hippo-memory 1.62.0 → 1.63.0

package/dist/project-briefs.js

@@ -1,6 +1,5 @@
 /**
- * E2 project_brief first-class object
- * (docs/plans/2026-05-30-e2-project-brief-object.md).
+ * Project_brief first-class object.
  *
  * A `project_brief` is the living, repo-scoped summary of a repository's state: a
  * `summary` body scoped to a `repo`, evolving via the supersede delta lifecycle.
@@ -31,6 +30,7 @@ import { createMemory, Layer } from './memory.js';
 import { appendAuditEvent } from './audit.js';
 import { objectHalfLifeDays } from './half-life-migration.js';
 import { keysetAfter } from './keyset.js';
+import { escapeLike } from './escape.js';
 export const VALID_BRIEF_STATES = new Set([
     'active',
     'superseded',
@@ -106,7 +106,7 @@ function buildBriefContent(repo, summary) {
 // Preflight the supersede target BEFORE inserting the new row (so the new
 // autoincrement id can never be its own supersede target); read the
 // predecessor version in the same SELECT for server-derived versioning.
-// Mirrors saveSkill / saveProcess (codex P1 2026-05-28).
+// Mirrors saveSkill / saveProcess.
 function preflightBriefSupersede(db, tenantId, supersedesId) {
     // SAFETY: SELECT projects exactly status, version; .get() returns that
     // shape for the matching row, or undefined when no brief/tenant pair matches.
@@ -276,7 +276,7 @@ export function closeProjectBrief(hippoRoot, tenantId, id, actor = 'cli') {
             // Closing removes the object from the graph. Remove its rows DIRECTLY (deterministic),
             // not only via an enqueued rebuild whose queue item is lost if the mirror is later
             // forgotten (the queue row cascade-deletes with the memory), which would leave the closed
-            // object stale and could block that forget (codex P1). Still enqueue when a mirror exists
+            // object stale and could block that forget. Still enqueue when a mirror exists
             // so a concurrent rebuild re-derives consistently (harmless if it also runs).
             removeGraphEntitiesForObject(hippoRoot, tenantId, 'project', closed.id);
             if (closed.memoryId) {
@@ -351,7 +351,7 @@ export function loadProjectBriefs(hippoRoot, tenantId, opts = {}) {
 /**
  * The repo's CURRENT active brief, or null. By convention there is one active brief
  * per (tenant, repo); if an operator created more than one (the DB does not prevent
- * it, consistent with every other E2 object), the MOST-RECENT active row wins.
+ * it, consistent with every other first-class object), the MOST-RECENT active row wins.
  */
 export function loadActiveBriefForRepo(hippoRoot, tenantId, repo) {
     assertTenantId('loadActiveBriefForRepo', tenantId);
@@ -375,10 +375,6 @@ export function loadActiveBriefForRepo(hippoRoot, tenantId, repo) {
 // ---------------------------------------------------------------------------
 // Refresh assembler (the distinguishing deliverable)
 // ---------------------------------------------------------------------------
-/** Escape LIKE wildcards in operator-supplied text (mirror of store/search-rows.ts). */
-function escapeLike(term) {
-    return term.replace(/[%_\\]/g, '\\$&');
-}
 /** Single-line headline for a receipt: first non-empty line, newline-stripped,
  *  truncated. Deterministic + safe for the markdown bullet list. */
 function receiptHeadline(content) {
@@ -414,9 +410,9 @@ function loadBriefReceipts(hippoRoot, tenantId, normalizedRepo) {
 // NOTE on ordering: the `id DESC` tiebreak is lexical on a random-ish memory id
 // (e.g. `sem_<hex>`), NOT chronological — within the same `created` timestamp the
 // order is stable-but-arbitrary, not insertion order. `created DESC` is the real
-// recency ordering. (plan-eng-critic 2026-05-30, med.)
+// recency ordering.
