hippo-memory 1.61.0 → 1.62.0

package/dist/project-merge.js

@@ -1,14 +1,19 @@
-// `hippo projects`: list the project names a store holds, fold one into another, and re-tag sleep's old user-global merges.
+// `hippo projects`: list the project names a store holds, fold one into another, and repair old tags in one reversible pass.
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { setAsideRow } from './agent-memories/apply.js';
-import { AGENT_MEMORY_SOURCE_PREFIX, AGENT_MEMORY_TOOLS } from './agent-memories/tools.js';
-import { appendAuditEvent } from './audit.js';
+import { transcriptNotesOrigin } from './agent-memories/claude-code.js';
+import { containerId, containerPrefix } from './agent-memories/source.js';
+import { AGENT_MEMORY_SOURCE_PREFIX, AGENT_MEMORY_TOOLS, toolSourcePrefix } from './agent-memories/tools.js';
+import { appendAuditEvent, queryAuditEvents } from './audit.js';
 import { insertDormantRow, listDormantSnapshots, replaceDormantEntry } from './dormant.js';
+import { processEnv } from './env.js';
 import { calculateStrength } from './memory.js';
+import { deriveOriginProject, isGlobalStoreRoot } from './project-identity.js';
+import { duplicateKey } from './same-text.js';
 import { removeEntryMirrors } from './store/mirrors.js';
 import { deleteEntryRowInTx, writeEntryMirrors } from './store/entry-writes.js';
-import { selectAllEntries } from './store/entry-reads.js';
+import { selectAllEntries, selectLiveEntriesBySourcePrefix } from './store/entry-reads.js';
 const ACTOR = 'cli';
 function isImport(entry) {
     return entry.source.startsWith(AGENT_MEMORY_SOURCE_PREFIX);
@@ -25,8 +30,9 @@ export function listProjects(db, tenantId) {
     for (const e of live) {
         const origin = e.origin_project ?? null;
         byOrigin.set(origin, [...(byOrigin.get(origin) ?? []), e]);
+        const key = duplicateKey(e.content);
         if (isImport(e))
-            holders.set(e.content, (holders.get(e.content) ?? new Set()).add(origin));
+            holders.set(key, (holders.get(key) ?? new Set()).add(origin));
     }
     return [...byOrigin].map(([origin, rows]) => {
         const imports = rows.filter(isImport);
@@ -35,7 +41,7 @@ export function listProjects(db, tenantId) {
             live: rows.length,
             imported: imports.length,
             newest: rows.reduce((max, e) => (e.created > max ? e.created : max), ''),
-            copiesElsewhere: imports.filter((e) => (holders.get(e.content)?.size ?? 0) > 1).length,
+            copiesElsewhere: imports.filter((e) => (holders.get(duplicateKey(e.content))?.size ?? 0) > 1).length,
         };
     }).sort((a, b) => b.newest.localeCompare(a.newest));
 }
@@ -78,44 +84,111 @@ export function mergeProjects(db, hippoRoot, opts) {
     const { tenantId, from, into, dryRun } = opts;
     const backup = dryRun ? null : backupStore(db, hippoRoot, 'before-merge');
     const result = inTransaction(db, dryRun, () => {
-        const rows = selectAllEntries(db, tenantId).filter((e) => e.origin_project === from);
-        const setAside = [];
-        for (const row of rows) {
-            const tag = toolTag(row.source);
-            if (!isImport(row) || row.superseded_by || row.kind === 'raw' || tag === null)
-                continue;
-            if (setAsideRow(db, tag, { ...row, origin_project: into }, 'project-merge').kind === 'dormant')
-                setAside.push(row.id);
-        }
-        const gone = new Set(setAside);
-        const restamped = rows.filter((e) => !gone.has(e.id)).map((e) => e.id);
-        db.prepare(`UPDATE memories SET origin_project = ?, updated_at = datetime('now') WHERE tenant_id = ? AND origin_project = ?`)
-            .run(into, tenantId, from);
-        const dormantRestamped = [];
-        for (const snap of listDormantSnapshots(db, tenantId)) {
-            if (snap.entry.origin_project !== from || gone.has(snap.entry.id))
-                continue;
-            replaceDormantEntry(db, tenantId, snap.entry.id, { ...snap.entry, origin_project: into });
-            dormantRestamped.push(snap.entry.id);
-        }
-        const compactions = Number(db.prepare(`UPDATE compactions SET origin_project = ? WHERE tenant_id = ? AND origin_project = ?`)
-            .run(into, tenantId, from).changes ?? 0);
-        appendAuditEvent(db, {
-            tenantId, actor: ACTOR, op: 'project_merge',
-            metadata: { from, into, backup, setAside, restamped, dormantRestamped, compactions },
-        });
-        return { from, into, setAside, restamped, dormantRestamped, compactions, backup };
+        const folded = foldInTx(db, tenantId, from, into);
+        appendAuditEvent(db, { tenantId, actor: ACTOR, op: 'project_merge', metadata: { from, into, backup, ...folded } });
+        return { from, into, ...folded, backup };
