hippo-memory 1.63.1 → 1.64.0

package/dist/server.js

@@ -2,20 +2,22 @@ import { envPort, envRequireAuth, envV1Rps } from './env.js';
 import { createServer } from 'node:http';
 import { existsSync } from 'node:fs';
 import { detectServer, removePidfileIfOwned, writePidfile } from './server-detect.js';
-import { closeHippoDb, getHippoDbPath, isSqliteBusy, openHippoDb, SERVER_DB_WAIT_MS, withBusyWait } from './db.js';
+import { closeHippoDb, getHippoDbPath, isStoreBusy, openHippoDb, SERVER_DB_WAIT_MS, withBusyWait, withSqliteBlocked } from './db.js';
+import { sqliteStore } from './store-port.js';
 import { auditWriteFailureCount } from './audit.js';
 import { PACKAGE_VERSION } from './version.js';
 import { errorFields, log } from './log.js';
 import { createRateLimiter } from './rate-limit.js';
-import { authRevoke, RecallContractError } from './api.js';
+import { authCreateSelf, authRevoke, RecallContractError } from './api.js';
 import { handleSlackEventsWebhook } from './connectors/slack/webhook.js';
 import { handleGitHubEventsWebhook } from './connectors/github/webhook.js';
-import { BodyTooLargeError, HttpError, JSON_HEADERS, sendJson } from './http-util.js';
+import { BodyTimeoutError, BodyTooLargeError, closeAfterReply, HttpError, JSON_HEADERS, sendJson } from './http-util.js';
 import { ForbiddenError } from './api-errors.js';
-import { isLoopback } from './server/auth.js';
+import { buildContextWithAuth, isLoopback, LIMITER_MAX_KEYS, requireAuth } from './server/auth.js';
 import { enforceRateLimit } from './server/client-ip.js';
 import { drainAndClose } from './server/lifecycle.js';
 import { handleMcpPost, handleMcpStream } from './server/mcp-http.js';
+import { MCP_PROJECT_SCOPED_HEADER } from './project-identity.js';
 import { logRequestFailure, matchPath, parseRequest, rejectEncodedSlash, replyFor, requestIds, resolveRequestId, sendError } from './server/request.js';
 import { handleApproveQuarantine, handleCreateAuthKey, handleListAudit, handleListAuthKeys, handleListQuarantine, handleRejectQuarantine, handleRevokeAuthKey } from './server/routes/admin.js';
 import { handleCloseCustomerNote, handleCreateCustomerNote, handleGetCustomerNote, handleListCustomerNotes, handleSupersedeCustomerNote } from './server/routes/customer-notes.js';
@@ -28,14 +30,36 @@ import { handleCloseProcess, handleCreateProcess, handleGetProcess, handleListPr
 import { handleCloseProjectBrief, handleCreateProjectBrief, handleGetProjectBrief, handleListProjectBriefs, handleRefreshProjectBrief, handleSupersedeProjectBrief } from './server/routes/project-briefs.js';
 import { handleAssembleSession, handleDrillRecall, handleGetContext, handleRecallMemories } from './server/routes/recall.js';
 import { handleCloseSkill, handleCreateSkill, handleExportSkills, handleGetSkill, handleListSkills, handleSupersedeSkill } from './server/routes/skills.js';
-// Add-on packages revoke keys through these without importing the whole api surface.
-export { authRevoke, ForbiddenError };
+import { parseJsonBody } from './server/validation.js';
+// Add-on packages mint and revoke keys through these without importing the whole api surface.
+export { authCreateSelf, authRevoke, ForbiddenError };
 // Published on the hippo-memory/server subpath before they moved to http-util.ts, so they stay exported here.
 export { isCrossSite, LOOPBACK_HOST_HEADER } from './http-util.js';
 // The code behind these lives in src/server/; this subpath keeps exporting them.
 export { __resetSessionRecallHistoryHttp } from './server/routes/recall.js';
 export { clientIpForRateLimit } from './server/client-ip.js';
 export { isLoopback, isReservedActor } from './server/auth.js';
+// What an add-on route handler needs: HttpError for its 4xx replies, promptHookContext for a caller that renders the prompt hook elsewhere, JsonValue for its body.
