hippo-memory 1.69.0 → 1.71.0

package/dist/{invalidation.js → learn/invalidation.js}

@@ -1,13 +1,11 @@
-import { writeEntryOn } from './store/entry-writes.js';
-import { loadAllEntries, selectEntriesByIds } from './store/entry-reads.js';
-import { openStore } from './store/open.js';
-import { openHippoDb, closeHippoDb } from './db.js';
-import { CHURN_STALE_TAG } from './memory.js';
+import { addTagToEntries, writeEntriesSeparately } from '../store/entry-writes.js';
+import { confirmedOutcomeTimes } from '../store/audit.js';
+import { chunked, loadAllEntries, loadEntriesByIds } from '../store/entry-reads.js';
+import { CHURN_STALE_TAG } from '../core/memory.js';
 import { GitReadError, gitLsFilesAtHead, fetchChurnWindowLog, gitGrepPresence, resolveCommitBefore, packageScriptsAt, } from './churn-git.js';
-/**
- * Extract what was replaced/removed from a commit message.
- * Returns null if the commit isn't a breaking/migration change.
- */
+const HEADLINE_CHARS = 60;
+/** Extract what was replaced/removed from a commit message.
+ *  Returns null if the commit isn't a breaking/migration change. */
 export function extractInvalidationTarget(message) {
     // Strip conventional commit prefix (e.g., "feat(scope): ")
     const body = message.replace(/^[a-z]+(\([^)]*\))?:\s*/i, '').trim();
@@ -44,26 +42,38 @@ export function extractInvalidationTarget(message) {
     }
     return null;
 }
-/**
- * Find memories that reference the invalidated pattern and weaken them.
- * - Halves half_life_days
- * - Sets confidence to 'stale'
- * - Adds 'invalidated' tag
- * - Skips pinned memories (reported in skippedPinned)
- *
- * Tag matching is EXACT (2026-06-09 incident): the FULL pattern must equal a
- * tag. Token-level matching applies to content only, so a pattern that merely
- * CONTAINS a common tag word ("hippo") can no longer mass-weaken every memory
- * carrying that tag. Both callers (the CLI `invalidate` command and the
- * auto-learn-from-git path) inherit this contract.
- */
+/** Find memories that reference the invalidated pattern and weaken them (halve half_life_days, confidence 'stale', add 'invalidated' tag; pinned are skipped).
+ *  Tag matching is EXACT: the FULL pattern must equal a tag, so a pattern merely containing a common tag word cannot mass-weaken every memory with that tag. */
 export function invalidateMatching(hippoRoot, target, tenantId, options) {
-    // L9: tenantId opt-in. When provided, only this tenant's memories are
-    // considered for weakening. When undefined, behaves as it did pre-1.12.1
-    // (host-wide invalidation across all tenants in the store).
-    // options.onlyId resolves by FILTERING this tenant-scoped list — never a
-    // direct id lookup — so an id from another tenant is invisible here.
-    const entries = loadAllEntries(hippoRoot, tenantId);
+    // tenantId opt-in: when set, only that tenant's memories are weakened; undefined is host-wide.
+    // options.onlyId filters this tenant-scoped list rather than looking up an id directly, so another tenant's id is invisible here.
+    const { result, weakened } = weakenMatches(loadAllEntries(hippoRoot, tenantId), target, options);
+    writeEntriesSeparately(hippoRoot, weakened);
+    return result;
+}
+/** invalidateMatching for a batch: matches against `live`, the caller's list of the tenant's rows, and keeps it current.
+ *  Each match is read again before it is weakened, so a row another writer changed since the list was read is never written back stale. */
+export function invalidateMatchingAmong(hippoRoot, live, target, tenantId) {
+    const seen = weakenMatches(live, target, { dryRun: true }).result;
+    const ids = [...seen.targets, ...seen.skippedPinned];
+    // loadEntriesByIds reads at most 500 ids a call.
