hippo-memory 1.69.0 → 1.70.0

package/dist/core/session-digest-row.js

@@ -0,0 +1,6 @@
+export const SESSION_DIGEST_TAG = 'session-digest';
+/** Facts extracted from a digest and DAG summaries over one inherit its tag, but they are not the digest itself. */
+export function isSessionDigestRow(entry) {
+    return entry.source === SESSION_DIGEST_TAG && entry.tags.includes(SESSION_DIGEST_TAG) && !entry.extracted_from;
+}
+//# sourceMappingURL=session-digest-row.js.map

package/dist/{dashboard-actions.d.ts → dashboard/dashboard-actions.d.ts}

@@ -1,4 +1,4 @@
-import type { MemoryEntry } from './memory.js';
+import type { MemoryEntry } from '../core/memory.js';
 import { type ActionBody } from './dashboard-params.js';
 /** What an action hands the router: a status, a JSON body, and whether the store changed. */
 export interface ActionResult {

package/dist/{dashboard-actions.js → dashboard/dashboard-actions.js}

@@ -1,9 +1,9 @@
 // The four dashboard writes, each a thin call into an existing store or api function; the router owns HTTP and the cache.
-import * as api from './api.js';
-import { NotFoundError } from './api-errors.js';
-import { listTouchableConflicts, resolveConflict } from './store/conflicts.js';
-import { readEntry } from './store/entry-reads.js';
-import { writeEntry } from './store/entry-writes.js';
+import * as api from '../api/index.js';
+import { NotFoundError } from '../core/api-errors.js';
+import { listTouchableConflicts, resolveConflict } from '../store/conflicts.js';
+import { readEntry } from '../store/entry-reads.js';
+import { writeEntry } from '../store/entry-writes.js';
 import { ParamError, parseMemoryId } from './dashboard-params.js';
 import { isLiveMemory } from './dashboard-snapshot.js';
 const ACTOR = 'dashboard';

package/dist/{dashboard-queries.d.ts → dashboard/dashboard-queries.d.ts}

@@ -1,4 +1,4 @@
-import { type MemoryEntry } from './memory.js';
+import { type MemoryEntry } from '../core/memory.js';
 import { type Snapshot } from './dashboard-snapshot.js';
 import type { MemoryQuery } from './dashboard-params.js';
 import type { MemoryDetail, MemoryPage, Overview, ProjectDetail, SearchResult } from './dashboard-types.js';
@@ -10,6 +10,11 @@ export declare function buildProjectDetail(snap: Snapshot, key: string): Project
 export declare function buildMemoryPage(snap: Snapshot, key: string, query: MemoryQuery): MemoryPage | null;
 /** Substring search over content and tags across every project; it reads the snapshot and never touches recall. */
 export declare function buildSearch(snap: Snapshot, text: string): SearchResult;
+export interface MemoryDetailOptions {
+    readonly snapshotId: number;
+    readonly nowMs: number;
+    readonly embedded: boolean;
+}
 /** Full detail read fresh from the store, never from the snapshot, so the drawer is current inside the coalescing window. */
-export declare function buildMemoryDetail(hippoRoot: string, tenantId: string, entry: MemoryEntry, snapshotId: number, nowMs: number, embedded: boolean): MemoryDetail;
+export declare function buildMemoryDetail(hippoRoot: string, tenantId: string, entry: MemoryEntry, options: MemoryDetailOptions): MemoryDetail;
 //# sourceMappingURL=dashboard-queries.d.ts.map

