hippo-memory 1.71.0 → 1.72.0

package/dist/mcp/recall-tools.js

@@ -2,7 +2,7 @@
 import * as path from 'path';
 import { fitBudget } from '../search/finalize.js';
 import { dropHeldCopies, duplicateKey, storedTextKeys } from '../util/same-text.js';
-import { retrieve as apiRetrieve, drillDown as apiDrillDown, assemble as apiAssemble, getContext as apiGetContext } from '../api/index.js';
+import { retrieve as apiRetrieve, drillDown as apiDrillDown, assemble as apiAssemble, getContext as apiGetContext, } from '../api/index.js';
 import { autoDetectContext } from '../api/context-auto.js';
 import { resolveProjectIdentity } from '../core/project-identity.js';
 import { isSharedStore } from '../core/config.js';
@@ -10,12 +10,14 @@ import { detectAnchoring, hashQueryText, biasHintEnabled, snapshotRing } from '.
 import { detectAvailabilityBias } from '../api/availability.js';
 import { estimateTokens } from '../util/token-text.js';
 import { assembleCost, assembleText, drillCost, drillText } from '../api/context-render.js';
-import { mcpActor } from './protocol.js';
+import { mcpActor, ownsServerCwd } from './protocol.js';
 import { lastRecalledIds, resolveClientKey } from './session-state.js';
 import { formatContinuityBlock, formatMemories, memoryCost, memoriesReserve, snapshotPiece, handoffPiece, trailPiece, contextCost, tailSection, planningSection, } from './format.js';
 import { isJsonString } from '../util/json.js';
 import { parseContextRequest, parseRecallRequest, toolParams } from '../api/recall-request.js';
 import { noteRecall, sessionRing, shownRecallRows } from '../api/recall-record.js';
+// Candidate pool the MCP recall ranks before the token budget trims what is shown.
+const MCP_RECALL_LIMIT = 50;
 function detectBiasHints(list, pool, anchorRing, queryHash) {
     const anchoring = anchorRing ? detectAnchoring(snapshotRing(anchorRing), queryHash, list[0]?.entry.id ?? null) : null;
     const availability = biasHintEnabled('availability')
@@ -126,7 +128,7 @@ export async function runRecallTool(call) {
     // RecallContractError throws reach the MCP caller raw, as mcp-recall-fresh-tail-policy.test.ts pins.
     await apiRetrieve(apiCtx, {
         ...recallOpts,
-        limit: 50,
+        limit: MCP_RECALL_LIMIT,
         mode: config.physics?.enabled !== false ? 'physics' : 'hybrid',
         // The hint is computed below over the list MCP shows; the window band's copy would emit its audit row twice.
         suppressAvailabilityHint: true,
@@ -211,10 +213,10 @@ export async function runDrillTool({ args, ctx, hippoRoot, tenantId }) {
     }
     return drillText(r);
 }
-// The served store names the project (an HTTP daemon runs from anywhere); the global root names none, so stdio falls back to its launch cwd.
-function localProject(hippoRoot) {
+// The served store names the project (an HTTP daemon runs from anywhere); the global root names none, so only an owner of the server cwd falls back to it.
+function localProject(hippoRoot, ownsCwd) {
     const storeProject = resolveProjectIdentity(path.dirname(path.resolve(hippoRoot)));
-    return storeProject.name !== '' ? storeProject : resolveProjectIdentity(process.cwd());
+    return storeProject.name !== '' || !ownsCwd ? storeProject : resolveProjectIdentity(process.cwd());
 }
 export async function runContextTool({ args, ctx, hippoRoot, config, tenantId }) {
     // Stdio names no project, and the store's folder or the launch cwd is no caller's; HTTP sends X-Hippo-Project.
@@ -226,12 +228,13 @@ export async function runContextTool({ args, ctx, hippoRoot, config, tenantId })
         return '';
     if (budget < memoriesReserve(budget))
         return ''; // not even the heading fits, so nothing prints, as at budget 0
+    const ownsCwd = ownsServerCwd(ctx);
     const result = await apiGetContext({ hippoRoot, tenantId, actor: mcpActor(ctx), store: ctx?.store }, {
-        // The server's git state is no caller's, so a shared-store caller gets its project's rows without a query.
-        q: ctx?.project ? undefined : autoDetectContext(),
+        // The server's git state is no remote caller's, so a project or remote caller gets rows by strength without a query.
+        q: ctx?.project || !ownsCwd ? undefined : autoDetectContext(),
         budget,
         exactScope,
-        currentProject: ctx?.project ?? localProject(hippoRoot),
+        currentProject: ctx?.project ?? localProject(hippoRoot, ownsCwd),
         cost: contextCost,
     });
     lastRecalledIds.set(resolveClientKey(ctx), result.entries.map((r) => r.entry.id));

