hippo-memory 1.62.0 → 1.63.0

package/README.md

@@ -547,6 +547,15 @@ hippo projects merge hippo-wt-fix hippo --global   # fold an old worktree name i
 hippo projects repair --global                 # set aside note copies, fold old worktree names, re-tag merges
 ```
 
+A project's name is the `id` in a committed `.hippo-project.json`, else its `origin` remote
+(`github.com/acme/api`), else its folder name. So two repos both called `api` no longer share
+memories in the global store. Rows saved under the old folder name stay visible to the
+project, and `hippo projects repair` folds that name into the id unless two projects claim it.
+`hippo sleep` runs that repair once per store after an upgrade, with a backup; in the global store
+it leaves the name folds to you, since only `hippo projects repair --global` lists them for review.
+Set `{"projectIdentity":{"remote":false}}` in the global `config.json` to keep folder names.
+A long-running MCP or HTTP server reads a new project file or remote after a restart.
+
 **See what memory costs in tokens.** Every block of memory text hippo hands an agent (the
 per-prompt hook, the block `hippo compact-resume` restores after compaction, `hippo context`,
 `hippo recall`, the MCP tools, the HTTP API) is recorded in a token ledger: counts, surface

package/dist/agent-memories/apply.d.ts

@@ -24,6 +24,8 @@ export interface ContainerWork {
     readonly adopt: ReadonlyMap<string, readonly MemoryEntry[]>;
     /** Legacy rows a new row of the key supersedes, by key (second round). */
     readonly replace: ReadonlyMap<string, readonly MemoryEntry[]>;
+    /** This container's prefixes under the project's earlier names; their rows move here, so a new id imports nothing twice. */
+    readonly legacyPrefixes: readonly string[];
 }
 export interface ContainerOutcome {
     readonly tally: Tally;

package/dist/agent-memories/apply.js

@@ -1,6 +1,6 @@
 // One container's sync in one transaction on the caller's handle: lookup, plan, then every write (plan designs 6 to 8).
 import { appendAuditEvent } from '../audit.js';
-import { deleteDormantRow, dormantSnapshotsBySourcePrefix, insertDormantRow, readDormantSnapshot } from '../dormant.js';
+import { deleteDormantRow, dormantSnapshotsBySourcePrefix, insertDormantRow, readDormantSnapshot, replaceDormantEntry } from '../dormant.js';
 import { gatedWrite } from '../gated-write.js';
 import { Layer, calculateStrength, createMemory } from '../memory.js';
 import { findRejectedValue, rejectionDigest } from '../rejection.js';
@@ -65,6 +65,8 @@ class ContainerRun {
     }
     run() {
         this.adoptLegacy();
+        for (const old of this.w.legacyPrefixes)
+            this.adoptPrefix(old);
         const live = selectLiveEntriesBySourcePrefix(this.s.db, this.s.tenantId, this.w.prefix);
         for (const row of [...live, ...[...this.w.replace.values()].flat()])
             this.rows.set(row.id, row);
@@ -116,6 +118,26 @@ class ContainerRun {
             }
         }
     }
+    /** Rows filed under an earlier project name keep their id and history; dormant ones move too, scanned only until this prefix holds live rows. */
+    adoptPrefix(old) {
+        const origin = this.s.originProject ?? null;
+        let moved = 0;
+        for (const row of selectLiveEntriesBySourcePrefix(this.s.db, this.s.tenantId, old)) {
+            const source = this.w.prefix + row.source.slice(old.length);
+            const done = this.s.db.prepare(`UPDATE memories SET source = ?, origin_project = COALESCE(?, origin_project) WHERE id = ? AND tenant_id = ? AND source = ?`).run(source, origin, row.id, row.tenantId, row.source);
+            if (Number(done.changes ?? 0) === 0)
+                continue;
+            moved++;
+            this.mirror.push({ ...row, source, origin_project: origin ?? row.origin_project });
+        }
+        this.tally.renamed += moved;
+        if (moved === 0 && (this.w.container.items.length === 0 || selectLiveEntriesBySourcePrefix(this.s.db, this.s.tenantId, this.w.prefix).length > 0))
+            return;
+        for (const snap of dormantSnapshotsBySourcePrefix(this.s.db, this.s.tenantId, old)) {
+            const source = this.w.prefix + snap.entry.source.slice(old.length);
+            replaceDormantEntry(this.s.db, this.s.tenantId, snap.entry.id, { ...snap.entry, source, origin_project: origin ?? snap.entry.origin_project });
+        }
+    }
     refusals() {
         const out = new Map();
         for (const item of this.w.container.items) {

package/dist/agent-memories/claude-code.d.ts

@@ -1,3 +1,4 @@
+import { type ProjectIdentity } from '../project-identity.js';
 import type { Adapter, AdapterContext, Listing } from './types.js';
 /** Claude Code's auto memory folder names for a project: its checkout, which subfolders share, or the folder itself outside a repository. */
 export declare function claudeMemoryFolderNames(projectRoot: string, platform: NodeJS.Platform): Set<string>;
@@ -9,5 +10,5 @@ export declare const claudeCodeAdapter: Adapter;
 /** A session's own notes folder and nothing else, with no git call, so post-compact can read it inside the hook's time limit. */
 export declare function claudeTranscriptListing(ctx: AdapterContext, transcriptPath: string): Listing;
 /** The project a session folder's notes belong to: the one Claude named the folder for, the session's start folder, else cwd or a parent; null when none matches. */
-export declare function transcriptNotesOrigin(transcriptPath: string, cwd: string | null, machine: Pick<AdapterContext, 'platform' | 'env'>): string | null;
+export declare function transcriptNotesProject(transcriptPath: string, cwd: string | null, machine: Pick<AdapterContext, 'platform' | 'env'>): ProjectIdentity | null;
 //# sourceMappingURL=claude-code.d.ts.map

package/dist/agent-memories/claude-code.js

@@ -1,7 +1,7 @@
 // Claude Code's auto memory: frontmatter `.md` notes in a per-project folder, plus the `autoMemoryDirectory` user folder.