package/dist/{dashboard-queries.js → dashboard/dashboard-queries.js}

@@ -1,7 +1,6 @@
 // Read models over a snapshot: overview, project, memory page, search, and the fresh single-memory detail.
-import { calculateStrength } from './memory.js';
-import { listMemoryConflicts } from './store/conflicts.js';
-import { readEntry } from './store/entry-reads.js';
+import { calculateStrength } from '../core/memory.js';
+import { loadOpenConflictsOf } from '../store/conflicts.js';
 import { BANDS, DAY_MS, LAYERS, isLiveMemory, memoryFacts, projectIdentity, } from './dashboard-snapshot.js';
 const SERIES_DAYS = 90;
 /** The server words each delta for this range; the client re-slices the series for 7d and 90d. */
@@ -297,12 +296,8 @@ export function buildSearch(snap, text) {
 }
 function openConflictsOf(hippoRoot, tenantId, entry, nowMs) {
     const out = [];
-    for (const c of listMemoryConflicts(hippoRoot, 'open', tenantId)) {
-        if (c.memory_a_id !== entry.id && c.memory_b_id !== entry.id)
-            continue;
-        const otherId = c.memory_a_id === entry.id ? c.memory_b_id : c.memory_a_id;
-        const other = readEntry(hippoRoot, otherId, tenantId);
-        if (!other || !isLiveMemory(other))
+    for (const { conflict: c, other } of loadOpenConflictsOf(hippoRoot, tenantId, entry.id)) {
+        if (!isLiveMemory(other))
             continue;
         out.push({
             id: c.id,
@@ -319,7 +314,8 @@ function openConflictsOf(hippoRoot, tenantId, entry, nowMs) {
     return out;
 }
 /** Full detail read fresh from the store, never from the snapshot, so the drawer is current inside the coalescing window. */
-export function buildMemoryDetail(hippoRoot, tenantId, entry, snapshotId, nowMs, embedded) {
+export function buildMemoryDetail(hippoRoot, tenantId, entry, options) {
+    const { snapshotId, nowMs, embedded } = options;
     const f = memoryFacts(entry, nowMs);
     const project = projectIdentity(entry.origin_project);
     return {

package/dist/{dashboard-snapshot.d.ts → dashboard/dashboard-snapshot.d.ts}

@@ -1,13 +1,11 @@
-import { Layer as MemoryLayer, type MemoryEntry } from './memory.js';
-import type { MemoryConflict } from './store/rows.js';
+import { Layer as MemoryLayer, type ConfidenceInputs, type MemoryEntry, type StrengthInputs } from '../core/memory.js';
+import { type DashboardRow, type ExcludedCounts } from '../store/dashboard-reads.js';
+import type { MemoryConflict } from '../store/rows.js';
 import type { Band, ChipCounts, Layer, Overview, ProjectKind, ProjectSummary, ScatterGrid, ScatterPoints } from './dashboard-types.js';
-export declare const DAY_MS = 86400000;
+import { DAY_MS } from '../util/time.js';
+export { DAY_MS };
 export declare const LAYERS: readonly Layer[];
 export declare const BANDS: readonly Band[];
-/** An outside commit rebuilds the snapshot at most this often. */
-export declare const COALESCE_MS = 10000;
-/** Projected strengths track the clock, so the snapshot is rebuilt at least this often. */
-export declare const TTL_MS: number;
 /** The one predicate for "shown on the dashboard": not superseded, not archived, not quarantined. */
 export declare function isLiveMemory(entry: Pick<MemoryEntry, 'superseded_by' | 'kind' | 'scope'>): boolean;
 /** Wire key, display name and kind of a project. */
@@ -34,7 +32,7 @@ export interface MemoryFacts {
     wrong: boolean;
 }
 /** Strength now and at +7d and +30d, band, age and the confidence split for one entry at `nowMs`. */
-export declare function memoryFacts(entry: MemoryEntry, nowMs: number): MemoryFacts;
+export declare function memoryFacts(entry: StrengthInputs & ConfidenceInputs & Pick<MemoryEntry, 'layer'>, nowMs: number): MemoryFacts;
 /** One live memory as the snapshot holds it: numbers and short strings only, never the full entry. */
 export interface Fact {
     id: string;
@@ -116,7 +114,9 @@ export interface SnapshotInput {
     id: number;
     tenantId: string;
     nowMs: number;
-    entries: readonly MemoryEntry[];
+    entries: readonly DashboardRow[];
+    /** Rows counted out before `entries` was read; any entry here that is not live adds to them. */
+    excluded?: ExcludedCounts;
     openConflicts: readonly Pick<MemoryConflict, 'memory_a_id' | 'memory_b_id'>[];
     embeddedIds: ReadonlySet<string> | null;
 }