package/dist/mcp/request.js

@@ -4,7 +4,8 @@ import { STORE_NOT_PORTED_MESSAGE } from '../util/http-util.js';
 import { getGlobalRoot, initGlobal } from '../sharing/global-store.js';
 import { loadConfig } from '../core/config.js';
 import { resolveTenantId } from '../store/tenant.js';
-import { rethrowIfSqliteBlocked, runWithRequestStores } from '../db/index.js';
+import { runWithRequestStores } from '../db/index.js';
+import { rethrowIfSqliteBlocked } from '../util/sqlite-blocked.js';
 import { hasGroup, storeFor } from '../store/index.js';
 import { estimateTokens } from '../util/token-text.js';
 import { PACKAGE_VERSION } from '../util/version.js';

package/dist/mcp/stdio.js

@@ -1,7 +1,8 @@
 // Stdio transport: newline-delimited JSON-RPC frames in on stdin, replies out on stdout.
 import { exitAfterFlush, installCrashHandlers } from '../util/crash-handlers.js';
 import { errorFields, errorMessage, log } from '../util/log.js';
-import { requestDeadlineMs } from '../server/deadline.js';
+import { requestDeadlineMs } from '../util/request-scope.js';
+import { MAX_BODY_BYTES } from '../util/http-util.js';
 import { parseFrame } from './framing.js';
 import { mcpErrorResponse } from './protocol.js';
 import { handleMcpRequest } from './request.js';
@@ -14,7 +15,10 @@ function send(msg) {
     process.stdout.write(JSON.stringify(msg) + '\n');
 }
 // ── Stdio transport ──
-let buffer = Buffer.alloc(0);
+let pending = [];
+let pendingBytes = 0;
+// Set when the pending bytes hold a Content-Length header whose body has not fully arrived.
+let needs;
 // The part of a refused frame still on its way, dropped as it arrives so it is never buffered or read as a new frame.
 let refused = 0;
 function withoutRefused(chunk) {
@@ -69,7 +73,8 @@ function callName(req) {
     const tool = req.params?.name;
     return isJsonString(tool) ? `${req.method} ${tool.slice(0, 128)}` : req.method;
 }
-/** Answers `req` with one timeout error at the deadline a served request has. The returned function stops the timer and says whether that answer went out, so a later reply is dropped. */
+/** Answers `req` with one timeout error at the deadline a served request has. The returned function stops the timer and says whether that
+ * answer went out, so a later reply is dropped. */
 function watchDeadline(req, owedReply) {
     const ms = requestDeadlineMs();
     if (ms === 0)
@@ -122,20 +127,29 @@ function dispatch(body) {
     track(req.method, handleMcpRequest(req).then((resp) => { if (!timedOut() && resp)
         send(resp); }).catch((err) => {
         if (timedOut())
-            log.debug(`mcp: ${callName(req)} failed after its timeout reply: ${errorMessage(err)}`);
+            log.error(`mcp: ${callName(req)} failed after its timeout reply: ${errorMessage(err)}`, errorFields(err));
         else
-            send(mcpErrorResponse(req.id, err));
+            send(mcpErrorResponse(req.id, err, undefined, callName(req)));
     }));
 }
 /** Wires stdin/stdout to the dispatcher; idempotent. Only the entrypoint (cli.ts `hippo mcp`, or this file run directly) should call it, so the HTTP daemon
  * (which imports `handleMcpRequest`) does not steal stdin or exit when its parent closes a pipe. */
 export function startStdioLoop() {
-    process.stdin.on('data', (chunk) => {
-        buffer = Buffer.concat([buffer, withoutRefused(chunk)]);
+    process.stdin.on('data', (raw) => {
+        const chunk = withoutRefused(raw);
+        pending.push(chunk);
+        pendingBytes += chunk.length;
+        // Joining on every chunk would copy the whole pending frame each time; wait until a frame can have ended.
+        if (needs === undefined ? !chunk.includes(0x0a) && pendingBytes <= MAX_BODY_BYTES : pendingBytes < needs)
+            return;
+        let buffer = Buffer.concat(pending, pendingBytes);
+        needs = undefined;
         while (true) {
             const result = parseFrame(buffer);
-            if (result.kind === 'incomplete')
+            if (result.kind === 'incomplete') {
+                needs = result.needs;
                 break;
+            }
             buffer = result.rest;
             if (result.kind === 'oversize') {
                 refused = result.remainder;
@@ -147,6 +161,8 @@ export function startStdioLoop() {
             if (result.kind === 'message')
                 runWithRequestId(randomUUID(), () => dispatch(result.body));
         }
+        pending = buffer.length > 0 ? [buffer] : [];
+        pendingBytes = buffer.length;
     });
     process.stdin.on('end', () => { void exitWhenDrained(); });
     installCrashHandlers('mcp');