 //
-// Budget-aware assembly (codex-review-critic 2026-05-30, P2): the digest is the
+// Budget-aware assembly: the digest is the
 // brief `summary`, which saveProjectBrief caps at MAX_BRIEF_SUMMARY_LEN. The
 // receipt/headline caps (50 x ~200) could otherwise build an ~11KB body that the
 // store then REJECTS, breaking refresh for inputs within the advertised caps. So
@@ -518,8 +514,8 @@ export function refreshBrief(hippoRoot, tenantId, repo, actor = 'cli') {
         supersedesBriefId: active ? active.id : undefined,
         refreshReceiptCount: receiptCount,
         // Tag the refreshed brief's mirror as repo-local so path-aware recall boosts
-        // it like the manual `brief new`/`supersede` paths do (codex-review 2026-05-30,
-        // P2). Safe vs self-recursion: assembleBriefFromReceipts excludes
+        // it like the manual `brief new`/`supersede` paths do.
+        // Safe vs self-recursion: assembleBriefFromReceipts excludes
         // source='project_brief', so the brief never becomes its own receipt.
         extraTags: [`path:${normalizedRepo.toLowerCase()}`],
     }, actor);

package/dist/project-identity.d.ts

@@ -1,6 +1,5 @@
 /**
- * Project identity resolution for memory scope isolation (ROADMAP.md Part I
- * [Committed] "Memory scope isolation"; plan docs/plans/2026-07-01-memory-scope-isolation.md S1).
+ * Project identity resolution for memory scope isolation.
  *
  * Resolution rules:
  * - The nearest ancestor of cwd (including cwd itself) containing a `.hippo`
@@ -11,6 +10,9 @@
  * - A directory with no marker anywhere up the walk is NOT a project: it
  *   resolves to the user-global identity (empty name), so memories written
  *   there stay injectable everywhere (matches pre-isolation behavior).
+ * - A project's name is its id: `.hippo-project.json` at the root, else the
+ *   checkout's normalised `origin` remote, else the folder rule (legacyName),
+ *   so two repos in folders of one name stay apart.
  *
  * NOTE: this module must stay free of imports from shared.ts / store.ts /
  * api.ts so any of them can import it without creating a cycle.
@@ -19,8 +21,12 @@
 export interface ProjectIdentity {
     /** Realpath-resolved root directory of the project (the start dir when not in a project). */
     root: string;
-    /** Lowercased basename of the project root, or of its repo for a linked worktree with no `.hippo` (a store keeps the name its rows carry); '' outside a project. */
+    /** The project id rows are stamped with: the project file's id, the origin remote, or legacyName; '' outside a project. */
     name: string;
+    /** The folder rule rows written before ids carry: the root's lowercased basename, or its repo's for a linked worktree with no `.hippo`. */
+    legacyName: string;
+    /** Every other name this root resolves to (the project file id, the origin remote even with the rule off, legacyName), so rows written under an earlier id stay readable. */
+    aliases?: readonly string[];
     /** True when the directory resolves to the user home working set. */
     isHome: boolean;
 }
@@ -33,7 +39,7 @@ export interface ResolveProjectIdentityOpts {
     homeDir?: string;
     stopDir?: string;
 }
-/** Clear the per-process identity cache (test seam). */
+/** Clear the per-process identity cache and the remote switch it read (test seam). */
 export declare function clearProjectIdentityCache(): void;
 /**
  * Canonicalize a path via realpath, falling back to path.resolve when the
@@ -46,17 +52,25 @@ export declare function realpathOrResolve(p: string): string;
  */
 export declare function resolveProjectIdentity(cwd?: string, opts?: ResolveProjectIdentityOpts): ProjectIdentity;
 /** Nearest ancestor `.hippo` below home and the temp root (never projects; on Windows the temp root sits inside home).
- *  Everything is realpath'd so a symlinked temp root or cwd still matches its bound. Design notes: docs/plans/2026-09-05-*.md */
+ *  Everything is realpath'd so a symlinked temp root or cwd still matches its bound. */
 export declare function findHippoStoreDir(cwd?: string, opts?: ResolveProjectIdentityOpts): string | null;
+/** A reader's project: a bare name, or an identity whose own rows may also carry its legacy folder name. */
+export type ProjectRef = string | Pick<ProjectIdentity, 'name' | 'legacyName' | 'aliases'>;
+/** The id a reader's new rows are stamped with; '' outside a project. */
+export declare function projectId(project: ProjectRef): string;
+/** Every origin_project value the reader's own rows carry: the id first, then each alias and the legacy name. */
+export declare function projectNames(project: ProjectRef): readonly string[];
+/** `origin_project IN (?, ...)` with one placeholder per name; an empty list matches nothing. */
+export declare function originInSql(names: readonly string[], column?: string): string;
 /**
  * v39 memory scope isolation: classify a memory's origin_project against the
- * active project. `currentName === ''` means the session is not in a project
+ * active project. An empty current id means the session is not in a project
  * (home dir or markerless cwd) - everything is in scope there, matching
  * pre-isolation behavior. NULL/undefined origin is a legacy pre-v39 row and
  * is treated as cross-project (deny by default) - the safe direction for a
  * security partition.
