hippo-memory 1.71.0 → 2.0.0

package/dist/core/memory.js

@@ -2,7 +2,7 @@
 import { DEFAULT_TENANT_ID, envLossAversionRatio } from '../util/env.js';
 import { BadRequestError } from './api-errors.js';
 import { randomUUID } from 'crypto';
-import { isDecayAblated, isOutcomeSlowAblated, isRecallBoostAblated, evalNow, } from './ablation.js';
+import { evalNow, NO_STRENGTH_ABLATION } from './ablation.js';
 import { AGENT_MEMORY_TOOLS, toolSourcePrefix } from './agent-memory-tools.js';
 import { isJsonString } from '../util/json.js';
 import { DAY_MS } from '../util/time.js';
@@ -16,6 +16,7 @@ export var Layer;
     Layer["Semantic"] = "semantic";
     Layer["Trace"] = "trace";
 })(Layer || (Layer = {}));
+export const MEMORY_KINDS = ['raw', 'distilled', 'superseded', 'archived'];
 /** Tag on a memory whose named file/symbol/script changed after it was stored. */
 export const CHURN_STALE_TAG = 'churn-stale';
 // Losses weigh ~2x gains (Lovallo-Kahneman), so negative is 2.0; HIPPO_LOSS_AVERSION_RATIO scales it per process.
@@ -57,9 +58,9 @@ export function applyLossAversionRatio(valence, baseMultiplier) {
     return baseMultiplier * getLossAversionRatio();
 }
 /** 1 + REWARD_SLOPE * (pos - neg) / (pos + neg + 1), in (0.5, 1.5), 1.0 with no outcomes; it scales the effective half-life. */
-export function calculateRewardFactor(entry) {
+export function calculateRewardFactor(entry, ablation = NO_STRENGTH_ABLATION) {
     // EVAL-ONLY ablation (see ablation.ts): the slow outcome channel.
-    if (isOutcomeSlowAblated())
+    if (ablation.outcomeSlow)
         return 1.0;
     const pos = entry.outcome_positive ?? 0;
     const neg = entry.outcome_negative ?? 0;
@@ -75,8 +76,8 @@ export const DECAY_BASE = 0.5;
 export const REWARD_SLOPE = 0.5;
 export const RETRIEVAL_BOOST_SLOPE = 0.1;
 /** Bad outcome marks past good ones, floored at zero; each halves strength and stops recall strengthening, so a correction outranks pinning. */
-export function netWrong(entry) {
-    if (isOutcomeSlowAblated() || isDecayAblated())
+export function netWrong(entry, ablation = NO_STRENGTH_ABLATION) {
+    if (ablation.outcomeSlow || ablation.decay)
         return 0;
     return Math.max(0, (entry.outcome_negative ?? 0) - (entry.outcome_positive ?? 0));
 }
@@ -85,22 +86,23 @@ export function netWrong(entry) {
 export function calculateStrength(entry, 
 // evalNow() is the real clock unless HIPPO_FAKE_NOW is set (eval-only); an explicit `now` wins.
 now = evalNow(), options = {}) {
+    const ablation = options.ablation ?? NO_STRENGTH_ABLATION;
     // Being marked wrong outranks every shield: pinning, error tags, heavy recall.
-    const wrongPenalty = Math.pow(DECAY_BASE, Math.min(netWrong(entry), MAX_WRONG_HALVINGS));
+    const wrongPenalty = Math.pow(DECAY_BASE, Math.min(netWrong(entry, ablation), MAX_WRONG_HALVINGS));
     if (entry.pinned)
         return wrongPenalty;
     // EVAL-ONLY ablation (see ablation.ts): anchor decay at creation so clock resets from earlier unflagged runs cannot leak in.
-    const lastRetrieved = new Date(isRecallBoostAblated() ? entry.created : entry.last_retrieved);
+    const lastRetrieved = new Date(ablation.recallBoost ? entry.created : entry.last_retrieved);
     const daysSince = (now.getTime() - lastRetrieved.getTime()) / DAY_MS;
-    const rewardFactor = calculateRewardFactor(entry);
+    const rewardFactor = calculateRewardFactor(entry, ablation);
     const effectiveHalfLife = entry.half_life_days * rewardFactor;
     // Guard: zero half-life causes 0/0 = NaN in the exponent
     if (effectiveHalfLife <= 0)
         return 0.0;
     const decayExponent = decayExponentFor(options, daysSince, effectiveHalfLife);
     // EVAL-ONLY ablation (see ablation.ts): decay := 1, so the [0,1] clamp below caps the boost at baseline.
-    const decay = isDecayAblated() ? 1.0 : Math.pow(DECAY_BASE, decayExponent);
-    const retrievalBoost = retrievalBoostFor(entry);
+    const decay = ablation.decay ? 1.0 : Math.pow(DECAY_BASE, decayExponent);
+    const retrievalBoost = retrievalBoostFor(entry, ablation);
     const baseMultiplier = EMOTIONAL_MULTIPLIERS[entry.emotional_valence] ?? 1.0;
     const emotionalMultiplier = applyLossAversionRatio(entry.emotional_valence, baseMultiplier);
     const raw = decay * retrievalBoost * emotionalMultiplier;
@@ -127,8 +129,8 @@ function decayExponentFor(options, daysSince, halfLifeDays) {
     return daysSince / effectiveHalfLife;
 }
 // EVAL-ONLY ablation (see ablation.ts) neutralizes the read side too, so counts written before the flag cannot leak in.
-function retrievalBoostFor(entry) {
-    return isRecallBoostAblated() || netWrong(entry) > 0
+function retrievalBoostFor(entry, ablation) {