package/dist/mcp/tool-args.js

@@ -1,4 +1,5 @@
 // Hand-written for the JSON Schema subset the hippo tool definitions use, so the MCP server needs no validator dependency.
+import { truncateWithEllipsis } from '../util/ellipsize.js';
 const ARG_PREVIEW_CHARS = 40;
 function isArgString(v) {
     return typeof v === 'string';
@@ -24,7 +25,7 @@ function describeValue(v) {
     if (Array.isArray(v))
         return 'array';
     if (isArgString(v))
-        return JSON.stringify(v.length > ARG_PREVIEW_CHARS ? `${v.slice(0, ARG_PREVIEW_CHARS)}...` : v);
+        return JSON.stringify(truncateWithEllipsis(v, ARG_PREVIEW_CHARS));
     if (isArgNumber(v) || isArgBoolean(v))
         return String(v);
     return 'object';

package/dist/mcp/tools.js

@@ -1,18 +1,18 @@
 // Tool definitions and input schemas served by tools/list.
 import { DEFAULT_RECALL_BUDGET } from '../core/search-types.js';
 import { DEFAULT_ASSEMBLE_BUDGET } from '../api/assemble.js';
-import { MAX_ID_LEN } from '../util/http-util.js';
+import { MAX_ID_LEN, MAX_LIST_LIMIT } from '../util/limits.js';
 import { DEFAULT_SEARCH_CANDIDATE_LIMIT } from '../store/rows.js';
 import { DEFAULT_CONFIG } from '../core/config.js';
 // ── Tool definitions ──
 // HTTP sets no budget cap; 25x the recall default leaves room for large-context clients while bounding one call's work.
 const MAX_BUDGET_TOKENS = 25 * DEFAULT_RECALL_BUDGET;
-// Same ceiling as the HTTP list routes' parseListLimit.
-const MAX_LIST_LIMIT = 1000;
 export const TOOLS = [
     {
         name: 'hippo_recall',
-        description: 'Retrieve relevant memories from the project memory store. Returns memories ranked by relevance, strength, and recency within the token budget. Use at session start or when you need context about a topic. Pass include_continuity=true to also surface the active task snapshot, latest matching session handoff, and recent session events as a "## Continuity" appendix.',
+        description: 'Retrieve relevant memories from the project memory store. Returns memories ranked by relevance, strength, and recency within the token budget. Use ' +
+            'at session start or when you need context about a topic. Pass include_continuity=true to also surface the active task snapshot, latest matching ' +
+            'session handoff, and recent session events as a "## Continuity" appendix.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -29,28 +29,37 @@ export const TOOLS = [
                 },
                 scope: {
                     type: 'string',
-                    description: 'Restrict results and continuity to memories/rows matching this scope exactly. When omitted, default-deny applies to ANY <source>:private:* (slack, github, ...) and unknown-legacy rows.',
+                    description: 'Restrict results and continuity to memories/rows matching this scope exactly. When omitted, default-deny applies to ANY ' +
+                        '<source>:private:* (slack, github, ...) and unknown-legacy rows.',
                 },
                 fresh_tail_count: {
                     type: 'number',
-                    description: 'When > 0, surface the last N kind=raw rows tagged isFreshTail=true regardless of query match. Useful for "what did I just see" continuity. Capped at 200.',
+                    description: 'When > 0, surface the last N kind=raw rows tagged isFreshTail=true regardless of query match. Useful for "what did I just see" ' +
+                        'continuity. Capped at 200.',
                 },
                 fresh_tail_session_id: {
                     type: 'string',
-                    description: 'Restrict the fresh-tail window to a specific session. Without this, fresh-tail is tenant-wide (legacy v1.5.2 behaviour, pre-v1.6.3 default).',
+                    description: 'Restrict the fresh-tail window to a specific session. Without this, fresh-tail is tenant-wide (legacy v1.5.2 behaviour, pre-v1.6.3 ' +
+                        'default).',
                 },
                 summarize_overflow: {
                     type: 'boolean',
-                    description: 'When true (default), entries that overflow the limit and share a level-2 parent summary cause that summary to be appended in their place. Set false for strict-limit behaviour.',
+                    description: 'When true (default), entries that overflow the limit and share a level-2 parent summary cause that summary to be appended in their ' +
+                        'place. Set false for strict-limit behaviour.',
                 },
                 scorer_window: {
                     type: 'number',