+export { HttpError } from './http-util.js';
+export { promptHookContext } from './prompt-hook.js';
+// A session-end route stores the turns its caller read from a transcript on the caller's own machine.
+export { captureSessionTexts } from './capture/session-texts.js';
+// An add-on serves from another database by passing serve() its own HippoStore.
+export { sqliteStore } from './store-port.js';
+export { StoreBusyError } from './db.js';
+// An add-on's install step mints the first admin key into a store folder it names, which `hippo auth create` cannot reach.
+export { authCreate } from './api.js';
+// An add-on that serves a team store checks the flag before it starts.
+export { isSharedStore } from './config.js';
+export { ownerOrSubject } from './api.js';
+// A route that writes for a session binds it to the caller's owner first.
+export { bindSessionOwner } from './session-owners.js';
+// A hook route for a caller on another machine: each call binds the session, then writes under the caller's owner and project.
+export { preCompactForCaller } from './capture/pre-compact-caller.js';
+export { compactResumeForCaller } from './capture/compact-resume-caller.js';
+export { saveCompactionItemsForCaller } from './capture/compaction-items-caller.js';
+export { captureFailureForCaller } from './capture/failure-caller.js';
+export { sessionEndHandoffForCaller } from './capture/session-end-caller.js';
 // Review patch #2: explicit allow-list for unauthenticated /v1/* routes.
 // New unauth routes MUST be added here AND get a corresponding entry in
 // tests/server-bearer-lockdown.test.ts. Do not gate auth elsewhere by
@@ -45,6 +69,7 @@ export { isLoopback, isReservedActor } from './server/auth.js';
 // `buildContextWithAuth` / `requireAuth`. Adding a route here without
 // adding the corresponding `isPublicRoute` short-circuit in a handler is
 // a no-op (auth still applies), so the failure mode is fail-closed.
+// The only other unauthenticated paths are ServeOpts.publicJson's: GET only, checked at boot by assertPublicJson.
 const PUBLIC_ROUTES = new Set([
     'POST /v1/connectors/slack/events',
     'POST /v1/connectors/github/events',
@@ -128,46 +153,122 @@ const V1_ROUTES = [
     { method: 'POST', regex: /^\/v1\/customer-notes\/(\d+)\/close$/, handler: handleCloseCustomerNote },
     { method: 'GET', regex: /^\/v1\/customer-notes\/(\d+)$/, handler: handleGetCustomerNote },
 ];
-/**
- * Run the first /v1 route whose method and path match. Each matcher runs before its method check, as the
- * inline route blocks did, so a malformed `%` escape still throws from matchPath on any method.
- */
+/** The route's handler bound to this request's path params, or null when method or path differ. The matcher runs before the
+ *  method check, as the inline route blocks did, so a malformed `%` escape still throws from matchPath on any method. */
+function routeMatches(route, method, path) {
+    if ('path' in route)
+        return method === route.method && path === route.path ? route.handler : null;
+    if ('pattern' in route) {
+        const params = matchPath(route.pattern, path);
+        return method === route.method && params ? (r) => route.handler(r, params) : null;
+    }
+    const match = path.match(route.regex);
+    return method === route.method && match ? (r) => route.handler(r, match) : null;
+}
+/** Run the first /v1 route whose method and path match. */
 async function dispatchV1Route(r, method, path) {
     for (const route of V1_ROUTES) {
-        if ('path' in route) {
-            if (method === route.method && path === route.path) {
-                await route.handler(r);
-                return true;
-            }
-        }
-        else if ('pattern' in route) {
-            const params = matchPath(route.pattern, path);
-            if (method === route.method && params) {