 import fs from 'node:fs';
 import path from 'node:path';
-import { deriveOriginProject, realpathOrResolve } from '../project-identity.js';
+import { realpathOrResolve, resolveProjectIdentity } from '../project-identity.js';
 import { isStringValue } from '../capture-contract.js';
 import { isJsonObject } from '../hooks/shared.js';
 import { expandHome, frontmatterField, itemTime, readTextFile, splitFrontmatter } from './files.js';
@@ -52,7 +52,7 @@ export function claudeTranscriptListing(ctx, transcriptPath) {
     return { tool: 'claude-code', home: config, containers: readFolders([folder], 'project', ctx.platform), warnings: [] };
 }
 /** The project a session folder's notes belong to: the one Claude named the folder for, the session's start folder, else cwd or a parent; null when none matches. */
-export function transcriptNotesOrigin(transcriptPath, cwd, machine) {
+export function transcriptNotesProject(transcriptPath, cwd, machine) {
     const fold = (name) => (machine.platform === 'win32' ? name.toLowerCase() : name);
     const folder = fold(path.basename(path.dirname(transcriptPath)));
     const start = transcriptStartCwd(transcriptPath);
@@ -60,13 +60,13 @@ export function transcriptNotesOrigin(transcriptPath, cwd, machine) {
     if (pinned !== null && fold(pinned) === folder) {
         // A pinned name stands for whatever project the session ran in, so its start folder decides.
         const from = start ?? cwd;
-        return from !== null && fs.existsSync(from) ? deriveOriginProject(from) : null;
+        return from !== null && fs.existsSync(from) ? resolveProjectIdentity(from) : null;
     }
     for (const from of [start, cwd]) {
         for (let dir = from === null ? null : path.resolve(from); dir !== null; dir = path.dirname(dir) === dir ? null : path.dirname(dir)) {
             // A folder gone from disk resolves to its bare name, never the project it was in, so it decides nothing.
             if ([dir, realpathOrResolve(dir)].some((d) => fold(claudeFolderName(d)) === folder))
-                return fs.existsSync(dir) ? deriveOriginProject(dir) : null;
+                return fs.existsSync(dir) ? resolveProjectIdentity(dir) : null;
         }
     }
     return null;

package/dist/agent-memories/report.d.ts

@@ -8,6 +8,7 @@ export interface Tally {
     untagged: number;
     unchanged: number;
     adopted: number;
+    renamed: number;
     collapsed: number;
     retagged: number;
     handedOver: number;

package/dist/agent-memories/report.js

@@ -2,7 +2,7 @@
 import { AGENT_MEMORY_TOOLS } from './tools.js';
 export function emptyTally() {
     return {
-        imported: 0, replaced: 0, restored: 0, setAside: 0, untagged: 0, unchanged: 0, adopted: 0, collapsed: 0, retagged: 0,
+        imported: 0, replaced: 0, restored: 0, setAside: 0, untagged: 0, unchanged: 0, adopted: 0, renamed: 0, collapsed: 0, retagged: 0,
         handedOver: 0, duplicate: 0, secret: 0, short: 0, rejected: 0, unread: 0, unreadable: 0, busy: 0,
     };
 }
@@ -47,7 +47,7 @@ export function totalTally(report) {
 const plural = (n, one, many) => `${n} ${n === 1 ? one : many}`;
 const TALLY_WORDS = {
     imported: 'new', replaced: 'replaced', restored: 'brought back', setAside: 'set aside', untagged: 'pinned and kept',
-    unchanged: 'unchanged', adopted: 'taken over from the old Claude import', collapsed: 'duplicates folded', retagged: 'retagged',
+    unchanged: 'unchanged', adopted: 'taken over from the old Claude import', renamed: 'moved to the project id', collapsed: 'duplicates folded', retagged: 'retagged',
     handedOver: 'handed over from the global store', duplicate: 'already stored', secret: 'skipped for a secret', short: 'too short',
     rejected: 'skipped as rejected', unread: 'files skipped', unreadable: 'unreadable folders', busy: 'busy folders',
 };

package/dist/agent-memories/sync.js

@@ -6,7 +6,8 @@ import path from 'node:path';
 import { errorMessage } from '../log.js';
 import { loadConfig } from '../config.js';