-                    description: `How many of the top-ranked memories the fresh-tail and summarize-overflow appendix is worked out against. The main list ranks the whole tenant store, so scorer_window does not narrow it. Default ${DEFAULT_SEARCH_CANDIDATE_LIMIT}. Rejected as RecallContractError code=invalid_scorer_window if 0/negative/non-finite/non-numeric.`,
+                    description: `How many of the top-ranked memories the fresh-tail and summarize-overflow appendix is worked out against. ` +
+                        `The main list ranks the whole tenant store, so scorer_window does not narrow it. ` +
+                        `Default ${DEFAULT_SEARCH_CANDIDATE_LIMIT}. ` +
+                        `Rejected as RecallContractError code=invalid_scorer_window if 0/negative/non-finite/non-numeric.`,
                 },
                 session_id: {
                     type: 'string',
                     maxLength: MAX_ID_LEN,
-                    description: `Optional session id (v1.7.4). When set AND (tenant, session) has active goals, applies the dlPFC goal-stack boost to the ranked memories before formatting. Mirrors fresh_tail_session_id shape (${MAX_ID_LEN}-char cap).`,
+                    description: `Optional session id (v1.7.4). When set AND (tenant, session) has active goals, ` +
+                        `applies the dlPFC goal-stack boost to the ranked memories before formatting. ` +
+                        `Mirrors fresh_tail_session_id shape (${MAX_ID_LEN}-char cap).`,
                 },
             },
             required: ['query'],
@@ -58,7 +67,9 @@ export const TOOLS = [
     },
     {
         name: 'hippo_assemble',
-        description: 'Build a chronologically-ordered context window for a session. Returns ordered items: fresh-tail raw rows + level-2 summary substitutions for older rows + budget-fit. Hippo-additive vs lossless-claw: eviction picks lowest-strength non-fresh-tail items first instead of oldest-first. Tenant-scoped; default-deny on private scopes.',
+        description: 'Build a chronologically-ordered context window for a session. Returns ordered items: fresh-tail raw rows + level-2 summary substitutions for older ' +
+            'rows + budget-fit. Hippo-additive vs lossless-claw: eviction picks lowest-strength non-fresh-tail items first instead of oldest-first. ' +
+            'Tenant-scoped; default-deny on private scopes.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -82,7 +93,8 @@ export const TOOLS = [
                 },
                 scope: {
                     type: 'string',
-                    description: 'Restrict to memories whose scope matches exactly. When omitted, default-deny applies to ANY <source>:private:* scope and unknown:legacy rows. Pass an explicit scope to assemble a private session with consent.',
+                    description: 'Restrict to memories whose scope matches exactly. When omitted, default-deny applies to ANY <source>:private:* scope and ' +
+                        'unknown:legacy rows. Pass an explicit scope to assemble a private session with consent.',
                 },
             },
             required: ['session_id'],
@@ -90,7 +102,8 @@ export const TOOLS = [
     },
     {
         name: 'hippo_drill',
-        description: 'Walk one step down the DAG from a level-2+ topic summary to its direct children. Companion to hippo_recall: when recall returns an item with isSummary=true and substitutedFor=[ids], pass the summary id here to recover the original detail. Tenant-scoped; default-deny on private scopes.',
+        description: 'Walk one step down the DAG from a level-2+ topic summary to its direct children. Companion to hippo_recall: when recall returns an item with ' +
+            'isSummary=true and substitutedFor=[ids], pass the summary id here to recover the original detail. Tenant-scoped; default-deny on private scopes.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -114,7 +127,8 @@ export const TOOLS = [
                     type: 'integer',
                     minimum: 1,
                     maximum: 10,
-                    description: 'v0.30 / E5: walk N levels down (default 1 = direct children only). Higher values include children of children. Token budget remains GLOBAL across levels. Hard cap 10.',
+                    description: 'v0.30 / E5: walk N levels down (default 1 = direct children only). Higher values include children of children. Token budget remains ' +
+                        'GLOBAL across levels. Hard cap 10.',
                 },
             },
             required: ['summary_id'],
@@ -122,7 +136,8 @@ export const TOOLS = [
     },
     {
         name: 'hippo_remember',
-        description: 'Store a new memory. Use when you learn something non-obvious, hit an error, or discover a useful pattern. Memories decay over time unless retrieved. Errors get 2x half-life.',
