hippo-memory 1.70.0 → 1.72.0

package/dist/learn/autolearn.js

@@ -1,8 +1,6 @@
-/**
- * Auto-learn from errors and git history.
- * Agents learn from failures without explicit hippo remember calls.
- */
-import { execSync, execFileSync, spawn } from 'child_process';
+/** Auto-learn from errors and git history.
+ *  Agents learn from failures without explicit hippo remember calls. */
+import { execFileSync, spawn } from 'child_process';
 import { createMemory, Layer, DEFAULT_HALF_LIFE_DAYS } from '../core/memory.js';
 import { loadAllEntries } from '../store/entry-reads.js';
 import { textOverlap } from '../util/tokenize.js';
@@ -11,7 +9,7 @@ import { redactSecretsStrict } from '../util/secret-detect.js';
 import { errorMessage, log } from '../util/log.js';
 const AUTOLEARN_TEXT_CHARS = 500;
 const AUTOLEARN_TAG_CHARS = 30;
-/** A memory of a failed command, "Command '<cmd>' failed: <truncated stderr>"; no store is in reach, so `hippo watch` re-derives its half-life from the store's config. */
+/** A memory of a failed command, "Command '<cmd>' failed: <truncated stderr>"; `hippo watch` stores its text and tags through remember. */
 export function captureError(exitCode, stderr, command, tenantId) {
     // Truncate to first 500 chars to avoid storing megabytes of build logs
     const clean = redactSecretsStrict(stderr);
@@ -35,10 +33,8 @@ export function captureError(exitCode, stderr, command, tenantId) {
         baseHalfLifeDays: DEFAULT_HALF_LIFE_DAYS,
     });
 }
-/**
- * Parse git log output for actionable lessons.
- * Looks for fix:, revert:, bug:, error:, hotfix: commit messages.
- */
+/** Parse git log output for actionable lessons.
+ *  Looks for fix:, revert:, bug:, error:, hotfix: commit messages. */
 export function extractLessons(gitLog, customPatterns) {
     const lessons = [];
     const lines = gitLog.split('\n');
@@ -73,18 +69,8 @@ export function extractLessons(gitLog, customPatterns) {
     // Deduplicate exact matches at extraction time
     return [...new Set(lessons)];
 }
-/**
- * Split parsed lessons into ones worth storing and low-information ones.
- *
- * `extractLessons` is a published API surface (exported from src/index.ts)
- * and does one job: parse a git log into candidate lesson strings. Adding a
- * quality check inside it would break that contract and silently change
- * what external callers get back. So parsing and admission are separate
- * steps: this function is the write-path gate, called by each caller that
- * actually stores a lesson, not by the parser itself.
- *
- * Order is preserved in both output arrays; both hold lessons with secret shapes redacted.
- */
+/** Split parsed lessons into ones worth storing and low-information ones; kept out of `extractLessons` so that published parser's output cannot change.
+ *  Order is preserved in both arrays, and both hold lessons with secret shapes redacted. */
 export function partitionLessons(lessons) {
     const kept = [];
     const dropped = [];
@@ -98,15 +84,8 @@ export function partitionLessons(lessons) {
     }
     return { kept, dropped };
 }
-/**
- * Check if a substantially similar memory already exists.
- * Returns true if overlap > threshold (default 0.7).
- *
- * `tenantId` is opt-in. Only takes effect when the first argument is a
- * root string (string-overload path). When the first argument is a
- * pre-loaded MemoryEntry[], the caller has already scoped — tenantId is
- * ignored on that path.
- */
+/** Check if a substantially similar memory already exists: true if overlap > threshold (default 0.7).
+ *  `tenantId` applies only on the root-string overload; a pre-loaded MemoryEntry[] is already scoped, so it is ignored there. */
 export function deduplicateLesson(hippoRootOrEntries, lesson, threshold = 0.7, tenantId) {
     const entries = Array.isArray(hippoRootOrEntries)
         ? hippoRootOrEntries
@@ -118,37 +97,53 @@ export function deduplicateLesson(hippoRootOrEntries, lesson, threshold = 0.7, t
     }
     return false;
 }
-/**
- * Run a command in a shell, streaming stderr live; never pass text the caller did not write.
- * Returns: { exitCode, stderr }.
- */
-export function runWatched(command) {
-    return new Promise((resolve) => {
+/** The most stderr `runWatched` returns; the terminal still gets all of it. */
+const STDERR_TAIL_BYTES = 64 * 1024;
+/** A transfer command that has not exited in this long is hung on a prompt or a dead remote. */
+export const RUN_WATCHED_DEADLINE_MS = 30 * 60_000;
+/** The command passed its deadline and was killed. */
+export class RunWatchedTimeoutError extends Error {
+    deadlineMs;
+    stderr;
+    constructor(deadlineMs, stderr) {
+        super(`the command did not exit within ${deadlineMs} ms and was killed`);
+        this.deadlineMs = deadlineMs;
+        this.stderr = stderr;
+        this.name = 'RunWatchedTimeoutError';
+    }
+}
+/** Run a command in a shell, streaming stderr live; never pass text the caller did not write.
+ *  Returns: { exitCode, stderr } with only the last 64 KiB of stderr; rejects with RunWatchedTimeoutError past `deadlineMs`. */
+export function runWatched(command, deadlineMs = RUN_WATCHED_DEADLINE_MS) {
+    return new Promise((resolve, reject) => {
         // Use shell: true so the command string is handled by the shell as-is
         const child = spawn(command, { shell: true, stdio: ['inherit', 'inherit', 'pipe'], windowsHide: true });
-        const stderrChunks = [];
+        let tail = Buffer.alloc(0);
         child.stderr.on('data', (chunk) => {
-            stderrChunks.push(chunk);
-            // Also pass through to terminal
+            tail = Buffer.concat([tail, chunk]);
+            if (tail.length > STDERR_TAIL_BYTES)
+                tail = tail.subarray(tail.length - STDERR_TAIL_BYTES);
             process.stderr.write(chunk);
         });
+        // SHORTCUT: kills the shell only; on Windows a grandchild can outlive it. A process-tree kill is the upgrade path.
+        const timer = setTimeout(() => {
+            child.kill('SIGKILL');
+            reject(new RunWatchedTimeoutError(deadlineMs, tail.toString('utf8')));
+        }, deadlineMs);
         child.on('close', (code) => {
-            resolve({
-                exitCode: code ?? 1,
-                stderr: Buffer.concat(stderrChunks).toString('utf8'),
-            });
+            clearTimeout(timer);
+            resolve({ exitCode: code ?? 1, stderr: tail.toString('utf8') });
         });
         child.on('error', (err) => {
+            clearTimeout(timer);
             resolve({ exitCode: 1, stderr: err.message });
         });
     });
 }
-/**
- * Check whether a directory is a git work tree.
- */
+/** Check whether a directory is a git work tree. */
 export function isGitRepo(cwd) {
     try {
-        const raw = execSync('git rev-parse --is-inside-work-tree', {
+        const raw = execFileSync('git', ['rev-parse', '--is-inside-work-tree'], {
             encoding: 'utf8',
             cwd,
             timeout: 10000,
@@ -162,10 +157,8 @@ export function isGitRepo(cwd) {
         return false;
     }
 }
-/**
- * Fetch recent git log lines (subject lines only).
- * days: how many days of history to include.
- */
+/** Fetch recent git log lines (subject lines only).
+ *  days: how many days of history to include. */
 export function fetchGitLog(cwd, days) {
     try {
         const raw = execFileSync('git', [