 import { closeHippoDb, isSqliteBusy, openHippoDb } from '../db.js';
-import { deriveOriginProject, isGlobalStoreRoot, resolveGlobalRootDir } from '../project-identity.js';
+import { namesFoldedInto } from '../project-merge.js';
+import { isGlobalStoreRoot, originInSql, projectNames, resolveGlobalRootDir, resolveProjectIdentity } from '../project-identity.js';
 import { duplicateKey, heldTextKeys } from '../same-text.js';
 import { removeEntryMirrors } from '../store/mirrors.js';
 import { initStore, isInitialized } from '../store/open.js';
@@ -15,7 +16,7 @@ import { selectLiveEntriesBySourcePrefix } from '../store/entry-reads.js';
 import { updateStats } from '../store/index-and-stats.js';
 import { resolveTenantId } from '../tenant.js';
 import { setAsideRow, syncContainer } from './apply.js';
-import { claudeCodeAdapter, claudeTranscriptListing, transcriptNotesOrigin } from './claude-code.js';
+import { claudeCodeAdapter, claudeTranscriptListing, transcriptNotesProject } from './claude-code.js';
 import { codexAdapter } from './codex.js';
 import { copilotAdapter } from './copilot.js';
 import { geminiAdapter } from './gemini.js';
@@ -43,14 +44,14 @@ export function importForStore(hippoRoot, opts) {
 export function importProjectMemories(hippoRoot, opts) {
     const ctx = context(opts.machine, { projectRoot: path.dirname(hippoRoot) });
     return runPass({
-        scope: 'project', target: hippoRoot, invoking: hippoRoot, list: (a) => a.list(ctx, 'project'), legacy: true, originProject: undefined, handover: true,
+        scope: 'project', target: hippoRoot, invoking: hippoRoot, list: (a) => a.list(ctx, 'project'), legacy: true, originProject: undefined, legacyOrigins: [], handover: true,
     }, opts);
 }
 /** Every tool's user-level memory into the global store, created on demand, with no origin. */
 export function importUserMemories(invokingRoot, opts) {
     const ctx = context(opts.machine, {});
     return runPass({
-        scope: 'user', target: resolveGlobalRootDir(), invoking: invokingRoot, list: (a) => a.list(ctx, 'user'), legacy: false, originProject: '', handover: false,
+        scope: 'user', target: resolveGlobalRootDir(), invoking: invokingRoot, list: (a) => a.list(ctx, 'user'), legacy: false, originProject: '', legacyOrigins: [], handover: false,
     }, opts);
 }
 /** Session end in a folder with no store of its own: the session's project into the global store with its origin, the session folder's notes, then the user pass. */
@@ -58,7 +59,7 @@ export function importAtSessionEnd(cwd, transcriptPath, opts) {
     const globalRoot = resolveGlobalRootDir();
     const ctx = context(opts.machine, { projectRoot: cwd });
     const report = runPass({
-        scope: 'project', target: globalRoot, invoking: globalRoot, list: (a) => a.list(ctx, 'project'), legacy: false, originProject: deriveOriginProject(cwd), handover: false,
+        scope: 'project', target: globalRoot, invoking: globalRoot, list: (a) => a.list(ctx, 'project'), legacy: false, ...projectOrigins(resolveProjectIdentity(cwd)), handover: false,
     }, opts);
     if (transcriptPath !== undefined)
         mergeReports(report, importSessionFolder(globalRoot, transcriptPath, cwd, opts));
@@ -67,18 +68,21 @@ export function importAtSessionEnd(cwd, transcriptPath, opts) {
 }
 /** The session folder's notes under the project Claude filed them for, never cwd's: a session begun at home keeps its home notes user-global wherever it ends. No git call, so post-compact can run it. */
 export function importSessionFolder(hippoRoot, transcriptPath, cwd, opts) {
-    const origin = transcriptNotesOrigin(transcriptPath, cwd, opts.machine);
-    if (origin === null)
+    const project = transcriptNotesProject(transcriptPath, cwd, opts.machine);
+    if (project === null)
         return emptyReport();
     // A project store takes its own project's notes; another project's, or home's, go to the global store, which parts them by origin.