+    const fresh = new Map(chunked(ids, 500).flatMap((chunk) => loadEntriesByIds(hippoRoot, chunk, tenantId)).map((entry) => [entry.id, entry]));
+    const { result, weakened } = weakenMatches(ids.flatMap((id) => fresh.get(id) ?? []), target);
+    writeEntriesSeparately(hippoRoot, weakened);
+    const byId = new Map(weakened.map((entry) => [entry.id, entry]));
+    for (let i = 0; i < live.length; i++)
+        live[i] = byId.get(live[i].id) ?? live[i];
+    return result;
+}
+function referencesPattern(entry, fromTokens, exactTag) {
+    const contentTokens = invalidationTokenize(entry.content);
+    const tagTokens = entry.tags.map(t => t.toLowerCase());
+    const tokenMatch = matchScore(fromTokens, contentTokens);
+    const tagMatch = tagTokens.includes(exactTag);
+    return tokenMatch >= 0.5 || tagMatch;
+}
+/** The match pass: weakens each unpinned match in place and returns them, writing nothing. */
+function weakenMatches(entries, target, options) {
     const fromTokens = invalidationTokenize(target.from);
     const exactTag = target.from.toLowerCase().trim();
     const dryRun = options?.dryRun === true;
@@ -80,15 +90,8 @@ export function invalidateMatching(hippoRoot, target, tenantId, options) {
             if (entry.id !== options.onlyId)
                 continue;
         }
-        else {
-            const contentTokens = invalidationTokenize(entry.content);
-            const tagTokens = entry.tags.map(t => t.toLowerCase());
-            // Check if the memory references the old pattern
-            const tokenMatch = matchScore(fromTokens, contentTokens);
-            const tagMatch = tagTokens.includes(exactTag);
-            if (!(tokenMatch >= 0.5 || tagMatch))
-                continue;
-        }
+        else if (!referencesPattern(entry, fromTokens, exactTag))
+            continue;
         // Pinned check runs AFTER matching so pinned would-be targets are
         // observable in skippedPinned (pattern mode and onlyId mode alike).
         if (entry.pinned) {
@@ -99,7 +102,7 @@ export function invalidateMatching(hippoRoot, target, tenantId, options) {
         result.targets.push(entry.id);
         result.preview.push({
             id: entry.id,
-            headline: entry.content.replace(/\s+/g, ' ').slice(0, 60),
+            headline: entry.content.replace(/\s+/g, ' ').slice(0, HEADLINE_CHARS),
         });
         if (dryRun)
             continue;
@@ -110,21 +113,7 @@ export function invalidateMatching(hippoRoot, target, tenantId, options) {
         }
         weakened.push(entry);
     }
-    writeEntriesOnOneHandle(hippoRoot, weakened);
-    return result;
-}
-/** Each row commits alone, as a run of writeEntry calls would, but the store opens once. */
-function writeEntriesOnOneHandle(hippoRoot, entries) {
-    if (entries.length === 0)
-        return;
-    const db = openStore(hippoRoot);
-    try {
-        for (const entry of entries)
-            writeEntryOn(db, hippoRoot, entry);
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    return { result, weakened };
 }
 const STOPWORDS = new Set([
     'the', 'an', 'is', 'it', 'in', 'on', 'at', 'to', 'for', 'of', 'by',
@@ -219,22 +208,6 @@ function resolveTrackedPath(token, repoRoot, projectName, index) {
     }
     return null;
 }
-// Anchor SQL runs on its own handle (closed in finally); queryAuditEvents is NOT
-// reused here because its 10k-row cap would silently miss old confirmations.
-function queryConfirmedAt(hippoRoot, tenantId) {
-    const db = openHippoDb(hippoRoot);
-    try {
-        // SAFETY: the SELECT list above is exactly target_id and ts; no other shape reaches this cast.