+    return ablation.recallBoost || netWrong(entry, ablation) > 0
         ? 1.0
         : 1 + RETRIEVAL_BOOST_SLOPE * Math.log2(entry.retrieval_count + 1);
 }
@@ -259,7 +261,7 @@ export function createMemory(content, options = {}) {
         scope: options.scope ?? null,
         owner: options.owner ?? null,
         artifact_ref: options.artifact_ref ?? null,
-        tenantId: options.tenantId ?? DEFAULT_TENANT_ID,
+        tenant_id: options.tenantId ?? DEFAULT_TENANT_ID,
     };
     entry.strength = calculateStrength(entry);
     return entry;
@@ -296,16 +298,26 @@ export function createSuccessor(old, content, opts) {
 /** How well new content fits existing knowledge, 0..1: above 0.7 consolidates faster, below 0.3 is novel and decays faster if unused.
  *  Tags shared with existing memories count by rarity (a rare shared tag fits more), plus content-token overlap. */
 export function computeSchemaFit(content, tags, existingEntries) {
+    return schemaFitFrom(content, tags, schemaFitSourceOf(existingEntries));
+}
+/** What schema fit reads from `entries`, built once for a caller that scores many contents against the same rows. */
+export function schemaFitSourceOf(entries) {
     const tagCounts = new Map();
-    for (const entry of existingEntries) {
+    for (const entry of entries) {
         for (const tag of entry.tags) {
             tagCounts.set(tag, (tagCounts.get(tag) ?? 0) + 1);
         }
     }
-    return schemaFitFrom(content, tags, { rows: existingEntries.length, tagCounts, contents: existingEntries.map((e) => e.content) });
+    return { rows: entries.length, tagCounts, contents: entries.map((e) => e.content) };
 }
+// Tokens of this length or shorter are filler for schema fit.
+const FILLER_TOKEN_MAX_LENGTH = 3;
+// Matching half the tags at average weight scores about 0.5, so the raw overlap ratio is doubled.
+const TAG_OVERLAP_SCALE = 2;
+// Floor on the matches that saturate the content score, so a tiny store cannot saturate it on one hit.
+const CONTENT_ENOUGH_MIN_MATCHES = 5;
 function significantTokens(text) {
-    return new Set(text.toLowerCase().replace(/[^\w\s]/g, ' ').split(/\s+/).filter((t) => t.length > 3));
+    return new Set(text.toLowerCase().replace(/[^\w\s]/g, ' ').split(/\s+/).filter((t) => t.length > FILLER_TOKEN_MAX_LENGTH));
 }
 /** computeSchemaFit against `source`, for a caller that holds counts and texts but no rows. */
 export function schemaFitFrom(content, tags, source) {
@@ -325,13 +337,12 @@ export function schemaFitFrom(content, tags, source) {
             weightedOverlap += Math.log(N / freq) + 1;
         totalWeight += maxIdf;
     }
-    // Scaled so that matching half the tags at average weight gives about 0.5.
-    const tagScore = totalWeight > 0 ? Math.min(1, (weightedOverlap / totalWeight) * 2) : 0;
+    const tagScore = totalWeight > 0 ? Math.min(1, (weightedOverlap / totalWeight) * TAG_OVERLAP_SCALE) : 0;
     const newTokens = significantTokens(content);
     if (newTokens.size === 0)
         return Math.min(1, Math.max(0, tagScore));
     // The content score is capped at 1, which this many matching memories reach.
-    const enough = Math.max(5, N * CONTENT_ENOUGH_FRACTION);
+    const enough = Math.max(CONTENT_ENOUGH_MIN_MATCHES, N * CONTENT_ENOUGH_FRACTION);
     let contentMatches = 0;
     for (const text of source.contents) {
         const entryTokens = significantTokens(text);
@@ -358,13 +369,14 @@ function inferValence(tags) {
 }
 /** Returns copies with the retrieval count, clock and half-life updated; the caller persists them.
  *  Under HIPPO_ABLATE_RECALL_BOOST (eval-only) the entries come back unchanged, not empty, since callers derive last_retrieval_ids from them. */
-export function markRetrieved(entries, now = evalNow()) {
-    if (isRecallBoostAblated())
+export function markRetrieved(entries, now = evalNow(), options = {}) {
+    const ablation = options.ablation ?? NO_STRENGTH_ABLATION;
+    if (ablation.recallBoost)
         return entries;
     return entries.map((e) => {
         if (e.superseded_by)
             return e;
-        const wrong = netWrong(e) > 0;
+        const wrong = netWrong(e, ablation) > 0;
         // Confidence stays untouched: it is an epistemic tier, not a recency signal.
         const updated = {
             ...e,
@@ -373,7 +385,7 @@ export function markRetrieved(entries, now = evalNow()) {
             last_retrieved: wrong ? e.last_retrieved : now.toISOString(),
             half_life_days: wrong ? e.half_life_days : e.half_life_days + RETRIEVAL_HALF_LIFE_GAIN_DAYS,
         };
-        updated.strength = calculateStrength(updated, now);
+        updated.strength = calculateStrength(updated, now, { ablation });
         return updated;
     });
 }

