hippo-memory 1.61.0 → 1.63.0

package/dist/invalidation.js

@@ -1,5 +1,6 @@
-import { writeEntry } from './store/entry-writes.js';
-import { loadAllEntries, readEntry } from './store/entry-reads.js';
+import { writeEntryOn } from './store/entry-writes.js';
+import { loadAllEntries, selectEntriesByIds } from './store/entry-reads.js';
+import { openStore } from './store/open.js';
 import { openHippoDb, closeHippoDb } from './db.js';
 import { CHURN_STALE_TAG } from './memory.js';
 import { GitReadError, gitLsFilesAtHead, fetchChurnWindowLog, gitGrepPresence, resolveCommitBefore, packageScriptsAt, } from './churn-git.js';
@@ -73,6 +74,7 @@ export function invalidateMatching(hippoRoot, target, tenantId, options) {
         dryRun,
         preview: [],
     };
+    const weakened = [];
     for (const entry of entries) {
         if (options?.onlyId !== undefined) {
             if (entry.id !== options.onlyId)
@@ -106,10 +108,24 @@ export function invalidateMatching(hippoRoot, target, tenantId, options) {
         if (!entry.tags.includes('invalidated')) {
             entry.tags.push('invalidated');
         }
-        writeEntry(hippoRoot, entry);
+        weakened.push(entry);
     }
+    writeEntriesOnOneHandle(hippoRoot, weakened);
     return result;
 }
+/** Each row commits alone, as a run of writeEntry calls would, but the store opens once. */
+function writeEntriesOnOneHandle(hippoRoot, entries) {
+    if (entries.length === 0)
+        return;
+    const db = openStore(hippoRoot);
+    try {
+        for (const entry of entries)
+            writeEntryOn(db, hippoRoot, entry);
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
 const STOPWORDS = new Set([
     'the', 'an', 'is', 'it', 'in', 'on', 'at', 'to', 'for', 'of', 'by',
     'and', 'or', 'but', 'not', 'with', 'from', 'that', 'this', 'was', 'are',
@@ -225,16 +241,11 @@ function emptyChurnResult(dryRun, skippedPinned = [], error) {
         result.error = error;
     return result;
 }
-/** Flags memories whose named file/symbol/script changed or disappeared since storage (or last confirmation); only adds/removes CHURN_STALE_TAG, never confidence/half-life/strength. */
-export function detectChurnStale(hippoRoot, repoRoot, opts) {
-    const dryRun = opts.dryRun === true;
-    if (!opts.projectName)
-        return emptyChurnResult(dryRun);
-    const entries = loadAllEntries(hippoRoot, opts.tenantId);
+function collectChurnCandidates(entries, opts) {
     const skippedPinned = [];
     const candidates = [];
     for (const entry of entries) {
-        if (!entry.origin_project || entry.origin_project !== opts.projectName)
+        if (!entry.origin_project || (entry.origin_project !== opts.projectName && entry.origin_project !== opts.legacyName))
             continue;
         if (entry.superseded_by)
             continue;
@@ -249,6 +260,135 @@ export function detectChurnStale(hippoRoot, repoRoot, opts) {
             continue;
         candidates.push({ entry, refs: extractChurnRefs(entry.content) });
     }
+    return { candidates, skippedPinned };
+}
+function loadChurnGitView(repoRoot, projectName, candidates, anchorOf, needs) {
+    const headFiles = gitLsFilesAtHead(repoRoot);
+    let windowLog = [];
+    if (needs.paths) {
+        const minAnchor = candidates.reduce((min, c) => {
+            const a = anchorOf(c.entry);
+            return min === '' || a < min ? a : min;
+        }, '');
+        windowLog = fetchChurnWindowLog(repoRoot, minAnchor);
+    }
+    const touchedInWindow = new Set();
+    for (const c of windowLog)
+        for (const f of c.files)
+            touchedInWindow.add(f.path);
+    const trackedIndex = buildTrackedIndex(new Set([...headFiles, ...touchedInWindow]));
+    const headIndex = buildTrackedIndex(headFiles);
+    const presentAtHeadSymbols = needs.symbols
+        ? gitGrepPresence(repoRoot, [...new Set(candidates.flatMap((c) => c.refs.symbols))], 'HEAD')
+        : new Set();
+    const anchorCommitCache = new Map();
+    const resolveAnchorCommit = (anchorIso) => {
+        if (!anchorCommitCache.has(anchorIso)) {
+            anchorCommitCache.set(anchorIso, resolveCommitBefore(repoRoot, anchorIso));
