hippo-memory 1.70.0 → 1.72.0

package/README.md

@@ -137,7 +137,7 @@ hippo init
 #    Scheduled machine-level daily runner (6:15am) via crontab
 ```
 
-To leave parts out: `--no-hooks` skips the instruction files and hooks, `--no-schedule` the daily run, and `--no-learn` the git history and agent memory import. `HIPPO_SKIP_AUTO_INTEGRATIONS=1` skips the same files and hooks that `--no-hooks` does.
+To leave parts out: `--no-hooks` skips the instruction files and hooks, `--no-schedule` the daily run, and `--no-learn` the git history and agent memory import. `HIPPO_SKIP_AUTO_INTEGRATIONS=1` skips the same files and hooks that `--no-hooks` does, and `HIPPO_SKIP_SCHEDULE=1` skips the daily run as `--no-schedule` does.
 
 ### Agent memories
 
@@ -784,7 +784,7 @@ hippo watch "npm run build"
 | `hippo dashboard` | Open web dashboard at localhost:3333 (memory health by project, and the card board); open the printed URL, which carries a per-start access token |
 | `hippo dashboard --port <n>` | Use custom port |
 | `hippo mcp` | Start MCP server (stdio transport) |
-| `hippo serve` | Start the HTTP API server for this store on `127.0.0.1:6789` (`--port <n>` or `HIPPO_PORT`; `--host <host>`, which off loopback needs `HIPPO_REQUIRE_AUTH=1`) |
+| `hippo serve` | Start the HTTP API server for this store on `127.0.0.1:6789` (`--port <n>` or `HIPPO_PORT`; `--host <host>`, which off loopback needs `HIPPO_REQUIRE_AUTH=1`). Every request needs an API key (`hippo auth create`, then `Authorization: Bearer <key>`; the hippo CLI reads `HIPPO_API_KEY`). `HIPPO_ALLOW_KEYLESS_LOCAL=1` lets requests from this machine in without one, as host admin; `HIPPO_REQUIRE_AUTH=1` wins over it |
 | `hippo serve --tls-cert <file> --tls-key <file>` | Serve HTTPS with that PEM certificate and key (or set `HIPPO_TLS_CERT` and `HIPPO_TLS_KEY`). Without them a network bind still starts, and warns once that API keys and memory text travel in cleartext unless a TLS-terminating proxy sits in front |
 
 On `heartbeat`, `block`, `review` and `complete`, a given `--run` is checked against the card's live run and the command is refused, unchanged, if the two do not match.

package/dist/agent-memories/apply.d.ts

@@ -3,7 +3,6 @@ import { type MemoryEntry } from '../core/memory.js';
 import { type Tally } from './report.js';
 import type { AgentMemoryTool } from '../core/agent-memory-tools.js';
 import type { Container } from './types.js';
-export declare const SYNC_ACTOR = "agent-memories";
 export interface StoreSession {
     readonly db: DatabaseSyncLike;
     readonly hippoRoot: string;
@@ -36,14 +35,4 @@ export interface ContainerOutcome {
 }
 /** Throws SQLITE_BUSY when another writer holds the store past its busy timeout; nothing is written then. */
 export declare function syncContainer(s: StoreSession, work: ContainerWork): ContainerOutcome;
-export type SetAsideWhy = 'note-gone' | 'note-changed' | 'handover' | 'project-merge' | 'project-repair';
-export type SetAsideResult = {
-    readonly kind: 'untagged';
-    readonly entry: MemoryEntry;
-} | {
-    readonly kind: 'dormant';
-    readonly id: string;
-};
-/** Design 6's set-aside on the caller's transaction: a pinned row only loses the tag, any other goes dormant, restorable. */
-export declare function setAsideRow(db: DatabaseSyncLike, tag: string, row: MemoryEntry, why: SetAsideWhy): SetAsideResult;
 //# sourceMappingURL=apply.d.ts.map

package/dist/agent-memories/apply.js

@@ -1,41 +1,26 @@
 // One container's sync in one transaction on the caller's handle: lookup, plan, then every write (plan designs 6 to 8).