-    const own = isGlobalStoreRoot(hippoRoot) || origin === deriveOriginProject(path.dirname(hippoRoot));
+    const own = isGlobalStoreRoot(hippoRoot) || project.name === resolveProjectIdentity(path.dirname(hippoRoot)).name;
     const target = own ? hippoRoot : resolveGlobalRootDir();
     const ctx = context(opts.machine, {});
     return runPass({
-        scope: 'project', target, invoking: hippoRoot, legacy: false, originProject: origin, handover: false,
+        scope: 'project', target, invoking: hippoRoot, legacy: false, ...projectOrigins(project), handover: false,
         list: (a) => (a.tool === 'claude-code' ? claudeTranscriptListing(ctx, transcriptPath) : null),
     }, opts);
 }
+function projectOrigins(project) {
+    return { originProject: project.name, legacyOrigins: projectNames(project).slice(1) };
+}
 function context(machine, extra) {
     return { home: machine.home, env: machine.env, platform: machine.platform, ...extra };
 }
@@ -183,11 +187,12 @@ function syncStore(pass, listings, store, opts, report) {
         tenantId,
         baseHalfLifeDays: loadConfig(store.root).defaultHalfLifeDays,
         originProject: pass.originProject,
-        isDuplicate: duplicateCheck(store, tenantId, pass.originProject, legacy?.adopted ?? new Set()),
+        isDuplicate: duplicateCheck(store, tenantId, [pass.originProject ?? '', ...pass.legacyOrigins], legacy?.adopted ?? new Set()),
         dryRun: opts.dryRun === true,
     };
     // A project's rows in the global store are parted by origin: a worktree and its main checkout share a Claude folder.
     const partition = store.global && pass.scope === 'project' ? pass.originProject ?? '' : null;
+    const earlier = partition === null || partition === '' ? [] : earlierNames(store.db, tenantId, partition, pass.legacyOrigins);
     const synced = [];
     let remembered = 0;
     for (const listing of listings) {
@@ -198,7 +203,7 @@ function syncStore(pass, listings, store, opts, report) {
                 out.tally.unreadable++;
                 continue;
             }
-            const work = containerWork(tool, container, opts.machine.platform, legacy, partition ?? '');
+            const work = containerWork(tool, container, opts.machine.platform, legacy, partition ?? '', earlier);
             const outcome = syncOne(session, work, out, report);
             if (outcome === null)
                 continue;
@@ -208,21 +213,28 @@ function syncStore(pass, listings, store, opts, report) {
                 afterCommit(store.root, outcome, report);
         }
         if (session.dryRun)
-            out.unlisted += unlistedRows(store.db, tenantId, tool, pass.scope, listing, opts.machine.platform, partition);
+            out.unlisted += unlistedRows(store.db, tenantId, tool, pass.scope, listing, opts.machine.platform, partition === null ? null : [partition, ...earlier]);
     }
     if (remembered > 0 && !session.dryRun)
         bumpRemembered(store.root, remembered, report);
     return synced;
 }
-function containerWork(tool, container, platform, legacy, origin) {
+/** The legacy names plus every name a merge or repair folded into the project; the audit read runs once per pass. */
+function earlierNames(db, tenantId, id, legacyOrigins) {
+    const names = [id, ...legacyOrigins];
+    return [...legacyOrigins, ...namesFoldedInto(db, tenantId, names)].filter((n) => n !== '' && n !== id);
+}
+function containerWork(tool, container, platform, legacy, origin, earlier) {
     const none = new Map();
     const own = tool.id === 'claude-code' ? legacy?.byContainer.get(container.path) : undefined;
+    const prefixOf = (name) => containerPrefix(tool.id, containerId(container.path, container.scope, platform, name));
     return {
         tool,
         container,
-        prefix: containerPrefix(tool.id, containerId(container.path, container.scope, platform, origin)),
+        prefix: prefixOf(origin),
         adopt: own?.adopt ?? none,
         replace: own?.replace ?? none,
+        legacyPrefixes: earlier.map(prefixOf),
     };
 }
 /** Null when the container was skipped: a busy store waits for the next sync, any other failure is a warning and the sync goes on. */
@@ -265,27 +277,27 @@ function bumpRemembered(root, remembered, report) {
     }
 }
 /** Design 6: only text stored by another path counts, and in the global store only rows visible where the new row goes. */
-function duplicateCheck(store, tenantId, origin, adopted) {
+function duplicateCheck(store, tenantId, origins, adopted) {
     let keys = null;
     return (text) => {
-        keys ??= otherPathKeys(store, tenantId, origin ?? '', adopted);
+        keys ??= otherPathKeys(store, tenantId, origins, adopted);
         return keys.has(duplicateKey(text));
     };
 }
-function otherPathKeys(store, tenantId, origin, adopted) {
-    const visible = store.global ? ` AND (origin_project = '' OR origin_project = ?)` : '';
-    const params = store.global ? [tenantId, AGENT_MEMORY_SOURCE_PREFIX, origin] : [tenantId, AGENT_MEMORY_SOURCE_PREFIX];
+function otherPathKeys(store, tenantId, origins, adopted) {
+    const visible = store.global ? ` AND (origin_project = '' OR ${originInSql(origins)})` : '';
+    const params = store.global ? [tenantId, AGENT_MEMORY_SOURCE_PREFIX, ...origins] : [tenantId, AGENT_MEMORY_SOURCE_PREFIX];
     // SAFETY: the SELECT names the three columns of the row type.