-        const rows = db.prepare(`SELECT target_id, MAX(ts) AS ts FROM audit_log
-       WHERE tenant_id = ? AND op = 'outcome' AND target_id IS NOT NULL
-         AND json_extract(metadata_json, '$.good') = 1
-       GROUP BY target_id`).all(tenantId);
-        return new Map(rows.map((r) => [r.target_id, r.ts]));
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
 function emptyChurnResult(dryRun, skippedPinned = [], error) {
     const result = { checked: 0, marked: 0, alreadyMarked: 0, skippedPinned, dryRun, preview: [] };
     if (error !== undefined)
@@ -262,25 +235,8 @@ function collectChurnCandidates(entries, opts) {
     }
     return { candidates, skippedPinned };
 }
-function loadChurnGitView(repoRoot, projectName, candidates, anchorOf, needs) {
-    const headFiles = gitLsFilesAtHead(repoRoot);
-    let windowLog = [];
-    if (needs.paths) {
-        const minAnchor = candidates.reduce((min, c) => {
-            const a = anchorOf(c.entry);
-            return min === '' || a < min ? a : min;
-        }, '');
-        windowLog = fetchChurnWindowLog(repoRoot, minAnchor);
-    }
-    const touchedInWindow = new Set();
-    for (const c of windowLog)
-        for (const f of c.files)
-            touchedInWindow.add(f.path);
-    const trackedIndex = buildTrackedIndex(new Set([...headFiles, ...touchedInWindow]));
-    const headIndex = buildTrackedIndex(headFiles);
-    const presentAtHeadSymbols = needs.symbols
-        ? gitGrepPresence(repoRoot, [...new Set(candidates.flatMap((c) => c.refs.symbols))], 'HEAD')
-        : new Set();
+/** The per-commit lookups of a ChurnGitView; each asks git once per commit and remembers the answer. */
+function churnCommitLookups(repoRoot) {
     const anchorCommitCache = new Map();
     const resolveAnchorCommit = (anchorIso) => {
         if (!anchorCommitCache.has(anchorIso)) {
@@ -299,7 +255,6 @@ function loadChurnGitView(repoRoot, projectName, candidates, anchorOf, needs) {
         }
         return known;
     };
-    const headScripts = needs.scripts ? packageScriptsAt(repoRoot, 'HEAD') : null;
     const scriptsAtCommit = new Map();
     const scriptsAt = (hash) => {
         if (!scriptsAtCommit.has(hash)) {
@@ -307,7 +262,29 @@ function loadChurnGitView(repoRoot, projectName, candidates, anchorOf, needs) {
         }
         return scriptsAtCommit.get(hash);
     };
-    return { repoRoot, projectName, windowLog, trackedIndex, headIndex, presentAtHeadSymbols, headScripts, resolveAnchorCommit, symbolsPresentAt, scriptsAt };
+    return { resolveAnchorCommit, symbolsPresentAt, scriptsAt };
+}
+function loadChurnGitView(repoRoot, projectName, candidates, anchorOf, needs) {
+    const headFiles = gitLsFilesAtHead(repoRoot);
+    let windowLog = [];
+    if (needs.paths) {
+        const minAnchor = candidates.reduce((min, c) => {
+            const a = anchorOf(c.entry);
+            return min === '' || a < min ? a : min;
+        }, '');
+        windowLog = fetchChurnWindowLog(repoRoot, minAnchor);
+    }
+    const touchedInWindow = new Set();
+    for (const c of windowLog)
+        for (const f of c.files)
+            touchedInWindow.add(f.path);
+    const trackedIndex = buildTrackedIndex(new Set([...headFiles, ...touchedInWindow]));
+    const headIndex = buildTrackedIndex(headFiles);
+    const presentAtHeadSymbols = needs.symbols
+        ? gitGrepPresence(repoRoot, [...new Set(candidates.flatMap((c) => c.refs.symbols))], 'HEAD')
+        : new Set();
+    const headScripts = needs.scripts ? packageScriptsAt(repoRoot, 'HEAD') : null;
+    return { repoRoot, projectName, windowLog, trackedIndex, headIndex, presentAtHeadSymbols, headScripts, ...churnCommitLookups(repoRoot) };
 }
 function pathEvidence(git, paths, anchorTime) {
     for (const rawPath of paths) {
@@ -362,27 +339,34 @@ function churnEvidence(git, refs, anchor) {
 }
 function tagChurnStale(hippoRoot, tenantId, toTag, confirmedAt) {
     // The git calls above can take seconds; a good outcome landing meanwhile moves the anchor past the evidence.