package/dist/{dashboard-snapshot.js → dashboard/dashboard-snapshot.js}

@@ -1,13 +1,11 @@
 // The dashboard's read model: one in-memory snapshot of a tenant's live memories, grouped by origin project.
 // Pure build functions plus one cache; the queries over it live in dashboard-queries.ts.
-import * as fs from 'fs';
-import { calculateStrength, confidenceFacets, netWrong, Layer as MemoryLayer } from './memory.js';
-import { isQuarantineScope } from './quarantine.js';
-import { listMemoryConflicts } from './store/conflicts.js';
-import { loadAllEntries } from './store/entry-reads.js';
-import { closeHippoDb, getHippoDbPath, openHippoDbReadOnly } from './db.js';
-import { storedVectorIds } from './vector-store.js';
-export const DAY_MS = 86_400_000;
+import { calculateStrength, facetsOf, netWrong, Layer as MemoryLayer } from '../core/memory.js';
+import { isQuarantineScope } from '../trust/quarantine.js';
+import { listMemoryConflicts } from '../store/conflicts.js';
+import { DashboardConnection, loadDashboardRows } from '../store/dashboard-reads.js';
+import { DAY_MS } from '../util/time.js';
+export { DAY_MS };
 export const LAYERS = ['buffer', 'episodic', 'semantic', 'trace'];
 // Wire order of `Band`, and the order the mockup sorts bands in.
 export const BANDS = ['pinned', 'strong', 'fading', 'atRisk'];
@@ -18,9 +16,9 @@ const BAND_AT_RISK = 3;
 const CONFIDENCE_ORDER = ['verified', 'observed', 'inferred', 'stale'];
 const HEAD_CHARS = 240;
 /** An outside commit rebuilds the snapshot at most this often. */
-export const COALESCE_MS = 10_000;
+const COALESCE_MS = 10_000;
 /** Projected strengths track the clock, so the snapshot is rebuilt at least this often. */
-export const TTL_MS = 5 * 60_000;
+const TTL_MS = 5 * 60_000;
 /** The one predicate for "shown on the dashboard": not superseded, not archived, not quarantined. */
 export function isLiveMemory(entry) {
     return !entry.superseded_by && (entry.kind === 'raw' || entry.kind === 'distilled') && !isQuarantineScope(entry.scope);
@@ -52,7 +50,7 @@ export function memoryFacts(entry, nowMs) {
     const strength = calculateStrength(entry, now);
     const strength7d = calculateStrength(entry, new Date(nowMs + 7 * DAY_MS));
     const strength30d = calculateStrength(entry, new Date(nowMs + 30 * DAY_MS));
-    const facets = confidenceFacets(entry, now);
+    const facets = facetsOf(entry, now);
     const band = entry.pinned ? BAND_PINNED : strength30d < 0.2 ? BAND_AT_RISK : strength >= 0.5 ? BAND_STRONG : BAND_FADING;
     return {
         strength,
@@ -144,30 +142,42 @@ function toFact(entry, f, project, embedded, createdMs) {
         createdMs,
     };
 }
+function tallyExcluded(entry, excluded) {
+    if (isQuarantineScope(entry.scope))
+        excluded.quarantined++;
+    else if (entry.superseded_by || entry.kind === 'superseded')
+        excluded.superseded++;
+    else if (entry.kind === 'archived')
+        excluded.archived++;
+}
+function draftIndexFor(identity, projectIndex, drafts) {
+    let p = projectIndex.get(identity.key);
+    if (p === undefined) {
+        p = drafts.length;
+        projectIndex.set(identity.key, p);
+        drafts.push(newDraft(identity));
+    }
+    return p;
+}
+function finishProject(d) {
+    d.summary.atRisk = d.summary.bands.atRisk;
+    d.summary.share = d.summary.live > 0 ? d.summary.atRisk / d.summary.live : 0;
+    d.summary.lastRetrievedDays = d.summary.live > 0 ? round1(d.lastDays) : null;
+    return { summary: d.summary, members: Int32Array.from(d.members), firstCreatedMs: d.firstCreatedMs };
+}
 /** Builds the snapshot from already-loaded rows; it touches no store, so tests can feed it directly. */
 export function buildSnapshot(input) {
     const { entries, embeddedIds, nowMs } = input;
-    const excluded = { superseded: 0, archived: 0, quarantined: 0 };
+    const excluded = { superseded: 0, archived: 0, quarantined: 0, ...input.excluded };
     const facts = [];
     const projectIndex = new Map();
     const drafts = [];
     for (const entry of entries) {
         if (!isLiveMemory(entry)) {
-            if (isQuarantineScope(entry.scope))
-                excluded.quarantined++;