     });
     if (!dryRun)
         refreshMirrors(db, hippoRoot, tenantId, result.restamped, result.setAside);
     return result;
 }
-/** Reads only, so doctor can call it on a read-only handle: what the repair would do to each user-global merged row. */
-export function planUserGlobalRepair(db, tenantId) {
+function foldInTx(db, tenantId, from, into) {
+    const rows = selectAllEntries(db, tenantId).filter((e) => e.origin_project === from);
+    const setAside = [];
+    for (const row of rows) {
+        const tag = toolTag(row.source);
+        if (!isImport(row) || row.superseded_by || row.kind === 'raw' || tag === null)
+            continue;
+        if (setAsideRow(db, tag, { ...row, origin_project: into }, 'project-merge').kind === 'dormant')
+            setAside.push(row.id);
+    }
+    const gone = new Set(setAside);
+    const restamped = rows.filter((e) => !gone.has(e.id)).map((e) => e.id);
+    db.prepare(`UPDATE memories SET origin_project = ?, updated_at = datetime('now') WHERE tenant_id = ? AND origin_project = ?`)
+        .run(into, tenantId, from);
+    const dormantRestamped = [];
+    for (const snap of listDormantSnapshots(db, tenantId)) {
+        if (snap.entry.origin_project !== from || gone.has(snap.entry.id))
+            continue;
+        replaceDormantEntry(db, tenantId, snap.entry.id, { ...snap.entry, origin_project: into });
+        dormantRestamped.push(snap.entry.id);
+    }
+    const compactions = Number(db.prepare(`UPDATE compactions SET origin_project = ? WHERE tenant_id = ? AND origin_project = ?`)
+        .run(into, tenantId, from).changes ?? 0);
+    return { setAside, restamped, dormantRestamped, compactions };
+}
+/** Live imports under a project name whose exact text a user-global import holds: a session folder's notes stamped with the folder it ended in. */
+function importCopies(db, tenantId) {
+    const live = selectAllEntries(db, tenantId).filter((e) => !e.superseded_by && isImport(e));
+    const userGlobal = new Set(live.filter((e) => e.origin_project === '').map((e) => duplicateKey(e.content)));
+    return live.filter((e) => e.origin_project && e.kind !== 'raw' && !e.pinned && toolTag(e.source) !== null && userGlobal.has(duplicateKey(e.content)));
+}
+/** Imports to set aside. The global store also checks each Claude session folder a compaction recorded: its notes under any other project are misfiled, edited or not, and a text copy in the right folder is kept. */
+function strayImports(db, hippoRoot, tenantId) {
+    const copies = importCopies(db, tenantId);
+    if (!isGlobalStoreRoot(hippoRoot))
+        return copies;
+    const machine = { platform: process.platform, env: processEnv() };
+    const { platform } = machine;
+    // SAFETY: the SELECT names the two columns of the row type.
+    const sessions = db.prepare(`SELECT DISTINCT transcript_path AS transcript, cwd FROM compactions WHERE tenant_id = ? AND transcript_path IS NOT NULL`)
+        .all(tenantId);
+    const owners = new Map();
+    for (const { transcript, cwd } of sessions) {
+        const origin = transcriptNotesOrigin(transcript, cwd, machine);
+        const dir = path.join(path.dirname(transcript), 'memory');
+        if (origin !== null)
+            owners.set(dir, (owners.get(dir) ?? new Set()).add(origin));
+    }
+    const tool = toolSourcePrefix('claude-code');
+    const live = selectLiveEntriesBySourcePrefix(db, tenantId, tool).filter((e) => e.kind !== 'raw' && !e.pinned);
+    const origins = new Set(live.map((e) => e.origin_project ?? ''));
+    const right = new Set();
+    const wrong = new Set();
+    for (const [dir, owner] of owners) {
+        if (owner.size !== 1)
+            continue;
+        for (const origin of origins)
+            (owner.has(origin) ? right : wrong).add(containerPrefix('claude-code', containerId(dir, 'project', platform, origin)));
+    }
+    const prefix = (e) => e.source.slice(0, e.source.indexOf('/', tool.length) + 1);
+    const misfiled = live.filter((e) => wrong.has(prefix(e)));
+    const seen = new Set(misfiled.map((e) => e.id));
+    return [...misfiled, ...copies.filter((e) => !seen.has(e.id) && !right.has(prefix(e)))];
+}
+/** Global store only, where a compaction's name came from its cwd: a name whose every cwd still on disk resolves to one other project today. */
+function planFolds(db, tenantId) {
+    // SAFETY: the SELECT names the two columns of the row type.
+    const rows = db.prepare(`SELECT DISTINCT origin_project AS origin, cwd FROM compactions WHERE tenant_id = ? AND origin_project <> '' AND cwd IS NOT NULL`)
+        .all(tenantId);
+    const today = new Map();
+    for (const { origin, cwd } of rows) {
+        if (fs.existsSync(cwd))
+            today.set(origin, (today.get(origin) ?? new Set()).add(deriveOriginProject(cwd)));