-                await route.handler(r, params);
-                return true;
-            }
-        }
-        else {
-            const match = path.match(route.regex);
-            if (method === route.method && match) {
-                await route.handler(r, match);
-                return true;
-            }
-        }
+        const run = routeMatches(route, method, path);
+        if (run === null)
+            continue;
+        if (!route.storeReady)
+            await refuseUnportedRoute(r.req, r.opts);
+        await run(r);
+        return true;
     }
     return false;
 }
+const PLAIN_SEGMENT_RE = /^[A-Za-z0-9._~-]+$/;
+function isPlainV1Path(path) {
+    return path.startsWith('/v1/') && new URL(path, 'http://h').pathname === path
+        && path.slice('/v1/'.length).split('/').every((segment) => PLAIN_SEGMENT_RE.test(segment));
+}
+// A plain path never holds a `%`, so matchPath cannot throw here.
+function isCorePath(method, path) {
+    return PUBLIC_ROUTES.has(`${method} ${path}`) || V1_ROUTES.some((route) => routeMatches(route, method, path) !== null);
+}
+/** Boot-time check: an add-on path must be plain, unique and not one core serves, so no add-on shadows a core route or hides from dispatch. */
+function assertAddonRoutes(routes) {
+    const seen = new Set();
+    for (const { path } of routes) {
+        if (!isPlainV1Path(path))
+            throw new Error(`add-on route '${path}' is not a plain /v1/ path (segments use A-Z a-z 0-9 . _ ~ -)`);
+        if (seen.has(path))
+            throw new Error(`add-on route '${path}' is registered twice`);
+        if (isCorePath('POST', path))
+            throw new Error(`add-on route '${path}' is already served by core`);
+        seen.add(path);
+    }
+}
+const PUBLIC_JSON_MAX_BYTES = 64 * 1024;
+/** Boot-time check and serialization: a public path that a core GET route serves would open that route to anyone. */
+function assertPublicJson(publicJson) {
+    const bodies = new Map();
+    for (const [path, value] of Object.entries(publicJson)) {
+        if (!isPlainV1Path(path))
+            throw new Error(`public JSON path '${path}' is not a plain /v1/ path (segments use A-Z a-z 0-9 . _ ~ -)`);
+        if (isCorePath('GET', path))
+            throw new Error(`public JSON path '${path}' is already served by core`);
+        const text = JSON.stringify(value);
+        if (text === undefined)
+            throw new Error(`public JSON at '${path}' is not JSON`);
+        if (Buffer.byteLength(text) > PUBLIC_JSON_MAX_BYTES)
+            throw new Error(`public JSON at '${path}' is over 64 KiB`);
+        bodies.set(path, text);
+    }
+    return bodies;
+}
+/** Core authenticates and parses before the handler runs, so an add-on route gets the same 401, 400 and 501 as a core one. */
+async function dispatchAddonRoute({ req, res, opts }, method, path) {
+    const route = method === 'POST' ? opts.routes?.find((r) => r.path === path) : undefined;
+    if (!route)
+        return false;
+    await refuseUnportedRoute(req, opts);
+    const ctx = await buildContextWithAuth(req, opts);
+    const body = await parseJsonBody(req, ctx);
+    sendJson(res, 200, await route.handler({ ctx, body }));
+    return true;
+}
+/** No auth, body read or store access, so a caller with no key gets it under any store. */
+function dispatchPublicJson({ res, opts }, method, path) {
+    const text = method === 'GET' ? opts.publicJsonBodies.get(path) : undefined;
+    if (text === undefined)
+        return false;
+    res.writeHead(200, { ...JSON_HEADERS, 'cache-control': 'no-store' });
+    res.end(text);
+    return true;
+}
+const NOT_ON_STORE_MESSAGE = 'not available on this store';
+function assertSqliteStore(opts) {
+    if (opts.store.kind !== 'sqlite')
+        throw new HttpError(501, NOT_ON_STORE_MESSAGE);
+}
