hippo-memory 1.70.0 → 1.71.0

package/dist/sharing/scope.d.ts

@@ -1,14 +1,7 @@
-/**
- * Detect the current operational scope from environment signals.
- * Returns a scope name string (no prefix), or null if no scope detected.
- * Priority: HIPPO_SCOPE > GSTACK_SKILL > OPENCLAW_SKILL.
- *
- * Pure env var reads: no I/O, safe to call from hot paths (e.g. UserPromptSubmit hook).
- */
+/** Detect the current operational scope from env (HIPPO_SCOPE > GSTACK_SKILL > OPENCLAW_SKILL); returns the name without prefix, or null.
+ *  Pure env reads, no I/O, so it is safe on hot paths such as the UserPromptSubmit hook. */
 export declare function detectScope(): string | null;
-/**
- * Compute scope match between a memory's scope tags and the active scope.
- * Returns: 1 if matching scope, -1 if mismatching scope, 0 if neutral (no scope on either side).
- */
+/** Compute scope match between a memory's scope tags and the active scope.
+ *  Returns: 1 if matching scope, -1 if mismatching scope, 0 if neutral (no scope on either side). */
 export declare function scopeMatch(memoryTags: string[], activeScope: string | null): -1 | 0 | 1;
 //# sourceMappingURL=scope.d.ts.map

package/dist/sharing/scope.js

@@ -1,11 +1,6 @@
 import { envGstackSkill, envOpenclawSkill, envScope } from '../util/env.js';
-/**
- * Detect the current operational scope from environment signals.
- * Returns a scope name string (no prefix), or null if no scope detected.
- * Priority: HIPPO_SCOPE > GSTACK_SKILL > OPENCLAW_SKILL.
- *
- * Pure env var reads: no I/O, safe to call from hot paths (e.g. UserPromptSubmit hook).
- */
+/** Detect the current operational scope from env (HIPPO_SCOPE > GSTACK_SKILL > OPENCLAW_SKILL); returns the name without prefix, or null.
+ *  Pure env reads, no I/O, so it is safe on hot paths such as the UserPromptSubmit hook. */
 export function detectScope() {
     const explicit = envScope();
     if (explicit && explicit.trim())
@@ -18,10 +13,8 @@ export function detectScope() {
         return openclawSkill.trim();
     return null;
 }
-/**
- * Compute scope match between a memory's scope tags and the active scope.
- * Returns: 1 if matching scope, -1 if mismatching scope, 0 if neutral (no scope on either side).
- */
+/** Compute scope match between a memory's scope tags and the active scope.
+ *  Returns: 1 if matching scope, -1 if mismatching scope, 0 if neutral (no scope on either side). */
 export function scopeMatch(memoryTags, activeScope) {
     const scopeTags = memoryTags.filter(t => t.startsWith('scope:'));
     if (scopeTags.length === 0)