-            else if (entry.superseded_by || entry.kind === 'superseded')
-                excluded.superseded++;
-            else if (entry.kind === 'archived')
-                excluded.archived++;
+            tallyExcluded(entry, excluded);
             continue;
         }
-        const identity = projectIdentity(entry.origin_project);
-        let p = projectIndex.get(identity.key);
-        if (p === undefined) {
-            p = drafts.length;
-            projectIndex.set(identity.key, p);
-            drafts.push(newDraft(identity));
-        }
+        const p = draftIndexFor(projectIdentity(entry.origin_project), projectIndex, drafts);
         const f = memoryFacts(entry, nowMs);
         const embedded = embeddedIds !== null && embeddedIds.has(entry.id);
         const parsedCreated = Date.parse(entry.created);
@@ -187,12 +197,7 @@ export function buildSnapshot(input) {
         facts.push(toFact(entry, f, p, embedded, Number.isFinite(parsedCreated) ? parsedCreated : nowMs));
     }
     const openConflicts = countOpenConflicts(facts, drafts.map((d) => d.summary), input.openConflicts);
-    const projects = drafts.map((d) => {
-        d.summary.atRisk = d.summary.bands.atRisk;
-        d.summary.share = d.summary.live > 0 ? d.summary.atRisk / d.summary.live : 0;
-        d.summary.lastRetrievedDays = d.summary.live > 0 ? round1(d.lastDays) : null;
-        return { summary: d.summary, members: Int32Array.from(d.members), firstCreatedMs: d.firstCreatedMs };
-    });
+    const projects = drafts.map(finishProject);
     const embeddedTotal = projects.reduce((sum, p) => sum + p.summary.embedded, 0);
     return {
         id: input.id,
@@ -227,82 +232,74 @@ function countOpenConflicts(facts, summaries, conflicts) {
     }
     return total;
 }
+function cacheStillServes(hit, want, wallMs) {
+    const age = wallMs - hit.builtAtMs;
+    return hit.snapshot.tenantId === want.tenantId
+        && (hit.dataVersion !== null || want.dataVersion === null)
+        && age < TTL_MS
+        && (hit.dataVersion === want.dataVersion || age < COALESCE_MS);
+}
 // Keeps ids rising between two services created in the same millisecond of one process.
 let highestIssuedId = 0;
-/** Holds one read-only connection for its commit signal (`PRAGMA data_version`) and the snapshot cache; `now` dates the strength projections, `cacheClock` ages the cache. */
-export function createSnapshotService(hippoRoot, now, cacheClock = Date.now) {
-    let db = null;
-    let cached = null;
+class SnapshotCacheService {
+    hippoRoot;
+    now;
+    cacheClock;
+    connection;
+    cached = null;
     // Wall clock, not `now`, so ids keep rising across server restarts and a client holding an old tab never sees a lower one.
-    let lastId = Math.max(Date.now(), highestIssuedId);
-    let lastEmbeddedIds;
-    const dataVersion = () => {
-        if (db === null) {
-            if (!fs.existsSync(getHippoDbPath(hippoRoot)))
-                return null;
-            db = openHippoDbReadOnly(hippoRoot);
+    lastId = Math.max(Date.now(), highestIssuedId);
+    lastEmbeddedIds;
+    constructor(hippoRoot, now, cacheClock) {
+        this.hippoRoot = hippoRoot;
+        this.now = now;
+        this.cacheClock = cacheClock;
+        this.connection = new DashboardConnection(hippoRoot);
+    }
+    build(tenantId, dv, nowMs) {
+        const rows = dv === null ? null : loadDashboardRows(this.hippoRoot, tenantId);
+        const openConflicts = dv === null ? [] : listMemoryConflicts(this.hippoRoot, 'open', tenantId);
+        this.lastId += 1;
+        highestIssuedId = Math.max(highestIssuedId, this.lastId);
+        // After loadDashboardRows, whose writable open has run any pending migration and legacy embeddings.json import.
+        this.lastEmbeddedIds = this.connection.embeddedIds();
+        return buildSnapshot({ id: this.lastId, tenantId, nowMs, entries: rows?.live ?? [], excluded: rows?.excluded, openConflicts, embeddedIds: this.lastEmbeddedIds });
+    }
+    get(tenantId, fresh = false) {
+        const nowMs = this.now();
+        // A frozen eval clock (HIPPO_FAKE_NOW) would never age the cache, so reuse is timed on its own clock.