-    const confirmedNow = queryConfirmedAt(hippoRoot, tenantId);
+    const confirmedNow = confirmedOutcomeTimes(hippoRoot, tenantId);
     const unconfirmed = toTag.filter((stale) => confirmedNow.get(stale.id) === confirmedAt.get(stale.id));
     if (unconfirmed.length === 0)
         return;
-    const db = openStore(hippoRoot);
-    try {
-        const live = selectEntriesByIds(db, unconfirmed.map((stale) => stale.id), tenantId);
-        for (const stale of unconfirmed) {
-            const entry = live.get(stale.id);
-            if (!entry || entry.tags.includes(CHURN_STALE_TAG))
-                continue;
-            const tagged = { ...entry, tags: [...entry.tags, CHURN_STALE_TAG] };
-            writeEntryOn(db, hippoRoot, tagged);
-            live.set(stale.id, tagged); // a repeated id is already tagged, as a fresh read would show
+    addTagToEntries(hippoRoot, tenantId, unconfirmed.map((stale) => stale.id), CHURN_STALE_TAG);
+}
+/** Counts every candidate's evidence into `result` and returns the rows still to tag, writing nothing. */
+function recordChurnEvidence(git, candidates, anchorOf, result) {
+    const toTag = [];
+    for (const { entry, refs } of candidates) {
+        result.checked++;
+        const evidence = churnEvidence(git, refs, anchorOf(entry));
+        if (!evidence)
+            continue;
+        const headline = entry.content.replace(/\s+/g, ' ').slice(0, HEADLINE_CHARS);
+        if (entry.tags.includes(CHURN_STALE_TAG)) {
+            result.alreadyMarked++;
+            result.preview.push({ id: entry.id, headline, evidence, already: true });
+            continue;
         }
+        result.marked++;
+        result.preview.push({ id: entry.id, headline, evidence, already: false });
+        toTag.push(entry);
     }
-    finally {
-        closeHippoDb(db);
-    }
+    return toTag;
 }
-/** Flags memories whose named file/symbol/script changed or disappeared since storage (or last confirmation); only adds/removes CHURN_STALE_TAG, never confidence/half-life/strength. */
+/** Flags memories whose named file/symbol/script changed or disappeared since storage (or last
+ * confirmation); only adds/removes CHURN_STALE_TAG, never confidence/half-life/strength. */
 export function detectChurnStale(hippoRoot, repoRoot, opts) {
     const dryRun = opts.dryRun === true;
     if (!opts.projectName)
@@ -391,7 +375,7 @@ export function detectChurnStale(hippoRoot, repoRoot, opts) {
     const { candidates, skippedPinned } = collectChurnCandidates(entries, opts);
     if (candidates.length === 0)
         return emptyChurnResult(dryRun, skippedPinned);
-    const confirmedAt = queryConfirmedAt(hippoRoot, opts.tenantId);
+    const confirmedAt = confirmedOutcomeTimes(hippoRoot, opts.tenantId);
     // Compared as epoch ms, not strings: imported rows may carry offsets or other ISO forms.
     const anchorOf = (entry) => {
         const confirmed = confirmedAt.get(entry.id);
@@ -409,25 +393,8 @@ export function detectChurnStale(hippoRoot, repoRoot, opts) {
     const result = { checked: 0, marked: 0, alreadyMarked: 0, skippedPinned, dryRun, preview: [] };
     try {
         const git = loadChurnGitView(repoRoot, opts.legacyName ?? opts.projectName, candidates, anchorOf, needs);
-        // Collected here, written only after every candidate's evidence is
-        // computed: a GitReadError thrown mid-loop must never leave an earlier
-        // candidate tagged while a later one aborts the run untagged.
-        const toTag = [];
-        for (const { entry, refs } of candidates) {
-            result.checked++;
-            const evidence = churnEvidence(git, refs, anchorOf(entry));
-            if (!evidence)
-                continue;
-            const headline = entry.content.replace(/\s+/g, ' ').slice(0, 60);
-            if (entry.tags.includes(CHURN_STALE_TAG)) {
-                result.alreadyMarked++;
-                result.preview.push({ id: entry.id, headline, evidence, already: true });
-                continue;
-            }
-            result.marked++;
-            result.preview.push({ id: entry.id, headline, evidence, already: false });
-            toTag.push(entry);
-        }
+        // Collected here and written only after every candidate's evidence is computed, so a GitReadError mid-loop cannot leave an earlier candidate tagged.