     const rows = store.db.prepare(`SELECT id, content, source FROM memories
       WHERE tenant_id = ? AND superseded_by IS NULL AND substr(source, 1, ${AGENT_MEMORY_SOURCE_PREFIX.length}) != ?${visible}`).all(...params);
     return new Set(rows.filter((r) => !adopted.has(r.id)).flatMap(heldTextKeys));
 }
-/** Dry run only: kept rows of this scope in containers this run did not list (a moved project's old folder); `partition` limits it to one origin. */
+/** Dry run only: kept rows of this scope in containers this run did not list (a moved project's old folder); `partition` limits it to one project's names. */
 function unlistedRows(db, tenantId, tool, scope, listing, platform, partition) {
-    const listed = listing.containers.map((c) => containerPrefix(tool.id, containerId(c.path, c.scope, platform, partition ?? '')));
+    const listed = listing.containers.flatMap((c) => (partition ?? ['']).map((name) => containerPrefix(tool.id, containerId(c.path, c.scope, platform, name))));
     return selectLiveEntriesBySourcePrefix(db, tenantId, `${toolSourcePrefix(tool.id)}${scope === 'project' ? 'p' : 'u'}-`)
         .filter((row) => row.tags.includes(tool.tag) && !listed.some((p) => row.source.startsWith(p)))
-        .filter((row) => partition === null || (row.origin_project ?? '') === partition).length;
+        .filter((row) => partition === null || partition.includes(row.origin_project ?? '')).length;
 }
 /** Design 2's handover: rows the store-less hook path left in the global store, under this project's origin, for containers its store now syncs. */
 function handOver(synced, projectRoot, opts, report) {
@@ -297,7 +309,9 @@ function handOver(synced, projectRoot, opts, report) {
         db = openHippoDb(globalRoot, { busyWaitMs: opts.busyWaitMs });
         const tenantId = resolveTenantId({});
         // A folder with no git and no marker wrote as '' before its store existed, and as its own name after.
-        const origins = [...new Set([deriveOriginProject(projectRoot), ''])];
+        // Names folded into this project's in the global store were its rows too.
+        const names = projectNames(resolveProjectIdentity(projectRoot));
+        const origins = [...new Set([...names, ...namesFoldedInto(db, tenantId, names), ''])];
         for (const work of synced)
             handOverContainer(db, globalRoot, tenantId, work, origins, opts.machine.platform, report);
     }

package/dist/ambient-store.d.ts

@@ -2,10 +2,10 @@ import { type AmbientTallies } from './ambient.js';
 /** The rows an ambient summary describes: a context read's envelope, origin partition and tag secret veto. */
 export interface AmbientStoreFilter {
     exactScope?: string;
-    /** Rows of this project and user-global rows pass; absent admits every origin. */
-    project?: string;
-    /** The reader's project: a secret-tagged row counts only inside its own non-empty origin project. */
-    currentProject: string;
+    /** Rows carrying one of these project names, and user-global rows, pass; absent admits every origin. */
+    project?: readonly string[];
+    /** The reader's project names: a secret-tagged row counts only inside its own non-empty origin project. */
+    currentProject: readonly string[];
     now: Date;
 }
 /** Whole-store ambient tallies in one aggregate pass, no row loaded. Content-pattern secrets and session-local

package/dist/ambient-store.js

@@ -3,6 +3,7 @@ import { strengthSql } from './memory.js';
 import { RECALL_DEFAULT_DENY_SCOPES } from './recall-scope.js';
 import { SECRET_TAGS } from './secret-detect.js';
 import { openStore } from './store/open.js';
+import { originInSql } from './project-identity.js';
 import { isErrorTagged } from './ambient.js';
 // A malformed or non-array JSON list reads as empty, as parseJsonArray does, instead of failing json_each.