+        const wallMs = this.cacheClock();
+        // Read before the build, so a commit that lands during it shows on the next read.
+        const dv = this.connection.dataVersion();
+        const hit = this.cached;
+        if (hit !== null && !fresh) {
+            if (cacheStillServes(hit, { tenantId, dataVersion: dv }, wallMs))
+                return hit.snapshot;
         }
-        // SAFETY: PRAGMA data_version returns one row with that single integer column.
-        const row = db.prepare('PRAGMA data_version').get();
-        return row.data_version;
-    };
-    // No database means no vectors; a store not yet on schema v52 has no table to count, so coverage is unknown.
-    const readEmbeddedIds = () => {
-        if (db === null)
-            return new Set();
-        // SAFETY: sqlite_master rows carry a text name; the query only tests presence.
-        const table = db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'memory_vectors'").get();
-        return table === undefined ? null : storedVectorIds(db);
-    };
-    const build = (tenantId, dv, nowMs) => {
-        const entries = dv === null ? [] : loadAllEntries(hippoRoot, tenantId);
-        const openConflicts = dv === null ? [] : listMemoryConflicts(hippoRoot, 'open', tenantId);
-        lastId += 1;
-        highestIssuedId = Math.max(highestIssuedId, lastId);
-        // After loadAllEntries, whose writable open has run any pending migration and legacy embeddings.json import.
-        lastEmbeddedIds = readEmbeddedIds();
-        return buildSnapshot({ id: lastId, tenantId, nowMs, entries, openConflicts, embeddedIds: lastEmbeddedIds });
-    };
-    return {
-        get(tenantId, fresh = false) {
-            const nowMs = now();
-            // A frozen eval clock (HIPPO_FAKE_NOW) would never age the cache, so reuse is timed on its own clock.
-            const wallMs = cacheClock();
-            // Read before the build, so a commit that lands during it shows on the next read.
-            const dv = dataVersion();
-            const hit = cached;
-            if (hit !== null && !fresh) {
-                const age = wallMs - hit.builtAtMs;
-                const reusable = hit.snapshot.tenantId === tenantId
-                    && (hit.dataVersion !== null || dv === null)
-                    && age < TTL_MS
-                    && (hit.dataVersion === dv || age < COALESCE_MS);
-                if (reusable)
-                    return hit.snapshot;
-            }
-            const snapshot = build(tenantId, dv, nowMs);
-            cached = { snapshot, dataVersion: dv, builtAtMs: wallMs };
-            return snapshot;
-        },
-        invalidate() {
-            cached = null;
-        },
-        currentId() {
-            return lastId;
-        },
-        embeddedIds() {
-            if (lastEmbeddedIds !== undefined)
-                return lastEmbeddedIds;
-            dataVersion();
-            return readEmbeddedIds();
-        },
-        close() {
-            if (db !== null)
-                closeHippoDb(db);
-            db = null;
-            cached = null;
-            lastEmbeddedIds = undefined;
-        },
-    };
+        const snapshot = this.build(tenantId, dv, nowMs);
+        this.cached = { snapshot, dataVersion: dv, builtAtMs: wallMs };
+        return snapshot;
+    }
+    invalidate() {
+        this.cached = null;
+    }
+    currentId() {
+        return this.lastId;
+    }
+    embeddedIds() {
+        if (this.lastEmbeddedIds !== undefined)
+            return this.lastEmbeddedIds;
+        this.connection.dataVersion();
+        return this.connection.embeddedIds();
+    }
+    close() {
+        this.connection.close();
+        this.cached = null;
+        this.lastEmbeddedIds = undefined;
+    }
+}
+/** Holds one read-only connection for its commit signal (`PRAGMA data_version`) and the snapshot cache; `now` dates the strength projections, `cacheClock` ages the cache. */
+export function createSnapshotService(hippoRoot, now, cacheClock = Date.now) {
+    return new SnapshotCacheService(hippoRoot, now, cacheClock);
 }
 //# sourceMappingURL=dashboard-snapshot.js.map