+        }
+        return anchorCommitCache.get(anchorIso) ?? null;
+    };
+    const symbolsAtCommit = new Map();
+    const symbolsPresentAt = (hash, symbols) => {
+        const known = symbolsAtCommit.get(hash) ?? new Set();
+        const missing = symbols.filter((s) => !known.has(s));
+        if (missing.length > 0) {
+            for (const s of gitGrepPresence(repoRoot, missing, hash))
+                known.add(s);
+            symbolsAtCommit.set(hash, known);
+        }
+        return known;
+    };
+    const headScripts = needs.scripts ? packageScriptsAt(repoRoot, 'HEAD') : null;
+    const scriptsAtCommit = new Map();
+    const scriptsAt = (hash) => {
+        if (!scriptsAtCommit.has(hash)) {
+            scriptsAtCommit.set(hash, packageScriptsAt(repoRoot, hash));
+        }
+        return scriptsAtCommit.get(hash);
+    };
+    return { repoRoot, projectName, windowLog, trackedIndex, headIndex, presentAtHeadSymbols, headScripts, resolveAnchorCommit, symbolsPresentAt, scriptsAt };
+}
+function pathEvidence(git, paths, anchorTime) {
+    for (const rawPath of paths) {
+        const resolved = resolveTrackedPath(rawPath, git.repoRoot, git.projectName, git.trackedIndex);
+        if (!resolved)
+            continue;
+        if (isTrackedPath(git.headIndex, resolved)) {
+            const changed = git.windowLog.some((c) => new Date(c.date).getTime() > anchorTime && c.files.some((f) => f.path === resolved));
+            if (changed)
+                return `file-changed: ${resolved}`;
+        }
+        else {
+            // --no-renames means a rename shows as a D + A pair, so this also fires for renames.
+            const deleted = git.windowLog.some((c) => new Date(c.date).getTime() > anchorTime &&
+                c.files.some((f) => f.status === 'D' && f.path === resolved));
+            if (deleted)
+                return `file-deleted: ${resolved}`;
+        }
+    }
+    return null;
+}
+function symbolEvidence(git, symbols, anchor) {
+    const absent = symbols.filter((s) => !git.presentAtHeadSymbols.has(s));
+    if (absent.length === 0)
+        return null;
+    const anchorCommit = git.resolveAnchorCommit(anchor);
+    if (!anchorCommit)
+        return null;
+    const presentAtAnchor = git.symbolsPresentAt(anchorCommit, absent);
+    const hit = absent.find((s) => presentAtAnchor.has(s));
+    return hit ? `symbol-gone: \`${hit}\`` : null;
+}
+function scriptEvidence(git, scripts, anchor, headScripts) {
+    const anchorCommit = git.resolveAnchorCommit(anchor);
+    if (!anchorCommit)
+        return null;
+    const anchorScripts = git.scriptsAt(anchorCommit);
+    const hit = anchorScripts
+        ? scripts.find((s) => anchorScripts[s] !== undefined && headScripts[s] === undefined)
+        : undefined;
+    return hit ? `script-gone: ${hit}` : null;
+}
+/** The first churn evidence against one candidate: a changed or deleted file, then a gone symbol, then a gone script. */
+function churnEvidence(git, refs, anchor) {
+    let evidence = pathEvidence(git, refs.paths, new Date(anchor).getTime());
+    if (!evidence && refs.symbols.length > 0)
+        evidence = symbolEvidence(git, refs.symbols, anchor);
+    if (!evidence && refs.scripts.length > 0 && git.headScripts !== null) {
+        evidence = scriptEvidence(git, refs.scripts, anchor, git.headScripts);
+    }
+    return evidence;
+}
+function tagChurnStale(hippoRoot, tenantId, toTag, confirmedAt) {
+    // The git calls above can take seconds; a good outcome landing meanwhile moves the anchor past the evidence.
+    const confirmedNow = queryConfirmedAt(hippoRoot, tenantId);
+    const unconfirmed = toTag.filter((stale) => confirmedNow.get(stale.id) === confirmedAt.get(stale.id));
+    if (unconfirmed.length === 0)
+        return;
+    const db = openStore(hippoRoot);
+    try {
+        const live = selectEntriesByIds(db, unconfirmed.map((stale) => stale.id), tenantId);
+        for (const stale of unconfirmed) {
+            const entry = live.get(stale.id);
+            if (!entry || entry.tags.includes(CHURN_STALE_TAG))
+                continue;