package/dist/learn/churn-git.js

@@ -3,12 +3,13 @@ import { execFileSync } from 'child_process';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
-import { DAY_MS } from '../util/time.js';
+import { DAY_MS, MINUTE_MS } from '../util/time.js';
 import { errorMessage } from '../util/log.js';
+import { isJsonObject, isJsonString } from '../util/json.js';
 // A `git log --name-status` dump can run to tens of MB; default 1MB pipe would truncate it.
 const GIT_MAX_BUFFER = 64 * 1024 * 1024;
 // Longer than the 10 s of one-line git reads because a full log dump on a large repo is slow, yet bounded so a wedged git cannot stall sleep.
-const GIT_TIMEOUT_MS = 60_000;
+const GIT_TIMEOUT_MS = MINUTE_MS;
 /** A real git failure (not git grep's expected exit-1-no-match). Callers abort the whole run on this. */
 export class GitReadError extends Error {
 }
@@ -93,9 +94,17 @@ export function packageScriptsAt(repoRoot, rev) {
         return {};
     const raw = runGit(['show', `${rev}:package.json`], repoRoot);
     try {
-        // SAFETY: optional chaining makes a `null` or scalar package.json read as "no scripts".
         const parsed = JSON.parse(raw);
-        return parsed?.scripts ?? {};
+        const scripts = isJsonObject(parsed) ? parsed.scripts : undefined;
+        if (!isJsonObject(scripts))
+            return {};
+        const out = {};
+        for (const [name, command] of Object.entries(scripts)) {
+            if (!isJsonString(command))
+                return {};
+            out[name] = command;
+        }
+        return out;
     }
     catch (err) {
         if (err instanceof SyntaxError)