+        const toTag = recordChurnEvidence(git, candidates, anchorOf, result);
         if (!dryRun && toTag.length > 0)
             tagChurnStale(hippoRoot, opts.tenantId, toTag, confirmedAt);
     }

package/dist/mcp/admin-tools.d.ts

@@ -1,5 +1,5 @@
 import { type ToolCall } from './protocol.js';
-export declare function runPredictBaserateTool({ args, ctx, hippoRoot, tenantId }: ToolCall): string;
+export declare function runPredictBaserateTool({ args, ctx, hippoRoot, tenantId }: ToolCall): Promise<string>;
 export declare function runStatusTool({ hippoRoot, config, tenantId }: ToolCall): string;
 export declare function runConflictsTool(call: ToolCall): string;
 export declare function runResolveTool({ args, ctx, hippoRoot, tenantId }: ToolCall): string;

package/dist/mcp/admin-tools.js

@@ -1,36 +1,28 @@
 // Store health and admin tool handlers: base rates, status, conflicts, resolve, share and peers.
-import { calculateStrength } from '../memory.js';
-import { evalNow } from '../ablation.js';
-import { loadStrengthRows } from '../store/candidates.js';
-import { listMemoryConflicts, listTouchableConflicts, resolveConflict } from '../store/conflicts.js';
-import { shareMemory, listPeers } from '../shared.js';
-import { computePredictionBaserate } from '../predictions/store.js';
-import { closeHippoDb, openHippoDb } from '../db.js';
-import { NotFoundError } from '../api-errors.js';
-import { classifyOriginProject } from '../project-identity.js';
-import { canTouchScope, passesScopeFilterForRecall, personalScopeOf } from '../recall-scope.js';
-import { selectEntriesByIds } from '../store/entry-reads.js';
-import { selectMemoryReach } from '../store/tenant-lookup.js';
+import { evalNow } from '../core/ablation.js';
+import { loadStrengthTallies } from '../store/candidates.js';
+import { countOpenConflicts, listTouchableConflicts, resolveConflict } from '../store/conflicts.js';
+import { shareMemory, listPeers } from '../sharing/share.js';
+import { requireGroup, storeFor } from '../store/index.js';
+import { NotFoundError } from '../core/api-errors.js';
+import { classifyOriginProject } from '../core/project-identity.js';
+import { canTouchScope, passesScopeFilterForRecall, personalScopeOf } from '../store/recall-scope.js';
+import { chunked, loadEntriesByIds, readEntry } from '../store/entry-reads.js';
 import { mcpActor } from './protocol.js';
-import { isJsonString } from '../json.js';
+import { isJsonString } from '../util/json.js';
+import { DATE_PREFIX_CHARS } from '../util/token-text.js';
+const BASERATE_DECIMALS = 3;
 const NOT_RESOLVED = 'Could not resolve. Check the conflict ID and --keep value.';
 /** The scope of memory `id`, null when it has none or does not exist. */
 function memoryScope(hippoRoot, id) {
-    const db = openHippoDb(hippoRoot);
-    try {
-        return selectMemoryReach(db, id)?.scope ?? null;
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    return readEntry(hippoRoot, id)?.scope ?? null;
 }
-export function runPredictBaserateTool({ args, ctx, hippoRoot, tenantId }) {
-    // Text-only reply, matching the other MCP tools; the helper opens its own db
-    // and emits the audit, so call sites cannot drift.
+export async function runPredictBaserateTool({ args, ctx, hippoRoot, tenantId }) {
+    // Text-only reply, matching the other MCP tools; the group's read writes the audit row, so no surface can skip it.