+        description: 'Store a new memory. Use when you learn something non-obvious, hit an error, or discover a useful pattern. Memories decay over time unless retrieved. ' +
+            'Errors get 2x half-life.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -133,14 +148,16 @@ export const TOOLS = [
                 error: { type: 'boolean', description: 'Mark as error memory (doubles half-life)' },
                 pin: { type: 'boolean', description: 'Pin memory (never decays)' },
                 tag: { type: 'string', description: 'Optional tag for categorization' },
-                personal: { type: 'boolean', description: 'Store it as your own private memory: only you can recall it, in every project. Needs a key you minted or a sign-in.' },
+                personal: { type: 'boolean', description: 'Store it as your own private memory: only you can recall it, in every project. Needs a key you minted or ' +
+                        'a sign-in.' },
             },
             required: ['text'],
         },
     },
     {
         name: 'hippo_outcome',
-        description: "Report whether recalled memories were useful. Good outcomes slow a memory's decay and bad ones speed it up, in proportion to its record. Call after completing work.",
+        description: "Report whether recalled memories were useful. Good outcomes slow a memory's decay and bad ones speed it up, in proportion to its record. Call after " +
+            "completing work.",
         inputSchema: {
             type: 'object',
             properties: {
@@ -154,7 +171,9 @@ export const TOOLS = [
     },
     {
         name: 'hippo_context',
-        description: 'Smart context injection: auto-detects current task from git state and returns relevant memories plus the active task snapshot, session handoff and recent session trail (the same bundle as GET /v1/context). Use at the start of any session. Memories and those sections are scope-filtered: a no-scope caller does NOT see ANY <source>:private:* (slack, github, ...) or legacy-quarantine rows.',
+        description: 'Smart context injection: auto-detects current task from git state and returns relevant memories plus the active task snapshot, session handoff and ' +
+            'recent session trail (the same bundle as GET /v1/context). Use at the start of any session. Memories and those sections are scope-filtered: a ' +
+            'no-scope caller does NOT see ANY <source>:private:* (slack, github, ...) or legacy-quarantine rows.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -166,7 +185,8 @@ export const TOOLS = [
                 },
                 scope: {
                     type: 'string',
-                    description: 'Restrict memories, snapshot, handoff and trail to this scope exactly. When omitted, default-deny applies to ANY <source>:private:* (slack, github, ...) and unknown-legacy rows.',
+                    description: 'Restrict memories, snapshot, handoff and trail to this scope exactly. When omitted, default-deny applies to ANY <source>:private:* ' +
+                        '(slack, github, ...) and unknown-legacy rows.',
                 },
             },
         },
@@ -234,13 +254,16 @@ export const TOOLS = [
     },
     {
         name: 'hippo_predict_baserate',
-        description: 'J3 reference-class / planning-fallacy detector. Get base-rate stats for closed predictions in a class. Call this when you make a forward-looking claim (effort estimate, rollout risk, deadline) to anchor on the past track record rather than the inside view. Returns count + mean estimate + mean actual + mean ratio + median ratio + MAE + a human-readable summary. Tenant-scoped.',
+        description: 'J3 reference-class / planning-fallacy detector. Get base-rate stats for closed predictions in a class. Call this when you make a forward-looking ' +
+            'claim (effort estimate, rollout risk, deadline) to anchor on the past track record rather than the inside view. Returns count + mean estimate + ' +
+            'mean actual + mean ratio + median ratio + MAE + a human-readable summary. Tenant-scoped.',
         inputSchema: {
             type: 'object',
             properties: {
                 class_tag: {
                     type: 'string',
-                    description: 'Cohort label, e.g. "migration-effort", "rollout-risk", "deadline-week". Must match the class_tag used when the predictions were created via hippo_predict (or `hippo predict ...`).',
+                    description: 'Cohort label, e.g. "migration-effort", "rollout-risk", "deadline-week". Must match the class_tag used when the predictions were ' +
+                        'created via hippo_predict (or `hippo predict ...`).',
                 },
             },
             required: ['class_tag'],