+    }
+    // A name someone merged into by hand stays: undoing their choice would rest on the resolver alone.
+    const chosen = new Set(queryAuditEvents(db, { tenantId, op: 'project_merge', limit: 10000 }).map((e) => e.metadata.into));
+    const folds = [...today].flatMap(([from, names]) => {
+        const [into] = names;
+        return names.size === 1 && into !== '' && into !== from && !chosen.has(from) ? [{ from, into }] : [];
+    });
+    // A fold into a name that itself folds would land rows by run order; the next repair takes the rest of the chain.
+    const sources = new Set(folds.map((f) => f.from));
+    return folds.filter((f) => !sources.has(f.into));
+}
+/** Reads only, so doctor and a dry run take no write lock; merged rows are planned before any fold, so a few may re-tag differently once folds apply. */
+export function planProjectRepair(db, hippoRoot, tenantId) {
+    const folds = isGlobalStoreRoot(hippoRoot) ? planFolds(db, tenantId) : [];
+    return { copies: strayImports(db, hippoRoot, tenantId).map((e) => e.id), folds, ...planUserGlobalRepair(db, tenantId, folds) };
+}
+/** Parents read with `folds` already applied, so a plan matches what apply does after folding. */
+function planUserGlobalRepair(db, tenantId, folds) {
     const all = selectAllEntries(db, tenantId);
-    const origins = new Map(listDormantSnapshots(db, tenantId).map((s) => [s.entry.id, s.entry.origin_project ?? null]));
+    const renamed = new Map(folds.map((f) => [f.from, f.into]));
+    const after = (origin) => (origin ? renamed.get(origin) ?? origin : origin ?? null);
+    const origins = new Map(listDormantSnapshots(db, tenantId).map((s) => [s.entry.id, after(s.entry.origin_project)]));
     for (const e of all)
-        origins.set(e.id, e.origin_project ?? null);
+        origins.set(e.id, after(e.origin_project));
     const toProject = [];
     const setAside = [];
     const untraced = [];
@@ -135,14 +208,22 @@ export function planUserGlobalRepair(db, tenantId) {
     }
     return { toProject, setAside, untraced };
 }
-/** Re-tags sleep's merged rows saved as user-global before the fix, by the projects of their parents. */
-export function repairUserGlobalMerges(db, hippoRoot, opts) {
+/** Sets aside stray imports, folds the names the resolver now maps elsewhere, then re-tags sleep's user-global merges by their parents; a dry run only plans. */
+export function repairProjects(db, hippoRoot, opts) {
     const { tenantId, dryRun } = opts;
     if (dryRun)
-        return { ...planUserGlobalRepair(db, tenantId), backup: null };
+        return { ...planProjectRepair(db, hippoRoot, tenantId), backup: null };
     const backup = backupStore(db, hippoRoot, 'before-repair');
-    const result = inTransaction(db, false, () => {
-        const plan = planUserGlobalRepair(db, tenantId);
+    const { result, rewrite, purge } = inTransaction(db, false, () => {
+        const copies = [];
+        for (const row of strayImports(db, hippoRoot, tenantId)) {
+            const tag = toolTag(row.source);
+            if (tag !== null && setAsideRow(db, tag, row, 'project-repair').kind === 'dormant')
+                copies.push(row.id);
+        }
+        const folds = isGlobalStoreRoot(hippoRoot) ? planFolds(db, tenantId) : [];
+        const folded = folds.map((f) => foldInTx(db, tenantId, f.from, f.into));
+        const plan = planUserGlobalRepair(db, tenantId, []);
         const stamp = db.prepare(`UPDATE memories SET origin_project = ?, updated_at = datetime('now') WHERE tenant_id = ? AND id = ?`);
         for (const { id, origin } of plan.toProject)
             stamp.run(origin, tenantId, id);
@@ -152,10 +233,14 @@ export function repairUserGlobalMerges(db, hippoRoot, opts) {
             insertDormantRow(db, { entry: row, strength: calculateStrength(row, now), reason: 'project-repair', dormantAt: now.toISOString() });
             deleteEntryRowInTx(db, row, ACTOR);
         }
-        appendAuditEvent(db, { tenantId, actor: ACTOR, op: 'project_repair', metadata: { backup, ...plan } });
-        return { ...plan, backup };
+        appendAuditEvent(db, { tenantId, actor: ACTOR, op: 'project_repair', metadata: { backup, copies, folds, folded, ...plan } });
+        return {
+            result: { copies, folds, ...plan, backup },
+            rewrite: [...plan.toProject.map((r) => r.id), ...folded.flatMap((f) => f.restamped)],
+            purge: [...copies, ...plan.setAside, ...folded.flatMap((f) => f.setAside)],
+        };
     });
-    refreshMirrors(db, hippoRoot, tenantId, result.toProject.map((r) => r.id), result.setAside);
+    refreshMirrors(db, hippoRoot, tenantId, rewrite, purge);
     return result;
 }
 /** After commit, as the agent memory sync does: a stale mirror would bring the old tag back on the next rebuild. */