+            const tagged = { ...entry, tags: [...entry.tags, CHURN_STALE_TAG] };
+            writeEntryOn(db, hippoRoot, tagged);
+            live.set(stale.id, tagged); // a repeated id is already tagged, as a fresh read would show
+        }
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+/** Flags memories whose named file/symbol/script changed or disappeared since storage (or last confirmation); only adds/removes CHURN_STALE_TAG, never confidence/half-life/strength. */
+export function detectChurnStale(hippoRoot, repoRoot, opts) {
+    const dryRun = opts.dryRun === true;
+    if (!opts.projectName)
+        return emptyChurnResult(dryRun);
+    const entries = loadAllEntries(hippoRoot, opts.tenantId);
+    const { candidates, skippedPinned } = collectChurnCandidates(entries, opts);
     if (candidates.length === 0)
         return emptyChurnResult(dryRun, skippedPinned);
     const confirmedAt = queryConfirmedAt(hippoRoot, opts.tenantId);
@@ -258,108 +398,24 @@ export function detectChurnStale(hippoRoot, repoRoot, opts) {
         const confirmedMs = confirmed ? Date.parse(confirmed) : NaN;
         return confirmedMs > Date.parse(entry.created) ? new Date(confirmedMs).toISOString() : new Date(entry.created).toISOString();
     };
-    const needsPaths = candidates.some((c) => c.refs.paths.length > 0);
-    const needsSymbols = candidates.some((c) => c.refs.symbols.length > 0);
-    const needsScripts = candidates.some((c) => c.refs.scripts.length > 0);
-    if (!needsPaths && !needsSymbols && !needsScripts) {
+    const needs = {
+        paths: candidates.some((c) => c.refs.paths.length > 0),
+        symbols: candidates.some((c) => c.refs.symbols.length > 0),
+        scripts: candidates.some((c) => c.refs.scripts.length > 0),
+    };
+    if (!needs.paths && !needs.symbols && !needs.scripts) {
         return { checked: candidates.length, marked: 0, alreadyMarked: 0, skippedPinned, dryRun, preview: [] };
     }
     const result = { checked: 0, marked: 0, alreadyMarked: 0, skippedPinned, dryRun, preview: [] };
     try {
-        const headFiles = gitLsFilesAtHead(repoRoot);
-        let windowLog = [];
-        if (needsPaths) {
-            const minAnchor = candidates.reduce((min, c) => {
-                const a = anchorOf(c.entry);
-                return min === '' || a < min ? a : min;
-            }, '');
-            windowLog = fetchChurnWindowLog(repoRoot, minAnchor);
-        }
-        const touchedInWindow = new Set();
-        for (const c of windowLog)
-            for (const f of c.files)
-                touchedInWindow.add(f.path);
-        const trackedIndex = buildTrackedIndex(new Set([...headFiles, ...touchedInWindow]));
-        const headIndex = buildTrackedIndex(headFiles);
-        const presentAtHeadSymbols = needsSymbols
-            ? gitGrepPresence(repoRoot, [...new Set(candidates.flatMap((c) => c.refs.symbols))], 'HEAD')
-            : new Set();
-        const anchorCommitCache = new Map();
-        const resolveAnchorCommit = (anchorIso) => {
-            if (!anchorCommitCache.has(anchorIso)) {
-                anchorCommitCache.set(anchorIso, resolveCommitBefore(repoRoot, anchorIso));
-            }
-            return anchorCommitCache.get(anchorIso) ?? null;
-        };
-        const symbolsAtCommit = new Map();
-        const symbolsPresentAt = (hash, symbols) => {
-            const known = symbolsAtCommit.get(hash) ?? new Set();
-            const missing = symbols.filter((s) => !known.has(s));
-            if (missing.length > 0) {
-                for (const s of gitGrepPresence(repoRoot, missing, hash))
-                    known.add(s);
-                symbolsAtCommit.set(hash, known);
-            }
-            return known;
-        };
-        const headScripts = needsScripts ? packageScriptsAt(repoRoot, 'HEAD') : null;
-        const scriptsAtCommit = new Map();
+        const git = loadChurnGitView(repoRoot, opts.legacyName ?? opts.projectName, candidates, anchorOf, needs);
         // Collected here, written only after every candidate's evidence is
         // computed: a GitReadError thrown mid-loop must never leave an earlier