+/** Under another store, a route not yet ported answers 501 without running; the caller is checked first, so a bad key is still a 401. */
+async function refuseUnportedRoute(req, opts) {
+    if (opts.store.kind === 'sqlite')
+        return;
+    await requireAuth(req, opts);
+    assertSqliteStore(opts);
+}
 async function handleRequest(req, res, opts, startedAt, streamSlots, limiter) {
     // Pre-decode raw-URL slash check. Catches `%2F` / `%2f` before
     // Node's URL parser collapses them and they slip past the route table.
     rejectEncodedSlash(req.url ?? '/');
     const { method, path, query } = parseRequest(req);
+    // An older core ignores X-Hippo-Project, so every /mcp reply, a 429 or 401 too, tells the client this one filters by it.
+    if (path === '/mcp')
+        res.setHeader(MCP_PROJECT_SCOPED_HEADER, '1');
     if (method === 'GET' && path === '/health') {
         sendHealth(req, res, startedAt);
         return;
     }
     enforceRateLimit(req, path, limiter);
-    if (await dispatchV1Route({ req, res, opts, query }, method, path))
+    const routeRequest = { req, res, opts, query };
+    if (await dispatchV1Route(routeRequest, method, path))
+        return;
+    if (dispatchPublicJson(routeRequest, method, path))
+        return;
+    if (await dispatchAddonRoute(routeRequest, method, path))
         return;
     if (method === 'POST' && path === '/v1/connectors/slack/events') {
         // Bearer auth deliberately skipped: this route is in PUBLIC_ROUTES and authenticates via the Slack HMAC signature.
@@ -175,6 +276,7 @@ async function handleRequest(req, res, opts, startedAt, streamSlots, limiter) {
             // Defensive: PUBLIC_ROUTES drift would land here. Fail closed.
             throw new HttpError(401, 'auth required');
         }
+        assertSqliteStore(opts);
         await handleSlackEventsWebhook({ req, res, opts });
         return;
     }
@@ -182,13 +284,16 @@ async function handleRequest(req, res, opts, startedAt, streamSlots, limiter) {
         if (!isPublicRoute(method, path)) {
             throw new HttpError(401, 'auth required');
         }
+        assertSqliteStore(opts);
         await handleGitHubEventsWebhook({ req, res, opts });
         return;
     }
     if (method === 'POST' && path === '/mcp') {
+        await refuseUnportedRoute(req, opts);
         await handleMcpPost(req, res, opts);
         return;
     }
+    // Store-ready: the stream and its heartbeat only authenticate, and auth goes through the port.
     if (method === 'GET' && path === '/mcp/stream') {
         await handleMcpStream(req, res, opts, streamSlots);
         return;
@@ -232,17 +337,48 @@ async function assertNoLiveServer(hippoRoot) {
             `Stop that server before starting another on the same hippoRoot.`);
     }
 }
-function bootRateLimiter() {
+// SHORTCUT: buckets live in this process and reset on restart or LRU eviction; move them to the store if serve ever runs as several processes.
+function limiterFor({ ratePerSec, burst }) {
+    return createRateLimiter({ ratePerSec, burst, idleEvictMs: 60000, maxKeys: LIMITER_MAX_KEYS });
+}
+function bootRateLimiter(perAddress) {
+    if (perAddress === 'off')
+        return undefined;
+    if (perAddress !== undefined)
+        return limiterFor(perAddress);
     // Per-IP rate limiter for /v1/* and /mcp*. Built here (not at module scope) so
     // HIPPO_V1_RPS is read at boot, matching HIPPO_PORT above and letting a test
     // set the rate before serve(). A non-positive or non-finite value disables
     // limiting (the opt-out knob).
     const v1Rps = Number(envV1Rps() ?? 20);
-    return Number.isFinite(v1Rps) && v1Rps > 0
-        ? createRateLimiter({ ratePerSec: v1Rps, burst: v1Rps * 2, idleEvictMs: 60000, maxKeys: 10000 })
-        : undefined;