package/dist/learn/extract.d.ts

@@ -1,4 +1,5 @@
 import { MemoryEntry, EmotionalValence } from '../core/memory.js';
+import { type AnthropicMessageFailure } from '../util/anthropic-messages.js';
 export interface ExtractedFact {
     content: string;
     tags: string[];
@@ -8,8 +9,8 @@ export interface ExtractOptions {
     apiKey: string;
     model?: string;
     fetcher?: typeof fetch;
-    /** Told why a call produced nothing, so callers can surface it instead of guessing. */
-    onError?: (msg: string) => void;
+    /** Told why a call produced nothing, so callers can surface it instead of guessing; `failure` is set when the API call itself failed. */
+    onError?: (msg: string, failure?: AnthropicMessageFailure) => void;
 }
 export declare function extractFacts(text: string, opts: ExtractOptions): Promise<ExtractedFact[]>;
 export declare function storeExtractedFacts(hippoRoot: string, source: MemoryEntry, facts: ExtractedFact[]): MemoryEntry[];

package/dist/learn/extract.js

@@ -1,20 +1,22 @@
 import { Layer, createMemory } from '../core/memory.js';
 import { writeEntry } from '../store/entry-writes.js';
 import { loadConfig } from '../core/config.js';
-import { RejectedValueError } from '../store/rejection.js';
+import { RejectedValueError } from '../core/api-errors.js';
 import { redactSecretsStrict } from '../util/secret-detect.js';
 import { describeMessageFailure, sendAnthropicMessage } from '../util/anthropic-messages.js';
-import { neverAutoShareTags } from '../sharing/shared.js';
+import { neverAutoShareTags } from '../sharing/share.js';
 import { errorMessage, log } from '../util/log.js';
 import { isJsonString } from '../util/json.js';
 import { certainDefect } from '../core/memory-quality.js';
-const EXTRACTION_PROMPT = `You are extracting factual statements from a conversation or memory entry. Extract 1-8 standalone factual statements that would be useful to remember later.
+const EXTRACTION_PROMPT = `You are extracting factual statements from a conversation or memory entry. ` +
+    `Extract 1-8 standalone factual statements that would be useful to remember later.
 
 Rules:
 - Each fact must be a complete, standalone sentence
 - Include the speaker's name in every fact (e.g. "Alice prefers..." not "She prefers...")
 - Preserve specific details: names, numbers, dates, paths, IDs
-- Return a JSON array of objects with: content (string), tags (array of "speaker:X" and "topic:Y" strings), valence ("neutral", "positive", "negative", or "critical")
+- Return a JSON array of objects with: content (string), tags (array of "speaker:X" and "topic:Y" strings), ` +
+    `valence ("neutral", "positive", "negative", or "critical")
 - Return an empty array [] for small talk with no extractable facts
 - Output ONLY the JSON array, no preamble or explanation
 
@@ -31,7 +33,7 @@ export async function extractFacts(text, opts) {
         fetcher: opts.fetcher,
     });
     if (!reply.ok) {
-        opts.onError?.(describeMessageFailure(reply.failure));
+        opts.onError?.(describeMessageFailure(reply.failure), reply.failure);
         return [];
     }
     try {
@@ -86,9 +88,7 @@ export function storeExtractedFacts(hippoRoot, source, facts) {
             continue;
         }
         const entry = buildExtractedEntry(fact, source, inheritedTags, baseHalfLifeDays);
-        // A refusal is per-VALUE: one rejected fact must not
-        // drop the rest of this batch. writeEntry has already audited the
-        // refusal (reject_refusal) before rethrowing, so skip-and-count here.
+        // A refusal is per-VALUE: one rejected fact must not drop the rest of the batch; writeEntry already audited it (reject_refusal), so skip and count.
         try {
             writeEntry(hippoRoot, entry);
         }