package/dist/sharing/search-both.d.ts

@@ -0,0 +1,60 @@
+import { MemoryEntry } from '../core/memory.js';
+import { type SearchResult, type ResultCost } from '../core/search-types.js';
+import { type HybridVectorCandidates } from '../search/vector.js';
+export declare function logEmbedAllFailure<E>(caller: string, err: E): void;
+export interface SearchOptions {
+    budget?: number;
+    now?: Date;
+    minResults?: number;
+    /** Tenant scope for both stores. Undefined = no filter (legacy single-tenant). */
+    tenantId?: string;
+}
+/** Search both local and global stores and merge: local results are boosted 1.2x to prefer project context.
+ *  Returns results sorted by adjusted score within the combined token budget. */
+export declare function searchBoth(query: string, localRoot: string, globalRoot: string, options?: SearchOptions): SearchResult[];
+export interface HybridSearchOptions extends SearchOptions {
+    embeddingWeight?: number;
+    explain?: boolean;
+    mmr?: boolean;
+    mmrLambda?: number;
+    /** Multiplier applied to local-store scores when merging with global.
+     *  Defaults to 1.2. Use 1.0 to remove the local bias for eval comparisons. */
+    localBump?: number;
+    /** Active scope for scope-boost scoring. Auto-detected if not provided. */
+    scope?: string | null;
+    /** Include superseded memories in results. Default false. */
+    includeSuperseded?: boolean;
+    /** Filter to memories current at this ISO date string. */
+    asOf?: string;
+    /** Budget cost per result, spent the same way in each store and in the merged list. */
+    cost?: ResultCost;
+    /** Propagated to underlying hybridSearch calls.
+     *  Per-call > env HIPPO_SUMMARY_DEBOOST > 0.85 default. */
+    summaryDeboost?: number;
+    /** Propagated. Default true (1.05 boost if rebuilt within 7d). */
+    summaryFreshness?: boolean;
+    /** Optional admission predicate applied to the loaded candidates of BOTH stores before ranking, cross-store dedupe and budgeting,
+     *  so an excluded row cannot shadow its admitted duplicate or saturate the budget. Undefined (recall paths never set it) means no filter. */
+    entryFilter?: (entry: MemoryEntry) => boolean;
+    /** Recall scope filter for `searchBothHybrid`: absent is the only unfiltered mode; present uses `loadRecallSearchEntries` plus a JS post-filter.
+     *  `{}` = default-deny (legacy and `<source>:private:*` excluded); `{ requested: 'X' }` = exact; `{ requested: 'X', additive: true }` = default plus X.
+     *  An object, not `string | null`, because the sibling `scope` option already gives null a different meaning.
+     *  Do not pass `{}` casually from non-recall paths. */
+    recallScope?: {
+        requested?: string;
+        additive?: boolean;
+        ownScope?: string;
+    };
+}
+/** Hybrid search across both local and global stores, using embeddings when available.
+ *  Async version of searchBoth that calls hybridSearch instead of search. */
+export declare function searchBothHybrid(query: string, localRoot: string, globalRoot: string, options?: HybridSearchOptions): Promise<SearchResult[]>;
+/** Hybrid ranking of rows already loaded from each store: the local bump, one copy per text, then the shared budget. */
+export declare function rankBothStores(query: string, roots: {
+    local: string;
+    global: string;
+}, entries: {
+    local: MemoryEntry[];
+    global: MemoryEntry[];
+}, vectorCandidates: HybridVectorCandidates, options?: HybridSearchOptions): Promise<SearchResult[]>;
+//# sourceMappingURL=search-both.d.ts.map