 import { appendAuditEvent } from '../store/audit.js';
 import { withTrialScope, withWriteScope } from '../db/index.js';
-import { deleteDormantRow, dormantSnapshotsBySourcePrefix, insertDormantRow, readDormantSnapshot, replaceDormantEntry } from '../store/dormant.js';
-import { gatedWrite } from '../trust/gated-write.js';
+import { deleteDormantRow, dormantSnapshotsBySourcePrefix, readDormantSnapshot, replaceDormantEntry } from '../store/dormant.js';
+import { gatedWrite } from '../store/gated-write.js';
+import { strengthAblation } from '../core/ablation.js';
 import { Layer, calculateStrength, createMemory } from '../core/memory.js';
 import { findRejectedValue, rejectionDigest } from '../store/rejection.js';
 import { redactSecretsStrict } from '../util/secret-detect.js';
 import { stampOriginProject } from '../store/entry-row.js';
-import { deleteEntryRowInTx, renameEntrySourceAndOriginAt, renameEntrySourceAt, setEntryTagsInTx, supersedeEntryAt } from '../store/entry-writes.js';
+import { renameEntrySourceAndOriginAt, renameEntrySourceAt, setEntryTagsInTx, supersedeEntryAt } from '../store/entry-writes.js';
+import { SYNC_ACTOR, setAsideRow } from '../store/set-aside.js';
 import { entryIdTakenAt, selectLiveEntriesBySourcePrefix } from '../store/entry-reads.js';
 import { markSummaryDirtyInTx } from '../store/summary-dirty.js';
 import { itemHash } from './keys.js';
 import { planContainer } from './plan.js';
 import { emptyTally } from './report.js';
 import { MIN_ITEM_CHARS, itemSource, splitSource, storedText } from './source.js';
-export const SYNC_ACTOR = 'agent-memories';
 /** Throws SQLITE_BUSY when another writer holds the store past its busy timeout; nothing is written then. */
 export function syncContainer(s, work) {
     const run = () => new ContainerRun(s, work).run();
     return s.dryRun ? withTrialScope(s.db, 'sync_container', run) : withWriteScope(s.db, 'sync_container', run);
 }
-/** Design 6's set-aside on the caller's transaction: a pinned row only loses the tag, any other goes dormant, restorable. */
-export function setAsideRow(db, tag, row, why) {
-    const untagged = { ...row, tags: row.tags.filter((t) => t !== tag) };
-    const audit = (metadata) => appendAuditEvent(db, { tenantId: row.tenantId, actor: SYNC_ACTOR, op: 'agent_memory_set_aside', targetId: row.id, metadata });
-    if (row.pinned) {
-        setEntryTagsInTx(db, untagged);
-        audit({ why, untagged: true });
-        return { kind: 'untagged', entry: untagged };
-    }
-    const now = new Date();
-    // Sleep's dormant move skips kept rows, so the steps are written out here without its filter.
-    insertDormantRow(db, { entry: untagged, strength: calculateStrength(row, now), reason: 'source-deleted', dormantAt: now.toISOString() });
-    deleteEntryRowInTx(db, row, SYNC_ACTOR);
-    audit({ why });
-    return { kind: 'dormant', id: row.id };
-}
 class ContainerRun {
     s;
     w;
@@ -223,7 +208,7 @@ class ContainerRun {
             tags: [...tags, this.tag],
             last_retrieved: now.toISOString(),
         };
-        if (!this.gated(stampOriginProject(this.s.hippoRoot, { ...revived, strength: calculateStrength(revived, now) })))
+        if (!this.gated(stampOriginProject(this.s.hippoRoot, { ...revived, strength: calculateStrength(revived, now, { ablation: strengthAblation() }) })))
             return;
         deleteDormantRow(this.s.db, this.s.tenantId, dormantId);
         appendAuditEvent(this.s.db, {

package/dist/agent-memories/claude-code.d.ts

@@ -1,12 +1,14 @@
 import { type ProjectIdentity } from '../core/project-identity.js';
 import type { Adapter, AdapterContext, Listing } from './types.js';
-/** Claude Code's rule: a linked worktree shares its main checkout's folder, or the git folder's when that sits outside a checkout (a bare repository, or --separate-git-dir); any other checkout, a submodule included, keeps its own. */
+/** Claude Code's rule: a linked worktree shares its main checkout's folder, or the git folder's when that sits outside
+ * a checkout (a bare repository, or --separate-git-dir); any other checkout, a submodule included, keeps its own. */
 export declare function claudeCheckoutRoot(top: string, gitDir: string, common: string): string;
 /** Claude Code's folder name for a path: non-alphanumerics made '-', and a name over 200 characters cut to 200 plus a base-36 hash of the whole path. */