  */
-export declare function classifyOriginProject(origin: string | null | undefined, currentName: string): 'project' | 'user-global' | 'cross-project';
+export declare function classifyOriginProject(origin: string | null | undefined, current: ProjectRef): 'project' | 'user-global' | 'cross-project';
 /**
  * The global Hippo store directory, resolved the same way shared.ts does:
  * $HIPPO_HOME > $XDG_DATA_HOME/hippo > ~/.hippo. Lives here (leaf module) so
@@ -85,8 +99,7 @@ export declare function originFromSource(source: string | null | undefined, home
  * Returns the project name, or '' for user-global (written at/under home or
  * in a markerless directory) - injectable everywhere. Write sites must always
  * persist this value; a NULL origin_project column is reserved for legacy
- * pre-migration rows, which ambient context treats as deny (see plan
- * docs/plans/2026-07-01-memory-scope-isolation.md "Origin model").
+ * pre-migration rows, which ambient context treats as deny.
  */
 export declare function deriveOriginProject(cwd?: string, opts?: ResolveProjectIdentityOpts): string;
 //# sourceMappingURL=project-identity.d.ts.map

package/dist/project-identity.js

@@ -2,12 +2,31 @@ import { envHippoHome, envXdgDataHome } from './env.js';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
+import { loadConfig } from './config.js';
 import { log } from './log.js';
+import { originRemoteId, projectFileId } from './project-remote.js';
 const MAX_WALK_DEPTH = 64;
 const identityCache = new Map();
-/** Clear the per-process identity cache (test seam). */
+let remoteSwitch = null;
+/** Clear the per-process identity cache and the remote switch it read (test seam). */
 export function clearProjectIdentityCache() {
     identityCache.clear();
+    remoteSwitch = null;
+}
+// The global store's config only: a per-store switch would stamp one checkout two ways.
+function remoteRuleOn() {
+    const globalRoot = resolveGlobalRootDir();
+    if (remoteSwitch?.globalRoot !== globalRoot)
+        remoteSwitch = { globalRoot, on: loadConfig(globalRoot).projectIdentity.remote };
+    return remoteSwitch.on;
+}
+/** The id a root names itself by plus every rung that resolves; only the root's own `.git` is read, so a store nested in another checkout keeps its folder name. */
+function namesAt(root, legacyName) {
+    const fileId = projectFileId(root);
+    const remoteId = originRemoteId(root);
+    const name = fileId ?? (remoteRuleOn() ? remoteId : null) ?? legacyName;
+    const aliases = [...new Set([fileId, remoteId, legacyName])].filter((n) => n !== null && n !== name);
+    return aliases.length > 0 ? { name, aliases } : { name };
 }
 /**
  * Canonicalize a path via realpath, falling back to path.resolve when the
@@ -72,16 +91,16 @@ export function resolveProjectIdentity(cwd, opts) {
     let identity;
     const root = hippoRoot ?? gitRoot;
     if (root !== null) {
-        const name = (hippoRoot === null ? linkedWorktreeRepoName(root, home) : null) ?? path.basename(root).toLowerCase();
-        identity = { root, name, isHome: false };
+        const legacyName = (hippoRoot === null ? linkedWorktreeRepoName(root, home) : null) ?? path.basename(root).toLowerCase();
+        identity = { root, ...namesAt(root, legacyName), legacyName, isHome: false };
     }
     else if (reachedHome || isUnder(start, home)) {
-        identity = { root: home, name: '', isHome: true };
+        identity = { root: home, name: '', legacyName: '', isHome: true };
     }
     else {
         // No markers anywhere: not a project. Empty name keeps these memories
         // user-global rather than fabricating an origin from a basename.
-        identity = { root: start, name: '', isHome: false };
+        identity = { root: start, name: '', legacyName: '', isHome: false };
     }
     if (cacheable)
         identityCache.set(startInput, identity);
@@ -137,7 +156,7 @@ function walkProjectMarkers(start, home, stopDirs) {
     return { hippoRoot, gitRoot, reachedHome };
 }
 /** Nearest ancestor `.hippo` below home and the temp root (never projects; on Windows the temp root sits inside home).