package/dist/sharing/search-both.js

@@ -0,0 +1,138 @@
+// Search across the local and global stores, merged into one ranked, budgeted list.
+import { compareScoresDesc } from '../core/compare.js';
+import * as fs from 'fs';
+import { loadSearchEntries, loadRecallSearchEntries, recallScopeFilter } from '../store/search-rows.js';
+import { passesScopeFilterForRecall, passesCliRecallScopeFilter } from '../store/recall-scope.js';
+import { search } from '../search/bm25-search.js';
+import { hybridSearch } from '../search/hybrid.js';
+import { fitBudget } from '../search/finalize.js';
+import { DEFAULT_LOCAL_BUMP, DEFAULT_RECALL_BUDGET } from '../core/search-types.js';
+import { startQueryEmbedDeadline } from '../search/vector.js';
+import { evalNow } from '../core/ablation.js';
+import { duplicateKey } from '../util/same-text.js';
+import { errorMessage, log } from '../util/log.js';
+// The rows are already copied; a failed background embed only delays vectors, so it warns instead of throwing.
+export function logEmbedAllFailure(caller, err) {
+    log.warn(`${caller}: background embed failed (${errorMessage(err)}); run 'hippo embed' to backfill`);
+}
+/** Search both local and global stores and merge: local results are boosted 1.2x to prefer project context.
+ *  Returns results sorted by adjusted score within the combined token budget. */
+export function searchBoth(query, localRoot, globalRoot, options = {}) {
+    const { budget = DEFAULT_RECALL_BUDGET, now = evalNow(), minResults, tenantId } = options;
+    const effectiveMin = minResults ?? 1;
+    const localEntries = fs.existsSync(localRoot) ? loadSearchEntries(localRoot, query, undefined, tenantId) : [];
+    const globalEntries = fs.existsSync(globalRoot) ? loadSearchEntries(globalRoot, query, undefined, tenantId) : [];
+    if (localEntries.length === 0 && globalEntries.length === 0)
+        return [];
+    // Search each store with full budget, then blend
+    const localResults = search(query, localEntries, { budget, now, minResults });
+    const globalResults = search(query, globalEntries, { budget, now, minResults });
+    const deduped = dedupeByContent(tagLocalAndGlobal(localResults, globalResults));
+    // PLAIN stable score sort on purpose: both inputs are deterministically ordered,
+    // and an exact tie keeps the LOCAL result ahead of the global one (concat order).
+    deduped.sort((a, b) => compareScoresDesc(a.score, b.score));
+    // Apply combined token budget (guarantee at least minResults items)
+    const results = [];
+    let usedTokens = 0;
+    for (let i = 0; i < deduped.length; i++) {
+        if (results.length >= effectiveMin && usedTokens + deduped[i].tokens > budget)
+            continue;
+        usedTokens += deduped[i].tokens;
+        results.push(deduped[i]);
+    }
+    return results;
+}
+function tagLocalAndGlobal(localResults, globalResults) {
+    // Tag global results. Local memories get a configurable priority bump.
+    return [
+        ...localResults.map((r) => ({
+            ...r,
+            isGlobal: false,
+            score: r.score * DEFAULT_LOCAL_BUMP,
+            breakdown: r.breakdown
+                ? { ...r.breakdown, sourceBump: DEFAULT_LOCAL_BUMP, final: r.breakdown.final * DEFAULT_LOCAL_BUMP }
+                : undefined,
+        })),
+        ...globalResults.map((r) => ({ ...r, isGlobal: true })),
+    ];
+}
+function dedupeByContent(tagged) {
+    // Remove duplicates by content (local/global IDs differ after promote/share)
+    const seen = new Set();
+    return tagged.filter((r) => {
+        const key = duplicateKey(r.entry.content);
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+/** Hybrid search across both local and global stores, using embeddings when available.
+ *  Async version of searchBoth that calls hybridSearch instead of search. */
+export async function searchBothHybrid(query, localRoot, globalRoot, options = {}) {
+    const { includeSuperseded, asOf, tenantId, entryFilter, recallScope } = options;
+    // With an admission filter, lift the per-store candidate cap (default 200) to a bounded 5000: excluded rows could otherwise fill the window first.
+    const searchWindow = entryFilter ? 5000 : undefined;
+    // Recall mode: push the scope predicate into SQL like api.recall, so quarantine/private rows never enter the candidates, shadow duplicates or use budget.
+    // The JS post-filter below is the regex-only `<source>:private:*` half plus defense in depth on exact match.
+    const loadEntries = (root) => {
+        if (!fs.existsSync(root))
+            return [];
+        return recallScope
+            ? loadRecallSearchEntries(root, query, searchWindow, tenantId, recallScope.requested, recallScope.additive ? 'additive' : 'exact', Boolean(includeSuperseded) || Boolean(asOf), undefined, recallScope.ownScope)
+            : loadSearchEntries(root, query, searchWindow, tenantId);
+    };
+    const passesScope = (e) => !recallScope || (recallScope.additive
+        ? passesCliRecallScopeFilter(e.scope ?? null, recallScope.requested) || passesScopeFilterForRecall(e.scope ?? null, undefined, recallScope.ownScope)
+        : passesScopeFilterForRecall(e.scope ?? null, recallScope.requested, recallScope.ownScope));
+    const admit = (e) => passesScope(e) && (!entryFilter || entryFilter(e));
+    const localEntries = loadEntries(localRoot).filter(admit);
+    const globalEntries = loadEntries(globalRoot).filter(admit);
+    // The vector arm loads under the same SQL rules as loadEntries, then the same JS admission.
+    const vectorCandidates = {
+        tenantId,
+        scope: recallScope ? recallScopeFilter(recallScope.requested, recallScope.additive ? 'additive' : 'exact', recallScope.ownScope) : undefined,
+        includeSuperseded: !recallScope || Boolean(includeSuperseded) || Boolean(asOf),
+        admit,
+    };
+    return rankBothStores(query, { local: localRoot, global: globalRoot }, { local: localEntries, global: globalEntries }, vectorCandidates, options);
+}
+/** Hybrid ranking of rows already loaded from each store: the local bump, one copy per text, then the shared budget. */
+export async function rankBothStores(query, roots, entries, vectorCandidates, options = {}) {
+    const { budget = DEFAULT_RECALL_BUDGET, now = evalNow(), embeddingWeight, explain, mmr, mmrLambda, localBump = DEFAULT_LOCAL_BUMP, minResults, cost, scope, includeSuperseded, asOf, summaryDeboost, summaryFreshness } = options;
+    if (entries.local.length === 0 && entries.global.length === 0)
+        return [];
+    // One deadline for both stores, so a provider that stalls on the first is not waited on again for the second.
+    const shared = {
+        budget, now, embeddingWeight, explain, mmr, mmrLambda, minResults, cost, scope, includeSuperseded, asOf, summaryDeboost, summaryFreshness,
+        vectorCandidates, queryEmbedDeadline: startQueryEmbedDeadline(),
+    };
+    const localResults = await hybridSearch(query, entries.local, { ...shared, hippoRoot: roots.local });
+    const globalResults = await hybridSearch(query, entries.global, { ...shared, hippoRoot: roots.global });
+    // Tag global results. Local memories get a configurable priority bump.
+    const tagged = [
+        ...localResults.map((r) => ({
+            ...r,
+            isGlobal: false,
+            score: r.score * localBump,
+            breakdown: r.breakdown
+                ? { ...r.breakdown, sourceBump: localBump, final: r.breakdown.final * localBump }
+                : undefined,
+        })),
+        ...globalResults.map((r) => ({ ...r, isGlobal: true })),
+    ];
+    // Remove duplicates by content (local/global IDs differ after promote/share)
+    const seen = new Set();
+    const deduped = tagged.filter((r) => {
+        const key = duplicateKey(r.entry.content);
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+    // PLAIN stable score sort on purpose -- see searchBoth above;
+    // same rationale (deterministic inputs + stability; local-first on ties).
+    deduped.sort((a, b) => compareScoresDesc(a.score, b.score));
+    return fitBudget(deduped, budget, minResults ?? 1, cost);
+}
+//# sourceMappingURL=search-both.js.map