 export declare function claudeFolderName(root: string): string;
 export declare const claudeCodeAdapter: Adapter;
 /** A session's own notes folder and nothing else, with no git call, so post-compact can read it inside the hook's time limit. */
 export declare function claudeTranscriptListing(ctx: AdapterContext, transcriptPath: string): Listing;
-/** The project a session folder's notes belong to: the one Claude named the folder for, the session's start folder, else cwd or a parent; null when none matches. */
+/** The project a session folder's notes belong to: the one Claude named the folder
+ * for, the session's start folder, else cwd or a parent; null when none matches. */
 export declare function transcriptNotesProject(transcriptPath: string, cwd: string | null, machine: Pick<AdapterContext, 'platform' | 'env'>): ProjectIdentity | null;
 //# sourceMappingURL=claude-code.d.ts.map

package/dist/agent-memories/claude-code.js

@@ -4,7 +4,7 @@ import path from 'node:path';
 import { resolveProjectIdentity } from '../core/project-identity.js';
 import { realpathOrResolve } from '../util/real-path.js';
 import { isStringValue } from '../core/capture-contract.js';
-import { claudeConfigDir } from '../hooks/shared.js';
+import { claudeConfigDir } from '../util/agent-homes.js';
 import { expandHome, frontmatterField, itemTime, readTextFile, splitFrontmatter } from './files.js';
 import { markdownNotes, readFolderStore, uniqueFolders } from './folder-store.js';
 import { gitLayout } from './git.js';
@@ -21,7 +21,8 @@ function claudeMemoryFolderNames(projectRoot, platform) {
         roots.push(claudeCheckoutRoot(layout.top, layout.gitDir, layout.common));
     return new Set(roots.map((root) => (platform === 'win32' ? claudeFolderName(root).toLowerCase() : claudeFolderName(root))));
 }
-/** Claude Code's rule: a linked worktree shares its main checkout's folder, or the git folder's when that sits outside a checkout (a bare repository, or --separate-git-dir); any other checkout, a submodule included, keeps its own. */
+/** Claude Code's rule: a linked worktree shares its main checkout's folder, or the git folder's when that sits outside
+ * a checkout (a bare repository, or --separate-git-dir); any other checkout, a submodule included, keeps its own. */
 export function claudeCheckoutRoot(top, gitDir, common) {
     if (gitDir === common)
         return top;
@@ -55,7 +56,8 @@ export function claudeTranscriptListing(ctx, transcriptPath) {
     const folder = path.join(path.dirname(transcriptPath), 'memory');
     return { tool: 'claude-code', home: config, containers: readFolders([folder], 'project', ctx.platform), warnings: [] };
 }
-/** The project a session folder's notes belong to: the one Claude named the folder for, the session's start folder, else cwd or a parent; null when none matches. */
+/** The project a session folder's notes belong to: the one Claude named the folder
+ * for, the session's start folder, else cwd or a parent; null when none matches. */
 export function transcriptNotesProject(transcriptPath, cwd, machine) {
     const fold = (name) => (machine.platform === 'win32' ? name.toLowerCase() : name);
     const folder = fold(path.basename(path.dirname(transcriptPath)));
@@ -79,9 +81,16 @@ export function transcriptNotesProject(transcriptPath, cwd, machine) {
 const START_SCAN_BYTES = 64 * 1024;
 /** The cwd on the transcript's first line that has one: the folder Claude named the session folder for, which a folder name alone cannot give back. */
 function transcriptStartCwd(transcriptPath) {
-    if (!fs.existsSync(transcriptPath))
-        return null;
-    const fd = fs.openSync(transcriptPath, 'r');
+    let fd;
+    try {
+        fd = fs.openSync(transcriptPath, 'r');
+    }
+    catch (err) {
+        // A transcript that is not there names no start folder; any other failure is the caller's to see.
+        if (err instanceof Error && 'code' in err && (err.code === 'ENOENT' || err.code === 'ENOTDIR'))
+            return null;
+        throw err;
+    }
     try {
         const buf = Buffer.alloc(START_SCAN_BYTES);
         const lines = buf.subarray(0, fs.readSync(fd, buf, 0, buf.length, 0)).toString('utf8').split('\n');

package/dist/agent-memories/codex.js

@@ -1,7 +1,7 @@
 // Codex CLI's memory_summary.md, the one memory file Codex puts in its prompt, read as a single text-keyed file.