- *  Everything is realpath'd so a symlinked temp root or cwd still matches its bound. Design notes: docs/plans/2026-09-05-*.md */
+ *  Everything is realpath'd so a symlinked temp root or cwd still matches its bound. */
 export function findHippoStoreDir(cwd, opts) {
     const home = realpathOrResolve(opts?.homeDir ?? os.homedir());
     const stops = [realpathOrResolve(os.tmpdir())];
@@ -147,22 +166,39 @@ export function findHippoStoreDir(cwd, opts) {
     const { hippoRoot } = walkProjectMarkers(start, home, stops);
     return hippoRoot === null ? null : path.join(hippoRoot, '.hippo');
 }
+function isBareName(project) {
+    return typeof project === 'string';
+}
+/** The id a reader's new rows are stamped with; '' outside a project. */
+export function projectId(project) {
+    return isBareName(project) ? project : project.name;
+}
+/** Every origin_project value the reader's own rows carry: the id first, then each alias and the legacy name. */
+export function projectNames(project) {
+    if (isBareName(project) || project.name === '')
+        return [projectId(project)];
+    return [...new Set([project.name, ...(project.aliases ?? []), project.legacyName])].filter((n) => n !== '');
+}
+/** `origin_project IN (?, ...)` with one placeholder per name; an empty list matches nothing. */
+export function originInSql(names, column = 'origin_project') {
+    return names.length === 0 ? '0' : `${column} IN (${names.map(() => '?').join(', ')})`;
+}
 /**
  * v39 memory scope isolation: classify a memory's origin_project against the
- * active project. `currentName === ''` means the session is not in a project
+ * active project. An empty current id means the session is not in a project
  * (home dir or markerless cwd) - everything is in scope there, matching
  * pre-isolation behavior. NULL/undefined origin is a legacy pre-v39 row and
  * is treated as cross-project (deny by default) - the safe direction for a
  * security partition.
  */
-export function classifyOriginProject(origin, currentName) {
-    if (currentName === '')
+export function classifyOriginProject(origin, current) {
+    if (projectId(current) === '')
         return 'project';
     if (origin === undefined || origin === null)
         return 'cross-project';
     if (origin === '')
         return 'user-global';
-    return origin === currentName ? 'project' : 'cross-project';
+    return projectNames(current).includes(origin) ? 'project' : 'cross-project';
 }
 /**
  * The global Hippo store directory, resolved the same way shared.ts does:
@@ -221,8 +257,7 @@ export function originFromSource(source, homeName) {
  * Returns the project name, or '' for user-global (written at/under home or
  * in a markerless directory) - injectable everywhere. Write sites must always
  * persist this value; a NULL origin_project column is reserved for legacy
- * pre-migration rows, which ambient context treats as deny (see plan
- * docs/plans/2026-07-01-memory-scope-isolation.md "Origin model").
+ * pre-migration rows, which ambient context treats as deny.