package/dist/objects/customer-notes.d.ts

@@ -2,8 +2,8 @@
  *  The `customer_notes` table is the source of truth; the memory mirror (memory_id NULLABLE, ON DELETE SET NULL) is for recall. */
 import type { KeysetPosition } from '../util/keyset.js';
 import type { SavableDescriptor } from './descriptor.js';
-import type { CustomerNote, NoteStatus } from '../store/object-types.js';
-export type { CustomerNote, NoteStatus } from '../store/object-types.js';
+import type { CustomerNote, NoteStatus } from '../core/object-types.js';
+export type { CustomerNote, NoteStatus } from '../core/object-types.js';
 export declare const VALID_NOTE_STATES: ReadonlySet<NoteStatus>;
 /** Field caps (untrusted at the HTTP/SDK boundary). note is a body, so a larger cap
  *  than the 4096 short-field convention. */

package/dist/objects/decisions.d.ts

@@ -3,8 +3,8 @@
 import type { MemoryEntry } from '../core/memory.js';
 import type { KeysetPosition } from '../util/keyset.js';
 import type { SavableDescriptor } from './descriptor.js';
-import type { Decision, DecisionStatus } from '../store/object-types.js';
-export type { Decision, DecisionStatus } from '../store/object-types.js';
+import type { Decision, DecisionStatus } from '../core/object-types.js';
+export type { Decision, DecisionStatus } from '../core/object-types.js';
 export declare const VALID_DECISION_STATES: ReadonlySet<DecisionStatus>;
 export interface SaveDecisionOpts {
     decisionText: string;

package/dist/objects/descriptor.d.ts

@@ -1,5 +1,5 @@
 import type { KeysetPosition } from '../util/keyset.js';
-import type { ObjectByKind, ObjectFields, ObjectKind, SavableKind } from '../store/object-types.js';
+import type { ObjectByKind, ObjectFields, ObjectKind, SavableKind } from '../core/object-types.js';
 export interface ObjectDescriptor<K extends ObjectKind> {
     readonly kind: K;
     /** The nouns error text uses: "brief 3 not found", "only active briefs". */

package/dist/objects/incidents.d.ts

@@ -3,9 +3,9 @@
  *  linked_memory_ids must all exist in the SAME tenant or save throws before the insert. */
 import type { KeysetPosition } from '../util/keyset.js';
 import type { ObjectDescriptor } from './descriptor.js';
-import type { Incident, IncidentStatus } from '../store/object-types.js';
+import type { Incident, IncidentStatus } from '../core/object-types.js';
 import { type Objects } from '../store/port.js';
-export type { Incident, IncidentStatus } from '../store/object-types.js';
+export type { Incident, IncidentStatus } from '../core/object-types.js';
 export declare const VALID_INCIDENT_STATES: ReadonlySet<IncidentStatus>;
 export interface SaveIncidentOpts {
     incidentText: string;

package/dist/objects/lifecycle.d.ts

@@ -1,5 +1,5 @@
 import { type MemoryEntry } from '../core/memory.js';
-import type { ObjectByKind, ObjectKind, SavableKind } from '../store/object-types.js';
+import type { ObjectByKind, ObjectKind, SavableKind } from '../core/object-types.js';
 import { type Objects } from '../store/port.js';
 import type { ObjectDescriptor, ObjectListOpts, SavableDescriptor } from './descriptor.js';
 /** Newest first. */

package/dist/objects/lifecycle.js

@@ -1,6 +1,7 @@
 // Save, close, load-by-id and list for every typed object: the checks, the mirror memory and the error text, over the `objects` store group.
 // Each flow is written twice over the same steps: `...At` answers at once on hippo.db for the CLI, and the other awaits a served store's group for the routes.
 // The tenant, the fields and the list status are checked first, so a bad request fails before a store is asked.
+import { DEFAULT_LIST_LIMIT } from '../util/limits.js';
 import { BadRequestError, ConflictError, NotFoundError } from '../core/api-errors.js';
 import { loadConfig } from '../core/config.js';
 import { createMemory, Layer } from '../core/memory.js';
@@ -13,7 +14,7 @@ function listQuery(d, tenantId, opts) {
     if (opts.status && !d.states.has(opts.status)) {
         throw new BadRequestError(`${d.fn.list}: status must be one of ${Array.from(d.states).join('|')}; got ${opts.status}`);
     }
-    return { status: opts.status || undefined, filter: opts.filter || undefined, limit: opts.limit ?? 100, after: opts.after };
+    return { status: opts.status || undefined, filter: opts.filter || undefined, limit: opts.limit ?? DEFAULT_LIST_LIMIT, after: opts.after };
 }
 /** Newest first. */
 export function listObjectsAt(hippoRoot, d, tenantId, opts) {

package/dist/objects/policies.d.ts

@@ -3,9 +3,9 @@
  *  All dates are normalised to ISO-8601 (`toISOString`) at the store boundary so the lexical half-open comparison is sound. */
 import type { KeysetPosition } from '../util/keyset.js';
 import type { SavableDescriptor } from './descriptor.js';
-import type { Policy, PolicyStatus } from '../store/object-types.js';
+import type { Policy, PolicyStatus } from '../core/object-types.js';
 import type { Objects } from '../store/port.js';
-export type { Policy, PolicyStatus } from '../store/object-types.js';
+export type { Policy, PolicyStatus } from '../core/object-types.js';
 export declare const VALID_POLICY_STATES: ReadonlySet<PolicyStatus>;
 export interface SavePolicyOpts {
     policyName: string;