package/dist/shared.d.ts

@@ -6,6 +6,7 @@
  */
 import { MemoryEntry } from './memory.js';
 import type { SearchResult, ResultCost } from './search/types.js';
+import type { HybridVectorCandidates } from './search/vector.js';
 import type { DatabaseSyncLike } from './db.js';
 /**
  * Returns the path to the global Hippo store.
@@ -93,6 +94,14 @@ export interface HybridSearchOptions extends SearchOptions {
  * Async version of searchBoth that calls hybridSearch instead of search.
  */
 export declare function searchBothHybrid(query: string, localRoot: string, globalRoot: string, options?: HybridSearchOptions): Promise<SearchResult[]>;
+/** Hybrid ranking of rows already loaded from each store: the local bump, one copy per text, then the shared budget. */
+export declare function rankBothStores(query: string, roots: {
+    local: string;
+    global: string;
+}, entries: {
+    local: MemoryEntry[];
+    global: MemoryEntry[];
+}, vectorCandidates: HybridVectorCandidates, options?: HybridSearchOptions): Promise<SearchResult[]>;
 /** Tags whose rows only a hand-run share or promote may copy to the global store; derived rows inherit them. */
 export declare const NEVER_AUTO_SHARE_TAGS: ReadonlySet<string>;
 export declare function neverAutoShareTags(sources: readonly MemoryEntry[]): string[];

package/dist/shared.js

@@ -148,13 +148,10 @@ export function searchBoth(query, localRoot, globalRoot, options = {}) {
  * Async version of searchBoth that calls hybridSearch instead of search.
  */
 export async function searchBothHybrid(query, localRoot, globalRoot, options = {}) {
-    const { budget = 4000, now = evalNow(), embeddingWeight, explain, mmr, mmrLambda, localBump = 1.2, minResults, cost, scope, includeSuperseded, asOf, tenantId, summaryDeboost, summaryFreshness, entryFilter, recallScope } = options;
+    const { includeSuperseded, asOf, tenantId, entryFilter, recallScope } = options;
     // When an admission filter is active, lift the per-store candidate cap
     // (default 200): excluded rows matching the query could otherwise fill the
     // window before any admitted row is even loaded (codex gating round 6).
-    // Only ambient-context query mode sets entryFilter, and that path is
-    // interactive - never the per-turn pinned-only hook - so ranking the full
-    // match set is acceptable.
     // 5000 = 25x the default 200-row window: large enough that exclusion
     // crowding is a non-issue on real stores, bounded so a common query term
     // on a 100k-row store cannot stall an interactive call by ranking every
@@ -179,8 +176,6 @@ export async function searchBothHybrid(query, localRoot, globalRoot, options = {
     const admit = (e) => passesScope(e) && (!entryFilter || entryFilter(e));
     const localEntries = loadEntries(localRoot).filter(admit);
     const globalEntries = loadEntries(globalRoot).filter(admit);
-    if (localEntries.length === 0 && globalEntries.length === 0)
-        return [];
     // The vector arm loads under the same SQL rules as loadEntries, then the same JS admission.
     const vectorCandidates = {
         tenantId,
@@ -188,9 +183,16 @@ export async function searchBothHybrid(query, localRoot, globalRoot, options = {
         includeSuperseded: !recallScope || Boolean(includeSuperseded) || Boolean(asOf),
         admit,
     };
+    return rankBothStores(query, { local: localRoot, global: globalRoot }, { local: localEntries, global: globalEntries }, vectorCandidates, options);
+}
+/** Hybrid ranking of rows already loaded from each store: the local bump, one copy per text, then the shared budget. */
+export async function rankBothStores(query, roots, entries, vectorCandidates, options = {}) {
+    const { budget = 4000, now = evalNow(), embeddingWeight, explain, mmr, mmrLambda, localBump = 1.2, minResults, cost, scope, includeSuperseded, asOf, summaryDeboost, summaryFreshness } = options;
+    if (entries.local.length === 0 && entries.global.length === 0)
+        return [];
     const shared = { budget, now, embeddingWeight, explain, mmr, mmrLambda, minResults, cost, scope, includeSuperseded, asOf, summaryDeboost, summaryFreshness, vectorCandidates };
-    const localResults = await hybridSearch(query, localEntries, { ...shared, hippoRoot: localRoot });
-    const globalResults = await hybridSearch(query, globalEntries, { ...shared, hippoRoot: globalRoot });
+    const localResults = await hybridSearch(query, entries.local, { ...shared, hippoRoot: roots.local });
+    const globalResults = await hybridSearch(query, entries.global, { ...shared, hippoRoot: roots.global });
     // Tag global results. Local memories get a configurable priority bump.
     const tagged = [
         ...localResults.map((r) => ({