package/dist/learn/forward-claim-detector.d.ts

@@ -1,36 +1,12 @@
-/**
- * Forward-claim detector: pure-function regex set + token extraction.
- *
- * No DB. No state. No dependencies beyond stdlib regex + String.
- *
- * The detector's job is to decide whether a recall query carries a
- * forward-prediction phrase ("will take ~3 days", "ship by Friday",
- * "ETA in 2 weeks"). Calibration is intentionally HIGH-PRECISION /
- * LOW-RECALL: better to fire on 20% of real forward-claims than 80% with
- * 40% noise. Cry-wolf failure dominates planning-fallacy hint UX (Lovallo-
- * Kahneman 2003 inside-vs-outside view).
- *
- * Iteration signal: the `recall_autodebias_hint_no_class_match` audit op
- * (emitted by recall when a phrase matches but no class
- * resolves) is the telemetry channel for deciding whether to add an
- * embedding-based detector.
- */
+/** Forward-claim detector: a pure regex set plus token extraction deciding whether a recall query carries a forward-prediction phrase.
+ *  Calibration is HIGH-PRECISION / LOW-RECALL, since cry-wolf noise dominates hint UX; `recall_autodebias_hint_no_class_match` audits are the telemetry. */
 export interface ForwardClaimMatch {
-    /** The regex match snippet, e.g. "will take" or "~3 days". Surfaced
-     *  to the calling agent in `PlanningFallacyHint.detectedPhrase` so they
-     *  see WHY the hint appeared. */
+    /** The regex match snippet (e.g. "will take"), surfaced in `PlanningFallacyHint.detectedPhrase` so the agent sees WHY the hint appeared. */
     phrase: string;
-    /** Lower-cased non-stop-word tokens (len >= 3, alpha or alphanumeric)
-     *  extracted from the FULL query, NOT just the match. Used by the
-     *  orchestrator's class resolver to score overlap with class_tag tokens. */
+    /** Lower-cased non-stop-word tokens (len >= 3) from the FULL query, not just the match; the class resolver scores them against class_tag tokens. */
     classQueryTokens: string[];
 }
-/**
- * Detect whether a recall query carries a forward-prediction phrase.
- *
- * @returns first-match phrase + extracted class-resolution tokens when
- *   any pattern matches; null otherwise. Token extraction runs only on a
- *   match — non-forward queries pay zero work beyond the regex gate.
- */
+/** Detect whether a recall query carries a forward-prediction phrase; returns the first-match phrase plus class-resolution tokens, else null.
+ *  Token extraction runs only on a match, so non-forward queries pay nothing beyond the regex gate. */
 export declare function detectForwardClaim(queryText: string): ForwardClaimMatch | null;
 //# sourceMappingURL=forward-claim-detector.d.ts.map