package/dist/objects/policies.js

@@ -1,6 +1,7 @@
 /** Policy object: a rule in force over a valid-time range [valid_from, valid_to), evolving via supersession; `loadPoliciesAsOf` queries it.
  *  Transaction-time travel (what we believed at past system time T) is deferred. Superseding keeps the predecessor's valid-time range.
  *  All dates are normalised to ISO-8601 (`toISOString`) at the store boundary so the lexical half-open comparison is sound. */
+import { DEFAULT_LIST_LIMIT } from '../util/limits.js';
 import { BadRequestError } from '../core/api-errors.js';
 import { assertTenantId } from '../store/tenant.js';
 import { closeObjectAt, listObjectsAt, objectByIdAt, saveObjectAt } from './lifecycle.js';
@@ -97,6 +98,6 @@ function inForceQuery(tenantId, asOfDate, opts) {
     const asOf = /^\d{4}-\d{2}-\d{2}$/.test(asOfDate.trim())
         ? normalizePolicyDate(`${asOfDate.trim()}T23:59:59.999Z`, 'asOfDate')
         : normalizePolicyDate(asOfDate, 'asOfDate');
-    return { asOf, name: opts.name, limit: opts.limit ?? 100 };
+    return { asOf, name: opts.name, limit: opts.limit ?? DEFAULT_LIST_LIMIT };
 }
 //# sourceMappingURL=policies.js.map

package/dist/objects/processes.d.ts

@@ -4,8 +4,8 @@
 import type { KeysetPosition } from '../util/keyset.js';
 import { type JsonValue } from '../util/json.js';
 import type { SavableDescriptor } from './descriptor.js';
-import type { Process, ProcessStatus } from '../store/object-types.js';
-export type { Process, ProcessStatus } from '../store/object-types.js';
+import type { Process, ProcessStatus } from '../core/object-types.js';
+export type { Process, ProcessStatus } from '../core/object-types.js';
 export declare const VALID_PROCESS_STATES: ReadonlySet<ProcessStatus>;
 /** DoS / abuse caps on the steps body (untrusted at the HTTP/SDK boundary). */
 export declare const MAX_PROCESS_STEPS = 200;

package/dist/objects/project-briefs.d.ts

@@ -4,9 +4,9 @@
 import type { KeysetPosition } from '../util/keyset.js';
 import type { SavableDescriptor } from './descriptor.js';
 import { type ObjectSaveSite } from './lifecycle.js';
-import type { BriefStatus, ProjectBrief } from '../store/object-types.js';
+import type { BriefStatus, ProjectBrief } from '../core/object-types.js';
 import type { Objects } from '../store/port.js';
-export type { BriefStatus, ProjectBrief } from '../store/object-types.js';
+export type { BriefStatus, ProjectBrief } from '../core/object-types.js';
 export declare const VALID_BRIEF_STATES: ReadonlySet<BriefStatus>;
 /** Field caps (untrusted at the HTTP/SDK boundary). summary is a body, so a larger
  *  cap than the 4096 short-field convention. */

package/dist/objects/project-briefs.js

@@ -1,6 +1,7 @@
 /** Project_brief object: the living, repo-scoped `summary` of a repository, evolving via supersession.
  *  `refreshBrief` assembles recent `path:<repo>` receipts with a deterministic (no-LLM) assembler; an LLM pipeline is deferred.
  *  The `project_briefs` table is the source of truth; the memory mirror (memory_id NULLABLE, ON DELETE SET NULL) is for recall. */
+import { truncateWithEllipsis } from '../util/ellipsize.js';
 import { BadRequestError } from '../core/api-errors.js';
 import { assertTenantId } from '../store/tenant.js';
 import { checkText, requireLine } from './fields.js';
@@ -87,9 +88,7 @@ function newestActive(repo) {
 function receiptHeadline(content) {
     const firstLine = (content ?? '').split(/\r?\n/).find((l) => l.trim().length > 0) ?? '';
     const trimmed = firstLine.trim();
-    return trimmed.length > MAX_RECEIPT_HEADLINE_LEN
-        ? `${trimmed.slice(0, MAX_RECEIPT_HEADLINE_LEN)}...`
-        : trimmed;
+    return truncateWithEllipsis(trimmed, MAX_RECEIPT_HEADLINE_LEN);
 }
 /** The tag a memory of the repo carries; the store matches it whole, so `path:hip` never matches `path:hippo`. */
 function receiptTag(normalizedRepo) {