     const classTag = String(args.class_tag || '').trim();
     if (!classTag)
         return 'No class_tag provided. Usage: pass class_tag matching a class used in past predictions (e.g. "migration-effort").';
-    const baserate = computePredictionBaserate(hippoRoot, tenantId, classTag, ctx?.actor ?? 'mcp');
+    const baserate = await requireGroup(storeFor({ hippoRoot, store: ctx?.store }), 'predictions').predictionBaserate(tenantId, classTag, ctx?.actor ?? 'mcp');
     if (baserate.nClosed === 0) {
         return `No closed predictions in class "${classTag}" yet. Create one via hippo_predict (or 'hippo predict ...' CLI) and close it with hippo_predict_close once the actual outcome is known. Base rates need closed predictions with numeric actual_value to compute.`;
     }
@@ -38,37 +30,26 @@ export function runPredictBaserateTool({ args, ctx, hippoRoot, tenantId }) {
     lines.push(`n_closed:         ${baserate.nClosed}`);
     lines.push(`n_ratio_eligible: ${baserate.nRatioEligible}`);
     if (baserate.meanEstimate !== null)
-        lines.push(`mean_estimate:    ${baserate.meanEstimate.toFixed(3)}`);
+        lines.push(`mean_estimate:    ${baserate.meanEstimate.toFixed(BASERATE_DECIMALS)}`);
     if (baserate.meanActual !== null)
-        lines.push(`mean_actual:      ${baserate.meanActual.toFixed(3)}`);
+        lines.push(`mean_actual:      ${baserate.meanActual.toFixed(BASERATE_DECIMALS)}`);
     if (baserate.meanRatio !== null)
-        lines.push(`mean_ratio:       ${baserate.meanRatio.toFixed(3)}x`);
+        lines.push(`mean_ratio:       ${baserate.meanRatio.toFixed(BASERATE_DECIMALS)}x`);
     if (baserate.p50Ratio !== null)
-        lines.push(`p50_ratio:        ${baserate.p50Ratio.toFixed(3)}x`);
+        lines.push(`p50_ratio:        ${baserate.p50Ratio.toFixed(BASERATE_DECIMALS)}x`);
     if (baserate.mae !== null)
-        lines.push(`mae:              ${baserate.mae.toFixed(3)}`);
+        lines.push(`mae:              ${baserate.mae.toFixed(BASERATE_DECIMALS)}`);
     return lines.join('\n');
 }
 export function runStatusTool({ hippoRoot, config, tenantId }) {
-    // Every row counts toward the averages, so this scans the store, but without its text.
-    const entries = loadStrengthRows(hippoRoot, tenantId);
-    const now = evalNow(); // honors HIPPO_FAKE_NOW (eval-only; see ablation.ts)
-    let atRisk = 0;
-    let totalStrength = 0;
-    for (const e of entries) {
-        const s = calculateStrength(e, now);
-        totalStrength += s;
-        if (s < 0.1 && !e.pinned)
-            atRisk++;
-    }
-    const avgStrength = entries.length > 0 ? (totalStrength / entries.length).toFixed(2) : '0';
-    const pinned = entries.filter((e) => e.pinned).length;
-    const errors = entries.filter((e) => e.tags.includes('error')).length;
-    const conflicts = listMemoryConflicts(hippoRoot, 'open', tenantId).length;
+    // honors HIPPO_FAKE_NOW (eval-only; see ablation.ts)
+    const tallies = loadStrengthTallies(hippoRoot, tenantId, evalNow(), 0.1);
+    const avgStrength = tallies.total > 0 ? (tallies.strengthSum / tallies.total).toFixed(2) : '0';
+    const conflicts = countOpenConflicts(hippoRoot, tenantId);
     return [
-        `Memories: ${entries.length} (${pinned} pinned, ${errors} errors)`,
+        `Memories: ${tallies.total} (${tallies.pinned} pinned, ${tallies.errors} errors)`,
         `Avg strength: ${avgStrength}`,
-        `At risk (<0.1): ${atRisk}`,
+        `At risk (<0.1): ${tallies.atRisk}`,
         `Open conflicts: ${conflicts}`,
         `Half-life default: ${config.defaultHalfLifeDays}d`,
     ].join('\n');
@@ -76,19 +57,15 @@ export function runStatusTool({ hippoRoot, config, tenantId }) {
 /** Pairs whose two rows the caller could recall: its repo or user-global, and no scope it was not asked for. */
 function recallablePairs(call, conflicts, project) {
     const own = personalScopeOf(mcpActor(call.ctx));
-    const db = openHippoDb(call.hippoRoot);
-    try {
-        const rows = selectEntriesByIds(db, conflicts.flatMap((c) => [c.memory_a_id, c.memory_b_id]), call.tenantId);
-        const shown = (id) => {
-            const row = rows.get(id);
-            return row !== undefined && classifyOriginProject(row.origin_project, project) !== 'cross-project'
-                && passesScopeFilterForRecall(row.scope ?? null, undefined, own);
-        };
-        return conflicts.filter((c) => shown(c.memory_a_id) && shown(c.memory_b_id));
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    const ids = [...new Set(conflicts.flatMap((c) => [c.memory_a_id, c.memory_b_id]))];
+    // loadEntriesByIds reads at most one chunk of ids per call.