 const jsonList = (column) => `(CASE WHEN json_valid(${column}) AND json_type(${column}) = 'array' THEN ${column} ELSE '[]' END)`;
@@ -19,8 +20,8 @@ function contextRowsWhere(tenantId, filter) {
         params.push(...RECALL_DEFAULT_DENY_SCOPES);
     }
     if (filter.project !== undefined) {
-        where.push(`(origin_project = '' OR origin_project = ?)`);
-        params.push(filter.project);
+        where.push(`(origin_project = '' OR ${originInSql(filter.project)})`);
+        params.push(...filter.project);
     }
     return { where, params };
 }
@@ -57,7 +58,7 @@ export function loadAmbientTallies(hippoRoot, tenantId, filter) {
       '[' || COALESCE(group_concat(${jsonList('tags_json')}, ','), '') || ']' AS tagLists
       FROM memories
       WHERE ${where.join(' AND ')}
-        AND ((origin_project = ? AND origin_project != '') OR NOT ${secret.sql})`).get(sevenDaysAgo, ...params, filter.currentProject, ...secret.params);
+        AND ((${originInSql(filter.currentProject)} AND origin_project != '') OR NOT ${secret.sql})`).get(sevenDaysAgo, ...params, ...filter.currentProject, ...secret.params);
         const tagCounts = new Map();
         let errors = 0;
         const lists = /* SAFETY: jsonList yields an array per row, joined into one array */ JSON.parse(row.tagLists);

package/dist/api/assemble.d.ts

@@ -1,6 +1,7 @@
 import type { Context } from './types.js';
+export declare const DEFAULT_ASSEMBLE_BUDGET = 4000;
 export interface AssembleOpts {
-    /** Token budget. Default 4000. */
+    /** Token budget. Default DEFAULT_ASSEMBLE_BUDGET. */
     budget?: number;
     /** Recent raw rows always kept verbatim. Default 10. */
     freshTailCount?: number;
@@ -8,7 +9,7 @@ export interface AssembleOpts {
      *  ancestor. Default true. */
     summarizeOlder?: boolean;
     /**
-     * Restrict to a specific scope. v1.6.1 senior-review P1 #3 parity with
+     * Restrict to a specific scope, same rule as
      * `recall`: when set, exact match required (so an authorised caller can
      * assemble a `slack:private:CSEC` session by passing scope explicitly).
      * When undefined, default-deny applies to ANY `<source>:private:*` and
@@ -49,19 +50,15 @@ export interface AssembleResult {
     items: AssembledContextItem[];
     tokens: number;
     /**
-     * Tenant + scope-filtered raw row count for the session — what the caller
-     * could have seen given their grant. Pre-v1.6.1 was pre-filter (confusing
-     * for all-private sessions); pre-v1.6.3 was capped (under-reported on
-     * sessions > rowCap). v1.6.3 reports the FULL post-filter count via a
-     * separate COUNT(*) query so consumers can render "session has N msgs"
-     * accurately even when items[] is the windowed view.
+     * Tenant + scope-filtered raw row count for the session, uncapped by `rowCap`, so
+     * "session has N msgs" stays accurate when items[] is the windowed view.
      */
     totalRaw: number;
     summarized: number;
     evicted: number;
     /**
-     * True when `rowCap` truncated the loaded window. With v1.6.2's NEWEST-cap
-     * semantics, the items[] array represents the freshest tail of the session;
+     * True when `rowCap` truncated the loaded window. The cap keeps the NEWEST
+     * rows, so the items[] array represents the freshest tail of the session;
      * older rows beyond the cap are silently absent. Use `totalRaw - items.length
      * - summarized + ...` to estimate how much you didn't see, or widen `rowCap`.
      */

package/dist/api/assemble.js

@@ -2,6 +2,7 @@
 import { loadEntriesByIds, loadSessionRawMemories, countSessionRawMemories } from '../store/entry-reads.js';
 import { estimateTokens } from '../token-ledger.js';
 import { passesScopeFilterForRecall, assertScopeRequestAllowed } from '../recall-scope.js';
+export const DEFAULT_ASSEMBLE_BUDGET = 4000;
 /**
  * Build a chronologically-ordered context window for a session. Adapts the
  * lossless-claw context-engine pattern to Hippo's score-ranked memory store.
@@ -26,7 +27,7 @@ import { passesScopeFilterForRecall, assertScopeRequestAllowed } from '../recall
  */
 export function assemble(ctx, sessionId, opts = {}) {
     assertScopeRequestAllowed(ctx.actor, opts.scope);
-    const budget = opts.budget ?? 4000;
+    const budget = opts.budget ?? DEFAULT_ASSEMBLE_BUDGET;
     const freshTailCount = opts.freshTailCount ?? 10;
     const summarizeOlder = opts.summarizeOlder ?? true;
     const rowCap = opts.rowCap ?? 5000;
@@ -35,17 +36,12 @@ export function assemble(ctx, sessionId, opts = {}) {
     }
     const rows = loadSessionRawMemories(ctx.hippoRoot, sessionId, ctx.tenantId, rowCap);
     const truncated = rows.length === rowCap;
-    // v1.6.3 senior-review P0-1: report the FULL post-filter row count even
-    // when the cap windows the loaded set. Pre-v1.6.3 used `scoped.length`
-    // which under-reported on long sessions and made consumers render
-    // wrong "session has N msgs" UX.
+    // `scoped.length` under-counts a capped session, so totalRaw falls back to a COUNT below.
     const scoped = rows.filter((r) => passesScopeFilterForRecall(r.scope ?? null, opts.scope));
     let totalRaw;
     if (truncated) {
-        // v1.6.3 codex P1 / senior P0: scope-aware unbounded COUNT. The helper
-        // SQL-encodes the same default-deny rule passesScopeFilterForRecall
-        // applies in TS, so a no-scope caller cannot infer private rows by
-        // comparing totalRaw to items.length on a truncated session.