package/dist/skills.js

@@ -111,9 +111,76 @@ function buildSkillContent(skillName, instructions, trigger) {
     content += `\n\n${instructions}`;
     return content;
 }
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
+// Preflight the supersede target BEFORE inserting the new row (so the new
+// autoincrement id can never be its own supersede target); read the
+// predecessor version in the same SELECT for server-derived versioning.
+// Mirrors saveProcess / savePolicy (codex P1 2026-05-28).
+function preflightSkillSupersede(db, tenantId, supersedesId) {
+    // SAFETY: row shape matches the `status, version` columns named in the SELECT below.
+    const pred = db.prepare(`SELECT status, version FROM skills WHERE id = ? AND tenant_id = ?`).get(supersedesId, tenantId);
+    if (!pred) {
+        throw new NotFoundError(`saveSkill: skill ${supersedesId} to supersede not found for tenant ${tenantId}`);
+    }
+    if (pred.status !== 'active') {
+        throw new ConflictError(`saveSkill: skill ${supersedesId} is not active (status='${pred.status}'); only active skills can be superseded.`);
+    }
+    return pred.version + 1;
+}
+function insertSkillRow(db, memoryId, w, version) {
+    const result = db.prepare(`
+    INSERT INTO skills(
+      memory_id, tenant_id, skill_name, instructions, trigger_text, version,
+      status, superseded_by, superseded_at, change_summary, closed_at, created_at
+    ) VALUES (?, ?, ?, ?, ?, ?, 'active', NULL, NULL, ?, NULL, ?)
+  `).run(memoryId, w.tenantId, w.name, w.instructions, w.trigger, version, w.changeSummary, w.now);
+    return Number(result.lastInsertRowid ?? 0);
+}
+function supersedeSkillRow(db, w, supersedesId, skillId, version) {
+    const sup = db.prepare(`
+    UPDATE skills
+    SET status = 'superseded', superseded_by = ?, superseded_at = ?
+    WHERE id = ? AND tenant_id = ? AND status = 'active' AND id != ?
+  `).run(skillId, w.now, supersedesId, w.tenantId, skillId);
+    if (sup.changes === 0) {
+        throw new ConflictError(`saveSkill: skill ${supersedesId} could not be superseded (no longer active or self-reference).`);
+    }
+    appendAuditEvent(db, {
+        tenantId: w.tenantId,
+        actor: w.actor,
+        op: 'skill_supersede',
+        targetId: String(supersedesId),
+        metadata: {
+            skill_id: supersedesId,
+            superseded_by: skillId,
+            new_version: version,
+        },
+    });
+}
+/** The afterWrite body: preflight, INSERT, supersede, reload, create audit, all in one SAVEPOINT. */
+function writeSkillRow(db, memoryId, w) {
+    const version = w.supersedesId !== undefined ? preflightSkillSupersede(db, w.tenantId, w.supersedesId) : 1;
+    const skillId = insertSkillRow(db, memoryId, w, version);
+    if (w.supersedesId !== undefined)
+        supersedeSkillRow(db, w, w.supersedesId, skillId, version);
+    // SAFETY: row's shape matches the columns named in SKILL_COLS above.
+    const row = db.prepare(`SELECT ${SKILL_COLS} FROM skills WHERE id = ?`)
+        .get(skillId);
+    if (!row)
+        throw new Error('saveSkill: failed to reload saved skill row');
+    // GDPR-light metadata: ids + flags only, no skill text.
+    appendAuditEvent(db, {
+        tenantId: w.tenantId,
+        actor: w.actor,
+        op: 'skill_create',
+        targetId: String(skillId),
+        metadata: {
+            skill_id: skillId,
+            version,
+            has_trigger: w.trigger !== null,
+        },
+    });
+    return row;
+}
 /**
  * Create a skill (or a new version that supersedes an existing one). Writes the
  * memory mirror + the skills row atomically inside writeEntry's SAVEPOINT. When
@@ -137,72 +204,21 @@ export function saveSkill(hippoRoot, tenantId, opts, actor = 'cli') {
         baseHalfLifeDays: objectHalfLifeDays(hippoRoot),
         tenantId,
