = await res.json();
     }
-    catch {
+    catch (err) {
+        log.debug(`judge: unreadable response: ${err instanceof Error ? err.message : String(err)}`);
         return null;
     }
     const durable = data.answers?.durable?.noul;

package/dist/mcp/server.d.ts

@@ -25,8 +25,13 @@ interface McpResponse {
     error?: {
         code: number;
         message: string;
+        data?: {
+            requestId: string;
+        };
     };
 }
+/** JSON-RPC reply for a request that threw: typed API errors keep their text; anything else is logged and answered generically. */
+export declare function mcpErrorResponse<E>(id: McpResponse['id'], err: E, requestId?: string): McpResponse;
 export type { McpRequest, McpResponse };
 /**
  * Optional execution context threaded from a non-stdio transport. When the

package/dist/mcp/server.js

@@ -9,14 +9,17 @@
  */
 import * as fs from 'fs';
 import * as path from 'path';
+import { randomUUID } from 'node:crypto';
+import { INTERNAL_ERROR_MESSAGE, mapApiError } from '../http-util.js';
+import { log } from '../log.js';
 import { createMemory, Layer, calculateStrength, } from '../memory.js';
 import { fitBudget, estimateTokens } from '../search.js';
 import { evalNow } from '../ablation.js';
-import { loadAllEntries, writeEntry, readEntry, listMemoryConflicts, resolveConflict, countCreatedSinceLastSleep } from '../store.js';
+import { loadStrengthRows, loadTextsHoldingWords, writeEntry, readEntry, listMemoryConflicts, resolveConflict, countCreatedSinceLastSleep } from '../store.js';
 import { shareMemory, listPeers, getGlobalRoot, initGlobal } from '../shared.js';
 import { consolidate } from '../consolidate.js';
 import { fetchGitLog, extractLessons, partitionLessons, isGitRepo } from '../autolearn.js';
-import { dropHeldCopies, duplicateKey, storedTextKeys } from '../same-text.js';
+import { dropHeldCopies, duplicateKey, longestWord, storedTextKeys } from '../same-text.js';
 import { loadConfig } from '../config.js';
 import { confidenceLabel } from '../memory.js';
 import { resolveTenantId } from '../tenant.js';
@@ -50,6 +53,18 @@ export function findHippoRoot(cwd = process.cwd(), opts) {
     const global = getGlobalRoot();
     return fs.existsSync(global) ? global : null;
 }
+/** JSON-RPC reply for a request that threw: typed API errors keep their text; anything else is logged and answered generically. */
+export function mcpErrorResponse(id, err, requestId = randomUUID()) {
+    const { status, message } = mapApiError(err);
+    if (status !== 500)
+        return { jsonrpc: '2.0', id, error: { code: -32603, message } };
+    log.error(`mcp request failed: ${err instanceof Error ? err.message : String(err)}`, { requestId });
+    return {
+        jsonrpc: '2.0',
+        id,
+        error: { code: -32603, message: `${INTERNAL_ERROR_MESSAGE} (request id ${requestId})`, data: { requestId } },
+    };
+}
 /**
  * The api-layer actor for a tool call. Stdio (no ctx) is the local operator
  * and runs as admin; over HTTP the transport's authenticated role is used, so
@@ -477,7 +492,7 @@ function resolveClientKey(ctx) {
 function createGlobalStoreOnFirstRun() {
     initGlobal();
     const root = getGlobalRoot();
-    console.error(`hippo: no memory store found; created the global store at ${root}. Run \`hippo init\` in a project for a project store.`);
+    log.warn(`no memory store found; created the global store at ${root}. Run \`hippo init\` in a project for a project store.`);
     return root;
 }
 // ── Token ledger (ROADMAP TE0) ──
@@ -524,7 +539,7 @@ async function executeTool(name, args, ctx) {
     // resolve tenant from HIPPO_TENANT.
     const hippoRoot = ctx?.hippoRoot ?? findHippoRoot() ?? createGlobalStoreOnFirstRun();
     const config = loadConfig(hippoRoot);
-    // A5: every loadAllEntries() in this server returns to the caller and is
+    // A5: every store read in this server returns to the caller and is
     // tenant-isolated. Resolved once per tool call: prefer the transport's
     // ctx.tenantId so an HTTP Bearer for tenant B doesn't drop to HIPPO_TENANT.
     const tenantId = ctx?.tenantId ?? resolveTenantId({});
@@ -866,7 +881,7 @@ async function executeTool(name, args, ctx) {
                 // Fire-and-forget (never block the response); an unhandled rejection would kill the server, so log it.
                 consolidate(hippoRoot)
                     .catch((err) => {
-                    console.error(`auto-sleep consolidate failed (tenant ${tenantId}): ${err instanceof Error ? err.message : err}`);
+                    log.error(`auto-sleep consolidate failed (tenant ${tenantId}): ${err instanceof Error ? err.message : String(err)}`);
                 })
                     .finally(() => autoSleepInFlight.delete(hippoRoot));
             }
@@ -922,7 +937,8 @@ async function executeTool(name, args, ctx) {
                 + formatMemories(result.entries);
         }
         case 'hippo_status': {
-            const entries = loadAllEntries(hippoRoot, tenantId);
+            // Every row counts toward the averages, so this scans the store, but without its text.
+            const entries = loadStrengthRows(hippoRoot, tenantId);
             const now = evalNow(); // honors HIPPO_FAKE_NOW (eval-only; see ablation.ts)
             let atRisk = 0;
             let totalStrength = 0;
@@ -965,7 +981,7 @@ async function executeTool(name, args, ctx) {
             let added = 0;
             let skipped = 0;
             let rejected = 0;
-            const keys = storedTextKeys(loadAllEntries(hippoRoot, tenantId));
+            const keys = storedTextKeys(loadTextsHoldingWords(hippoRoot, tenantId, lessons.map(longestWord)));
             for (const lesson of lessons) {
                 if (keys.has(duplicateKey(lesson))) {
                     skipped++;
@@ -1138,17 +1154,20 @@ function dispatch(body) {
         req = JSON.parse(body);
     }
     catch {
-        return; // skip malformed
+        log.debug('mcp: skipped a frame that is not valid JSON');
+        return;
     }
     if (!req.method)
         return;
     if (req.method.startsWith('notifications/')) {
-        handleMcpRequest(req).catch(() => { });
+        handleMcpRequest(req).catch((err) => {
+            log.error(`mcp notification ${req.method} failed: ${err instanceof Error ? err.message : String(err)}`);
+        });
         return;
     }
     handleMcpRequest(req).then((resp) => { if (resp)
         send(resp); }).catch((err) => {
-        send({ jsonrpc: '2.0', id: req.id, error: { code: -32603, message: err?.message ?? 'Internal error' } });
+        send(mcpErrorResponse(req.id, err));
     });
 }
 /**
@@ -1171,10 +1190,10 @@ export function startStdioLoop() {
     });
     process.stdin.on('end', () => process.exit(0));
     process.on('uncaughtException', (err) => {
-        process.stderr.write(`hippo-mcp uncaught: ${err?.message ?? err}\n`);
+        log.error(`mcp uncaught: ${err instanceof Error ? err.message : String(err)}`);
     });
     process.on('unhandledRejection', (err) => {
-        process.stderr.write(`hippo-mcp unhandled: ${err instanceof Error ? err.message : String(err)}\n`);
+        log.error(`mcp unhandled: ${err instanceof Error ? err.message : String(err)}`);
     });
 }
 // Auto-start when invoked as the main module (node dist/mcp/server.js or via
@@ -1196,7 +1215,7 @@ const isMainModule = (() => {
         return import.meta.url === mainUrl || import.meta.url === `file:///${argv1.replace(/\\/g, '/')}`;
     }
     catch {
-        return false;
+        return false; // an unreadable argv means this file was imported, not run; never start the stdio loop then
     }
 })();
 if (isMainModule) {