package/dist/{dashboard.js → dashboard/dashboard.js}

@@ -2,18 +2,19 @@
 import * as http from 'http';
 import * as path from 'path';
 import * as fs from 'fs';
-import { randomBytes, timingSafeEqual } from 'crypto';
-import { evalNow } from './ablation.js';
-import { readEntry } from './store/entry-reads.js';
-import { listCards } from './store-cards.js';
-import { resolveTenantId } from './tenant.js';
-import { loadCardDetail } from './card-detail.js';
-import { closeAfterReply, isCrossSite, LOOPBACK_HOST_HEADER } from './http-util.js';
-import { log } from './log.js';
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from 'crypto';
+import { evalNow } from '../core/ablation.js';
+import { readEntry } from '../store/entry-reads.js';
+import { listCards } from '../store/cards.js';
+import { resolveTenantId } from '../store/tenant.js';
+import { loadCardDetail } from '../store/card-detail.js';
+import { bodyDeadlineMs, BodyTimeoutError, closeAfterReply, isCrossSite, LOOPBACK_HOST_HEADER } from '../util/http-util.js';
+import { errorMessage, log } from '../util/log.js';
 import { createSnapshotService, isLiveMemory } from './dashboard-snapshot.js';
 import { buildMemoryDetail, buildMemoryPage, buildOverview, buildProjectDetail, buildSearch, } from './dashboard-queries.js';
 import { forgetMemory, markWrong, pinMemory, resolveOpenConflict, } from './dashboard-actions.js';
 import { ParamError, parseActionBody, parseConflictId, parseMemoryId, parseMemoryQuery, parseSearchText, } from './dashboard-params.js';
+import { runWithRequestId } from '../util/request-scope.js';
 const MIME_TYPES = {
     '.html': 'text/html; charset=utf-8',
     '.js': 'application/javascript; charset=utf-8',
@@ -72,6 +73,10 @@ function readActionBody(req) {
         const chunks = [];
         let size = 0;
         let aborted = false;
+        const deadlineMs = bodyDeadlineMs();
+        const timer = setTimeout(() => reject(new BodyTimeoutError(`request body not received within ${deadlineMs} ms`)), deadlineMs);
+        // Unref: a request that already failed another way must not hold the process open for the rest of the deadline.
+        timer.unref();
         req.on('data', (chunk) => {
             size += chunk.length;
             if (size <= BODY_MAX_BYTES)
@@ -83,6 +88,7 @@ function readActionBody(req) {
         });
         req.on('error', reject);
         req.on('end', () => {
+            clearTimeout(timer);
             if (size > BODY_MAX_BYTES)
                 return reject(new ParamError(`Body must be at most ${BODY_MAX_BYTES} bytes`));
             try {
@@ -123,7 +129,7 @@ function handleRead(ctx, segments) {
             return sendOrNotFound(res, null);
         const snapshotId = snapshots.get(tenantId, fresh).id;
         const embedded = snapshots.embeddedIds()?.has(entry.id) ?? false;
-        return sendOrNotFound(res, buildMemoryDetail(hippoRoot, tenantId, entry, snapshotId, ctx.now(), embedded));
+        return sendOrNotFound(res, buildMemoryDetail(hippoRoot, tenantId, entry, { snapshotId, nowMs: ctx.now(), embedded }));
     }
     if (head === 'search' && segments.length === 2) {
         return sendOrNotFound(res, buildSearch(snapshots.get(tenantId, fresh), parseSearchText(url.searchParams)));
@@ -175,7 +181,7 @@ async function handlePost(ctx, segments) {
     if (result.entry) {
         // The write is committed, so a rebuild failure must not turn it into a 500: the next read rebuilds.
         const embedded = snapshots.embeddedIds()?.has(result.entry.id) ?? false;
-        const detail = buildMemoryDetail(hippoRoot, tenantId, result.entry, snapshots.currentId(), ctx.now(), embedded);
+        const detail = buildMemoryDetail(hippoRoot, tenantId, result.entry, { snapshotId: snapshots.currentId(), nowMs: ctx.now(), embedded });
         jsonResponse(res, detail, result.status);
     }
     else {
@@ -183,21 +189,43 @@ async function handlePost(ctx, segments) {
     }
     return true;
 }
+// One style block, not style attributes, so the policy below can name its hash and allow no other inline style.
+const NOT_BUILT_CSS = "body{font-family:Georgia,'Palatino Linotype',serif;max-width:640px;margin:60px auto;padding:24px;line-height:1.6;background:#f4efe6;color:#3a3228}" +
+    'h1{color:#c45c3c}' +
+    'pre{background:#faf7f2;padding:16px;border:1px solid #c4b9a8;border-radius:3px;font-family:Consolas,monospace}';
+// Memory text is written by other tools and people, so every reply tells the browser to load code only from this server and never to frame, sniff or name the page elsewhere.
+const SECURITY_HEADERS = {
+    'Content-Security-Policy': [
+        "default-src 'none'",
+        "script-src 'self'",
+        `style-src 'self' 'sha256-${createHash('sha256').update(NOT_BUILT_CSS).digest('base64')}'`,
+        "img-src 'self' data:",
+        "font-src 'self'",
+        "connect-src 'self'",
+        "base-uri 'none'",
+        "form-action 'none'",
+        "frame-ancestors 'none'",
+    ].join('; '),