+    return Number.isFinite(v1Rps) && v1Rps > 0 ? limiterFor({ ratePerSec: v1Rps, burst: v1Rps * 2 }) : undefined;
 }
-function createStoreHolder(hippoRoot) {
+const DEFAULT_FAILED_AUTH = { ratePerSec: 20, burst: 40 };
+function assertRateLimitSpec(name, { ratePerSec, burst }) {
+    if (!Number.isFinite(ratePerSec) || ratePerSec <= 0)
+        throw new Error(`rateLimits.${name}.ratePerSec must be a finite number above 0`);
+    if (!Number.isFinite(burst) || burst < 1)
+        throw new Error(`rateLimits.${name}.burst must be a finite number of at least 1`);
+}
+/** Refuses a bad spec at boot, since a NaN or zero rate would otherwise turn a bucket off or refuse every request. */
+function bootLimiters(rateLimits) {
+    const { perCaller, perAddress, failedAuthPerAddress = DEFAULT_FAILED_AUTH } = rateLimits ?? {};
+    if (perCaller !== undefined)
+        assertRateLimitSpec('perCaller', perCaller);
+    if (perAddress !== undefined && perAddress !== 'off')
+        assertRateLimitSpec('perAddress', perAddress);
+    assertRateLimitSpec('failedAuthPerAddress', failedAuthPerAddress);
+    return {
+        perAddress: bootRateLimiter(perAddress),
+        callerLimiter: perCaller === undefined ? undefined : limiterFor(perCaller),
+        failedAuthLimiter: limiterFor(failedAuthPerAddress),
+    };
+}
+function createStoreHolder(hippoRoot, store) {
+    if (store.kind !== 'sqlite') {
+        log.info(`serve: the '${store.kind}' store serves ${hippoRoot}, so no hippo.db connection is held`);
+        return { hold: () => { }, release: () => { } };
+    }
     // Handlers open and close their own connections; while this one is held, none of those closes is SQLite's last,
     // which checkpoints and deletes the WAL. It opens only once the store exists, so serving never creates one.
     let heldDb;
@@ -276,8 +412,10 @@ function replyWithFailure(req, res, err, requestId) {
         catch { /* socket already gone */ }
         return;
     }
-    if (isSqliteBusy(err))
+    if (isStoreBusy(err))
         res.setHeader('Retry-After', '1');
+    else if (err instanceof HttpError && err.retryAfterSec !== undefined)
+        res.setHeader('Retry-After', String(err.retryAfterSec));
     if (mapped.status === 500) {
         // The id lets an operator find the logged cause without the client seeing internal text.
         sendJson(res, 500, { error: mapped.message, requestId });
@@ -288,10 +426,20 @@ function replyWithFailure(req, res, err, requestId) {
         sendJson(res, 400, { error: err.message, code: err.code });
         return;
     }
+    // readBody hit its cap or deadline, so close once the 413 or 408 is out rather than drain what the client keeps sending.
+    if (err instanceof BodyTooLargeError || err instanceof BodyTimeoutError)
+        res.once('finish', () => closeAfterReply(req));
     sendError(res, mapped.status, mapped.message);
-    // readBody hit the 1 MB cap mid-stream, so drop the socket rather than drain unbounded bytes.
-    if (err instanceof BodyTooLargeError)
-        req.destroy();
+}
+function replyOrClose(req, res, err, requestId) {
+    try {
+        replyWithFailure(req, res, err, requestId);
+    }
+    catch (replyErr) {
+        // A throw here would be an unhandled rejection, which stops the daemon for every caller.
+        log.error(`serve: failure reply not sent, socket closed: ${replyErr instanceof Error ? replyErr.message : String(replyErr)}`, { requestId });
+        res.destroy();
+    }
 }
 function setKeepAliveTimeouts(server) {
     // The default 5s keepAliveTimeout closes idle sockets just as clients reuse them (ECONNRESET).
@@ -341,7 +489,7 @@ function installSignalHandlers(stop) {
  * requireAuth) has shipped and every route checks it except GET /health
  * (public by design for platform health checks) and the two connector
  * webhooks in PUBLIC_ROUTES, which are HMAC-gated by their own signing