     });
+    const w = {
+        tenantId,
+        actor,
+        name,
+        instructions: opts.instructions,
+        trigger,
+        changeSummary,
+        supersedesId: opts.supersedesSkillId,
+        now,
+    };
     let savedRow;
     writeEntry(hippoRoot, mem, {
         actor,
         afterWrite: (db, memoryId) => {
-            // Preflight the supersede target BEFORE inserting the new row (so the new
-            // autoincrement id can never be its own supersede target); read the
-            // predecessor version in the same SELECT for server-derived versioning.
-            // Mirrors saveProcess / savePolicy (codex P1 2026-05-28).
-            let version = 1;
-            if (opts.supersedesSkillId !== undefined) {
-                // SAFETY: row shape matches the `status, version` columns named in the SELECT below.
-                const pred = db.prepare(`SELECT status, version FROM skills WHERE id = ? AND tenant_id = ?`).get(opts.supersedesSkillId, tenantId);
-                if (!pred) {
-                    throw new NotFoundError(`saveSkill: skill ${opts.supersedesSkillId} to supersede not found for tenant ${tenantId}`);
-                }
-                if (pred.status !== 'active') {
-                    throw new ConflictError(`saveSkill: skill ${opts.supersedesSkillId} is not active (status='${pred.status}'); only active skills can be superseded.`);
-                }
-                version = pred.version + 1;
-            }
-            const result = db.prepare(`
-        INSERT INTO skills(
-          memory_id, tenant_id, skill_name, instructions, trigger_text, version,
-          status, superseded_by, superseded_at, change_summary, closed_at, created_at
-        ) VALUES (?, ?, ?, ?, ?, ?, 'active', NULL, NULL, ?, NULL, ?)
-      `).run(memoryId, tenantId, name, opts.instructions, trigger, version, changeSummary, now);
-            const skillId = Number(result.lastInsertRowid ?? 0);
-            if (opts.supersedesSkillId !== undefined) {
-                const sup = db.prepare(`
-          UPDATE skills
-          SET status = 'superseded', superseded_by = ?, superseded_at = ?
-          WHERE id = ? AND tenant_id = ? AND status = 'active' AND id != ?
-        `).run(skillId, now, opts.supersedesSkillId, tenantId, skillId);
-                if (sup.changes === 0) {
-                    throw new ConflictError(`saveSkill: skill ${opts.supersedesSkillId} could not be superseded (no longer active or self-reference).`);
-                }
-                appendAuditEvent(db, {
-                    tenantId,
-                    actor,
-                    op: 'skill_supersede',
-                    targetId: String(opts.supersedesSkillId),
-                    metadata: {
-                        skill_id: opts.supersedesSkillId,
-                        superseded_by: skillId,
-                        new_version: version,
-                    },
-                });
-            }
-            // SAFETY: row's shape matches the columns named in SKILL_COLS above.
-            const row = db.prepare(`SELECT ${SKILL_COLS} FROM skills WHERE id = ?`)
-                .get(skillId);
-            if (!row)
-                throw new Error('saveSkill: failed to reload saved skill row');
-            savedRow = row;
-            // GDPR-light metadata: ids + flags only, no skill text.
-            appendAuditEvent(db, {
-                tenantId,
-                actor,
-                op: 'skill_create',
-                targetId: String(skillId),
-                metadata: {
-                    skill_id: skillId,
-                    version,
-                    has_trigger: trigger !== null,
-                },
-            });
+            savedRow = writeSkillRow(db, memoryId, w);
         },
     });
     if (!savedRow) {