         // candidate tagged while a later one aborts the run untagged.
         const toTag = [];
         for (const { entry, refs } of candidates) {
             result.checked++;
-            const anchor = anchorOf(entry);
-            const anchorTime = new Date(anchor).getTime();
-            let evidence = null;
-            for (const rawPath of refs.paths) {
-                const resolved = resolveTrackedPath(rawPath, repoRoot, opts.projectName, trackedIndex);
-                if (!resolved)
-                    continue;
-                if (isTrackedPath(headIndex, resolved)) {
-                    const changed = windowLog.some((c) => new Date(c.date).getTime() > anchorTime && c.files.some((f) => f.path === resolved));
-                    if (changed) {
-                        evidence = `file-changed: ${resolved}`;
-                        break;
-                    }
-                }
-                else {
-                    // --no-renames means a rename shows as a D + A pair, so this also fires for renames.
-                    const deleted = windowLog.some((c) => new Date(c.date).getTime() > anchorTime &&
-                        c.files.some((f) => f.status === 'D' && f.path === resolved));
-                    if (deleted) {
-                        evidence = `file-deleted: ${resolved}`;
-                        break;
-                    }
-                }
-            }
-            if (!evidence && refs.symbols.length > 0) {
-                const absent = refs.symbols.filter((s) => !presentAtHeadSymbols.has(s));
-                if (absent.length > 0) {
-                    const anchorCommit = resolveAnchorCommit(anchor);
-                    if (anchorCommit) {
-                        const presentAtAnchor = symbolsPresentAt(anchorCommit, absent);
-                        const hit = absent.find((s) => presentAtAnchor.has(s));
-                        if (hit)
-                            evidence = `symbol-gone: \`${hit}\``;
-                    }
-                }
-            }
-            if (!evidence && refs.scripts.length > 0 && headScripts !== null) {
-                const anchorCommit = resolveAnchorCommit(anchor);
-                if (anchorCommit) {
-                    if (!scriptsAtCommit.has(anchorCommit)) {
-                        scriptsAtCommit.set(anchorCommit, packageScriptsAt(repoRoot, anchorCommit));
-                    }
-                    const anchorScripts = scriptsAtCommit.get(anchorCommit);
-                    const hit = anchorScripts
-                        ? refs.scripts.find((s) => anchorScripts[s] !== undefined && headScripts[s] === undefined)
-                        : undefined;
-                    if (hit)
-                        evidence = `script-gone: ${hit}`;
-                }
-            }
+            const evidence = churnEvidence(git, refs, anchorOf(entry));
             if (!evidence)
                 continue;
             const headline = entry.content.replace(/\s+/g, ' ').slice(0, 60);
@@ -372,18 +428,8 @@ export function detectChurnStale(hippoRoot, repoRoot, opts) {
             result.preview.push({ id: entry.id, headline, evidence, already: false });
             toTag.push(entry);
         }
-        if (!dryRun && toTag.length > 0) {
-            // The git calls above can take seconds; a good outcome landing meanwhile moves the anchor past the evidence.
-            const confirmedNow = queryConfirmedAt(hippoRoot, opts.tenantId);
-            for (const stale of toTag) {
-                if (confirmedNow.get(stale.id) !== confirmedAt.get(stale.id))
-                    continue;
-                const entry = readEntry(hippoRoot, stale.id, opts.tenantId);
-                if (!entry || entry.tags.includes(CHURN_STALE_TAG))
-                    continue;
-                writeEntry(hippoRoot, { ...entry, tags: [...entry.tags, CHURN_STALE_TAG] });
-            }
-        }
+        if (!dryRun && toTag.length > 0)
+            tagChurnStale(hippoRoot, opts.tenantId, toTag, confirmedAt);
     }
     catch (err) {
         if (err instanceof GitReadError)