- * secrets and 404 when those secrets are unset. But the loopback
+ * secrets and 404 when those secrets are unset, and any publicJson GET path. But the loopback
  * no-auth fallback inside buildContextWithAuth still admits unauthenticated
  * requests from a loopback remote address (unless they carry Forwarded,
  * X-Forwarded-For/-Host/-Proto, X-Real-IP, Cf-Connecting-Ip or True-Client-Ip, which mark a same-host proxy and get
@@ -357,27 +505,35 @@ function installSignalHandlers(stop) {
 export async function serve(opts) {
     const host = opts.host ?? '127.0.0.1';
     const requestedPort = opts.port ?? Number(envPort() ?? 6789);
+    // A frozen copy, so a route the caller adds or renames after boot never skips the check below.
+    const routes = Object.freeze((opts.routes ?? []).map(({ path, handler }) => Object.freeze({ path, handler })));
+    assertAddonRoutes(routes);
+    const publicJsonBodies = assertPublicJson(opts.publicJson ?? {});
+    const { perAddress: limiter, callerLimiter, failedAuthLimiter } = bootLimiters(opts.rateLimits);
     assertBindable(host);
     await assertNoLiveServer(opts.hippoRoot);
     // The server's start time. Single source of truth: it is returned by every
     // GET /health response and (below) written into the pidfile, so detectServer
     // can match the two and prove a pid-reusing impostor is not the real server.
     const startedAt = new Date().toISOString();
-    const limiter = bootRateLimiter();
     // Open /mcp/stream count per client key, so the cap is per server rather than per process.
     const streamSlots = new Map();
-    const store = createStoreHolder(opts.hippoRoot);
+    const served = {
+        ...opts, routes, publicJsonBodies, store: opts.store ?? sqliteStore(opts.hippoRoot), callerLimiter, failedAuthLimiter,
+    };
+    const { kind } = served.store;
+    const holder = createStoreHolder(opts.hippoRoot, served.store);
     const inflight = new Set();
     const server = createServer((req, res) => {
-        res.once('finish', store.hold);
+        res.once('finish', holder.hold);
         inflight.add(res);
         res.once('close', () => inflight.delete(res));
         const requestId = resolveRequestId(req.headers['x-request-id']);
         requestIds.set(req, requestId);
         res.setHeader('X-Request-Id', requestId);
-        withBusyWait(SERVER_DB_WAIT_MS, () => handleRequest(req, res, opts, startedAt, streamSlots, limiter)).catch((err) => {
-            replyWithFailure(req, res, err, requestId);
-        });
+        const run = () => withBusyWait(SERVER_DB_WAIT_MS, () => handleRequest(req, res, served, startedAt, streamSlots, limiter));
+        // A missed port under another store would otherwise create and write a hippo.db that store never reads.
+        (kind === 'sqlite' ? run() : withSqliteBlocked(kind, run)).catch((err) => replyOrClose(req, res, err, requestId));
     });
     setKeepAliveTimeouts(server);
     await listenOn(server, requestedPort, host);
@@ -389,7 +545,7 @@ export async function serve(opts) {
     const actualPort = addressInfo.port;
     const url = `http://${host.includes(':') ? `[${host}]` : host}:${actualPort}`;
     writePidfile(opts.hippoRoot, { port: actualPort, url, startedAt });
-    store.hold();
+    holder.hold();
     let stopping = false;
     const stop = async () => {
         if (stopping)
@@ -400,7 +556,9 @@ export async function serve(opts) {
         // unconditional unlink here would orphan it.
         removePidfileIfOwned(opts.hippoRoot, { pid: process.pid, startedAt });
         await drainAndClose(server, inflight, opts.shutdownDrainMs ?? 5000);
-        store.release();
+        holder.release();
+        if (!opts.store)
+            await served.store.close();
     };
     if (opts.handleSignals)
         installSignalHandlers(stop);