 import fs from 'node:fs';
 import path from 'node:path';
-import { codexHomeDir } from '../hooks/shared.js';
+import { codexHomeDir } from '../util/agent-homes.js';
 import { readTextFile } from './files.js';
 import { textItemKeys } from './keys.js';
 import { splitMarkdownItems } from './markdown.js';

package/dist/agent-memories/copilot.d.ts

@@ -1,5 +1,3 @@
-import type { Adapter, AdapterContext } from './types.js';
-/** VS Code's user-data resolution: portable install first, then the app-data override, then the platform default. */
-export declare function vscodeDataFolders(ctx: Pick<AdapterContext, 'env' | 'home' | 'platform'>): string[];
+import type { Adapter } from './types.js';
 export declare const copilotAdapter: Adapter;
 //# sourceMappingURL=copilot.d.ts.map

package/dist/agent-memories/copilot.js

@@ -5,24 +5,8 @@ import { readTextFile } from './files.js';
 import { readFolderStore } from './folder-store.js';
 import { gitLayout } from './git.js';
 import { errorMessage } from '../util/log.js';
-const PRODUCTS = ['Code', 'Code - Insiders'];
+import { vscodeDataFolders } from '../util/agent-homes.js';
 const MEMORY_TOOL = ['github.copilot-chat', 'memory-tool', 'memories'];
-/** VS Code's user-data resolution: portable install first, then the app-data override, then the platform default. */
-export function vscodeDataFolders(ctx) {
-    const { env, home, platform } = ctx;
-    if (env.VSCODE_PORTABLE)
-        return [path.join(env.VSCODE_PORTABLE, 'user-data')];
-    let appData;
-    if (env.VSCODE_APPDATA)
-        appData = env.VSCODE_APPDATA;
-    else if (platform === 'win32')
-        appData = env.APPDATA || path.join(home, 'AppData', 'Roaming');
-    else if (platform === 'darwin')
-        appData = path.join(home, 'Library', 'Application Support');
-    else
-        appData = env.XDG_CONFIG_HOME || path.join(home, '.config');
-    return PRODUCTS.map((product) => path.join(appData, product));
-}
 /** A `file:` URI as a local path; null for any other scheme or a URI with a host part. */
 function fileUriToPath(uri, platform) {
     if (!uri.startsWith('file://'))

package/dist/agent-memories/files.js

@@ -7,23 +7,34 @@ const MAX_DEPTH = 8;
 /** A file's text, or why it was skipped: empty, too big, holds a NUL byte (not text), or unreadable. */
 export function readTextFile(file) {
     try {
-        const stat = fs.statSync(file);
-        if (!stat.isFile())
-            return { ok: false, reason: `${file}: not a file` };
-        // A tool rewriting a file truncates it first; read as holding no notes, every row would be set aside.
-        if (stat.size === 0)
-            return { ok: false, reason: `${file}: empty` };
-        if (stat.size > MAX_ITEM_BYTES)
-            return { ok: false, reason: `${file}: over ${MAX_ITEM_BYTES} bytes` };
-        const buf = fs.readFileSync(file);
-        if (buf.includes(0))
-            return { ok: false, reason: `${file}: not text` };
-        return { ok: true, text: buf.toString('utf8'), mtimeMs: stat.mtimeMs };
+        // O_NONBLOCK opens a FIFO at once, for the file check to turn away; Windows has no such flag and the OR adds nothing.
+        const fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NONBLOCK);
+        try {
+            return readOpenTextFile(file, fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
     }
     catch (err) {
         return { ok: false, reason: `${file}: ${errorMessage(err)}` };
     }
 }
+/** The checks and the read on one descriptor, so the file measured is the file read. */
+function readOpenTextFile(file, fd) {
+    const stat = fs.fstatSync(fd);
+    if (!stat.isFile())
+        return { ok: false, reason: `${file}: not a file` };
+    // A tool rewriting a file truncates it first; read as holding no notes, every row would be set aside.
+    if (stat.size === 0)
+        return { ok: false, reason: `${file}: empty` };
+    if (stat.size > MAX_ITEM_BYTES)
+        return { ok: false, reason: `${file}: over ${MAX_ITEM_BYTES} bytes` };
+    const buf = fs.readFileSync(fd);
+    if (buf.includes(0))
+        return { ok: false, reason: `${file}: not text` };
+    return { ok: true, text: buf.toString('utf8'), mtimeMs: stat.mtimeMs };
+}
 /** Files in a folder as '/'-separated relative paths, sorted; dot entries skipped, symlinked folders not followed. */
 export function listFiles(dir, opts) {
     if (!fs.existsSync(dir))

package/dist/agent-memories/markdown.d.ts

@@ -1,6 +1,4 @@
-/**
- * Splits one markdown memory file into items (a top-level bullet or a paragraph), each tagged with its heading. Pure.
- */
+/** Splits one markdown memory file into items (a top-level bullet or a paragraph), each tagged with its heading. Pure. */
 export interface MarkdownItem {
     readonly heading: string;
     readonly headingSlug: string;

package/dist/agent-memories/markdown.js

@@ -1,6 +1,4 @@
-/**
- * Splits one markdown memory file into items (a top-level bullet or a paragraph), each tagged with its heading. Pure.
- */
+/** Splits one markdown memory file into items (a top-level bullet or a paragraph), each tagged with its heading. Pure. */
 const HEADING = /^#{1,6}\s+/;
 // Column 0 only: an indented marker is a sub-bullet and stays inside its item.
 const BULLET = /^(?:[-*+]|\d+[.)]) /;

package/dist/agent-memories/project-folds.d.ts

@@ -0,0 +1,10 @@
+import type { ProjectTagReads } from '../store/project-tags.js';
+export interface ProjectFold {
+    readonly from: string;
+    readonly into: string;
+}
+export declare function foldEdges(store: Pick<ProjectTagReads, 'auditEvents'>): ProjectFold[];
+export declare function foldedInto(edges: readonly ProjectFold[], names: readonly string[]): string[];
+/** Names folded, directly or through others, into one of `names`; the sync moves imports still filed under them. */
+export declare function namesFoldedInto(store: Pick<ProjectTagReads, 'auditEvents'>, names: readonly string[]): string[];
+//# sourceMappingURL=project-folds.d.ts.map

package/dist/agent-memories/project-folds.js

@@ -0,0 +1,34 @@
+// Project names folded into others, read from the audit trail: the sync files imports under the surviving name, and `hippo projects` repair agrees.