+    'X-Content-Type-Options': 'nosniff',
+    'Referrer-Policy': 'no-referrer',
+    'X-Frame-Options': 'DENY',
+};
 function notBuilt(res) {
     res.writeHead(404, { 'Content-Type': 'text/html; charset=utf-8' });
     res.end(`<!doctype html>
-<html lang="en"><head><title>Hippo Dashboard</title><meta charset="utf-8"></head>
-<body style="font-family:Georgia,'Palatino Linotype',serif;max-width:640px;margin:60px auto;padding:24px;line-height:1.6;background:#f4efe6;color:#3a3228">
-<h1 style="color:#c45c3c">Hippo Dashboard</h1>
+<html lang="en"><head><title>Hippo Dashboard</title><meta charset="utf-8"><style>${NOT_BUILT_CSS}</style></head>
+<body>
+<h1>Hippo Dashboard</h1>
 <p>The React UI bundle is not built yet. Run:</p>
-<pre style="background:#faf7f2;padding:16px;border:1px solid #c4b9a8;border-radius:3px;font-family:Consolas,monospace">cd ui && npm install && npm run build</pre>
+<pre>cd ui && npm install && npm run build</pre>
 <p>Then refresh this page. The dashboard server will serve <code>dist-ui/index.html</code> automatically once present.</p>
 </body></html>`);
 }
 function serveSpa(res, distUiDir, pathname) {
     const safePath = path.normalize(pathname).replace(/^(\.\.[/\\])+/, '');
     const filePath = path.join(distUiDir, safePath);
-    if (!filePath.startsWith(distUiDir))
+    // The separator matters: a bare prefix also admits a sibling folder whose name starts with this one.
+    if (filePath !== distUiDir && !filePath.startsWith(distUiDir + path.sep))
         return forbidden(res);
     if (fs.existsSync(filePath) && fs.statSync(filePath).isFile() && serveStaticFile(res, filePath))
         return;
@@ -221,6 +249,78 @@ function cookieValue(header, name) {
     }
     return undefined;
 }
+/** Where a page load that carried the token goes next, without it; null for an API call or a write, which is answered in place. */
+function tokenFreeLocation(req, url) {
+    if ((req.method !== 'GET' && req.method !== 'HEAD') || url.pathname.startsWith('/api/'))
+        return null;
+    const query = new URLSearchParams(url.searchParams);
+    query.delete('token');
+    const rest = query.toString();
+    // One leading slash only: `//host` would send the browser to another site.
+    return `${url.pathname.replace(/^\/+/, '/')}${rest ? `?${rest}` : ''}`;
+}
+/** Moves the browser off the URL that carries the token, so the token stays out of history, bookmarks and copied links; false when the request is answered in place. */
+function leaveTokenUrl(req, res, url) {
+    const location = tokenFreeLocation(req, url);
+    if (location === null)
+        return false;
+    if (req.headers['sec-fetch-site'] !== 'cross-site') {
+        res.writeHead(303, { Location: location });
+        res.end();
+        return true;
+    }
+    // A browser withholds a SameSite=Strict cookie from a redirect another site started; a refresh from this page is same-site.
+    const target = location.replace(/&/g, '&amp;').replace(/"/g, '&quot;');
+    res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+    res.end(`<!doctype html>\n<html lang="en"><head><meta charset="utf-8"><meta http-equiv="refresh" content="0;url=${target}"><title>Hippo Dashboard</title></head><body></body></html>`);
+    return true;
+}
+/** True when the request may proceed; false when this already answered it (redirect off the token URL, or 401). */
+function admitDashboardRequest(req, res, url, access) {
+    const { token, port } = access;
+    // Cookies ignore the port, so the name carries it: two dashboards on one host keep separate tokens.
+    const cookieName = `hippo_dashboard_${req.socket.localPort ?? port}`;
+    if (sameToken(url.searchParams.get('token') ?? undefined, token)) {
+        res.setHeader('Set-Cookie', `${cookieName}=${token}; HttpOnly; SameSite=Strict; Path=/`);
+        if (leaveTokenUrl(req, res, url))
+            return false;
+    }
+    else if (!sameToken(cookieValue(req.headers.cookie, cookieName), token)) {
+        res.writeHead(401, { 'Content-Type': 'text/plain' });
+        res.end('Unauthorized: open the dashboard with the URL `hippo dashboard` printed; it carries the access token.');
+        return false;
+    }
+    return true;
+}
+function answerDashboardFailure(req, res, err) {
+    const clientFault = err instanceof ParamError || err instanceof URIError || err instanceof BodyTimeoutError;
+    // A cut-short response is logged even for a client fault; a bare 400 is not.
+    if (res.headersSent || !clientFault) {
+        log.error('dashboard request failed', { error: errorMessage(err), path: req.url });
+    }
+    if (res.headersSent) {
+        res.end();
+        return;
+    }
+    if (err instanceof BodyDrainExceeded || err instanceof BodyTimeoutError) {
+        // No `Connection: close` header: Node then destroys the socket as soon as the reply is written.
+        res.writeHead(err instanceof BodyTimeoutError ? 408 : 400, { 'Content-Type': 'application/json; charset=utf-8' });