package/dist/learn/forward-claim-detector.js

@@ -1,91 +1,43 @@
-/**
- * Forward-claim detector: pure-function regex set + token extraction.
- *
- * No DB. No state. No dependencies beyond stdlib regex + String.
- *
- * The detector's job is to decide whether a recall query carries a
- * forward-prediction phrase ("will take ~3 days", "ship by Friday",
- * "ETA in 2 weeks"). Calibration is intentionally HIGH-PRECISION /
- * LOW-RECALL: better to fire on 20% of real forward-claims than 80% with
- * 40% noise. Cry-wolf failure dominates planning-fallacy hint UX (Lovallo-
- * Kahneman 2003 inside-vs-outside view).
- *
- * Iteration signal: the `recall_autodebias_hint_no_class_match` audit op
- * (emitted by recall when a phrase matches but no class
- * resolves) is the telemetry channel for deciding whether to add an
- * embedding-based detector.
- */
-/**
- * Each pattern is intentionally narrow:
- * adding a pattern should require evidence from the
- * `recall_autodebias_hint_no_class_match` audit channel that real forward-
- * claims are slipping through, NOT speculative "this might match more".
- *
- * Word boundaries (`\b`) are mandatory: prevent `~5 days` inside
- * `~5 days_ago` from matching, and prevent `ETA` substring matches inside
- * a longer token (e.g. `BETAtesting`).
- */
-// Reused fragment for ALL duration-suffix patterns. Requires a digit + unit
-// so 'will take ownership' / 'ship in Docker' (no time component) don't
-// match: verb-only patterns fire on everyday non-estimate queries that share a class-token.
-// Accepts `<N> unit` (3 days), `a/an unit` (a week — implicit 1), and
-// `one unit` so natural English forward-claims aren't lost.
+/** Forward-claim detector: a pure regex set plus token extraction deciding whether a recall query carries a forward-prediction phrase.
+ *  Calibration is HIGH-PRECISION / LOW-RECALL, since cry-wolf noise dominates hint UX; `recall_autodebias_hint_no_class_match` audits are the telemetry. */
+/** Each pattern is deliberately narrow (add one only on audit evidence); word boundaries are mandatory so `ETA` never matches inside `BETAtesting`. */
+// Shared duration suffix: needs a digit + unit (`<N> unit`, `a/an unit`, `one unit`) so 'will take ownership' and 'ship in Docker' do not match.
 const DURATION_TAIL = String.raw `(?:about|around|~|≈)?\s*(?:\d+|a|an|one)\s*(?:day|week|month|hour|hr|min(?:ute)?|sec(?:ond)?)s?\b`;
 const FORWARD_CLAIM_PATTERNS = [
-    // Verb + duration tail. Old pattern `/\b(?:will|should...) take\b/i`
-    // matched `who will take ownership of auth?` because there was no
-    // quantifier requirement. Now requires `<verb> take <N> <unit>`.
+    // Verb + duration tail: requires `<verb> take <N> <unit>`, because a bare `will take` matched `who will take ownership of auth?`.
     new RegExp(String.raw `\b(?:will|should|gonna|going\s+to)\s+take\s+${DURATION_TAIL}`, 'i'),
-    // Ship + by/in + duration-or-day. Old pattern `/\bship(?:ping)?\s+(?:by|in)\b/i`
-    // matched `how does this ship in Docker?`. Now requires either a
-    // duration tail OR a literal day-of-week reference.
-    new RegExp(String.raw `\bship(?:ping|s)?\s+(?:by|in)\s+(?:(?:about|around)\s+)?(?:next\s+)?(?:${DURATION_TAIL}|(?:monday|tuesday|wednesday|thursday|friday|saturday|sunday))\b`, 'i'),
+    // Ship + by/in + duration-or-day: a bare `ship in` matched `how does this ship in Docker?`, so a duration tail or literal day-of-week is required.
+    new RegExp(String.raw `\bship(?:ping|s)?\s+(?:by|in)\s+(?:(?:about|around)\s+)?(?:next\s+)?` +
+        String.raw `(?:${DURATION_TAIL}|(?:monday|tuesday|wednesday|thursday|friday|saturday|sunday))\b`, 'i'),
     /\bestimate(?:d)?\s+(?:at\s+)?(?:~|≈|about|around)?\s*\d+/i,
     /\b(?:by|in|within)\s+(?:about|around|~)?\s*\d+\s*(?:day|week|month|hour)s?\b/i,
     /\bETA\s*(?:is|:)?\s*\d+/i,
     /\b(?:by|before)\s+next\s+(?:week|month|sprint|monday|tuesday|wednesday|thursday|friday|saturday|sunday)\b/i,
-    // Standalone tilde duration: '~3 days for migration', 'estimate ~3 days'.
-    // Lookbehind asserts start-of-string OR whitespace before the tilde
-    // because \b before ~ requires a word char immediately preceding (~ is
-    // not a word character), so /\b~/ would only match in 'foo~3 days'