package/dist/{consolidate → core}/merged-row.d.ts

@@ -1,4 +1,4 @@
-import { type MemoryEntry } from '../core/memory.js';
+import { type MemoryEntry } from './memory.js';
 /** The row that replaces a merged row once its retired texts leave: undefined when it holds none, null when nothing else is left. */
 export declare function mergedSuccessor(row: MemoryEntry, retired: (text: string) => boolean, retiredIds: ReadonlySet<string>): MemoryEntry | null | undefined;
 /** Sleep's check on a merged row: drops texts whose source was superseded since the merge, or that a rejection now covers. */

package/dist/{consolidate → core}/merged-row.js

@@ -1,7 +1,7 @@
 // A sleep-merged row copies its sources' texts, so retiring a text (reject, or superseding its source) must reach the row too.
 // SHORTCUT: reject rewrites merged rows at once, live and dormant; supersede and `resolve
 // --reject-loser` wait for the next sleep's check, which sees a dormant row only once restored.
-import { generateId } from '../core/memory.js';
+import { generateId } from './memory.js';
 import { duplicateKey, heldTexts, mergedText } from '../util/same-text.js';
 /** The row that replaces a merged row once its retired texts leave: undefined when it holds none, null when nothing else is left. */
 export function mergedSuccessor(row, retired, retiredIds) {

package/dist/core/physics.d.ts

@@ -1,7 +1,7 @@
 /** Memory-as-Physics engine: pure math (forces, Velocity Verlet integration, physics-based scoring, cluster amplification), no I/O.
  * Memories are particles on the unit hypersphere in embedding space (384-dim); query gravity, attraction, conflict repulsion and drag act on them,
  * and nearby high-scoring memories amplify each other. */
-import { type EmotionalValence } from './memory.js';
+import { type EmotionalValence, type MemoryEntry } from './memory.js';
 import type { PhysicsConfig } from './physics-config.js';
 export interface PhysicsParticle {
     memoryId: string;
@@ -71,4 +71,6 @@ export declare function physicsScore(particles: PhysicsParticle[], queryEmbeddin
 tieKeyOf?: (memoryId: string) => string): ScoredPhysicsResult[];
 /** Nudges a particle toward (good outcome) or away from (bad outcome) the query embedding; new memories respond more (temperature). Mutates in place. */
 export declare function applyOutcomeFeedback(particle: PhysicsParticle, queryEmbedding: number[], good: boolean, feedbackAlpha: number): void;
+/** Initialize physics state for a memory from its embedding vector; returns the new particle without persisting (the caller must save). */
+export declare function initializeParticle(entry: MemoryEntry, embedding: number[], now?: Date): PhysicsParticle;
 //# sourceMappingURL=physics.d.ts.map