+    const rows = new Map(chunked(ids).flatMap((chunk) => loadEntriesByIds(call.hippoRoot, chunk, call.tenantId)).map((row) => [row.id, row]));
+    const shown = (id) => {
+        const row = rows.get(id);
+        return row !== undefined && classifyOriginProject(row.origin_project, project) !== 'cross-project'
+            && passesScopeFilterForRecall(row.scope ?? null, undefined, own);
+    };
+    return conflicts.filter((c) => shown(c.memory_a_id) && shown(c.memory_b_id));
 }
 export function runConflictsTool(call) {
     const { ctx, hippoRoot, tenantId } = call;
@@ -129,10 +106,8 @@ export function runShareTool({ args, ctx, hippoRoot, tenantId }) {
     // Checked before shareMemory, whose personal-row refusal would tell another person the id exists.
     if (!canTouchScope(mcpActor(ctx), memoryScope(hippoRoot, shareId)))
         throw new NotFoundError(`Memory not found: ${shareId}`);
-    // Pass tenantId so shareMemory's readEntry filters by tenant. Without
-    // this, a Bearer for tenant A could call hippo_share with tenant B's
-    // id and copy the row to the global store. The 'Memory not found'
-    // error matches the cross-tenant deny shape elsewhere in the code.
+    // Pass tenantId so shareMemory's readEntry filters by tenant; otherwise a Bearer for tenant A could share tenant B's id to the global store.
+    // The 'Memory not found' error matches the cross-tenant deny shape elsewhere.
     const shared = shareMemory(hippoRoot, shareId, { force, tenantId });
     if (!shared)
         return 'Transfer score too low. Use force=true to override.';
@@ -143,6 +118,6 @@ export function runPeersTool({ tenantId }) {
     const peers = listPeers(undefined, tenantId);
     if (peers.length === 0)
         return 'No peers found.';
-    return peers.map((p) => `${p.project}: ${p.count} memories (latest: ${p.latest.slice(0, 10)})`).join('\n');
+    return peers.map((p) => `${p.project}: ${p.count} memories (latest: ${p.latest.slice(0, DATE_PREFIX_CHARS)})`).join('\n');
 }
 //# sourceMappingURL=admin-tools.js.map

package/dist/mcp/format.d.ts

@@ -1,9 +1,9 @@
-import type { SearchResult } from '../search/types.js';
+import type { SearchResult } from '../core/search-types.js';
 import type { SessionEvent, TaskSnapshot } from '../store/rows.js';
-import type { ContextCost, ContinuityBlock, RecallResult, RecallResultItem } from '../api.js';
-import { type SessionHandoff } from '../handoff.js';
-import { detectAnchoring } from '../recall-history.js';
-import { detectAvailabilityBias } from '../availability.js';
+import type { ContextCost, ContinuityBlock, RecallResult, RecallResultItem } from '../api/index.js';
+import { type SessionHandoff } from '../core/handoff.js';
+import { detectAnchoring } from '../api/recall-history.js';
+import { detectAvailabilityBias } from '../api/availability.js';
 export declare function formatContinuityBlock(block: ContinuityBlock): string;
 export declare function formatMemories(results: ReadonlyArray<Pick<SearchResult, 'entry'>>): string;
 export interface RenderedRecall {

package/dist/mcp/format.js

@@ -1,8 +1,9 @@
 // Text the MCP recall and context tools print, and what each printed piece costs the token budget.