  */
 export function deriveOriginProject(cwd, opts) {
     return resolveProjectIdentity(cwd, opts).name;

package/dist/project-merge.d.ts

@@ -11,7 +11,7 @@ export interface ProjectSummary {
 export interface MergeResult {
     readonly from: string;
     readonly into: string;
-    /** Imported note copies moved to dormant storage; the next sync under `into` imports the notes still on disk. */
+    /** Imports `into` already holds for the same note, moved to dormant storage; the rest are re-tagged and the next sync files them under `into`. */
     readonly setAside: readonly string[];
     readonly restamped: readonly string[];
     readonly dormantRestamped: readonly string[];
@@ -22,11 +22,18 @@ export interface ProjectFold {
     readonly from: string;
     readonly into: string;
 }
+/** An old name whose session folders now resolve to several projects: no fold can say whose rows are whose. */
+export interface ProjectCollision {
+    readonly name: string;
+    readonly ids: readonly string[];
+}
 export interface RepairResult {
     /** Imported notes filed under the wrong project, or under a project name when a user-global import holds the same text: set aside. */
     readonly copies: readonly string[];
     /** Names whose recorded session folders all resolve to one other project today, folded as `merge` would. */
     readonly folds: readonly ProjectFold[];
+    /** Names left unfolded because their folders now resolve to more than one project; only `merge` by hand can split them. */
+    readonly collisions: readonly ProjectCollision[];
     readonly toProject: ReadonlyArray<{
         readonly id: string;
         readonly origin: string;
@@ -50,11 +57,19 @@ export declare function mergeProjects(db: DatabaseSyncLike, hippoRoot: string, o
     into: string;
     dryRun: boolean;
 }): MergeResult;
+/** Names folded, directly or through others, into one of `names`; the sync moves imports still filed under them. */
+export declare function namesFoldedInto(db: DatabaseSyncLike, tenantId: string, names: readonly string[]): string[];
 /** Reads only, so doctor and a dry run take no write lock; merged rows are planned before any fold, so a few may re-tag differently once folds apply. */
-export declare function planProjectRepair(db: DatabaseSyncLike, hippoRoot: string, tenantId: string): Omit<RepairResult, 'backup'>;
+export declare function planProjectRepair(db: DatabaseSyncLike, hippoRoot: string, tenantId: string, globalFolds?: boolean): Omit<RepairResult, 'backup'>;
 /** Sets aside stray imports, folds the names the resolver now maps elsewhere, then re-tags sleep's user-global merges by their parents; a dry run only plans. */
 export declare function repairProjects(db: DatabaseSyncLike, hippoRoot: string, opts: {
     tenantId: string;
     dryRun: boolean;
+    globalFolds?: boolean;
 }): RepairResult;
+/**
+ * Sleep runs repair once per store, so an upgrade needs no command. Global-store folds stay
+ * with `hippo projects repair`: their evidence is compaction folders, blind to a same-named repo that never compacted.
+ */
+export declare function repairOnceOnSleep(db: DatabaseSyncLike, hippoRoot: string, tenantId: string): RepairResult | null;
 //# sourceMappingURL=project-merge.d.ts.map

package/dist/project-merge.js

@@ -2,14 +2,16 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { setAsideRow } from './agent-memories/apply.js';
-import { transcriptNotesOrigin } from './agent-memories/claude-code.js';
+import { transcriptNotesProject } from './agent-memories/claude-code.js';
 import { containerId, containerPrefix } from './agent-memories/source.js';
 import { AGENT_MEMORY_SOURCE_PREFIX, AGENT_MEMORY_TOOLS, toolSourcePrefix } from './agent-memories/tools.js';
 import { appendAuditEvent, queryAuditEvents } from './audit.js';
+import { getMeta, setMeta } from './db/meta.js';
 import { insertDormantRow, listDormantSnapshots, replaceDormantEntry } from './dormant.js';
 import { processEnv } from './env.js';
 import { calculateStrength } from './memory.js';
-import { deriveOriginProject, isGlobalStoreRoot } from './project-identity.js';
+import { isObjectLike, isStringValue } from './capture-contract.js';
+import { isGlobalStoreRoot, projectNames, resolveProjectIdentity } from './project-identity.js';
 import { duplicateKey } from './same-text.js';
 import { removeEntryMirrors } from './store/mirrors.js';
 import { deleteEntryRowInTx, writeEntryMirrors } from './store/entry-writes.js';
@@ -93,11 +95,14 @@ export function mergeProjects(db, hippoRoot, opts) {
     return result;
 }
 function foldInTx(db, tenantId, from, into) {
-    const rows = selectAllEntries(db, tenantId).filter((e) => e.origin_project === from);
+    const all = selectAllEntries(db, tenantId);
+    const rows = all.filter((e) => e.origin_project === from);
+    // The sync renames the rest to `into`'s prefix and keeps their ids; only a note `into` already holds would show twice.