package/dist/core/physics.js

@@ -1,8 +1,10 @@
 /** Memory-as-Physics engine: pure math (forces, Velocity Verlet integration, physics-based scoring, cluster amplification), no I/O.
  * Memories are particles on the unit hypersphere in embedding space (384-dim); query gravity, attraction, conflict repulsion and drag act on them,
  * and nearby high-scoring memories amplify each other. */
-import { isRecallBoostAblated } from './ablation.js';
-import { FALLBACK_HALF_LIFE_DAYS } from './memory.js';
+import { cosineOf } from './cosine.js';
+import { evalNow, isRecallBoostAblated, strengthAblation } from './ablation.js';
+import { calculateStrength, FALLBACK_HALF_LIFE_DAYS } from './memory.js';
+import { DAY_MS } from '../util/time.js';
 import { comparePhysicsResultsBy } from './compare.js';
 export function vecDot(a, b) {
     let sum = 0;
@@ -48,17 +50,6 @@ export function vecClampMagnitude(v, maxMag) {
         return v;
     return vecScale(v, maxMag / mag);
 }
-/** Cosine similarity between two vectors. */
-function cosine(a, b) {
-    if (a.length === 0 || b.length === 0 || a.length !== b.length)
-        return 0;
-    const dot = vecDot(a, b);
-    const na = vecNorm(a);
-    const nb = vecNorm(b);
-    if (na < 1e-10 || nb < 1e-10)
-        return 0;
-    return Math.min(1, Math.max(-1, dot / (na * nb)));
-}
 const CHARGE_MAP = {
     neutral: 0,
     positive: 0.3,
@@ -79,7 +70,7 @@ export function computeTemperature(ageDays, temperatureDecay) {
 }
 /** Query gravity (retrieval-time, virtual: does not move the particle): scalar ranking magnitude F = G_Q * mass * max(0, cosine(pos, query))^2. */
 export function queryGravityMagnitude(particle, queryEmbedding, G_query) {
-    const cos = cosine(particle.position, queryEmbedding);
+    const cos = cosineOf(particle.position, queryEmbedding);
     return G_query * particle.mass * Math.pow(Math.max(0, cos), 2);
 }
 /** Momentum bonus in [0, 1]: how aligned the particle's velocity is with the query direction. */
@@ -96,7 +87,7 @@ export function velocityAlignmentBonus(particle, queryEmbedding) {
 /** Attraction force on particle i from j (consolidation-time): G_M m_i m_j max(0, cosine)^3, directed along (pos_j - pos_i) projected tangent to the unit
  * sphere at pos_i (positions are re-normalized to the sphere after integration). Adds into `out` (a fresh zero vector by default) using `diff` as scratch. */
 export function attractionForce(pi, pj, G_memory, out = vecZero(pi.position.length), diff = vecZero(pi.position.length)) {
-    const cos = cosine(pi.position, pj.position);
+    const cos = cosineOf(pi.position, pj.position);
     if (cos <= 0)
         return out;
     const magnitude = G_memory * pi.mass * pj.mass * Math.pow(cos, 3);
@@ -113,7 +104,7 @@ export function attractionForce(pi, pj, G_memory, out = vecZero(pi.position.leng
 }
 /** Conflict repulsion on i away from j (consolidation-time): K_R * m_i * m_j / max(0.01, cosine_distance)^2, where cosine_distance = 1 - cosine_similarity. */
 export function repulsionForce(pi, pj, K_repulsion) {
-    const cos = cosine(pi.position, pj.position);
+    const cos = cosineOf(pi.position, pj.position);
     const dist = Math.max(0.01, 1 - cos);
     const magnitude = K_repulsion * pi.mass * pj.mass / (dist * dist);
     // Direction: away from j
@@ -237,7 +228,7 @@ export function computeSystemEnergy(particles, G_memory) {
     }
     for (let i = 0; i < particles.length; i++) {
         for (let j = i + 1; j < particles.length; j++) {
-            const cos = cosine(particles[i].position, particles[j].position);
+            const cos = cosineOf(particles[i].position, particles[j].position);
             potential -= G_memory * particles[i].mass * particles[j].mass * Math.max(0, cos);
         }
     }
@@ -292,7 +283,7 @@ function applyClusterAmplification(results, particles, config) {
             const pj = particleMap.get(top[j].memoryId);
             if (!pj)
                 continue;
-            const proximity = cosine(pi.position, pj.position);
+            const proximity = cosineOf(pi.position, pj.position);
             if (proximity > config.cluster_threshold) {
                 clusterSignal += top[j].baseScore * proximity;
             }
@@ -311,4 +302,18 @@ export function applyOutcomeFeedback(particle, queryEmbedding, good, feedbackAlp
     const nudge = vecScale(direction, sign * feedbackAlpha * particle.temperature);
     particle.position = vecNormalize(vecAdd(particle.position, nudge));
 }
+/** Initialize physics state for a memory from its embedding vector; returns the new particle without persisting (the caller must save). */
+export function initializeParticle(entry, embedding, now = evalNow()) {
+    const strength = calculateStrength(entry, now, { ablation: strengthAblation() });
+    const ageDays = (now.getTime() - new Date(entry.created).getTime()) / DAY_MS;
+    return {
+        memoryId: entry.id,
+        position: [...embedding], // copy: position will diverge from original embedding
+        velocity: vecZero(embedding.length),
+        mass: computeMass(strength, entry.retrieval_count),
+        charge: computeCharge(entry.emotional_valence),
+        temperature: computeTemperature(ageDays, 1.0),
+        lastSimulation: now.toISOString(),
+    };
+}
 //# sourceMappingURL=physics.js.map