package/dist/objects/skills.d.ts

@@ -3,9 +3,9 @@
  *  `trigger` is stored in `trigger_text` because it is a SQLite reserved keyword. */
 import type { KeysetPosition } from '../util/keyset.js';
 import type { SavableDescriptor } from './descriptor.js';
-import type { Skill, SkillStatus } from '../store/object-types.js';
+import type { Skill, SkillStatus } from '../core/object-types.js';
 import type { Objects } from '../store/port.js';
-export type { Skill, SkillStatus } from '../store/object-types.js';
+export type { Skill, SkillStatus } from '../core/object-types.js';
 export declare const VALID_SKILL_STATES: ReadonlySet<SkillStatus>;
 /** Field caps (untrusted at the HTTP/SDK boundary). instructions is a body, so a
  *  larger cap than the 4096 short-field convention. */

package/dist/postinstall.js

@@ -3,7 +3,7 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import { detectRealCodexPath, isCodexWrapperInstalled, repairCodexWrapperIfInstalled } from './hooks/codex-wrapper.js';
-import { claudeConfigDir } from './hooks/shared.js';
+import { claudeConfigDir } from './util/agent-homes.js';
 import { errorMessage, log } from './util/log.js';
 function main() {
     if (envSkipPostinstall())

package/dist/rerankers/clef.js

@@ -3,7 +3,7 @@ import { buildRelevanceRequest, JEV_DEFAULT_TOP_K, rankByScores } from './jev.js
 import { createOutageWarning } from './outage-warning.js';
 import { rerankerPost, RERANKER_MAX_REPLY_BYTES } from './remote.js';
 import { readCappedJson } from '../util/capped-json.js';
-import { isJsonObject } from '../util/json.js';
+import { isJsonObject, isJsonString } from '../util/json.js';
 import { errorMessage } from '../util/log.js';
 const RAY_ID_MAX_CHARS = 64;
 const CLEF_MODELS = ['clef-flash', 'clef'];
@@ -23,9 +23,6 @@ function isLoopback(hostname) {
 function isNumber(v) {
     return Number.isFinite(v);
 }
-function isString(v) {
-    return v !== undefined && v !== null && v.constructor === String;
-}
 function isRejection(v) {
     return v.constructor === String;
 }
@@ -83,7 +80,7 @@ export function parseClefReply(body, n, model, requireModel) {
     if (!isJsonObject(reply))
         return 'reply has no result object';
     const actual = reply.model;
-    if (actual !== undefined && (!isString(actual) || actual.trim() !== model))
+    if (actual !== undefined && (!isJsonString(actual) || actual.trim() !== model))
         return 'reply names a different model';
     if (actual === undefined && requireModel)
         return 'reply does not name its model';
@@ -105,7 +102,7 @@ export function parseClefReply(body, n, model, requireModel) {
     const usage = isJsonObject(reply.usage) ? reply.usage : {};
     return {
         scores,
-        actualModel: isString(actual) ? actual.trim() : undefined,
+        actualModel: isJsonString(actual) ? actual.trim() : undefined,
         inputTokens: isNumber(usage.input_tokens) ? usage.input_tokens : undefined,
         outputTokens: isNumber(usage.output_tokens) ? usage.output_tokens : undefined,
     };

package/dist/rerankers/cross-encoder.d.ts

@@ -1,4 +1,33 @@
 import type { RerankerFn } from './types.js';
-/** Track 2 reranker: MS-MARCO MiniLM cross-encoder, identity fallback if the model will not load. */
-export declare const crossEncoderReranker: RerankerFn;
+interface Tokenized {
+    readonly input_ids: object;
+    readonly attention_mask: object;
+}
+type TokenizerFn = (text: string, opts: {
+    text_pair: string;
+    padding: boolean;
+    truncation: boolean;
+}) => Promise<Tokenized>;
+type SeqClsModel = (inputs: Tokenized) => Promise<{
+    logits: {
+        data: ArrayLike<number>;
+    };
+}>;
+interface FromPretrained<T> {
+    from_pretrained: (model: string) => Promise<T>;
+}
+interface TransformersExports {
+    AutoTokenizer?: FromPretrained<TokenizerFn>;
+    AutoModelForSequenceClassification?: FromPretrained<SeqClsModel>;
+}
+interface TransformersModuleNamespace extends TransformersExports {
+    default?: TransformersExports;
+}
+type ImportModule = () => Promise<{
+    readonly name: string;
+    readonly mod: TransformersModuleNamespace;
+} | null>;
+/** Track 2 reranker: MS-MARCO MiniLM cross-encoder, identity fallback if the model will not load. Each instance owns its model and outage warning. */
+export declare function createCrossEncoderReranker(importModule?: ImportModule): RerankerFn;
+export {};
 //# sourceMappingURL=cross-encoder.d.ts.map