+        res.end(JSON.stringify({ error: err.message }), () => closeAfterReply(req));
+        return;
+    }
+    if (err instanceof ParamError)
+        return jsonResponse(res, { error: err.message }, 400);
+    if (err instanceof URIError)
+        return jsonResponse(res, { error: 'Malformed URL path' }, 400);
+    jsonResponse(res, { error: 'Internal error' }, 500);
+}
+function printDashboardBanner(boundPort, token, distUiDir) {
+    // The banner is the `hippo dashboard` command's printed result, so it stays on stdout.
+    console.log(`Hippo Dashboard running at http://localhost:${boundPort}/?token=${token}`);
+    if (distUiDir !== null)
+        console.log(`Serving React UI from ${distUiDir}`);
+    console.log('Press Ctrl+C to stop.');
+}
 /** Serves the dashboard on 127.0.0.1 behind a per-start `token` (tests pass one), since loopback alone lets any local process read every memory; `opts` sets the projection and cache clocks. */
 export function serveDashboard(hippoRoot, port = 3333, token = randomBytes(32).toString('base64url'), opts) {
     const distUiDir = path.resolve(import.meta.dirname, '..', 'dist-ui');
@@ -232,16 +332,8 @@ export function serveDashboard(hippoRoot, port = 3333, token = randomBytes(32).t
         if (host !== undefined && !LOOPBACK_HOST_HEADER.test(host))
             return forbidden(res);
         const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
-        // Cookies ignore the port, so the name carries it: two dashboards on one host keep separate tokens.
-        const cookieName = `hippo_dashboard_${req.socket.localPort ?? port}`;
-        if (sameToken(url.searchParams.get('token') ?? undefined, token)) {
-            res.setHeader('Set-Cookie', `${cookieName}=${token}; HttpOnly; SameSite=Strict; Path=/`);
-        }
-        else if (!sameToken(cookieValue(req.headers.cookie, cookieName), token)) {
-            res.writeHead(401, { 'Content-Type': 'text/plain' });
-            res.end('Unauthorized: open the dashboard with the URL `hippo dashboard` printed; it carries the access token.');
+        if (!admitDashboardRequest(req, res, url, { token, port }))
             return;
-        }
         if (url.pathname.startsWith('/api/')) {
             // A malformed % sequence throws URIError here; the caller answers 400.
             const segments = url.pathname.split('/').filter((s) => s !== '').map((s) => decodeURIComponent(s));
@@ -257,39 +349,18 @@ export function serveDashboard(hippoRoot, port = 3333, token = randomBytes(32).t
             return serveSpa(res, distUiDir, url.pathname);
         notBuilt(res);
     };
-    const server = http.createServer((req, res) => {
-        handleRequest(req, res).catch((err) => {
-            const clientFault = err instanceof ParamError || err instanceof URIError;
-            // A cut-short response is logged even for a client fault; a bare 400 is not.
-            if (res.headersSent || !clientFault) {
-                log.error('dashboard request failed', { error: err instanceof Error ? err.message : String(err), path: req.url });
-            }
-            if (res.headersSent) {
-                res.end();
-                return;
-            }
-            if (err instanceof BodyDrainExceeded) {
-                // No `Connection: close` header: Node then destroys the socket as soon as the reply is written.
-                res.writeHead(400, { 'Content-Type': 'application/json; charset=utf-8' });
-                res.end(JSON.stringify({ error: err.message }), () => closeAfterReply(req));
-                return;
-            }
-            if (err instanceof ParamError)
-                return jsonResponse(res, { error: err.message }, 400);
-            if (err instanceof URIError)
-                return jsonResponse(res, { error: 'Malformed URL path' }, 400);
-            jsonResponse(res, { error: 'Internal error' }, 500);
-        });
-    });
+    const onRequest = (req, res) => {
+        for (const [name, value] of Object.entries(SECURITY_HEADERS))
+            res.setHeader(name, value);
+        handleRequest(req, res).catch((err) => answerDashboardFailure(req, res, err));
+    };
+    // One id per request, so the lines it logs can be told apart from a concurrent request's.
+    const server = http.createServer((req, res) => runWithRequestId(randomUUID(), () => onRequest(req, res)));
     server.on('close', () => snapshots.close());
     server.listen(port, '127.0.0.1', () => {
         // SAFETY: listen() was given a TCP port, so address() is AddressInfo, never a pipe name.
         const boundPort = server.address().port;
-        // The banner is the `hippo dashboard` command's printed result, so it stays on stdout.
-        console.log(`Hippo Dashboard running at http://localhost:${boundPort}/?token=${token}`);
-        if (hasDistUi)
-            console.log(`Serving React UI from ${distUiDir}`);
-        console.log('Press Ctrl+C to stop.');
+        printDashboardBanner(boundPort, token, hasDistUi ? distUiDir : null);
     });
     return server;
 }