package/dist/json.d.ts

@@ -0,0 +1,5 @@
+export type JsonValue = string | number | boolean | null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+export declare function isJsonString(value: JsonValue | undefined): value is string;
+//# sourceMappingURL=json.d.ts.map

package/dist/json.js

@@ -0,0 +1,4 @@
+export function isJsonString(value) {
+    return typeof value === 'string';
+}
+//# sourceMappingURL=json.js.map

package/dist/judgment.js

@@ -38,8 +38,7 @@ const KINDS = ['error', 'decision', 'convention', 'preference', 'trivia'];
 const VALENCES = ['critical', 'negative', 'positive', 'neutral'];
 /** Absent key means hippo keeps its pre-Jev behaviour and makes no HTTP call. */
 export function judgmentApiKey() {
-    const key = envTypesafeApiKey()?.trim();
-    return key ? key : undefined;
+    return envTypesafeApiKey();
 }
 function oneOf(value, allowed) {
     return allowed.find((option) => option === value) ?? null;

package/dist/local-embedding.js

@@ -104,7 +104,7 @@ async function loadPipeline(model) {
         if (!pipelineFn)
             return null;
         // The offline bundle used in egress-blocked sandboxes ships only the FP32 model, so use whichever file is on disk.
-        const cacheRoot = envModelCache()?.trim();
+        const cacheRoot = envModelCache();
         const quantized = !cacheRoot
             || fs.existsSync(path.join(cacheRoot, model, 'onnx', 'model_quantized.onnx'));
         try {

package/dist/mcp/admin-tools.js

@@ -5,13 +5,10 @@ import { loadStrengthRows } from '../store/candidates.js';
 import { listMemoryConflicts, resolveConflict } from '../store/conflicts.js';
 import { shareMemory, listPeers } from '../shared.js';
 import { computePredictionBaserate } from '../predictions/store.js';
-import { isJsonString } from './protocol.js';
+import { isJsonString } from '../json.js';
 export function runPredictBaserateTool({ args, ctx, hippoRoot, tenantId }) {
-    // J3 reference-class / planning-fallacy detector. Reads from the E2
-    // predictions table; returns text-only response matching the existing
-    // MCP tool convention (no structured JSON over the wire). Direct call
-    // to computePredictionBaserate; helper opens its own db + emits audit
-    // (single source of truth, no caller-site drift).
+    // Text-only reply, matching the other MCP tools; the helper opens its own db
+    // and emits the audit, so call sites cannot drift.
     const classTag = String(args.class_tag || '').trim();
     if (!classTag)
         return 'No class_tag provided. Usage: pass class_tag matching a class used in past predictions (e.g. "migration-effort").';
@@ -68,8 +65,7 @@ export function runResolveTool({ args, ctx, hippoRoot, tenantId }) {
     const conflictId = Number(args.conflict_id);
     const keepId = String(args.keep || '');
     const forget = Boolean(args.forget);
-    // AT1: optional rejectLoser + reason, threaded straight through to
-    // resolveConflict's opts (plan §5 — mirrors the CLI's --reject-loser).
+    // Optional rejectLoser + reason pass straight to resolveConflict, as the CLI's --reject-loser does.
     const rejectLoser = Boolean(args.rejectLoser);
     const reason = isJsonString(args.reason) ? args.reason : undefined;
     if (isNaN(conflictId) || !keepId)
@@ -77,12 +73,8 @@ export function runResolveTool({ args, ctx, hippoRoot, tenantId }) {
     const result = resolveConflict(hippoRoot, conflictId, keepId, forget, tenantId, {
         rejectLoserValue: rejectLoser,
         reason,
-        // P2 fix: resolveConflict's opts.rejectedBy defaults to 'cli' when
-        // omitted — this call site never passed it, so the tombstone's
-        // rejected_by AND the conflict_resolve audit's actor both landed as
-        // 'cli' even though the caller was MCP. ctx.actor carries the
-        // auth-resolved actor for HTTP-MCP (see McpContext above); stdio
-        // callers pass no ctx, so 'mcp' is the honest fallback there.
+        // rejectedBy defaults to 'cli', so name the real actor for the tombstone and audit:
+        // ctx.actor for HTTP-MCP, 'mcp' for stdio callers, which pass no ctx.
         rejectedBy: ctx?.actor ?? 'mcp',
     });
     if (!result)
@@ -105,9 +97,7 @@ export function runShareTool({ args, hippoRoot, tenantId }) {
     return `Shared [${shared.id}] to global store. Source: ${shared.source}`;
 }
 export function runPeersTool({ tenantId }) {
-    // D4 v1.12.10: tenant-scope the cross-project peer discovery.
-    // tenantId is the caller's tenant (matches hippo_share above);
-    // passing undefined would restore the pre-D4 host-wide behaviour.
+    // Tenant-scope peer discovery to the caller, as hippo_share does; undefined would list host-wide.
     const peers = listPeers(undefined, tenantId);
     if (peers.length === 0)
         return 'No peers found.';