+import { isObjectLike, isStringValue } from '../core/capture-contract.js';
+function foldOf(value) {
+    if (!isObjectLike(value) || Array.isArray(value))
+        return [];
+    const { from, into } = value;
+    return isStringValue(from) && isStringValue(into) ? [{ from, into }] : [];
+}
+export function foldEdges(store) {
+    return [
+        ...store.auditEvents('project_merge').flatMap((e) => foldOf(e.metadata)),
+        ...store.auditEvents('project_repair')
+            .flatMap((e) => (Array.isArray(e.metadata.folds) ? e.metadata.folds.flatMap(foldOf) : [])),
+    ];
+}
+export function foldedInto(edges, names) {
+    const seen = new Set(names);
+    let grew = true;
+    while (grew) {
+        grew = false;
+        for (const { from, into } of edges) {
+            if (!seen.has(into) || seen.has(from))
+                continue;
+            seen.add(from);
+            grew = true;
+        }
+    }
+    return [...seen].filter((n) => !names.includes(n));
+}
+/** Names folded, directly or through others, into one of `names`; the sync moves imports still filed under them. */
+export function namesFoldedInto(store, names) {
+    return foldedInto(foldEdges(store), names);
+}
+//# sourceMappingURL=project-folds.js.map

package/dist/agent-memories/report.js

@@ -47,7 +47,8 @@ export function totalTally(report) {
 const plural = (n, one, many) => `${n} ${n === 1 ? one : many}`;
 const TALLY_WORDS = {
     imported: 'new', replaced: 'replaced', restored: 'brought back', setAside: 'set aside', untagged: 'pinned and kept',
-    unchanged: 'unchanged', adopted: 'taken over from the old Claude import', renamed: 'moved to the project id', collapsed: 'duplicates folded', retagged: 'retagged',
+    unchanged: 'unchanged', adopted: 'taken over from the old Claude import', renamed: 'moved to the project id', collapsed: 'duplicates folded',
+    retagged: 'retagged',
     handedOver: 'handed over from the global store', duplicate: 'already stored', secret: 'skipped for a secret', short: 'too short',
     rejected: 'skipped as rejected', unread: 'files skipped', unreadable: 'unreadable folders', busy: 'busy folders',
 };

package/dist/agent-memories/sync.d.ts

@@ -24,9 +24,11 @@ export declare function importForStore(hippoRoot: string, opts: SyncOptions): Im
 export declare function importProjectMemories(hippoRoot: string, opts: SyncOptions): ImportReport;
 /** Every tool's user-level memory into the global store, created on demand, with no origin. */
 export declare function importUserMemories(invokingRoot: string, opts: SyncOptions): ImportReport;
-/** Session end in a folder with no store of its own: the session's project into the global store with its origin, the session folder's notes, then the user pass. */
+/** Session end in a folder with no store of its own: the session's project into the
+ * global store with its origin, the session folder's notes, then the user pass. */
 export declare function importAtSessionEnd(cwd: string, transcriptPath: string | undefined, opts: SyncOptions): ImportReport;
-/** The session folder's notes under the project Claude filed them for, never cwd's: a session begun at home keeps its home notes user-global wherever it ends. No git call, so post-compact can run it. */
+/** The session folder's notes under the project Claude filed them for, never cwd's: a session begun at
+ * home keeps its home notes user-global wherever it ends. No git call, so post-compact can run it. */
 export declare function importSessionFolder(hippoRoot: string, transcriptPath: string, cwd: string | null, opts: SyncOptions): ImportReport;
 /** The variable when set (empty or `none` is off); else the tools both the invoking and the target store's config allow. */
 export declare function allowedTools(env: Machine['env'], invoking: string, target: string, warnings: string[]): Set<ToolId>;

package/dist/agent-memories/sync.js

@@ -6,16 +6,18 @@ import path from 'node:path';
 import { errorMessage } from '../util/log.js';
 import { loadConfig } from '../core/config.js';
 import { closeHippoDb, isSqliteBusy, openHippoDb, outsideRequestStores, withWriteScope } from '../db/index.js';
-import { namesFoldedInto } from '../sharing/project-merge.js';
-import { isGlobalStoreRoot, projectNames, resolveGlobalRootDir, resolveProjectIdentity } from '../core/project-identity.js';
+import { namesFoldedInto } from './project-folds.js';
+import { projectTagReads } from '../store/project-tags.js';
+import { isGlobalStoreRoot, isInitialized, projectNames, resolveGlobalRootDir, resolveProjectIdentity, } from '../core/project-identity.js';
 import { duplicateKey, heldTextKeys } from '../util/same-text.js';