+        // The COUNT applies the same default-deny scope rule in SQL, so a no-scope
+        // caller cannot infer private rows by comparing totalRaw to items.length.
         totalRaw = countSessionRawMemories(ctx.hippoRoot, sessionId, ctx.tenantId, opts.scope);
     }
     else {
@@ -69,9 +65,8 @@ export function assemble(ctx, sessionId, opts = {}) {
         isFreshTail: true,
         strength: r.strength,
     }));
-    // F4 (v1.6.5): byte compare canonical UTC ISO timestamps. ~50× faster than
-    // localeCompare and chronological by virtue of the timestamp invariant
-    // documented in src/memory.ts above MemoryEntry.
+    // Byte compare is chronological for the fixed-form UTC ISO timestamps
+    // (invariant documented in src/memory.ts above MemoryEntry).
     const cmpIso = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
     olderItems.sort((a, b) => cmpIso(a.createdAt, b.createdAt));
     tailItems.sort((a, b) => cmpIso(a.createdAt, b.createdAt));

package/dist/api/audit.d.ts

@@ -10,8 +10,8 @@ export interface AuditListOpts {
     after?: KeysetPosition;
 }
 /**
- * Read audit events scoped to `ctx.tenantId`. Read-only — no audit emit (matches
- * A5: cmdAuditList does not record a 'recall'-style read event).
+ * Read audit events scoped to `ctx.tenantId`. Read-only, no audit emit (matches
+ * cmdAuditList, which does not record a 'recall'-style read event).
  */
 export declare function auditList(ctx: Context, opts: AuditListOpts): AuditEvent[];
 //# sourceMappingURL=audit.d.ts.map

package/dist/api/audit.js

@@ -2,8 +2,8 @@
 import { openHippoDb, closeHippoDb } from '../db.js';
 import { queryAuditEvents } from '../audit.js';
 /**
- * Read audit events scoped to `ctx.tenantId`. Read-only — no audit emit (matches
- * A5: cmdAuditList does not record a 'recall'-style read event).
+ * Read audit events scoped to `ctx.tenantId`. Read-only, no audit emit (matches
+ * cmdAuditList, which does not record a 'recall'-style read event).
  */
 export function auditList(ctx, opts) {
     const db = openHippoDb(ctx.hippoRoot);

package/dist/api/auth.d.ts

@@ -4,8 +4,8 @@ import type { Context } from './types.js';
 export interface AuthCreateOpts {
     label?: string;
     /**
-     * v1.12.3: authorization role for the new key. Defaults to `'admin'` for
-     * back-compat with v1.12.0-v1.12.2 (the api_keys.role column DEFAULT also
+     * Authorization role for the new key. Defaults to `'admin'` for
+     * back-compat with keys minted before roles existed (the api_keys.role column DEFAULT also
      * resolves to 'admin' if omitted from the INSERT). Member keys are
      * 403-blocked from admin-gated routes (e.g. `POST /v1/sleep`).
      */
@@ -15,7 +15,7 @@ export interface AuthCreateResult {
     keyId: string;
     plaintext: string;
     tenantId: string;
-    /** v1.12.3: the role bound to the new key (admin | member). */
+    /** The role bound to the new key (admin | member). */
     role: 'admin' | 'member';
 }
 /**
@@ -36,7 +36,7 @@ export declare function authCreate(ctx: Context, opts: AuthCreateOpts): AuthCrea
  * Divergence from `cmdAuthList` in src/cli.ts: the CLI today returns ALL keys
  * regardless of tenant (single-tenant deployments). The API surface is tenant-
  * scoped because future multi-tenant deployments will share a hippoRoot, and
- * tenant A must not see tenant B's keys. Read-only — no audit emit (matches A5).
+ * tenant A must not see tenant B's keys. Read-only, so no audit emit.
  */
 export declare function authList(ctx: Context, opts: {
     active: boolean;
@@ -55,7 +55,7 @@ export declare function authListRows(ctx: Context, opts: {
  * revoke only its own key (checked first), so no caller can probe other key_ids.
  *
  * Audit: emits 'auth_revoke' with `tenantId` set to the KEY ROW's tenant_id
- * (M1 fix from A5 review, mirrors src/cli.ts:cmdAuthRevoke). Skipped on no-op
+ * (mirrors src/cli.ts:cmdAuthRevoke). Skipped on no-op
  * revoke (already revoked) so re-running doesn't pad the audit log.