package/dist/memory.d.ts

@@ -135,19 +135,21 @@ export declare function _resetLossAversionRatioCacheForTests(): void;
  * Modulates effective half-life: memories with consistent positive outcomes
  * decay slower; consistent negative outcomes decay faster.
  */
-export declare function calculateRewardFactor(entry: MemoryEntry): number;
+export declare function calculateRewardFactor(entry: Pick<MemoryEntry, 'outcome_positive' | 'outcome_negative'>): number;
 /**
  * Net wrongness: bad outcome marks past good ones, never below zero.
  * Strength halves per unit (capped at 3) and recall stops strengthening
  * the memory, so a correction outranks pinning, error tags and heavy recall.
  */
-export declare function netWrong(entry: MemoryEntry): number;
+export declare function netWrong(entry: Pick<MemoryEntry, 'outcome_positive' | 'outcome_negative'>): number;
 /**
  * Options for decay basis.
  * - clock: wall-clock time (default pre-v0.15)
  * - session: decay by sleep cycle count (for intermittent agents)
  * - adaptive: auto-scale half-life by session frequency (default v0.15+)
  */
+/** What calculateStrength reads, so a caller can score a row without loading its text. */
+export type StrengthInputs = Pick<MemoryEntry, 'pinned' | 'created' | 'last_retrieved' | 'half_life_days' | 'retrieval_count' | 'emotional_valence' | 'outcome_positive' | 'outcome_negative'>;
 export interface DecayOptions {
     decayBasis?: 'clock' | 'session' | 'adaptive';
     /** Average interval between sleep cycles, in days. Used by 'adaptive' and 'session' modes. */
@@ -166,7 +168,7 @@ export interface DecayOptions {
  *
  * Pinned memories skip time decay; being marked wrong still fades them (netWrong).
  */
-export declare function calculateStrength(entry: MemoryEntry, now?: Date, options?: DecayOptions): number;
+export declare function calculateStrength(entry: StrengthInputs, now?: Date, options?: DecayOptions): number;
 /**
  * Derive half-life based on signals, as per PLAN.md table.
  */

package/dist/processes.js

@@ -91,6 +91,7 @@ function parseSteps(raw) {
         return [];
     }
     catch {
+        // Legacy garbage reads back as no steps, per the docblock.
         return [];
     }
 }

package/dist/project-identity.d.ts

@@ -7,7 +7,7 @@
  *   directory is the project root; if none exists, the nearest ancestor
  *   containing `.git` (directory or worktree file).
  * - The user home directory is NEVER a project, even though it contains the
- *   global store at `~/.hippo`. Reaching home ends the walk.
+ *   global store at `~/.hippo`. Reaching home or the temp root (inside home on Windows) ends the walk.
  * - A directory with no marker anywhere up the walk is NOT a project: it
  *   resolves to the user-global identity (empty name), so memories written
  *   there stay injectable everywhere (matches pre-isolation behavior).