 import { removeEntryMirrors } from '../store/mirrors.js';
-import { initStore, isInitialized } from '../store/open.js';
+import { initStore } from '../store/open.js';
 import { writeEntryMirrors } from '../store/entry-writes.js';
 import { selectLiveEntriesBySourcePrefix, selectRowsOutsideSourcePrefixAt } from '../store/entry-reads.js';
 import { updateStats } from '../store/index-and-stats.js';
 import { resolveTenantId } from '../store/tenant.js';
-import { setAsideRow, syncContainer } from './apply.js';
+import { setAsideRow } from '../store/set-aside.js';
+import { syncContainer } from './apply.js';
 import { claudeCodeAdapter, claudeTranscriptListing, transcriptNotesProject } from './claude-code.js';
 import { codexAdapter } from './codex.js';
 import { copilotAdapter } from './copilot.js';
@@ -44,29 +46,34 @@ export function importForStore(hippoRoot, opts) {
 export function importProjectMemories(hippoRoot, opts) {
     const ctx = context(opts.machine, { projectRoot: path.dirname(hippoRoot) });
     return runPass({
-        scope: 'project', target: hippoRoot, invoking: hippoRoot, list: (a) => a.list(ctx, 'project'), legacy: true, originProject: undefined, legacyOrigins: [], handover: true,
+        scope: 'project', target: hippoRoot, invoking: hippoRoot, list: (a) => a.list(ctx, 'project'), legacy: true, originProject: undefined,
+        legacyOrigins: [], handover: true,
     }, opts);
 }
 /** Every tool's user-level memory into the global store, created on demand, with no origin. */
 export function importUserMemories(invokingRoot, opts) {
     const ctx = context(opts.machine, {});
     return runPass({
-        scope: 'user', target: resolveGlobalRootDir(), invoking: invokingRoot, list: (a) => a.list(ctx, 'user'), legacy: false, originProject: '', legacyOrigins: [], handover: false,
+        scope: 'user', target: resolveGlobalRootDir(), invoking: invokingRoot, list: (a) => a.list(ctx, 'user'), legacy: false, originProject: '',
+        legacyOrigins: [], handover: false,
     }, opts);
 }
-/** Session end in a folder with no store of its own: the session's project into the global store with its origin, the session folder's notes, then the user pass. */
+/** Session end in a folder with no store of its own: the session's project into the
+ * global store with its origin, the session folder's notes, then the user pass. */
 export function importAtSessionEnd(cwd, transcriptPath, opts) {
     const globalRoot = resolveGlobalRootDir();
     const ctx = context(opts.machine, { projectRoot: cwd });
     const report = runPass({
-        scope: 'project', target: globalRoot, invoking: globalRoot, list: (a) => a.list(ctx, 'project'), legacy: false, ...projectOrigins(resolveProjectIdentity(cwd)), handover: false,
+        scope: 'project', target: globalRoot, invoking: globalRoot, list: (a) => a.list(ctx, 'project'), legacy: false,
+        ...projectOrigins(resolveProjectIdentity(cwd)), handover: false,
     }, opts);
     if (transcriptPath !== undefined)
         mergeReports(report, importSessionFolder(globalRoot, transcriptPath, cwd, opts));
     mergeReports(report, importUserMemories(globalRoot, opts));
     return report;
 }
-/** The session folder's notes under the project Claude filed them for, never cwd's: a session begun at home keeps its home notes user-global wherever it ends. No git call, so post-compact can run it. */
+/** The session folder's notes under the project Claude filed them for, never cwd's: a session begun at
+ * home keeps its home notes user-global wherever it ends. No git call, so post-compact can run it. */
 export function importSessionFolder(hippoRoot, transcriptPath, cwd, opts) {
     const project = transcriptNotesProject(transcriptPath, cwd, opts.machine);
     if (project === null)
@@ -225,7 +232,7 @@ function syncStore(pass, listings, store, opts, report) {
 /** The legacy names plus every name a merge or repair folded into the project; the audit read runs once per pass. */
 function earlierNames(db, tenantId, id, legacyOrigins) {
     const names = [id, ...legacyOrigins];
-    return [...legacyOrigins, ...namesFoldedInto(db, tenantId, names)].filter((n) => n !== '' && n !== id);
+    return [...legacyOrigins, ...namesFoldedInto(projectTagReads(db, tenantId), names)].filter((n) => n !== '' && n !== id);
 }
 function containerWork(tool, container, options) {
     const { platform, legacy, origin, earlier } = options;
@@ -311,7 +318,7 @@ function handOver(synced, projectRoot, opts, report) {
         // A folder with no git and no marker wrote as '' before its store existed, and as its own name after.