package/dist/core/prediction.d.ts

@@ -0,0 +1,3 @@
+export type ClosureState = 'open' | 'closed' | 'closed-unknown';
+export declare const VALID_CLOSURE_STATES: ReadonlySet<ClosureState>;
+//# sourceMappingURL=prediction.d.ts.map

package/dist/core/prediction.js

@@ -0,0 +1,6 @@
+export const VALID_CLOSURE_STATES = new Set([
+    'open',
+    'closed',
+    'closed-unknown',
+]);
+//# sourceMappingURL=prediction.js.map

package/dist/core/project-identity.d.ts

@@ -27,6 +27,9 @@ export declare function resolveProjectIdentity(cwd?: string, opts?: ResolveProje
 /** Nearest ancestor `.hippo` below home and the temp root (never projects; on Windows the temp root sits inside home).
  *  Everything is realpath'd so a symlinked temp root or cwd still matches its bound. */
 export declare function findHippoStoreDir(cwd?: string, opts?: ResolveProjectIdentityOpts): string | null;
+/** Nearest ancestor store like git; the strict join is the fallback so `hippo init` still creates `<cwd>/.hippo`. */
+export declare function getHippoRoot(cwd?: string, opts?: ResolveProjectIdentityOpts): string;
+export declare function isInitialized(hippoRoot: string): boolean;
 /** A reader's project: a bare name, or an identity whose own rows may also carry its legacy folder name. */
 export type ProjectRef = string | Pick<ProjectIdentity, 'name' | 'legacyName' | 'aliases'>;
 /** The id a reader's new rows are stamped with; '' outside a project. */

package/dist/core/project-identity.js

@@ -4,10 +4,11 @@ import * as os from 'os';
 import * as path from 'path';
 import { BadRequestError } from './api-errors.js';
 import { isSharedStore, loadConfig } from './config.js';
-import { MAX_ID_LEN } from '../util/http-util.js';
+import { MAX_ID_LEN } from '../util/limits.js';
 import { errorMessage, log } from '../util/log.js';
 import { originRemoteId, projectFileId } from './project-remote.js';
 import { realpathOrResolve } from '../util/real-path.js';
+import { placeholders } from '../util/sql.js';
 const MAX_WALK_DEPTH = 64;
 const identityCache = new Map();
 let remoteSwitch = null;
@@ -154,6 +155,15 @@ export function findHippoStoreDir(cwd, opts) {
     const { hippoRoot } = walkProjectMarkers(start, home, stops);
     return hippoRoot === null ? null : path.join(hippoRoot, '.hippo');
 }
+/** Nearest ancestor store like git; the strict join is the fallback so `hippo init` still creates `<cwd>/.hippo`. */
+export function getHippoRoot(cwd = process.cwd(), opts) {
+    return findHippoStoreDir(cwd, opts) ?? path.join(realpathOrResolve(cwd), '.hippo');
+}
+export function isInitialized(hippoRoot) {
+    // autoInstallHooks / setupDailySchedule can create a bare .hippo with no hippo.db; counting
+    // that as initialized makes `hippo init` skip initStore, so only hippo.db counts.
+    return fs.existsSync(path.join(hippoRoot, 'hippo.db'));
+}
 function isBareName(project) {
     return typeof project === 'string';
 }
@@ -187,7 +197,7 @@ export function assertCallerProject(project) {
 }
 /** `origin_project IN (?, ...)` with one placeholder per name; an empty list matches nothing. */
 export function originInSql(names, column = 'origin_project') {
-    return names.length === 0 ? '0' : `${column} IN (${names.map(() => '?').join(', ')})`;
+    return names.length === 0 ? '0' : `${column} IN (${placeholders(names.length)})`;
 }
 /** Classifies a memory's origin_project against the active project. An empty current id (home or markerless cwd) puts everything in scope;
  * NULL/undefined origin (legacy row, or a shared-store write naming none) counts as cross-project: deny by default for a security partition. */