package/dist/sharing/share.d.ts

@@ -0,0 +1,38 @@
+import { MemoryEntry } from '../core/memory.js';
+/** Tags whose rows only a hand-run share or promote may copy to the global store; derived rows inherit them. */
+export declare const NEVER_AUTO_SHARE_TAGS: ReadonlySet<string>;
+export declare function neverAutoShareTags(sources: readonly MemoryEntry[]): string[];
+/** Tags whose rows sleep keeps as written: never merged, never sent to LLM extraction. Conflict detection keeps its own list. */
+export declare const NO_MERGE_TAGS: ReadonlySet<string>;
+/** Estimate how well a memory would transfer to other projects.
+ *  Returns 0..1 where >0.5 = good candidate for sharing. */
+export declare function transferScore(entry: MemoryEntry): number;
+/** Share a memory to the global store with attribution (source enriched with project path and timestamp).
+ *  Returns the new entry, or null if the transfer score is too low. */
+export declare function shareMemory(localRoot: string, id: string, options?: {
+    force?: boolean;
+    tenantId?: string;
+    skipEmbed?: boolean;
+}): MemoryEntry | null;
+/** List all projects that contributed memories to the global store, parsed from 'shared:<project>:' or 'promoted:<path>' sources.
+ *  `tenantId` filters to one tenant; undefined is host-wide (legacy callers: CLI standalone, dashboard). */
+export declare function listPeers(globalRoot?: string, tenantId?: string): Array<{
+    project: string;
+    count: number;
+    latest: string;
+}>;
+type AutoShareStats = {
+    secretSkipped: number;
+    rejectedSkipped?: number;
+    neverAutoShareSkipped?: number;
+};
+/** Auto-share local memories with high transfer scores, not already global and without a NEVER_AUTO_SHARE_TAGS tag; `options.tenantId` scopes the LOCAL read.
+ *  `options.stats` is an opt-in out-param: `secretSkipped` counts shares the secret veto prevented, `rejectedSkipped` rejection refusals (0 under `dryRun`). */
+export declare function autoShare(localRoot: string, options?: {
+    minScore?: number;
+    dryRun?: boolean;
+    tenantId?: string;
+    stats?: AutoShareStats;
+}): MemoryEntry[];
+export {};
+//# sourceMappingURL=share.d.ts.map