package/dist/store/search-rows.d.ts

@@ -68,8 +68,8 @@ export declare function loadSearchEntries(hippoRoot: string, query: string, limi
  * mode (its `tenantId` option is optional); `loadSearchRows` already treats
  * undefined as "no tenant filter" for legacy callers.
  */
-export declare function loadRecallSearchEntries(hippoRoot: string, query: string, limit?: number, tenantId?: string, requestedScope?: string, explicitScopeMode?: 'exact' | 'additive', includeSuperseded?: boolean): MemoryEntry[];
-export declare function loadRecallSearchEntriesFromDb(db: DatabaseSyncLike, query: string, limit?: number, tenantId?: string, requestedScope?: string, explicitScopeMode?: 'exact' | 'additive', includeSuperseded?: boolean): MemoryEntry[];
+export declare function loadRecallSearchEntries(hippoRoot: string, query: string, limit?: number, tenantId?: string, requestedScope?: string, explicitScopeMode?: 'exact' | 'additive', includeSuperseded?: boolean, originProject?: string): MemoryEntry[];
+export declare function loadRecallSearchEntriesFromDb(db: DatabaseSyncLike, query: string, limit?: number, tenantId?: string, requestedScope?: string, explicitScopeMode?: 'exact' | 'additive', includeSuperseded?: boolean, originProject?: string): MemoryEntry[];
 /** Which rows the vector arm of hybrid search may add: the same tenant, scope and superseded rules as the lexical load. */
 export interface VectorCandidateSpec {
     tenantId?: string;

package/dist/store/search-rows.js

@@ -22,6 +22,12 @@ function recallScopeClause(col, scopeFilter) {
     // The trailing arm keeps a deliberately requested scope loadable, private or quarantined included.
     return { sql: ` AND (${admitted} OR ${col}scope = ?)`, params: [...RECALL_DEFAULT_DENY_SCOPES, scopeFilter.value] };
 }
+// In SQL, not after the window cut, so other projects' matches cannot crowd the project's own rows out of the LIMIT.
+function withProject(scope, col, originProject) {
+    if (originProject === undefined)
+        return scope;
+    return { sql: `${scope.sql} AND (${col}origin_project = '' OR ${col}origin_project = ?)`, params: [...scope.params, originProject] };
+}
 /** Scope rule for recall: none requested is default-deny; 'exact' narrows to the request; 'additive' adds it to the default set. */
 export function recallScopeFilter(requestedScope, mode) {
     if (!requestedScope)
@@ -29,8 +35,8 @@ export function recallScopeFilter(requestedScope, mode) {
     return mode === 'additive' ? { mode: 'default-deny-or-exact', value: requestedScope } : { mode: 'exact', value: requestedScope };
 }
 const FTS_QUERY_SYNTAX_RE = /fts5: syntax error|unterminated string/i;
-function loadSearchRows(db, query, limit, tenantId, scopeFilter, includeSuperseded = true) {
-    const p = searchPredicates(tenantId, scopeFilter, includeSuperseded);
+function loadSearchRows(db, query, limit, tenantId, scopeFilter, includeSuperseded = true, originProject) {
+    const p = searchPredicates(tenantId, scopeFilter, includeSuperseded, originProject);
     const terms = Array.from(new Set(tokenize(query)));
     if (terms.length === 0) {
         // F3 (v1.7.0) self-review: empty-query path is the second uncapped
@@ -61,7 +67,7 @@ function loadSearchRows(db, query, limit, tenantId, scopeFilter, includeSupersed
     // caller's cap.
     return selectAllCandidates(db, p, limit);
 }
-function searchPredicates(tenantId, scopeFilter, includeSuperseded) {
+function searchPredicates(tenantId, scopeFilter, includeSuperseded, originProject) {
     // tenantId undefined = no tenant filter (legacy callers / cross-deployment
     // helpers). tenantId set = strict tenant isolation, leveraging the composite
     // idx_memories_tenant_created (leading column tenant_id, O(log n) lookup).
@@ -89,8 +95,8 @@ function searchPredicates(tenantId, scopeFilter, includeSuperseded) {
     // by always joining `tenantOnlyPredicate + archivedClauseTenantOnly` where
     // the latter switches between " AND" and " WHERE" based on caller context.
     const archivedClauseTenantOnly = tenantId !== undefined ? ` AND kind != 'archived'` : ` WHERE kind != 'archived'`;
-    const aliasScope = recallScopeClause('m.', scopeFilter);
-    const plainScope = recallScopeClause('', scopeFilter);
+    const aliasScope = withProject(recallScopeClause('m.', scopeFilter), 'm.', originProject);
+    const plainScope = withProject(recallScopeClause('', scopeFilter), '', originProject);
     const scopeParams = aliasScope.params;
     const currentAlias = includeSuperseded ? '' : ' AND m.superseded_by IS NULL';
     const currentNoAlias = includeSuperseded ? '' : ' AND superseded_by IS NULL';
@@ -193,10 +199,10 @@ export function loadSearchEntries(hippoRoot, query, limit = DEFAULT_SEARCH_CANDI
  * mode (its `tenantId` option is optional); `loadSearchRows` already treats
  * undefined as "no tenant filter" for legacy callers.
  */
-export function loadRecallSearchEntries(hippoRoot, query, limit = DEFAULT_SEARCH_CANDIDATE_LIMIT, tenantId, requestedScope, explicitScopeMode = 'exact', includeSuperseded = true) {
+export function loadRecallSearchEntries(hippoRoot, query, limit = DEFAULT_SEARCH_CANDIDATE_LIMIT, tenantId, requestedScope, explicitScopeMode = 'exact', includeSuperseded = true, originProject) {
     const db = openStore(hippoRoot);
     try {
-        return loadRecallSearchEntriesFromDb(db, query, limit, tenantId, requestedScope, explicitScopeMode, includeSuperseded);
+        return loadRecallSearchEntriesFromDb(db, query, limit, tenantId, requestedScope, explicitScopeMode, includeSuperseded, originProject);
     }
     finally {
         closeHippoDb(db);
@@ -204,8 +210,8 @@ export function loadRecallSearchEntries(hippoRoot, query, limit = DEFAULT_SEARCH
 }
 // Split out so callers with an already-open db (Z1 prompt-recall path) skip
 // the initStore+open/close cycle per store per call.
-export function loadRecallSearchEntriesFromDb(db, query, limit = DEFAULT_SEARCH_CANDIDATE_LIMIT, tenantId, requestedScope, explicitScopeMode = 'exact', includeSuperseded = true) {
-    return loadSearchRows(db, query, limit, tenantId, recallScopeFilter(requestedScope, explicitScopeMode), includeSuperseded).map(rowToEntry);
+export function loadRecallSearchEntriesFromDb(db, query, limit = DEFAULT_SEARCH_CANDIDATE_LIMIT, tenantId, requestedScope, explicitScopeMode = 'exact', includeSuperseded = true, originProject) {
+    return loadSearchRows(db, query, limit, tenantId, recallScopeFilter(requestedScope, explicitScopeMode), includeSuperseded, originProject).map(rowToEntry);
 }
 /** The rows nearest `queryVector` that pass `spec`, nearest first. */
 export function loadVectorCandidateEntries(hippoRoot, queryVector, spec) {