package/dist/session-digest.d.ts

@@ -37,7 +37,6 @@ export declare function __setDigestExistsProbe(probe: ((p: string) => boolean) |
 export declare function realFsPath(p: string): string | null;
 /** Repo-relative with forward slashes, '' for the root itself, null outside the repo or when the path cannot be resolved. */
 export declare function repoRelative(p: string, repoRoot: string): string | null;
-export declare const USER_SEGMENT: readonly RegExp[];
 /** Sentences of the reply; code spans and "e.g." are held out of the split so their dots never end a sentence. */
 export declare function digestSentences(text: string): string[];
 export declare function sentenceScore(sentence: string): number;

package/dist/session-digest.js

@@ -3,10 +3,10 @@ import { createHash } from 'crypto';
 import * as fs from 'fs';
 import * as path from 'path';
 import { collectSessionTurns } from './capture/transcript.js';
-import { splitSentences } from './capture/extract.js';
 import { isObjectLike, isStringValue } from './capture-contract.js';
 import { PATCH_SUCCESS_LINE, patchPaths, shellPatch } from './codex-patch.js';
 import { loadConfig } from './config.js';
+import { USER_SEGMENT } from './home-path.js';
 import { errorMessage } from './log.js';
 import { createMemory, Layer } from './memory.js';
 import { RejectedValueError } from './rejection.js';
@@ -304,16 +304,6 @@ function changedFiles(edits, repoRoot) {
     }
     return files;
 }
-// A home-directory path names its user and the store may be shared, so such a sentence is dropped.
-export const USER_SEGMENT = [
-    /[A-Za-z]:[\\/]+(?:Users|Documents and Settings)[\\/]+[^\\/\s]+/i,
-    /(?<![\w.])(?:\/mnt)?\/[A-Za-z]\/Users\/[^/\s]+/i,
-    /\\\\\?\\/,
-    /(?<![\w.~-])(?:\/var)?\/home\/[^/\s]+/,
-    /(?<![\w.~-])(?:\/var)?\/root(?![\w.-])/,
-    /(?<![\w.~-])\/Users\/[^/\s]+/,
-    /[\\/][A-Z0-9_$]{1,6}~\d{1,6}(?:\.[A-Z0-9]{1,3})?(?![\w~])|\b[A-Z0-9_$]{1,6}~\d{1,6}(?:\.[A-Z0-9]{1,3})?[\\/]/,
-];
 const ABSOLUTE_PATH = /(?<![\w.~/\\:-])(?:\\\\\?\\)?(?:[A-Za-z]:[\\/]|\/)[^\s`'"<>|*?()[\]{},;]+/g;
 function rewriteRepoPaths(sentence, repoRoot) {
     return sentence.replace(ABSOLUTE_PATH, (token) => {
@@ -369,7 +359,7 @@ function proseText(text) {
 export function digestSentences(text) {
     const held = [];
     const masked = proseText(text).replace(PROTECTED, (m) => `\uE000${held.push(m) - 1}\uE001`);
-    return splitSentences(masked)
+    return masked.split(/(?<=[.!?])\s+|\n/).filter((s) => s.trim().length > 5)
         .map((s) => s.replace(/\uE000(\d+)\uE001/g, (_m, i) => held[Number(i)]).trim())
         .filter(Boolean);
 }
@@ -410,6 +400,7 @@ function rankedSentences(finalText, windows, repoRoot) {
         if (/[?:]$/.test(sentence) || opensOnReferent(sentence) || echoes(sentence, windows))
             return;
         const text = rewriteRepoPaths(sentence, repoRoot);
+        // A home-directory path names its user and the store may be shared, so such a sentence is dropped.
         if (text.length > MAX_SENTENCE_CHARS || USER_SEGMENT.some((re) => re.test(text)))
             return;
         kept.push({ index, text, score: sentenceScore(text) });

package/dist/session-owners.d.ts

@@ -0,0 +1,7 @@
+import { type Context } from './api/types.js';
+import { type DatabaseSyncLike } from './db.js';
+/** Binds under the write lock and returns the stored owner, which is not `owner` when a concurrent first bind won. */
+export declare function insertBinding(db: DatabaseSyncLike, tenantId: string, sessionId: string, owner: string): string | null;
+/** Binds `sessionId` to the caller's owner on first use; a session another owner holds is a 409, so the client can set it aside. */
+export declare function bindSessionOwner(ctx: Context, sessionId: string): void;
+//# sourceMappingURL=session-owners.d.ts.map