         // Names folded into this project's in the global store were its rows too.
         const names = projectNames(resolveProjectIdentity(projectRoot));
-        const origins = [...new Set([...names, ...namesFoldedInto(db, tenantId, names), ''])];
+        const origins = [...new Set([...names, ...namesFoldedInto(projectTagReads(db, tenantId), names), ''])];
         for (const work of synced)
             handOverContainer(db, globalRoot, tenantId, work, { origins, platform: opts.machine.platform, report });
     }

package/dist/api/assemble.d.ts

@@ -9,19 +9,10 @@ export interface AssembleOpts {
     /** Substitute parent summaries for older raws when ≥2 share a level-2
      *  ancestor. Default true. */
     summarizeOlder?: boolean;
-    /**
-     * Restrict to a specific scope, same rule as
-     * `recall`: when set, exact match required (so an authorised caller can
-     * assemble a `slack:private:CSEC` session by passing scope explicitly).
-     * When undefined, default-deny applies to ANY `<source>:private:*` and
-     * `unknown:legacy` rows.
-     */
+    /** Exact scope match when set, so an authorised caller can assemble a private session.
+     * When undefined, default-deny applies to every `<source>:private:*` and `unknown:legacy` row. */
     scope?: string;
-    /**
-     * Hard row cap on the SELECT that loads session raws. Default 5000 to
-     * protect against degenerate sessions. When the cap is hit, `truncated`
-     * is set on the result so the caller knows to widen.
-     */
+    /** Hard row cap on the SELECT that loads session raws (default 5000); `truncated` is set when it is hit. */
     rowCap?: number;
     cost?: AssembleCost;
     project?: CallerProject;
@@ -51,42 +42,14 @@ export interface AssembleResult {
     sessionId: string;
     items: AssembledContextItem[];
     tokens: number;
-    /**
-     * Tenant + scope-filtered raw row count for the session, uncapped by `rowCap`, so
-     * "session has N msgs" stays accurate when items[] is the windowed view.
-     */
+    /** Tenant + scope-filtered raw row count, uncapped by `rowCap`, so "session has N msgs" stays accurate for a windowed items[]. */
     totalRaw: number;
     summarized: number;
     evicted: number;
-    /**
-     * True when `rowCap` truncated the loaded window. The cap keeps the NEWEST
-     * rows, so the items[] array represents the freshest tail of the session;
-     * older rows beyond the cap are silently absent. Use `totalRaw - items.length
-     * - summarized + ...` to estimate how much you didn't see, or widen `rowCap`.
-     */
+    /** True when `rowCap` truncated the window; the cap keeps the NEWEST rows, so older rows beyond it are absent. */
     truncated: boolean;
 }
-/**
- * Build a chronologically-ordered context window for a session. Adapts the
- * lossless-claw context-engine pattern to Hippo's score-ranked memory store.
- *
- * Algorithm:
- *   1. Load all kind='raw' rows for the session, tenant + scope filtered.
- *   2. Split: newest `freshTailCount` are protected (fresh tail).
- *   3. For older rows, when ≥2 share a level-2 parent, substitute the
- *      summary; everything else passes through as raw.
- *   4. Hippo-additive eviction: when over-budget, drop the lowest-strength
- *      non-fresh-tail item first. Fresh-tail rows are never evicted.
- *
- * Strength-weighted eviction is the differentiator from lossless-claw,
- * which evicts oldest-first. A high-strength older row (high retrieval
- * count, slow decay) survives; a low-strength recent row (newer but
- * unimportant) goes first.
- *
- * Returns `items: []` cleanly when:
- *   - sessionId is empty
- *   - no raws exist for the session
- *   - all rows fail the scope/tenant filter
- */
+/** Chronological context window for a session; over budget, evicts the lowest-strength non-fresh-tail item first (fresh tail is never evicted).
+ * Returns `items: []` for an empty sessionId, no raws, or when every row fails the scope/tenant filter. */
 export declare function assemble(ctx: Context, sessionId: string, opts?: AssembleOpts): Promise<AssembleResult>;
 //# sourceMappingURL=assemble.d.ts.map

package/dist/api/assemble.js

@@ -1,33 +1,13 @@
 // Session context assembly under a token budget.
 import { requireGroup, storeFor } from '../store/index.js';
 import { estimateTokens } from '../util/token-text.js';
-import { passesScopeFilterForRecall, assertScopeRequestAllowed, personalScopeOf } from '../store/recall-scope.js';
+import { passesScopeFilterForRecall, assertScopeRequestAllowed, personalScopeOf } from '../core/recall-scope.js';
 import { classifyOriginProject, projectNames } from '../core/project-identity.js';
 const DEFAULT_FRESH_TAIL_COUNT = 10;
 const DEFAULT_ROW_CAP = 5000;
 export const DEFAULT_ASSEMBLE_BUDGET = 4000;
-/**
- * Build a chronologically-ordered context window for a session. Adapts the
- * lossless-claw context-engine pattern to Hippo's score-ranked memory store.