-    // (malformed) and silently miss the legitimate cases.
+    // Standalone tilde duration ('~3 days for migration'): the lookbehind asserts start-of-string or whitespace because `\b` before `~` needs a word char
+    // and /\b~/ would only match 'foo~3 days', silently missing the real cases.
     /(?<=^|\s)~\s*\d+\s*(?:day|week|month|hour)s?\b/i,
     // Should + verb + duration tail. Same tightening as the leading 'will
     // take' rule: 'should ship by EOD' must include a quantifier.
-    new RegExp(String.raw `\bshould\s+(?:be|ship|finish|complete|land)\s+(?:by|in|within)\s+(?:(?:about|around)\s+)?(?:next\s+)?(?:${DURATION_TAIL}|(?:monday|tuesday|wednesday|thursday|friday|saturday|sunday))\b`, 'i'),
+    new RegExp(String.raw `\bshould\s+(?:be|ship|finish|complete|land)\s+(?:by|in|within)\s+(?:(?:about|around)\s+)?(?:next\s+)?` +
+        String.raw `(?:${DURATION_TAIL}|(?:monday|tuesday|wednesday|thursday|friday|saturday|sunday))\b`, 'i'),
 ];
-/**
- * Pronouns + function words + modal verbs the regex set already gates on.
- * Dropped before class-resolution so the overlap signal comes from
- * domain tokens ("migration", "auth", "refactor") rather than connectives.
- */
+/** Pronouns, function words and modal verbs the regex set already gates on; dropped before class resolution so overlap comes from domain tokens. */
 const STOP_WORDS = new Set([
     'the', 'a', 'an', 'and', 'or', 'but', 'for', 'to', 'in', 'on', 'at', 'of',
     'by', 'with', 'my', 'your', 'our', 'their', 'its', 'it', 'this', 'that',
     'these', 'those', 'will', 'should', 'can', 'i', 'we', 'they', 'he', 'she',
     'is', 'be', 'was', 'are', 'were', 'has', 'have', 'had', 'do', 'does', 'did',
     'from', 'as', 'so', 'than', 'then',
-    // Verbs that appear inside FORWARD_CLAIM_PATTERNS themselves — they're
-    // signal for the regex gate but NOT signal for class resolution (you
-    // wouldn't name a prediction class "take" or "ship"). Listing here so
-    // they don't pollute the classQueryTokens overlap score.
+    // Verbs inside FORWARD_CLAIM_PATTERNS gate the regex but are no signal for class resolution; listing them keeps them out of the classQueryTokens overlap.
     'take', 'taken', 'takes', 'ship', 'ships', 'finish', 'complete', 'land',
     'eta', 'estimate', 'estimated', 'next', 'about', 'around',
-    // Duration units appear in every forward-claim phrase by design (the
-    // regex set REQUIRES a `<N> <unit>` quantifier after the verb). Letting
-    // them through to class resolution lets a class tag containing 'days'
-    // win or tie on the unit token instead of the domain token.
+    // Every forward-claim phrase contains a duration unit by design; letting it through would let a class tag containing 'days' win or tie on the unit.
     'day', 'days', 'week', 'weeks', 'month', 'months',
     'hour', 'hours', 'hr', 'hrs',
     'min', 'mins', 'minute', 'minutes', 'sec', 'secs', 'second', 'seconds',
 ]);
-/**
- * Detect whether a recall query carries a forward-prediction phrase.
- *
- * @returns first-match phrase + extracted class-resolution tokens when
- *   any pattern matches; null otherwise. Token extraction runs only on a
- *   match — non-forward queries pay zero work beyond the regex gate.
- */
+/** Detect whether a recall query carries a forward-prediction phrase; returns the first-match phrase plus class-resolution tokens, else null.
+ *  Token extraction runs only on a match, so non-forward queries pay nothing beyond the regex gate. */
 export function detectForwardClaim(queryText) {
     if (!queryText)
         return null;
@@ -103,9 +55,7 @@ function extractClassQueryTokens(queryText) {
         .toLowerCase()
         // Strip everything that's not alphanum or whitespace or hyphen / underscore.
         .replace(/[^a-z0-9\s_-]/g, ' ')
-        // Split on whitespace AND hyphen AND underscore so `migration-effort`
-        // produces ['migration', 'effort'] — matching the class-tag split
-        // pattern in resolveClassFromTokens (split on /[-_\s]+/).
+        // Split on whitespace, hyphen and underscore so `migration-effort` yields ['migration', 'effort'], matching the class-tag split in resolveClassFromTokens.
         .split(/[\s_-]+/)
         .filter((t) => t.length >= 3 && !STOP_WORDS.has(t) && !/^\d+$/.test(t));
 }