package/dist/{store → core}/recall-scope.d.ts

@@ -1,6 +1,6 @@
 /** Recall-side scope predicates, in a leaf module so search-both.ts can apply the same default-deny rule to searchBothHybrid's candidate loads without an
  * import cycle. src/api/index.ts imports these and re-exports them for back-compat (`api.isPrivateScope`, tests importing `passesScopeFilterForRecall`). */
-import { ForbiddenError } from '../core/api-errors.js';
+import { ForbiddenError } from './api-errors.js';
 /** Literal scopes excluded from recall by default-deny when the caller passes no `scope`; read by the SQL clause in `loadSearchRows` and by
  * `passesScopeFilterForRecall`. Invariant: never empty, or quarantine scopes would pass both paths silently (the module-load assertion below pins this). */
 export declare const RECALL_DEFAULT_DENY_SCOPES: readonly ["unknown:legacy"];
@@ -31,15 +31,6 @@ export declare function ownScopeTouches(ownScope: string | null, scope: string |
 /** JS half of the recall default-deny rule (SQL half: `loadSearchRows`). A non-empty `requested` needs an exact match;
  * otherwise `<source>:private:*` and `RECALL_DEFAULT_DENY_SCOPES` buckets are denied, while null, public scopes and the caller's `ownScope` pass. */
 export declare function passesScopeFilterForRecall(scope: string | null, requested: string | undefined, ownScope?: string | null): boolean;
-export interface SqlFragment {
-    sql: string;
-    params: string[];
-}
-/** SQL twin of the no-request arm of passesScopeFilterForRecall; `ownScope` is bound and compared with `=`, so `%` or `_` in an owner match nothing extra. */
-export declare function scopeAdmitSql(col: '' | 'm.', ownScope?: string | null): SqlFragment;
-/** SQL twin of canTouchScope, which is also canReadScope for an admin: every row but
- * another person's personal one. LIKE folds ASCII case as isPersonalScope's /i does. */
-export declare function touchableScopeSql(col: '' | 'm.', ownScope?: string | null): SqlFragment;
 /** CLI `--scope` variant: an explicit `--scope X` UNLOCKS scope X on top of the default-admitted set rather than narrowing to X (api.recall keeps 'exact').
  * Includes private/quarantine scopes (owner access); a named personal scope never unlocks: the CLI has no caller identity. */
 export declare function passesCliRecallScopeFilter(scope: string | null, requested: string | undefined): boolean;

package/dist/{store → core}/recall-scope.js

@@ -1,7 +1,7 @@
 /** Recall-side scope predicates, in a leaf module so search-both.ts can apply the same default-deny rule to searchBothHybrid's candidate loads without an
  * import cycle. src/api/index.ts imports these and re-exports them for back-compat (`api.isPrivateScope`, tests importing `passesScopeFilterForRecall`). */
-import { BadRequestError, ForbiddenError } from '../core/api-errors.js';
-import { MAX_ID_LEN } from '../util/http-util.js';
+import { BadRequestError, ForbiddenError } from './api-errors.js';
+import { MAX_ID_LEN } from '../util/limits.js';
 /** Literal scopes excluded from recall by default-deny when the caller passes no `scope`; read by the SQL clause in `loadSearchRows` and by
  * `passesScopeFilterForRecall`. Invariant: never empty, or quarantine scopes would pass both paths silently (the module-load assertion below pins this). */
 export const RECALL_DEFAULT_DENY_SCOPES = ['unknown:legacy'];
@@ -63,23 +63,6 @@ export function passesScopeFilterForRecall(scope, requested, ownScope) {
     }
     return !isRestrictedScope(scope) || (ownScope != null && scope === ownScope);
 }
-/** SQL twin of the no-request arm of passesScopeFilterForRecall; `ownScope` is bound and compared with `=`, so `%` or `_` in an owner match nothing extra. */
-export function scopeAdmitSql(col, ownScope) {
-    const placeholders = RECALL_DEFAULT_DENY_SCOPES.map(() => '?').join(', ');
-    const admitted = `${col}scope IS NULL OR (${col}scope NOT IN (${placeholders}) AND ${col}scope NOT LIKE '%:private:%')`;
-    if (ownScope == null)
-        return { sql: `(${admitted})`, params: [...RECALL_DEFAULT_DENY_SCOPES] };
-    // The own arm sits inside the outer parentheses so a caller's `AND ${sql}` cannot split it off.
-    return { sql: `(${admitted} OR ${col}scope = ?)`, params: [...RECALL_DEFAULT_DENY_SCOPES, ownScope] };
-}
-/** SQL twin of canTouchScope, which is also canReadScope for an admin: every row but
- * another person's personal one. LIKE folds ASCII case as isPersonalScope's /i does. */
-export function touchableScopeSql(col, ownScope) {
-    const notPersonal = `${col}scope IS NULL OR ${col}scope NOT LIKE '${PERSONAL_SCOPE_PREFIX}%'`;
-    if (ownScope == null)
-        return { sql: `(${notPersonal})`, params: [] };
-    return { sql: `(${notPersonal} OR ${col}scope = ?)`, params: [ownScope] };
-}
 /** CLI `--scope` variant: an explicit `--scope X` UNLOCKS scope X on top of the default-admitted set rather than narrowing to X (api.recall keeps 'exact').
  * Includes private/quarantine scopes (owner access); a named personal scope never unlocks: the CLI has no caller identity. */
 export function passesCliRecallScopeFilter(scope, requested) {