package/dist/mcp/format.js

@@ -120,7 +120,7 @@ export function tailSection(rows) {
     }
     return '\n' + lines.join('\n');
 }
-// J3.2: the hint depends on the query alone, so api.retrieve's copy is the one shown; JSON.stringify fences the phrase.
+// The hint depends on the query alone, so api.retrieve's copy is the one shown; JSON.stringify fences the phrase.
 export function planningSection(r) {
     if (r.planningFallacyHint) {
         const h = r.planningFallacyHint;

package/dist/mcp/framing.js

@@ -1,9 +1,6 @@
-// MCP stdio transport framing.
-//
-// Spec: messages are newline-delimited JSON-RPC, with no embedded newlines.
-//   https://modelcontextprotocol.io/specification/.../basic/transports#stdio
-// We also accept legacy LSP-style `Content-Length` framing so the
-// printf-and-pipe smoke test from issue #13 still works.
+// MCP stdio transport framing: newline-delimited JSON-RPC, no embedded newlines
+// (https://modelcontextprotocol.io/specification/.../basic/transports#stdio). Legacy LSP-style
+// `Content-Length` framing is also accepted so a printf-and-pipe smoke test still works.
 const HEADER_DELIM = Buffer.from('\r\n\r\n');
 export function parseFrame(buffer) {
     // Strip leading whitespace/newlines between messages.

package/dist/mcp/protocol.d.ts

@@ -1,6 +1,7 @@
 import { loadConfig } from '../config.js';
 import type { Actor as ApiActor } from '../api.js';
 import { type ResolveProjectIdentityOpts } from '../project-identity.js';
+import type { JsonValue } from '../json.js';
 /** Same bounded walk as the CLI (ends at home, so HIPPO_HOME wins over ~/.hippo); cwd/opts are the test seam. */
 export declare function findHippoRoot(cwd?: string, opts?: ResolveProjectIdentityOpts): string | null;
 interface McpRequest {
@@ -44,7 +45,7 @@ export interface McpContext {
      * assuming admin, or a member key over HTTP-MCP would act as admin.
      */
     role?: 'admin' | 'member';
-    /** EI2: scope grants for the HTTP-MCP caller's key. Absent for stdio (admin, needs none). */
+    /** Scope grants for the HTTP-MCP caller's key. Absent for stdio (admin, needs none). */
     scopes?: readonly string[];
     viaAuthResolver?: true;
     /** Set by the HTTP transport for the host's operator; a context without a role is in-process and implies it. */
@@ -63,10 +64,6 @@ export interface McpContext {
  * a member key never acts as admin through MCP.
  */
 export declare function mcpActor(ctx: McpContext | undefined): ApiActor;
-export type JsonValue = string | number | boolean | null | JsonValue[] | {
-    [key: string]: JsonValue;
-};
-export declare function isJsonString(v: JsonValue | undefined): v is string;
 export declare function isJsonBoolean(v: JsonValue | undefined): v is boolean;
 export declare function isJsonObjectRecord(v: JsonValue | undefined): v is {
     [key: string]: JsonValue;

package/dist/mcp/protocol.js

@@ -43,9 +43,7 @@ export function mcpActor(ctx) {
         actor.hostAdmin = true;
     return actor;
 }
-export function isJsonString(v) {
-    return typeof v === 'string';
-}
+// ── JSON-ish domain type for untrusted MCP tool-call arguments ──
 export function isJsonBoolean(v) {
     return typeof v === 'boolean';
 }