package/dist/learn/invalidation.d.ts

@@ -20,24 +20,11 @@ export interface InvalidationOptions {
     /** Consider ONLY this memory id (no content/tag matching). */
     onlyId?: string;
 }
-/**
- * Extract what was replaced/removed from a commit message.
- * Returns null if the commit isn't a breaking/migration change.
- */
+/** Extract what was replaced/removed from a commit message.
+ *  Returns null if the commit isn't a breaking/migration change. */
 export declare function extractInvalidationTarget(message: string): InvalidationTarget | null;
-/**
- * Find memories that reference the invalidated pattern and weaken them.
- * - Halves half_life_days
- * - Sets confidence to 'stale'
- * - Adds 'invalidated' tag
- * - Skips pinned memories (reported in skippedPinned)
- *
- * Tag matching is EXACT (2026-06-09 incident): the FULL pattern must equal a
- * tag. Token-level matching applies to content only, so a pattern that merely
- * CONTAINS a common tag word ("hippo") can no longer mass-weaken every memory
- * carrying that tag. Both callers (the CLI `invalidate` command and the
- * auto-learn-from-git path) inherit this contract.
- */
+/** Find memories that reference the invalidated pattern and weaken them (halve half_life_days, confidence 'stale', add 'invalidated' tag; pinned are skipped).
+ *  Tag matching is EXACT: the FULL pattern must equal a tag, so a pattern merely containing a common tag word cannot mass-weaken every memory with that tag. */
 export declare function invalidateMatching(hippoRoot: string, target: InvalidationTarget, tenantId?: string, options?: InvalidationOptions): InvalidationResult;
 /** invalidateMatching for a batch: matches against `live`, the caller's list of the tenant's rows, and keeps it current.
  *  Each match is read again before it is weakened, so a row another writer changed since the list was read is never written back stale. */
@@ -73,6 +60,7 @@ export interface ChurnStaleResult {
     preview: ChurnStalePreviewRow[];
     error?: string;
 }
-/** Flags memories whose named file/symbol/script changed or disappeared since storage (or last confirmation); only adds/removes CHURN_STALE_TAG, never confidence/half-life/strength. */
+/** Flags memories whose named file/symbol/script changed or disappeared since storage (or last
+ * confirmation); only adds/removes CHURN_STALE_TAG, never confidence/half-life/strength. */
 export declare function detectChurnStale(hippoRoot: string, repoRoot: string, opts: DetectChurnStaleOptions): ChurnStaleResult;
 //# sourceMappingURL=invalidation.d.ts.map