package/dist/sharing/share.js

@@ -0,0 +1,226 @@
+// Sharing local memories to the global store: transfer scoring, share, peers and auto-share.
+import { BadRequestError, NotFoundError } from '../core/api-errors.js';
+import * as fs from 'fs';
+import * as path from 'path';
+import { generateId, COMPACTION_MEMORY_TAG } from '../core/memory.js';
+import { AGENT_MEMORY_SOURCE_PREFIX, AGENT_MEMORY_TAGS } from '../core/agent-memory-tools.js';
+import { writeEntry } from '../store/entry-writes.js';
+import { loadAllEntries, readEntry } from '../store/entry-reads.js';
+import { tallySources } from '../store/candidates.js';
+import { isPersonalScope } from '../store/recall-scope.js';
+import { fallbackOrigin } from '../core/project-identity.js';
+import { detectSecret } from '../util/secret-detect.js';
+import { isQuarantineScope } from '../trust/quarantine.js';
+import { RejectedValueError } from '../store/rejection.js';
+import { embedMemory, embedAll } from '../store/embeddings/index.js';
+import { duplicateKey, storedTextKeys } from '../util/same-text.js';
+import { isReusable } from '../core/memory-quality.js';
+import { log } from '../util/log.js';
+import { getGlobalRoot, initGlobal } from './global-store.js';
+import { logEmbedAllFailure } from './search-both.js';
+/** Tags that indicate project-specific memories (poor transfer candidates) */
+const PROJECT_SPECIFIC_TAGS = new Set([
+    'file-path', 'config', 'deploy', 'cron', 'url', 'auth',
+    'field-names', 'column-names', 'api-key', 'endpoint',
+]);
+/** Tags that indicate transferable memories (good transfer candidates) */
+const TRANSFERABLE_TAGS = new Set([
+    'error', 'platform', 'windows', 'encoding', 'python', 'shell',
+    'powershell', 'quant', 'backtest', 'pattern', 'rule', 'gotcha',
+    'sub-agent', 'review', 'best-practice',
+]);
+/** Tags whose rows only a hand-run share or promote may copy to the global store; derived rows inherit them. */
+export const NEVER_AUTO_SHARE_TAGS = new Set([
+    'git-learned',
+    'session-digest',
+    ...AGENT_MEMORY_TAGS,
+]);
+export function neverAutoShareTags(sources) {
+    return [...NEVER_AUTO_SHARE_TAGS].filter((tag) => sources.some((s) => s.tags.includes(tag)));
+}
+/** Tags whose rows sleep keeps as written: never merged, never sent to LLM extraction. Conflict detection keeps its own list. */
+export const NO_MERGE_TAGS = new Set([
+    'extracted',
+    'session-digest',
+    COMPACTION_MEMORY_TAG,
+    ...AGENT_MEMORY_TAGS,
+]);
+/** Estimate how well a memory would transfer to other projects.
+ *  Returns 0..1 where >0.5 = good candidate for sharing. */
+export function transferScore(entry) {
+    let score = 0.5; // neutral default
+    // Boost for transferable tags
+    const transferableCount = entry.tags.filter((t) => TRANSFERABLE_TAGS.has(t)).length;
+    score += transferableCount * 0.1;
+    // Penalize for project-specific tags
+    const specificCount = entry.tags.filter((t) => PROJECT_SPECIFIC_TAGS.has(t)).length;
+    score -= specificCount * 0.15;
+    // High-retrieval memories are more likely to be universally useful
+    if (entry.retrieval_count >= 3)
+        score += 0.1;
+    // Pinned memories are important to their owner
+    if (entry.pinned)
+        score += 0.1;
+    // Error-tagged memories often encode universal lessons
+    if (entry.emotional_valence === 'negative' || entry.emotional_valence === 'critical')
+        score += 0.05;
+    return Math.min(1, Math.max(0, score));
+}
+/** Share a memory to the global store with attribution (source enriched with project path and timestamp).
+ *  Returns the new entry, or null if the transfer score is too low. */
+export function shareMemory(localRoot, id, options = {}) {
+    // tenantId is optional for single-tenant callers (autoShare passes only `{ force: true }`); MCP/REST hosts MUST pass it so tenant A cannot share
+    // tenant B's memory to global (readEntry returns null on a cross-tenant lookup).
+    const entry = readEntry(localRoot, id, options.tenantId);
+    if (!entry)
+        throw new NotFoundError(`Memory not found: ${id}`);
+    assertShareable(entry, id);
+    const score = transferScore(entry);
+    if (score < 0.3 && !options.force)
+        return null;
+    initGlobal();
+    const globalRoot = getGlobalRoot();
+    // The label keeps the folder name for a user-global row; a NULL row gets `shared::`, which originFromSource reads as no project.
+    const fallbackName = path.basename(path.resolve(localRoot, '..'));
+    const originName = entry.origin_project ?? fallbackOrigin(localRoot);
+    const label = originName === '' ? fallbackName : (originName ?? '');
+    const globalEntry = {
+        ...entry,
+        id: generateId('g'),
+        source: `shared:${label}:${new Date().toISOString()}`,
+        origin_project: originName,
+    };
+    writeEntry(globalRoot, globalEntry);
+    // Embed here unless the caller opts out: autoShare sets skipEmbed to batch one embedAll(), since embedMemory rewrites the whole index per call.
+    if (!options.skipEmbed) {
+        void embedMemory(globalRoot, globalEntry);
+    }
+    return globalEntry;
+}
+function assertShareable(entry, id) {
+    // Secret veto: secrets never reach the global store, even with --force; throw loudly, since a silent null reads as "low transfer score" and invites retries.
+    const secret = detectSecret(entry);
+    if (secret.flagged) {
+        throw new BadRequestError(`Refusing to share ${id} to the global store: content matches secret material (${secret.reason}). ` +
+            `Secrets stay in their owning project's store.`);
+    }
+    // A quarantined row is unreviewed input, not a lesson; sharing it would spread poison globally.
+    if (isQuarantineScope(entry.scope)) {
+        throw new BadRequestError(`Refusing to share ${id}: it is quarantined pending review. Approve it first via 'hippo quarantine approve ${id}'.`);