- *
- * Algorithm:
- *   1. Load all kind='raw' rows for the session, tenant + scope filtered.
- *   2. Split: newest `freshTailCount` are protected (fresh tail).
- *   3. For older rows, when ≥2 share a level-2 parent, substitute the
- *      summary; everything else passes through as raw.
- *   4. Hippo-additive eviction: when over-budget, drop the lowest-strength
- *      non-fresh-tail item first. Fresh-tail rows are never evicted.
- *
- * Strength-weighted eviction is the differentiator from lossless-claw,
- * which evicts oldest-first. A high-strength older row (high retrieval
- * count, slow decay) survives; a low-strength recent row (newer but
- * unimportant) goes first.
- *
- * Returns `items: []` cleanly when:
- *   - sessionId is empty
- *   - no raws exist for the session
- *   - all rows fail the scope/tenant filter
- */
+/** Chronological context window for a session; over budget, evicts the lowest-strength non-fresh-tail item first (fresh tail is never evicted).
+ * Returns `items: []` for an empty sessionId, no raws, or when every row fails the scope/tenant filter. */
 export async function assemble(ctx, sessionId, opts = {}) {
     assertScopeRequestAllowed(ctx.actor, opts.scope);
     const budget = opts.budget ?? DEFAULT_ASSEMBLE_BUDGET;

package/dist/api/audit.d.ts

@@ -1,4 +1,6 @@
-import type { AuditEvent, AuditOp } from '../store/audit.js';
+import { type AuditEvent, type AuditOp } from '../store/audit.js';
+import { type AuditIssue, type AuditResult } from '../core/memory-audit.js';
+import { type QualityRepairResult } from '../store/quality-repair.js';
 import type { KeysetPosition } from '../util/keyset.js';
 import type { Context } from './types.js';
 export interface AuditListOpts {
@@ -11,4 +13,34 @@ export interface AuditListOpts {
 }
 /** Read audit events scoped to `ctx.tenantId` on the store the request runs on. Read-only, no audit emit. */
 export declare function auditList(ctx: Context, opts: AuditListOpts): Promise<AuditEvent[]>;
+/** The pass that removes audit errors; it leads the reason on each forget row. */
+export type AuditPass = 'audit --fix' | 'sleep-audit';
+/** Delete the memories an audit marked as errors, each with its own forget row, and answer the ids that went: a pinned or raw row stays. */
+export declare function removeAuditErrors(ctx: Context, pass: AuditPass, issues: readonly AuditIssue[]): string[];
+/** The caller's memories run through the quality audit; a memory that backs an object is never marked for removal. */
+export declare function auditMemoryQuality(ctx: Context): AuditResult;
+/** Audit repair for the caller's tenant: a preview, or with `apply` the moves of certain defects to dormant storage behind a backup. */
+export declare function repairMemoryQuality(ctx: Context, apply: boolean): QualityRepairResult;
+/** The repair sleep and the daily runner apply once per store after an upgrade; null when it already ran there. */
+export declare function repairMemoryQualityOnce(ctx: Context): QualityRepairResult | null;
+export interface PruneAuditOpts {
+    /** Cutoff in days. Rows with `ts < (now - N days)` are deleted. */
+    olderThanDays: number;
+    /** When true, count matching rows but do NOT delete. Default false. */
+    dryRun?: boolean;
+}
+export interface PruneAuditResult {
+    /** ISO timestamp of the cutoff. Rows with ts strictly less than this were deleted. */
+    cutoff: string;
+    /** Number of audit_log rows deleted (or that would be deleted, if dryRun). */
+    count: number;
+    /** Echo back whether this was a dry run. */
+    dryRun: boolean;
+}
+/** Cutoff ISO timestamp for N days ago; exported so tests can pin "now" without mocking Date. */
+export declare function computeCutoff(days: number, now?: Date): string;
+/** Delete the caller's tenant's audit_log rows older than `olderThanDays`, then record an `audit_prune` row as `ctx.actor`; opt-in, since
+ *  retention floors (HIPAA, SOX, GDPR) apply. The row is written after the DELETE, so a call never prunes its own record.
+ *  Throws on non-positive days or an empty tenant. */
+export declare function pruneAuditLog(ctx: Context, opts: PruneAuditOpts): PruneAuditResult;
 //# sourceMappingURL=audit.d.ts.map