+    const held = new Set(all.filter((e) => e.origin_project === into && !e.superseded_by && isImport(e)).map(noteKey));
     const setAside = [];
     for (const row of rows) {
         const tag = toolTag(row.source);
-        if (!isImport(row) || row.superseded_by || row.kind === 'raw' || tag === null)
+        if (!isImport(row) || row.superseded_by || row.kind === 'raw' || tag === null || !held.has(noteKey(row)))
             continue;
         if (setAsideRow(db, tag, { ...row, origin_project: into }, 'project-merge').kind === 'dormant')
             setAside.push(row.id);
@@ -117,6 +122,11 @@ function foldInTx(db, tenantId, from, into) {
         .run(into, tenantId, from).changes ?? 0);
     return { setAside, restamped, dormantRestamped, compactions };
 }
+/** Tool, note key and hash of an import, without the container, whose id hashes the project name. */
+function noteKey(entry) {
+    const rest = entry.source.slice(AGENT_MEMORY_SOURCE_PREFIX.length);
+    return `${rest.split(':')[0]}:${rest.slice(rest.indexOf('/') + 1)}`;
+}
 /** Live imports under a project name whose exact text a user-global import holds: a session folder's notes stamped with the folder it ended in. */
 function importCopies(db, tenantId) {
     const live = selectAllEntries(db, tenantId).filter((e) => !e.superseded_by && isImport(e));
@@ -135,51 +145,106 @@ function strayImports(db, hippoRoot, tenantId) {
         .all(tenantId);
     const owners = new Map();
     for (const { transcript, cwd } of sessions) {
-        const origin = transcriptNotesOrigin(transcript, cwd, machine);
+        const project = transcriptNotesProject(transcript, cwd, machine);
         const dir = path.join(path.dirname(transcript), 'memory');
-        if (origin !== null)
-            owners.set(dir, (owners.get(dir) ?? new Set()).add(origin));
+        if (project === null)
+            continue;
+        const ids = owners.get(dir) ?? new Map();
+        owners.set(dir, ids.set(project.name, [...new Set([...(ids.get(project.name) ?? []), ...projectNames(project)])]));
     }
     const tool = toolSourcePrefix('claude-code');
     const live = selectLiveEntriesBySourcePrefix(db, tenantId, tool).filter((e) => e.kind !== 'raw' && !e.pinned);
     const origins = new Set(live.map((e) => e.origin_project ?? ''));
+    const edges = foldEdges(db, tenantId);
     const right = new Set();
     const wrong = new Set();
-    for (const [dir, owner] of owners) {
-        if (owner.size !== 1)
+    for (const [dir, ids] of owners) {
+        if (ids.size !== 1)
             continue;
-        for (const origin of origins)
-            (owner.has(origin) ? right : wrong).add(containerPrefix('claude-code', containerId(dir, 'project', platform, origin)));
+        // Its names before the id, and names folded into it, are the owner's too: the next sync moves those prefixes under the id.
+        const [names] = ids.values();
+        const own = new Set([...names, ...foldedInto(edges, names)]);
+        for (const origin of new Set([...origins, ...own]))
+            (own.has(origin) ? right : wrong).add(containerPrefix('claude-code', containerId(dir, 'project', platform, origin)));
     }
     const prefix = (e) => e.source.slice(0, e.source.indexOf('/', tool.length) + 1);
     const misfiled = live.filter((e) => wrong.has(prefix(e)));
     const seen = new Set(misfiled.map((e) => e.id));
     return [...misfiled, ...copies.filter((e) => !seen.has(e.id) && !right.has(prefix(e)))];
 }
-/** Global store only, where a compaction's name came from its cwd: a name whose every cwd still on disk resolves to one other project today. */
-function planFolds(db, tenantId) {
+/** The global store reads each name's recorded session folders, where a compaction's name came from its cwd; a project store folds only its own folder name. */
+function planFolds(db, hippoRoot, tenantId, globalFolds) {
+    // A name someone merged into by hand stays: undoing their choice would rest on the resolver alone.
+    const chosen = new Set(queryAuditEvents(db, { tenantId, op: 'project_merge', limit: 10000 }).map((e) => e.metadata.into));
+    if (!isGlobalStoreRoot(hippoRoot))
+        return { folds: ownLegacyFold(db, hippoRoot, tenantId).filter((f) => !chosen.has(f.from)), collisions: [] };
     // SAFETY: the SELECT names the two columns of the row type.
     const rows = db.prepare(`SELECT DISTINCT origin_project AS origin, cwd FROM compactions WHERE tenant_id = ? AND origin_project <> '' AND cwd IS NOT NULL`)
         .all(tenantId);
     const today = new Map();
     for (const { origin, cwd } of rows) {
         if (fs.existsSync(cwd))
-            today.set(origin, (today.get(origin) ?? new Set()).add(deriveOriginProject(cwd)));
+            today.set(origin, (today.get(origin) ?? new Set()).add(resolveProjectIdentity(cwd).name));
     }
-    // A name someone merged into by hand stays: undoing their choice would rest on the resolver alone.