+    }
+    if (isPersonalScope(entry.scope ?? null)) {
+        throw new BadRequestError(`Refusing to share ${id}: it is a personal memory and stays with its owner on this server.`);
+    }
+}
+/** List all projects that contributed memories to the global store, parsed from 'shared:<project>:' or 'promoted:<path>' sources.
+ *  `tenantId` filters to one tenant; undefined is host-wide (legacy callers: CLI standalone, dashboard). */
+export function listPeers(globalRoot, tenantId) {
+    const root = globalRoot ?? getGlobalRoot();
+    if (!fs.existsSync(root))
+        return [];
+    // Tenant-scoped by default when tenantId provided. Host-wide when
+    // undefined (preserves back-compat).
+    const tallies = tallySources(root, tenantId).sort((a, b) => (a.first < b.first ? -1 : a.first > b.first ? 1 : 0));
+    const peerMap = new Map();
+    for (const tally of tallies) {
+        let project = 'unknown';
+        if (tally.source.startsWith('shared:')) {
+            const parts = tally.source.split(':');
+            project = parts[1] || 'unknown';
+        }
+        else if (tally.source.startsWith('promoted:')) {
+            const promotedPath = tally.source.slice('promoted:'.length);
+            project = path.basename(path.resolve(promotedPath, '..'));
+        }
+        else if (tally.source === 'cli-global') {
+            project = 'global-cli';
+        }
+        const existing = peerMap.get(project);
+        if (!existing) {
+            peerMap.set(project, { count: tally.count, latest: tally.latest });
+        }
+        else {
+            existing.count += tally.count;
+            if (tally.latest > existing.latest)
+                existing.latest = tally.latest;
+        }
+    }
+    return Array.from(peerMap.entries())
+        .map(([project, data]) => ({ project, ...data }))
+        .sort((a, b) => b.count - a.count);
+}
+function isAutoShareCandidate(entry, globalContentSet, minScore, stats) {
+    // shareMemory refuses quarantined and personal rows; filtering here keeps sleep from aborting on one.
+    if (isQuarantineScope(entry.scope ?? null) || isPersonalScope(entry.scope ?? null) || !isReusable(entry))
+        return false;
+    // Before the score: these rows describe one project only, and a git seed's 'error' tag clears the bar.
+    if (entry.tags.some((t) => NEVER_AUTO_SHARE_TAGS.has(t)) || entry.source.startsWith(AGENT_MEMORY_SOURCE_PREFIX)) {
+        if (stats)
+            stats.neverAutoShareSkipped = (stats.neverAutoShareSkipped ?? 0) + 1;
+        return false;
+    }
+    const score = transferScore(entry);
+    if (score < minScore)
+        return false;
+    // Skip if already shared (same text apart from spacing)
+    if (globalContentSet.has(duplicateKey(entry.content)))
+        return false;
+    // Secret veto, checked LAST so the stats counter only counts rows it withheld (a row failing the score or dedupe gate was never going to share).
+    // shareMemory would throw here; filtering keeps the sleep pipeline fail-safe.
+    if (detectSecret(entry).flagged) {
+        if (stats)
+            stats.secretSkipped++;
+        return false;
+    }
+    return true;
+}
+// Rejection containment: shareMemory -> writeEntry can throw RejectedValueError against the GLOBAL store tombstones and abort the autoShare sleep phase.
+// Catch per item like syncGlobalToLocal; writeEntry already audits reject_refusal before rethrowing, so count and continue.
+function shareCandidates(localRoot, candidates, stats) {
+    const shared = [];
+    let rejectedSkipped = 0;
+    for (const entry of candidates) {
+        try {
+            // skipEmbed: batching invariant, this is a batch producer, so it embeds
+            // once via embedAll() below rather than once per row inside shareMemory.
+            const result = shareMemory(localRoot, entry.id, { force: true, skipEmbed: true });
+            if (result)
+                shared.push(result);
+        }
+        catch (err) {
+            if (err instanceof RejectedValueError) {
+                rejectedSkipped++;
+                if (stats)
+                    stats.rejectedSkipped = (stats.rejectedSkipped ?? 0) + 1;
+                continue;
+            }
+            throw err;
+        }
+    }
+    if (rejectedSkipped > 0) {
+        log.warn(`autoShare: skipped ${rejectedSkipped} candidate(s) refused by the global store's rejection tombstone`);
+    }
+    return shared;
+}
+/** Auto-share local memories with high transfer scores, not already global and without a NEVER_AUTO_SHARE_TAGS tag; `options.tenantId` scopes the LOCAL read.
+ *  `options.stats` is an opt-in out-param: `secretSkipped` counts shares the secret veto prevented, `rejectedSkipped` rejection refusals (0 under `dryRun`). */
+export function autoShare(localRoot, options = {}) {
+    const { minScore = 0.6, dryRun = false } = options;
+    const localEntries = loadAllEntries(localRoot, options.tenantId);
+    initGlobal();
+    const globalRoot = getGlobalRoot();
+    // Host-wide read. The global store IS the union across all tenants;
+    // per-tenant filtering on the global root would defeat the purpose.
+    const globalEntries = loadAllEntries(globalRoot);
+    // Build set of global content hashes to avoid duplicates
+    const globalContentSet = storedTextKeys(globalEntries);
+    const candidates = localEntries.filter((entry) => isAutoShareCandidate(entry, globalContentSet, minScore, options.stats));
+    if (dryRun)
+        return candidates;
+    const shared = shareCandidates(localRoot, candidates, options.stats);
+    if (shared.length > 0) {
+        void embedAll(globalRoot).catch((err) => logEmbedAllFailure('autoShare', err));
+    }
+    return shared;
+}
+//# sourceMappingURL=share.js.map