package/dist/mcp/recall-tools.js

@@ -11,9 +11,11 @@ import { detectAvailabilityBias } from '../availability.js';
 import { openHippoDb, closeHippoDb } from '../db.js';
 import { estimateTokens } from '../token-ledger.js';
 import { assembleCost, assembleText, drillCost, drillText } from '../context-render.js';
-import { mcpActor, isJsonString, isJsonBoolean } from './protocol.js';
+import { mcpActor, isJsonBoolean } from './protocol.js';
 import { sessionRecallHistoryMcp, lastRecalledIds, resolveClientKey } from './session-state.js';
 import { formatContinuityBlock, formatMemories, memoryCost, memoriesReserve, snapshotPiece, handoffPiece, trailPiece, contextCost, tailSection, planningSection, } from './format.js';
+import { isJsonString } from '../json.js';
+import { MAX_ID_LEN } from '../http-util.js';
 function parseRecallArgs(args, defaultBudget) {
     const query = String(args.query || '');
     const budget = Number(args.budget) || defaultBudget;
@@ -35,9 +37,9 @@ function parseRecallArgs(args, defaultBudget) {
     const scorerWindow = args.scorer_window === undefined
         ? undefined
         : Number(args.scorer_window);
-    // session_id drives the goal-stack boost inside api.retrieve; same trim and 256-char cap as fresh_tail_session_id.
+    // session_id drives the goal-stack boost inside api.retrieve; same trim and MAX_ID_LEN cap as fresh_tail_session_id.
     const sessionIdRaw = isJsonString(args.session_id) ? args.session_id.trim() : '';
-    const sessionId = sessionIdRaw.length > 0 && sessionIdRaw.length <= 256
+    const sessionId = sessionIdRaw.length > 0 && sessionIdRaw.length <= MAX_ID_LEN
         ? sessionIdRaw
         : undefined;
     const recallExtra = {};
@@ -71,7 +73,7 @@ function recallPresenter(budget, includeContinuity, anchorRing, queryHash, out)
         const showTail = tailRows.length > 0 && pays(tailSection(tailRows));
         const continuityPiece = includeContinuity && apiResult.continuity ? `\n\n${formatContinuityBlock(apiResult.continuity)}` : '';
         const showContinuity = continuityPiece !== '' && pays(continuityPiece);
-        // J1, J2 and C5: the hints and Cutoff block describe the list MCP shows, not the window band in apiResult.
+        // The hints and Cutoff block describe the list MCP shows, not the window band in apiResult.
         const render = (cut) => {
             const list = dropHeldCopies(cut, (r) => r.entry); // after every cut, so a merged row cut here never hides its sources
             const anchoring = anchorRing ? detectAnchoring(snapshotRing(anchorRing), queryHash, list[0]?.entry.id ?? null) : null;
@@ -168,11 +170,8 @@ function auditRecallHints(call, query, anchorRing, queryHash, rendered) {
             }
         }
         else {
-            // Telemetry: caller had no sessionId so ring tracking skipped.
-            // Per the recall-audit convention at api.ts:854, use SHA-256/16
-            // for prompt hashing (NOT hashQueryText which is FNV-1a 32-bit
-            // for recall matching; brute-force trivial for low-entropy
-            // queries). Codex round-2 P2 catch.
+            // No sessionId, so no ring. Hash the prompt with SHA-256/16 as the recall audit does (api.ts:854):
+            // hashQueryText is FNV-1a 32-bit, trivial to brute-force on low-entropy queries.
             appendRecallAudit(hippoRoot, {
                 tenantId,
                 actor: ctx?.actor ?? 'mcp',
@@ -278,10 +277,8 @@ export function runDrillTool({ args, ctx, hippoRoot, tenantId }) {
         drillExtra.depth = depth;
     const r = apiDrillDown(apiCtx, summaryId, { ...drillExtra, cost: drillCost });
     if ('failure' in r) {
-        // v1.6.4: only not_drillable is caller-actionable. not_found
-        // intentionally collapses cross-tenant + scope-blocked + missing
-        // (codex round 3 P1: distinguishing scope_blocked would leak
-        // private-row existence on this surface).
+        // Only not_drillable is caller-actionable. not_found merges cross-tenant, scope-blocked and
+        // missing, because telling scope_blocked apart would leak private-row existence.
         if (r.failure === 'not_drillable') {
             return `Id ${summaryId} is a leaf row, not a level-2+ summary; nothing to drill into.`;
         }
@@ -303,12 +300,12 @@ export async function runContextTool({ args, ctx, hippoRoot, config, tenantId })
         ? args.scope
         : undefined;
     // The served store names the project (an HTTP daemon runs from anywhere); the global root names none, so stdio falls back to its launch cwd.
-    const storeProject = resolveProjectIdentity(path.dirname(path.resolve(hippoRoot))).name;
+    const storeProject = resolveProjectIdentity(path.dirname(path.resolve(hippoRoot)));
     const result = await apiGetContext({ hippoRoot, tenantId, actor: mcpActor(ctx) }, {
         q: autoDetectContext(),
         budget,
         exactScope,
-        currentProject: storeProject !== '' ? storeProject : resolveProjectIdentity(process.cwd()).name,
+        currentProject: storeProject.name !== '' ? storeProject : resolveProjectIdentity(process.cwd()),
         cost: contextCost,
     });
     lastRecalledIds.set(resolveClientKey(ctx), result.entries.map((r) => r.entry.id));