  */
 export interface AuthRevokeResult {
@@ -72,7 +72,7 @@ export declare function authKeyTenant(ctx: Context, keyId: string): string | und
 export interface AuthGrantResult {
     ok: true;
 }
-/** Grant `keyId` read access to one restricted `scope` (ROADMAP Part VIII EI2). Admin only. */
+/** Grant `keyId` read access to one restricted `scope`. Admin only. */
 export declare function authGrant(ctx: Context, keyId: string, scope: string): AuthGrantResult;
 /** Revoke `keyId`'s grant on `scope`. Same authorization and lookup rules as authGrant. */
 export declare function authUngrant(ctx: Context, keyId: string, scope: string): AuthGrantResult;

package/dist/api/auth.js

@@ -27,10 +27,8 @@ export function authCreate(ctx, opts) {
     try {
         const role = opts.role ?? (ctx.actor.viaAuthResolver ? 'member' : 'admin');
         const result = createApiKey(db, { tenantId: ctx.tenantId, label: opts.label, role });
-        // v1.12.4: audit emit (closes the gap v1.12.3 CHANGELOG flagged as deferred).
-        // Mirrors the auth_revoke pattern at authRevoke — same try/catch so audit
-        // failure can't crash a successful mint. The plaintext is NEVER logged;
-        // metadata carries label + role + the keyId (which is non-secret).
+        // Same try/catch as authRevoke so audit failure can't crash a successful mint.
+        // The plaintext is NEVER logged; metadata carries label + role, keyId is non-secret.
         try {
             appendAuditEvent(db, {
                 tenantId: ctx.tenantId,
@@ -59,7 +57,7 @@ export function authCreate(ctx, opts) {
  * Divergence from `cmdAuthList` in src/cli.ts: the CLI today returns ALL keys
  * regardless of tenant (single-tenant deployments). The API surface is tenant-
  * scoped because future multi-tenant deployments will share a hippoRoot, and
- * tenant A must not see tenant B's keys. Read-only — no audit emit (matches A5).
+ * tenant A must not see tenant B's keys. Read-only, so no audit emit.
  */
 export function authList(ctx, opts) {
     return authListRows(ctx, opts).map((r) => r.key);
@@ -101,7 +99,7 @@ export function authRevoke(ctx, keyId) {
         if (!alreadyRevoked) {
             try {
                 appendAuditEvent(db, {
-                    tenantId: row.tenantId, // M1: KEY's tenant, not ctx.tenantId.
+                    tenantId: row.tenantId, // KEY's tenant, not ctx.tenantId.
                     actor: ctx.actor.subject,
                     op: 'auth_revoke',
                     targetId: keyId,
@@ -134,7 +132,7 @@ export function authKeyTenant(ctx, keyId) {
         closeHippoDb(db);
     }
 }
-/** Grant `keyId` read access to one restricted `scope` (ROADMAP Part VIII EI2). Admin only. */
+/** Grant `keyId` read access to one restricted `scope`. Admin only. */
 export function authGrant(ctx, keyId, scope) {
     return changeScopeGrant(ctx, keyId, scope, 'auth_grant');
 }

package/dist/api/context-select.d.ts

@@ -1,6 +1,7 @@
 import type { AmbientLoadResult } from '../store/candidates.js';
 import { type MemoryEntry } from '../memory.js';
 import { type HippoConfig } from '../config.js';
+import type { ProjectRef } from '../project-identity.js';
 import type { DeliveryObserver } from '../delivery-recorder.js';
 import type { ContextCost, ContextOpts, ContextResultEntry } from './context-types.js';
 import type { Context } from './types.js';
@@ -18,9 +19,9 @@ export interface ContextPlan {
     primaryIsGlobal: boolean;
     hasLocalTaskState: boolean;
     config: HippoConfig;
-    currentProjectName: string;
+    currentProject: ProjectRef;
     includeCrossProject: boolean;
-    originProject: string | undefined;
+    originProject: readonly string[] | undefined;
     promptRecallPending: boolean;
     cost: ContextCost | undefined;
     price: (entry: MemoryEntry, isGlobal: boolean, promptRecall?: boolean) => number;
@@ -41,7 +42,7 @@ export interface ContextPools {
 export declare function oneCopyPerMemory(local: readonly MemoryEntry[], global: readonly MemoryEntry[], now: Date): [MemoryEntry[], MemoryEntry[]];
 export declare const finiteOr: (v: number, dflt: number, min: number) => number;
 /** Pins plus the prompt-recall or recent-N backfill; null means the block is empty. */
-export declare function selectPinned(ctx: Context, opts: ContextOpts, plan: ContextPlan, left: number, pools: ContextPools, admission: ContextAdmission): ContextResultEntry[] | null;
+export declare function selectPinned(opts: ContextOpts, plan: ContextPlan, left: number, pools: ContextPools, admission: ContextAdmission): ContextResultEntry[] | null;
 /** No query: the strongest memories by strength, up to budget. */
 export declare function selectStrongest(plan: ContextPlan, left: number, pools: ContextPools): ContextResultEntry[];
 /** Real query: hybrid search over both stores, or physics/hybrid over the local rows; emits the 'recall' audit row. */