-import { confidenceLabel } from '../memory.js';
-import { formatHandoffEvidenceLine } from '../handoff.js';
-import { printedTokens } from '../context-render.js';
-import { estimateTokens } from '../token-ledger.js';
+import { confidenceLabel } from '../core/memory.js';
+import { formatHandoffEvidenceLine } from '../core/handoff.js';
+import { printedTokens } from '../api/context-render.js';
+import { estimateTokens } from '../util/token-text.js';
+const MCP_PREVIEW_CHARS = 200;
 // ── Format helpers ──
 function handoffLines(h) {
     const lines = [`- Summary: ${h.summary}`];
@@ -24,7 +25,7 @@ function handoffLines(h) {
 }
 function trailLines(events) {
     return events.map((e) => {
-        const preview = e.content.length > 200 ? e.content.slice(0, 200) + '…' : e.content;
+        const preview = e.content.length > MCP_PREVIEW_CHARS ? e.content.slice(0, MCP_PREVIEW_CHARS) + '…' : e.content;
         return `- [${e.event_type}] ${preview}`;
     });
 }
@@ -110,7 +111,7 @@ export function tailSection(rows) {
     const lines = ['', '## Fresh tail / substituted summaries'];
     for (const r of rows) {
         const tag = r.isSummary ? '[summary]' : '[tail]';
-        const head = r.content.length > 200 ? r.content.slice(0, 200) + '…' : r.content;
+        const head = r.content.length > MCP_PREVIEW_CHARS ? r.content.slice(0, MCP_PREVIEW_CHARS) + '…' : r.content;
         if (r.isSummary && r.substitutedFor && r.substitutedFor.length > 0) {
             lines.push(`- ${tag} ${r.id} (covers ${r.substitutedFor.length} rows): ${head}`);
         }

package/dist/mcp/framing.d.ts

@@ -1,3 +1,5 @@
+/** What of a refused frame has not arrived yet: a byte count when its header declared one, else the rest of its line. */
+export type FrameRemainder = number | 'line';
 export type FrameResult = {
     kind: 'message';
     body: string;
@@ -5,6 +7,10 @@ export type FrameResult = {
 } | {
     kind: 'skip';
     rest: Buffer;
+} | {
+    kind: 'oversize';
+    rest: Buffer;
+    remainder: FrameRemainder;
 } | {
     kind: 'incomplete';
 };

package/dist/mcp/framing.js

@@ -1,7 +1,9 @@
 // MCP stdio transport framing: newline-delimited JSON-RPC, no embedded newlines
 // (https://modelcontextprotocol.io/specification/.../basic/transports#stdio). Legacy LSP-style
 // `Content-Length` framing is also accepted so a printf-and-pipe smoke test still works.
+import { MAX_BODY_BYTES } from '../util/http-util.js';
 const HEADER_DELIM = Buffer.from('\r\n\r\n');
+const EMPTY = Buffer.alloc(0);
 export function parseFrame(buffer) {
     // Strip leading whitespace/newlines between messages.
     let start = 0;
@@ -17,13 +19,17 @@ export function parseFrame(buffer) {
     if (trimmed[0] === 0x43 /* 'C' */ || trimmed[0] === 0x63 /* 'c' */) {
         const headerEnd = trimmed.indexOf(HEADER_DELIM);
         if (headerEnd === -1)
-            return { kind: 'incomplete' };
+            return trimmed.length > MAX_BODY_BYTES ? { kind: 'oversize', rest: EMPTY, remainder: 'line' } : { kind: 'incomplete' };
         const header = trimmed.subarray(0, headerEnd).toString('utf-8');
         const match = header.match(/Content-Length:\s*(\d+)/i);
         if (!match)
             return { kind: 'skip', rest: Buffer.from(trimmed.subarray(headerEnd + 4)) };
         const contentLength = parseInt(match[1], 10);
         const bodyStart = headerEnd + 4;
+        if (contentLength > MAX_BODY_BYTES) {
+            const end = bodyStart + contentLength;
+            return { kind: 'oversize', rest: Buffer.from(trimmed.subarray(Math.min(end, trimmed.length))), remainder: Math.max(0, end - trimmed.length) };
+        }
         if (trimmed.length < bodyStart + contentLength)
             return { kind: 'incomplete' };
         const body = trimmed.subarray(bodyStart, bodyStart + contentLength).toString('utf-8');
@@ -32,9 +38,11 @@ export function parseFrame(buffer) {
     // Newline-delimited JSON (MCP spec).
     const newlineIdx = trimmed.indexOf(0x0a);
     if (newlineIdx === -1)
-        return { kind: 'incomplete' };
-    const line = trimmed.subarray(0, newlineIdx).toString('utf-8').trimEnd();
+        return trimmed.length > MAX_BODY_BYTES ? { kind: 'oversize', rest: EMPTY, remainder: 'line' } : { kind: 'incomplete' };
     const rest = Buffer.from(trimmed.subarray(newlineIdx + 1));
+    if (newlineIdx > MAX_BODY_BYTES)
+        return { kind: 'oversize', rest, remainder: 0 };
+    const line = trimmed.subarray(0, newlineIdx).toString('utf-8').trimEnd();
     if (!line)
         return { kind: 'skip', rest };
     return { kind: 'message', body: line, rest };