package/dist/mcp/request.js

@@ -7,11 +7,12 @@ import { openHippoDb, closeHippoDb } from '../db.js';
 import { estimateTokens, recordTokenUse } from '../token-ledger.js';
 import { PACKAGE_VERSION } from '../version.js';
 import { validateToolArgs } from './tool-args.js';
-import { findHippoRoot, isJsonString, isJsonObjectRecord } from './protocol.js';
+import { findHippoRoot, isJsonObjectRecord } from './protocol.js';
 import { TOOLS, TOOLS_BY_NAME, ARGS_CHECKED_BY_API } from './tools.js';
 import { runRecallTool, runAssembleTool, runDrillTool, runContextTool } from './recall-tools.js';
 import { runRememberTool, runOutcomeTool, runLearnTool } from './memory-tools.js';
 import { runPredictBaserateTool, runStatusTool, runConflictsTool, runResolveTool, runShareTool, runPeersTool } from './admin-tools.js';
+import { isJsonString } from '../json.js';
 /**
  * Zero-install first run (`npx -y hippo-memory mcp` with no store anywhere):
  * create the global store instead of failing every tool call, and say so on
@@ -24,7 +25,7 @@ function createGlobalStoreOnFirstRun() {
     log.warn(`no memory store found; created the global store at ${root}. Run \`hippo init\` in a project for a project store.`);
     return root;
 }
-// ── Token ledger (ROADMAP TE0) ──
+// ── Token ledger ──
 const MCP_TOKEN_SURFACES = new Map([
     ['hippo_recall', 'mcp_recall'],
     ['hippo_context', 'mcp_context'],
@@ -83,7 +84,7 @@ async function executeTool(name, args, ctx) {
     // resolve tenant from HIPPO_TENANT.
     const hippoRoot = ctx?.hippoRoot ?? findHippoRoot() ?? createGlobalStoreOnFirstRun();
     const config = loadConfig(hippoRoot);
-    // A5: every store read in this server returns to the caller and is
+    // Every store read in this server returns to the caller and is
     // tenant-isolated. Resolved once per tool call: prefer the transport's
     // ctx.tenantId so an HTTP Bearer for tenant B doesn't drop to HIPPO_TENANT.
     const tenantId = ctx?.tenantId ?? resolveTenantId({});

package/dist/mcp/session-state.js

@@ -1,7 +1,6 @@
 // Per-process state the MCP tools share across calls: recall rings, last recalled ids, auto-sleep runs.
-// v0.33 / J1 — Module-level per-(tenant, session) recall-history ring map
-// for the MCP pipeline. Separate from CLI/HTTP rings per plan v3
-// architecture (per-pipeline rings; no IPC).
+// Per-(tenant, session) recall-history rings for the MCP pipeline, kept apart from
+// the CLI/HTTP rings: each pipeline owns its rings, with no IPC between them.
 export const sessionRecallHistoryMcp = new Map();
 /** Test-only: reset the module-level recall-history Map. Call from beforeEach. */
 export function __resetSessionRecallHistoryMcp() {

package/dist/mcp/stdio.js

@@ -1,8 +1,9 @@
 // Stdio transport: newline-delimited JSON-RPC frames in on stdin, replies out on stdout.
 import { errorFields, log } from '../log.js';
 import { parseFrame } from './framing.js';
-import { mcpErrorResponse, isJsonObjectRecord, isJsonString } from './protocol.js';
+import { mcpErrorResponse, isJsonObjectRecord } from './protocol.js';
 import { handleMcpRequest } from './request.js';
+import { isJsonString } from '../json.js';
 // MCP stdio transport spec: messages are newline-delimited JSON-RPC, no embedded newlines.
 // https://modelcontextprotocol.io/specification/.../basic/transports#stdio
 function send(msg) {