package/dist/session-owners.js

@@ -0,0 +1,54 @@
+// A session id belongs to the first owner that binds it, so one developer's client cannot write into another's session.
+import { ConflictError } from './api-errors.js';
+import { ownerOrSubject } from './api/types.js';
+import { closeHippoDb, execWithBusyRetry, HOOK_DB_WAIT_MS, openHippoDb, scopedBusyWait } from './db.js';
+import { raiseMinBinary } from './db/meta.js';
+import { assertTenantId } from './tenant.js';
+import { TASK_OWNER_MIN_BINARY } from './version.js';
+/** Bindings older than this are pruned when a new session binds. */
+const BINDING_RETENTION_DAYS = 90;
+function boundOwner(db, tenantId, sessionId) {
+    // SAFETY: the SELECT names exactly this one TEXT column.
+    const row = db.prepare(`SELECT owner_subject FROM session_owners WHERE tenant_id = ? AND session_id = ?`).get(tenantId, sessionId);
+    return row?.owner_subject ?? null;
+}
+/** Binds under the write lock and returns the stored owner, which is not `owner` when a concurrent first bind won. */
+export function insertBinding(db, tenantId, sessionId, owner) {
+    execWithBusyRetry(db, 'BEGIN IMMEDIATE', scopedBusyWait() ?? HOOK_DB_WAIT_MS);
+    try {
+        const result = db.prepare(`INSERT OR IGNORE INTO session_owners(tenant_id, session_id, owner_subject, created_at) VALUES (?, ?, ?, ?)`)
+            .run(tenantId, sessionId, owner, new Date().toISOString());
+        // An older binary supersedes across owners, so the first binding shuts it out in the same transaction.
+        if (Number(result.changes ?? 0) === 1)
+            raiseMinBinary(db, TASK_OWNER_MIN_BINARY);
+        // Pruned on write, as the failure log is; a pruned session id is a UUID no other caller knows.
+        // SHORTCUT: no created_at index, so each first bind scans the table; add one past a few hundred thousand rows.
+        db.prepare(`DELETE FROM session_owners WHERE created_at < ?`).run(new Date(Date.now() - BINDING_RETENTION_DAYS * 86_400_000).toISOString());
+        db.exec('COMMIT');
+    }
+    catch (err) {
+        try {
+            db.exec('ROLLBACK');
+        }
+        catch { /* the insert's error is the one to surface */ }
+        throw err;
+    }
+    // Re-read, since a concurrent first bind may have won the INSERT OR IGNORE.
+    return boundOwner(db, tenantId, sessionId);
+}
+/** Binds `sessionId` to the caller's owner on first use; a session another owner holds is a 409, so the client can set it aside. */
+export function bindSessionOwner(ctx, sessionId) {
+    assertTenantId('bindSessionOwner', ctx.tenantId);
+    const owner = ownerOrSubject(ctx.actor);
+    const db = openHippoDb(ctx.hippoRoot);
+    try {
+        // A bound session is the common case after the first prompt, so it must not take the write lock.
+        const bound = boundOwner(db, ctx.tenantId, sessionId) ?? insertBinding(db, ctx.tenantId, sessionId, owner);
+        if (bound !== owner)
+            throw new ConflictError('session id belongs to another caller');
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+//# sourceMappingURL=session-owners.js.map

package/dist/share-scrub.d.ts

@@ -0,0 +1,3 @@
+/** Secrets first, then emails, then home paths: a home-path mask could split a secret so that no pattern matches it. */
+export declare function scrubForSharing(text: string): string;
+//# sourceMappingURL=share-scrub.d.ts.map

package/dist/share-scrub.js

@@ -0,0 +1,8 @@
+// The scrub for transcript text that leaves the machine it was typed on.
+import { maskHomePaths } from './home-path.js';
+import { maskEmails, redactSecretsStrict } from './secret-detect.js';
+/** Secrets first, then emails, then home paths: a home-path mask could split a secret so that no pattern matches it. */
+export function scrubForSharing(text) {
+    return maskHomePaths(maskEmails(redactSecretsStrict(text)));
+}
+//# sourceMappingURL=share-scrub.js.map

package/dist/shared.d.ts

@@ -87,6 +87,7 @@ export interface HybridSearchOptions extends SearchOptions {
     recallScope?: {
         requested?: string;
         additive?: boolean;
+        ownScope?: string;
     };
 }
 /**