package/dist/core/search-types.d.ts

@@ -63,7 +63,7 @@ export interface ScoreBreakdown {
     scopeBoost: number;
     /** Extra multiplier applied post-hybrid (e.g. 1.2x for local hits in a local+global merge); 1.0 otherwise. */
     sourceBump: number;
-    /** Immediate outcome nudge, 1 + 0.15*tanh(pos - neg) clipped to [0.85, 1.15]; separate from the slow strength path. */
+    /** Immediate outcome nudge, 1 + 0.15*tanh((pos - neg) / 2) clipped to [0.85, 1.15]; separate from the slow strength path. */
     outcomeBoost: number;
     /** CHURN_STALE_RANK_MULTIPLIER if tagged 'churn-stale', else 1.0. */
     churnStaleMultiplier: number;

package/dist/dashboard/dashboard-actions.d.ts

@@ -12,9 +12,9 @@ export interface ActionResult {
 /** Sets `pinned`; the audit row says `remember` with actor `dashboard`, the same op the old star toggle wrote. */
 export declare function pinMemory(hippoRoot: string, tenantId: string, rawId: string, body: ActionBody): ActionResult;
 /** Marks a memory wrong, the same signal as `hippo outcome --bad`. */
-export declare function markWrong(hippoRoot: string, tenantId: string, rawId: string): ActionResult;
+export declare function markWrong(hippoRoot: string, tenantId: string, rawId: string): Promise<ActionResult>;
 /** Deletes a memory like `hippo forget`; a raw receipt is append-only and answers 409 with the archive hint. */
-export declare function forgetMemory(hippoRoot: string, tenantId: string, rawId: string): ActionResult;
+export declare function forgetMemory(hippoRoot: string, tenantId: string, rawId: string): Promise<ActionResult>;
 /** Keeps one side of an open conflict and weakens the other; every refusal maps to its own status. */
 export declare function resolveOpenConflict(hippoRoot: string, tenantId: string, conflictId: number, body: ActionBody): ActionResult;
 //# sourceMappingURL=dashboard-actions.d.ts.map

package/dist/dashboard/dashboard-actions.js

@@ -29,25 +29,25 @@ export function pinMemory(hippoRoot, tenantId, rawId, body) {
     return { status: 200, body: null, changed: true, entry: next };
 }
 /** Marks a memory wrong, the same signal as `hippo outcome --bad`. */
-export function markWrong(hippoRoot, tenantId, rawId) {
+export async function markWrong(hippoRoot, tenantId, rawId) {
     const id = parseMemoryId(rawId);
     if (liveEntry(hippoRoot, tenantId, id) === null)
         return notFound();
     const ctx = { hippoRoot, tenantId, actor: api.adminActor(ACTOR) };
     // outcome() answers `applied: 0` for a missing or other-tenant id instead of throwing.
-    if (api.outcome(ctx, [id], false).applied === 0)
+    if ((await api.outcome(ctx, [id], false)).applied === 0)
         return notFound();
     const entry = readEntry(hippoRoot, id, tenantId);
     return entry === null ? notFound() : { status: 200, body: null, changed: true, entry };
 }
 /** Deletes a memory like `hippo forget`; a raw receipt is append-only and answers 409 with the archive hint. */
-export function forgetMemory(hippoRoot, tenantId, rawId) {
+export async function forgetMemory(hippoRoot, tenantId, rawId) {
     const id = parseMemoryId(rawId);
     if (liveEntry(hippoRoot, tenantId, id) === null)
         return notFound();
     const ctx = { hippoRoot, tenantId, actor: api.adminActor(ACTOR) };
     try {
-        const done = api.forget(ctx, id);
+        const done = await api.forget(ctx, id);
         return { status: 200, body: done, changed: true };
     }
     catch (err) {
@@ -79,7 +79,7 @@ export function resolveOpenConflict(hippoRoot, tenantId, conflictId, body) {
     if (liveEntry(hippoRoot, tenantId, conflict.memory_a_id) === null || liveEntry(hippoRoot, tenantId, conflict.memory_b_id) === null) {
         return notFound();
     }
-    const resolved = resolveConflict(hippoRoot, conflictId, keep, false, tenantId, { rejectedBy: ACTOR });
+    const resolved = resolveConflict(hippoRoot, { conflictId, keepId: keep, tenantId }, { rejectedBy: ACTOR });
     // Both guards passed above, so null here is a race with another resolver.
     if (resolved === null)
         return already();