package/dist/store/ambient.js

@@ -1,8 +1,7 @@
-import { closeHippoDb } from '../db/index.js';
-import { strengthSql } from '../core/memory.js';
+import { strengthSql } from './rule-sql.js';
 import { scopeAdmitSql } from './recall-scope.js';
 import { SECRET_TAGS } from '../util/secret-detect.js';
-import { openStore } from './open.js';
+import { onHandle, openStore } from './open.js';
 import { jsonList } from './candidates.js';
 import { originInSql } from '../core/project-identity.js';
 import { isErrorTagged } from '../core/ambient.js';
@@ -41,8 +40,7 @@ export function loadAmbientTallies(hippoRoot, tenantId, filter) {
     const { where, params } = contextRowsWhere(tenantId, filter);
     const secret = secretTaggedSql();
     const sevenDaysAgo = new Date(filter.now.getTime() - 7 * DAY_MS).toISOString();
-    const db = openStore(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         // SAFETY: one aggregate row whose columns are the aliases named below. Tag lists come back as one JSON array of
         // arrays and are counted in JS, which maps items through String() as parseJsonArray does.
         const row = db.prepare(`SELECT
@@ -84,9 +82,6 @@ export function loadAmbientTallies(hippoRoot, tenantId, filter) {
             maxDagLevel: Number(row.maxDagLevel),
             tagCounts,
         };
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    }, openStore);
 }
 //# sourceMappingURL=ambient.js.map

package/dist/store/audit-event.d.ts

@@ -8,18 +8,10 @@ export interface AuditOptions {
     readonly actor?: string;
     readonly tenantId?: string;
 }
-/**
- * Emit an audit event for a mutation against `db`. Wrapped so a broken audit
- * log can never crash the surrounding mutation — the SQLite store is still the
- * source of truth and audit failures are diagnosable from the missing rows.
- */
+/** Emit an audit event for a mutation. Never throws: the SQLite store stays the source of truth,
+ * and a failed audit write shows up as missing rows. */
 export declare function audit(db: ReturnType<typeof openHippoDb>, op: AuditOp, options?: AuditOptions): void;
-/**
- * Refusal audit for the rejected-value guard. Written by the
- * transaction OWNER post-rollback — writeEntry's catch (no outer tx exists
- * there, so this lands in a fresh implicit transaction) and commitSupersede's
- * catch (after its own ROLLBACK) — never inside a scope the caller's own
- * rollback could claw back. Best-effort `audit()` semantics: never throws.
- */
+/** Refusal audit for the rejected-value guard, written by the transaction owner after rollback so the caller's own rollback cannot claw it back.
+ * Best-effort like `audit()`: never throws. */
 export declare function auditRejectionRefusal(db: ReturnType<typeof openHippoDb>, err: RejectedValueError, actor: string): void;
 //# sourceMappingURL=audit-event.d.ts.map