-    const chosen = new Set(queryAuditEvents(db, { tenantId, op: 'project_merge', limit: 10000 }).map((e) => e.metadata.into));
-    const folds = [...today].flatMap(([from, names]) => {
+    const folds = [];
+    const collisions = [];
+    for (const [from, names] of today) {
         const [into] = names;
-        return names.size === 1 && into !== '' && into !== from && !chosen.has(from) ? [{ from, into }] : [];
-    });
+        if (chosen.has(from))
+            continue;
+        if (names.size > 1)
+            collisions.push({ name: from, ids: [...names].sort() });
+        else if (into !== '' && into !== from)
+            folds.push({ from, into });
+    }
     // A fold into a name that itself folds would land rows by run order; the next repair takes the rest of the chain.
     const sources = new Set(folds.map((f) => f.from));
-    return folds.filter((f) => !sources.has(f.into));
+    return { folds: globalFolds ? folds.filter((f) => !sources.has(f.into)) : [], collisions };
+}
+/** A project store's rows, dormant snapshots and compaction records written before its id existed carry its folder name. */
+function ownLegacyFold(db, hippoRoot, tenantId) {
+    const { name, legacyName } = resolveProjectIdentity(path.dirname(path.resolve(hippoRoot)));
+    if (legacyName === '' || legacyName === name)
+        return [];
+    const heldIn = (table) => db.prepare(`SELECT 1 FROM ${table} WHERE tenant_id = ? AND origin_project = ? LIMIT 1`).get(tenantId, legacyName) !== undefined;
+    const held = heldIn('memories') || heldIn('compactions') || listDormantSnapshots(db, tenantId).some((s) => s.entry.origin_project === legacyName);
+    return held ? [{ from: legacyName, into: name }] : [];
+}
+function foldOf(value) {
+    if (!isObjectLike(value) || Array.isArray(value))
+        return [];
+    const { from, into } = value;
+    return isStringValue(from) && isStringValue(into) ? [{ from, into }] : [];
+}
+function foldEdges(db, tenantId) {
+    return [
+        ...queryAuditEvents(db, { tenantId, op: 'project_merge', limit: 10000 }).flatMap((e) => foldOf(e.metadata)),
+        ...queryAuditEvents(db, { tenantId, op: 'project_repair', limit: 10000 })
+            .flatMap((e) => (Array.isArray(e.metadata.folds) ? e.metadata.folds.flatMap(foldOf) : [])),
+    ];
+}
+function foldedInto(edges, names) {
+    const seen = new Set(names);
+    let grew = true;
+    while (grew) {
+        grew = false;
+        for (const { from, into } of edges) {
+            if (!seen.has(into) || seen.has(from))
+                continue;
+            seen.add(from);
+            grew = true;
+        }
+    }
+    return [...seen].filter((n) => !names.includes(n));
+}
+/** Names folded, directly or through others, into one of `names`; the sync moves imports still filed under them. */
+export function namesFoldedInto(db, tenantId, names) {
+    return foldedInto(foldEdges(db, tenantId), names);
 }
 /** Reads only, so doctor and a dry run take no write lock; merged rows are planned before any fold, so a few may re-tag differently once folds apply. */
-export function planProjectRepair(db, hippoRoot, tenantId) {
-    const folds = isGlobalStoreRoot(hippoRoot) ? planFolds(db, tenantId) : [];
-    return { copies: strayImports(db, hippoRoot, tenantId).map((e) => e.id), folds, ...planUserGlobalRepair(db, tenantId, folds) };
+export function planProjectRepair(db, hippoRoot, tenantId, globalFolds = true) {
+    const { folds, collisions } = planFolds(db, hippoRoot, tenantId, globalFolds);
+    return { copies: strayImports(db, hippoRoot, tenantId).map((e) => e.id), folds, collisions, ...planUserGlobalRepair(db, tenantId, folds) };
 }
 /** Parents read with `folds` already applied, so a plan matches what apply does after folding. */
 function planUserGlobalRepair(db, tenantId, folds) {
@@ -210,9 +275,9 @@ function planUserGlobalRepair(db, tenantId, folds) {
 }
 /** Sets aside stray imports, folds the names the resolver now maps elsewhere, then re-tags sleep's user-global merges by their parents; a dry run only plans. */
 export function repairProjects(db, hippoRoot, opts) {