package/dist/project-identity.js

@@ -1,6 +1,7 @@
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
+import { log } from './log.js';
 const MAX_WALK_DEPTH = 64;
 const identityCache = new Map();
 /** Clear the per-process identity cache (test seam). */
@@ -15,7 +16,8 @@ export function realpathOrResolve(p) {
     try {
         return fs.realpathSync.native(p);
     }
-    catch {
+    catch (err) {
+        log.debug(`project identity: realpath fell back to resolve for ${p}: ${err instanceof Error ? err.message : String(err)}`);
         return path.resolve(p);
     }
 }
@@ -43,7 +45,8 @@ function isDirectoryAt(p) {
     try {
         return fs.statSync(p).isDirectory();
     }
-    catch {
+    catch (err) {
+        log.debug(`project identity: no marker at ${p}: ${err instanceof Error ? err.message : String(err)}`);
         return false;
     }
 }
@@ -60,9 +63,11 @@ export function resolveProjectIdentity(cwd, opts) {
             return cached;
     }
     const home = realpathOrResolve(opts?.homeDir ?? os.homedir());
-    const stopDir = opts?.stopDir ? realpathOrResolve(opts.stopDir) : null;
+    const stops = [realpathOrResolve(os.tmpdir())];
+    if (opts?.stopDir)
+        stops.push(realpathOrResolve(opts.stopDir));
     const start = realpathOrResolve(startInput);
-    const { hippoRoot, gitRoot, reachedHome } = walkProjectMarkers(start, home, stopDir === null ? [] : [stopDir]);
+    const { hippoRoot, gitRoot, reachedHome } = walkProjectMarkers(start, home, stops);
     let identity;
     const root = hippoRoot ?? gitRoot;
     if (root !== null) {

package/dist/project-merge.d.ts

@@ -0,0 +1,52 @@
+import type { DatabaseSyncLike } from './db.js';
+export interface ProjectSummary {
+    /** '' is user-global, null is unknown; neither can be merged. */
+    readonly origin: string | null;
+    readonly live: number;
+    readonly imported: number;
+    readonly newest: string;
+    /** Imported notes whose text another project name also holds: evidence of a duplicate import, never a merge target. */
+    readonly copiesElsewhere: number;
+}
+export interface MergeResult {
+    readonly from: string;
+    readonly into: string;
+    /** Imported note copies moved to dormant storage; the next sync under `into` imports the notes still on disk. */
+    readonly setAside: readonly string[];
+    readonly restamped: readonly string[];
+    readonly dormantRestamped: readonly string[];
+    readonly compactions: number;
+    readonly backup: string | null;
+}
+export interface RepairResult {
+    readonly toProject: ReadonlyArray<{
+        readonly id: string;
+        readonly origin: string;
+    }>;
+    /** Parents in two projects: the merged text blends them, so it goes dormant and the parents re-merge per project. */
+    readonly setAside: readonly string[];
+    /** No parent left to say which project, or pinned: left as they are, since hiding them would rest on no evidence. */
+    readonly untraced: readonly string[];
+    readonly backup: string | null;
+}
+/** Live rows per project name, newest write first, with how many of its imported notes are copies held elsewhere. */
+export declare function listProjects(db: DatabaseSyncLike, tenantId: string): ProjectSummary[];
+/** Copies the database before a repair writes, so the audit ids plus this file are the way back. */
+export declare function backupStore(db: DatabaseSyncLike, hippoRoot: string, label: string, now?: Date): string;
+/** Refuses user-global and unknown: they are not projects, and folding them would leak or hide every row. */
+export declare function validateMergeNames(from: string, into: string): string | null;
+/** Folds project `from` into `into` for one tenant in one transaction; a dry run rolls back and writes nothing, mirrors included. */
+export declare function mergeProjects(db: DatabaseSyncLike, hippoRoot: string, opts: {
+    tenantId: string;
+    from: string;
+    into: string;
+    dryRun: boolean;
+}): MergeResult;
+/** Reads only, so doctor can call it on a read-only handle: what the repair would do to each user-global merged row. */
+export declare function planUserGlobalRepair(db: DatabaseSyncLike, tenantId: string): Omit<RepairResult, 'backup'>;
+/** Re-tags sleep's merged rows saved as user-global before the fix, by the projects of their parents. */
+export declare function repairUserGlobalMerges(db: DatabaseSyncLike, hippoRoot: string, opts: {
+    tenantId: string;
+    dryRun: boolean;
+}): RepairResult;
+//# sourceMappingURL=project-merge.d.ts.map