package/dist/store/audit-event.js

@@ -1,10 +1,7 @@
 import { resolveTenantId } from './tenant.js';
 import { appendAuditEvent, reportAuditWriteFailure } from './audit.js';
-/**
- * Emit an audit event for a mutation against `db`. Wrapped so a broken audit
- * log can never crash the surrounding mutation — the SQLite store is still the
- * source of truth and audit failures are diagnosable from the missing rows.
- */
+/** Emit an audit event for a mutation. Never throws: the SQLite store stays the source of truth,
+ * and a failed audit write shows up as missing rows. */
 export function audit(db, op, options = {}) {
     const { targetId, metadata, actor = 'cli', tenantId } = options;
     try {
@@ -21,13 +18,8 @@ export function audit(db, op, options = {}) {
         reportAuditWriteFailure(op, String(error), targetId);
     }
 }
-/**
- * Refusal audit for the rejected-value guard. Written by the
- * transaction OWNER post-rollback — writeEntry's catch (no outer tx exists
- * there, so this lands in a fresh implicit transaction) and commitSupersede's
- * catch (after its own ROLLBACK) — never inside a scope the caller's own
- * rollback could claw back. Best-effort `audit()` semantics: never throws.
- */
+/** Refusal audit for the rejected-value guard, written by the transaction owner after rollback so the caller's own rollback cannot claw it back.
+ * Best-effort like `audit()`: never throws. */
 export function auditRejectionRefusal(db, err, actor) {
     audit(db, 'reject_refusal', { targetId: err.entryId, metadata: { digest: err.digest, reason: err.reason }, actor, tenantId: err.tenantId });
 }

package/dist/store/audit.d.ts

@@ -66,11 +66,8 @@ export interface ListAuditAfterOpts {
     /** Omit for every tenant (deployment-wide export). */
     tenantId?: string;
 }
-/**
- * Cursor read: events with id > afterId, ascending by id. Ids are AUTOINCREMENT
- * and never reused, but deletes (retention prune) leave gaps, so resume from
- * the last id returned, never from a count.
- */
+/** Cursor read: events with id > afterId, ascending. Retention prune leaves gaps in the ids,
+ * so resume from the last id returned, never from a count. */
 export declare function listAuditEventsAfter(db: DatabaseSyncLike, opts: ListAuditAfterOpts): AuditEvent[];
 /** Latest time each target got a good outcome, from the audit rows, read on a handle of its own; unlike queryAuditEvents it has no row cap. */
 export declare function confirmedOutcomeTimes(hippoRoot: string, tenantId: string): Map<string, string>;

package/dist/store/audit.js

@@ -55,9 +55,6 @@ export function auditMemories(entries, backing) {
         clean: entries.length - issues.length,
     };
 }
-// ---------------------------------------------------------------------------
-// Audit log primitives (append-only mutation trail)
-// ---------------------------------------------------------------------------
 // The one list of audit ops: the AuditOp type, `hippo audit list --op` and GET /v1/audit?op= all read it.
 export const AUDIT_OPS = [
     'remember',
@@ -182,11 +179,8 @@ export function queryAuditEvents(db, opts) {
         .all(...params, ...after.params, limit);
     return rows.map(rowToAuditEvent);
 }
-/**
- * Cursor read: events with id > afterId, ascending by id. Ids are AUTOINCREMENT
- * and never reused, but deletes (retention prune) leave gaps, so resume from
- * the last id returned, never from a count.
- */
+/** Cursor read: events with id > afterId, ascending. Retention prune leaves gaps in the ids,
+ * so resume from the last id returned, never from a count. */
 export function listAuditEventsAfter(db, opts) {
     if (!Number.isInteger(opts.afterId) || opts.afterId < 0) {
         throw new RangeError('afterId must be a non-negative integer');
@@ -255,10 +249,8 @@ function rowToAuditEvent(r) {
 function safeJsonParse(raw, id) {
     try {
         const v = JSON.parse(raw);
-        // SAFETY: JSON.parse only ever returns a plain object, array, string, number,
-        // boolean, or null; `v instanceof Object` is true for exactly the first two
-        // (both are valid JsonObject shapes for our purposes), matching the prior
-        // `typeof v === 'object' && v !== null` check without using typeof.
+        // SAFETY: JSON.parse returns only an object, array or primitive; `instanceof Object` is true for the first two,
+        // both valid JsonObject shapes here.
         return v instanceof Object ? v : {};
     }
     catch {