package/dist/learn/invalidation.js

@@ -1,13 +1,12 @@
-import { addTagToEntries, writeEntriesSeparately } from '../store/entry-writes.js';
+import { addTagToEntries, writeEntriesTogether } from '../store/entry-writes.js';
 import { confirmedOutcomeTimes } from '../store/audit.js';
-import { chunked, loadAllEntries, loadEntriesByIds } from '../store/entry-reads.js';
+import { loadAllEntries, loadEntriesByIds, loadEntriesMentioning, readEntry } from '../store/entry-reads.js';
+import { chunked } from '../util/chunked.js';
 import { CHURN_STALE_TAG } from '../core/memory.js';
 import { GitReadError, gitLsFilesAtHead, fetchChurnWindowLog, gitGrepPresence, resolveCommitBefore, packageScriptsAt, } from './churn-git.js';
 const HEADLINE_CHARS = 60;
-/**
- * Extract what was replaced/removed from a commit message.
- * Returns null if the commit isn't a breaking/migration change.
- */
+/** Extract what was replaced/removed from a commit message.
+ *  Returns null if the commit isn't a breaking/migration change. */
 export function extractInvalidationTarget(message) {
     // Strip conventional commit prefix (e.g., "feat(scope): ")
     const body = message.replace(/^[a-z]+(\([^)]*\))?:\s*/i, '').trim();
@@ -44,27 +43,16 @@ export function extractInvalidationTarget(message) {
     }
     return null;
 }
-/**
- * Find memories that reference the invalidated pattern and weaken them.
- * - Halves half_life_days
- * - Sets confidence to 'stale'
- * - Adds 'invalidated' tag
- * - Skips pinned memories (reported in skippedPinned)
- *
- * Tag matching is EXACT (2026-06-09 incident): the FULL pattern must equal a
- * tag. Token-level matching applies to content only, so a pattern that merely
- * CONTAINS a common tag word ("hippo") can no longer mass-weaken every memory
- * carrying that tag. Both callers (the CLI `invalidate` command and the
- * auto-learn-from-git path) inherit this contract.
- */
+/** Find memories that reference the invalidated pattern and weaken them (halve half_life_days, confidence 'stale', add 'invalidated' tag; pinned are skipped).
+ *  Tag matching is EXACT: the FULL pattern must equal a tag, so a pattern merely containing a common tag word cannot mass-weaken every memory with that tag. */
 export function invalidateMatching(hippoRoot, target, tenantId, options) {
-    // L9: tenantId opt-in. When provided, only this tenant's memories are
-    // considered for weakening. When undefined, behaves as it did pre-1.12.1
-    // (host-wide invalidation across all tenants in the store).
-    // options.onlyId resolves by FILTERING this tenant-scoped list — never a
-    // direct id lookup — so an id from another tenant is invisible here.
-    const { result, weakened } = weakenMatches(loadAllEntries(hippoRoot, tenantId), target, options);
-    writeEntriesSeparately(hippoRoot, weakened);
+    // tenantId opt-in: when set, only that tenant's memories are weakened; undefined is host-wide.
+    // The onlyId read is tenant-scoped too, so another tenant's id is invisible here.
+    const entries = options?.onlyId === undefined
+        ? loadEntriesMentioning(hippoRoot, invalidationTokenize(target.from), target.from.toLowerCase().trim(), tenantId)
+        : [readEntry(hippoRoot, options.onlyId, tenantId)].filter((entry) => entry !== null);
+    const { result, weakened } = weakenMatches(entries, target, options);
+    writeEntriesTogether(hippoRoot, weakened);
     return result;
 }
 /** invalidateMatching for a batch: matches against `live`, the caller's list of the tenant's rows, and keeps it current.
@@ -75,7 +63,7 @@ export function invalidateMatchingAmong(hippoRoot, live, target, tenantId) {
     // loadEntriesByIds reads at most 500 ids a call.
     const fresh = new Map(chunked(ids, 500).flatMap((chunk) => loadEntriesByIds(hippoRoot, chunk, tenantId)).map((entry) => [entry.id, entry]));
     const { result, weakened } = weakenMatches(ids.flatMap((id) => fresh.get(id) ?? []), target);
-    writeEntriesSeparately(hippoRoot, weakened);
+    writeEntriesTogether(hippoRoot, weakened);
     const byId = new Map(weakened.map((entry) => [entry.id, entry]));
     for (let i = 0; i < live.length; i++)
         live[i] = byId.get(live[i].id) ?? live[i];
@@ -381,7 +369,8 @@ function recordChurnEvidence(git, candidates, anchorOf, result) {
     }
     return toTag;
 }
-/** Flags memories whose named file/symbol/script changed or disappeared since storage (or last confirmation); only adds/removes CHURN_STALE_TAG, never confidence/half-life/strength. */
+/** Flags memories whose named file/symbol/script changed or disappeared since storage (or last
+ * confirmation); only adds/removes CHURN_STALE_TAG, never confidence/half-life/strength. */
 export function detectChurnStale(hippoRoot, repoRoot, opts) {
     const dryRun = opts.dryRun === true;
     if (!opts.projectName)
@@ -408,9 +397,7 @@ export function detectChurnStale(hippoRoot, repoRoot, opts) {
     const result = { checked: 0, marked: 0, alreadyMarked: 0, skippedPinned, dryRun, preview: [] };
     try {
         const git = loadChurnGitView(repoRoot, opts.legacyName ?? opts.projectName, candidates, anchorOf, needs);
-        // Collected here, written only after every candidate's evidence is
-        // computed: a GitReadError thrown mid-loop must never leave an earlier
-        // candidate tagged while a later one aborts the run untagged.
+        // Collected here and written only after every candidate's evidence is computed, so a GitReadError mid-loop cannot leave an earlier candidate tagged.
         const toTag = recordChurnEvidence(git, candidates, anchorOf, result);
         if (!dryRun && toTag.length > 0)
             tagChurnStale(hippoRoot, opts.tenantId, toTag, confirmedAt);

package/dist/mcp/admin-tools.d.ts

@@ -1,8 +1,8 @@
 import { type ToolCall } from './protocol.js';
 export declare function runPredictBaserateTool({ args, ctx, hippoRoot, tenantId }: ToolCall): Promise<string>;
-export declare function runStatusTool({ hippoRoot, config, tenantId }: ToolCall): string;
+export declare function runStatusTool({ ctx, hippoRoot, config, tenantId }: ToolCall): string;
 export declare function runConflictsTool(call: ToolCall): string;
 export declare function runResolveTool({ args, ctx, hippoRoot, tenantId }: ToolCall): string;
-export declare function runShareTool({ args, ctx, hippoRoot, tenantId }: ToolCall): string;
+export declare function runShareTool({ args, ctx, hippoRoot, tenantId }: ToolCall): Promise<string>;
 export declare function runPeersTool({ tenantId }: ToolCall): string;
 //# sourceMappingURL=admin-tools.d.ts.map