package/dist/version.d.ts

@@ -16,7 +16,7 @@
  * an ESM `import` can resolve cleanly, and a hardcoded constant survives
  * any packager that drops .json files.
  */
-export declare const PACKAGE_VERSION = "1.61.0";
+export declare const PACKAGE_VERSION = "1.62.0";
 /** Compares plain x.y.z versions, positive if a > b; tags throw so the rollback guard never misfires silently. */
 export declare function compareSemver(a: string, b: string): number;
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -16,7 +16,7 @@
  * an ESM `import` can resolve cleanly, and a hardcoded constant survives
  * any packager that drops .json files.
  */
-export const PACKAGE_VERSION = '1.61.0';
+export const PACKAGE_VERSION = '1.62.0';
 /** Compares plain x.y.z versions, positive if a > b; tags throw so the rollback guard never misfires silently. */
 export function compareSemver(a, b) {
     const parse = (v) => {

package/extensions/openclaw-plugin/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "hippo-memory",
   "name": "Hippo Memory",
   "description": "Memory for AI agents that learns what is wrong and ranks it down. Injects context at session start and captures errors.",
-  "version": "1.61.0",
+  "version": "1.62.0",
 
   "configSchema": {
     "type": "object",

package/extensions/openclaw-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hippo-memory",
-  "version": "1.61.0",
+  "version": "1.62.0",
   "type": "module",
   "description": "Hippo Memory plugin for OpenClaw - biologically-inspired agent memory",
   "main": "index.ts",

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "hippo-memory",
   "name": "Hippo Memory",
   "description": "Memory for AI agents that learns what is wrong and ranks it down. Injects context at session start and captures errors.",
-  "version": "1.61.0",
+  "version": "1.62.0",
   "configSchema": {
     "type": "object",
     "additionalProperties": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hippo-memory",
-  "version": "1.61.0",
+  "version": "1.62.0",
   "description": "Memory for AI agents that learns what is wrong and ranks it down. MCP server, hooks for Claude Code, OpenCode and Codex, AGENTS.md instructions for Codex, Cursor, OpenClaw and Pi. SQLite, zero runtime deps.",
   "mcpName": "io.github.kitfunso/hippo-memory",
   "type": "module",