-    const { tenantId, dryRun } = opts;
+    const { tenantId, dryRun, globalFolds = true } = opts;
     if (dryRun)
-        return { ...planProjectRepair(db, hippoRoot, tenantId), backup: null };
+        return { ...planProjectRepair(db, hippoRoot, tenantId, globalFolds), backup: null };
     const backup = backupStore(db, hippoRoot, 'before-repair');
     const { result, rewrite, purge } = inTransaction(db, false, () => {
         const copies = [];
@@ -221,7 +286,7 @@ export function repairProjects(db, hippoRoot, opts) {
             if (tag !== null && setAsideRow(db, tag, row, 'project-repair').kind === 'dormant')
                 copies.push(row.id);
         }
-        const folds = isGlobalStoreRoot(hippoRoot) ? planFolds(db, tenantId) : [];
+        const { folds, collisions } = planFolds(db, hippoRoot, tenantId, globalFolds);
         const folded = folds.map((f) => foldInTx(db, tenantId, f.from, f.into));
         const plan = planUserGlobalRepair(db, tenantId, []);
         const stamp = db.prepare(`UPDATE memories SET origin_project = ?, updated_at = datetime('now') WHERE tenant_id = ? AND id = ?`);
@@ -235,7 +300,7 @@ export function repairProjects(db, hippoRoot, opts) {
         }
         appendAuditEvent(db, { tenantId, actor: ACTOR, op: 'project_repair', metadata: { backup, copies, folds, folded, ...plan } });
         return {
-            result: { copies, folds, ...plan, backup },
+            result: { copies, folds, collisions, ...plan, backup },
             rewrite: [...plan.toProject.map((r) => r.id), ...folded.flatMap((f) => f.restamped)],
             purge: [...copies, ...plan.setAside, ...folded.flatMap((f) => f.setAside)],
         };
@@ -243,6 +308,23 @@ export function repairProjects(db, hippoRoot, opts) {
     refreshMirrors(db, hippoRoot, tenantId, rewrite, purge);
     return result;
 }
+const AUTO_REPAIR_META_KEY = 'project_repair_auto';
+/** True when a repair would change nothing. */
+function repairIsEmpty(r) {
+    return r.copies.length + r.folds.length + r.toProject.length + r.setAside.length === 0;
+}
+/**
+ * Sleep runs repair once per store, so an upgrade needs no command. Global-store folds stay
+ * with `hippo projects repair`: their evidence is compaction folders, blind to a same-named repo that never compacted.
+ */
+export function repairOnceOnSleep(db, hippoRoot, tenantId) {
+    if (getMeta(db, AUTO_REPAIR_META_KEY) === '1')
+        return null;
+    const plan = planProjectRepair(db, hippoRoot, tenantId, false);
+    const result = repairIsEmpty(plan) ? null : repairProjects(db, hippoRoot, { tenantId, dryRun: false, globalFolds: false });
+    setMeta(db, AUTO_REPAIR_META_KEY, '1');
+    return result;
+}
 /** After commit, as the agent memory sync does: a stale mirror would bring the old tag back on the next rebuild. */
 function refreshMirrors(db, hippoRoot, tenantId, rewrite, purge) {
     const ids = new Set(rewrite);

package/dist/project-remote.d.ts

@@ -0,0 +1,12 @@
+/** The config file git reads for a checkout: `.git/config`, a linked worktree's `<commondir>/config`, a submodule's `<gitdir>/config`. */
+export declare function gitConfigPath(gitRoot: string): string | null;
+/** `remote.origin.url` from a config file's text, the first value as git fetch uses; the subsection name is case-sensitive. */
+export declare function originUrlFromConfig(text: string): string | null;
+/** `host/path` for a network remote, so ssh, scp and https forms agree; null for a local path, which would put a user path into rows. */
+export declare function normaliseRemote(url: string): string | null;
+/** The normalised origin of the checkout rooted at gitRoot, or null when it has none a project can be named by. */
+export declare function originRemoteId(gitRoot: string): string | null;
+export declare const PROJECT_FILE = ".hippo-project.json";
+/** The `id` a team committed in `.hippo-project.json` at root, lowercased like every project name; null when absent or unusable. */
+export declare function projectFileId(root: string): string | null;
+//# sourceMappingURL=project-remote.d.ts.map