package/dist/dashboard/dashboard-queries.js

@@ -2,6 +2,7 @@
 import { calculateStrength } from '../core/memory.js';
 import { loadOpenConflictsOf } from '../store/conflicts.js';
 import { BANDS, DAY_MS, LAYERS, isLiveMemory, memoryFacts, projectIdentity, } from './dashboard-snapshot.js';
+import { pct, round1 } from '../util/format.js';
 const SERIES_DAYS = 90;
 /** The server words each delta for this range; the client re-slices the series for 7d and 90d. */
 const DELTA_DAYS = 30;
@@ -9,9 +10,6 @@ const POINTS_MAX = 4_000;
 const GRID_COLS = 64;
 const GRID_ROWS = 32;
 const NAME_MATCHES = 3;
-function round1(value) {
-    return Math.round(value * 10) / 10;
-}
 function round3(value) {
     return Math.round(value * 1000) / 1000;
 }
@@ -32,9 +30,6 @@ function cumulativeSeries(times, nowMs) {
 function addedWithin(series) {
     return series[SERIES_DAYS] - series[SERIES_DAYS - DELTA_DAYS];
 }
-function pct(share) {
-    return `${(share * 100).toFixed(1)}%`;
-}
 function plural(n, one, many) {
     return `${n} ${n === 1 ? one : many}`;
 }
@@ -342,7 +337,7 @@ export function buildMemoryDetail(hippoRoot, tenantId, entry, options) {
         projectKey: project.key,
         projectName: project.name,
         scope: entry.scope,
-        tenant: entry.tenantId,
+        tenant: entry.tenant_id,
         kind: entry.kind,
         embedded,
         conflicts: openConflictsOf(hippoRoot, tenantId, entry, nowMs),

package/dist/dashboard/dashboard-snapshot.js

@@ -5,6 +5,7 @@ import { isQuarantineScope } from '../trust/quarantine.js';
 import { listMemoryConflicts } from '../store/conflicts.js';
 import { DashboardConnection, loadDashboardRows } from '../store/dashboard-reads.js';
 import { DAY_MS } from '../util/time.js';
+import { round1 } from '../util/format.js';
 export { DAY_MS };
 export const LAYERS = ['buffer', 'episodic', 'semantic', 'trace'];
 // Wire order of `Band`, and the order the mockup sorts bands in.
@@ -99,9 +100,6 @@ function cutHead(content) {
         end -= 1;
     return { head: content.slice(0, end), truncated: true };
 }
-function round1(value) {
-    return Math.round(value * 10) / 10;
-}
 function newDraft(identity) {
     return {
         summary: {

package/dist/dashboard/dashboard.js

@@ -179,7 +179,7 @@ async function handlePost(ctx, segments) {
     }
     const body = await readActionBody(req);
     const tenantId = resolveTenantId({});
-    const result = action(hippoRoot, tenantId, body);
+    const result = await action(hippoRoot, tenantId, body);
     if (result.changed)
         snapshots.invalidate();
     if (result.entry) {
@@ -300,7 +300,7 @@ function answerDashboardFailure(req, res, err) {
     const clientFault = err instanceof ParamError || err instanceof URIError || err instanceof BodyTimeoutError;
     // A cut-short response is logged even for a client fault; a bare 400 is not.
     if (res.headersSent || !clientFault) {
-        log.error('dashboard request failed', { ...errorFields(err), error: errorMessage(err), path: req.url });
+        log.error('dashboard request failed', { ...errorFields(err), error: errorMessage(err), path: (req.url ?? '/').split('?')[0] });
     }
     if (res.headersSent) {
         res.end();
@@ -318,9 +318,20 @@ function answerDashboardFailure(req, res, err) {
         return jsonResponse(res, { error: 'Malformed URL path' }, 400);
     jsonResponse(res, { error: 'Internal error' }, 500);
 }
-function printDashboardBanner(boundPort, token, distUiDir) {
+const DASHBOARD_URL_FILE = 'dashboard.url';
+function printDashboardBanner(hippoRoot, boundPort, token, distUiDir) {
     // The banner is the `hippo dashboard` command's printed result, so it stays on stdout.
-    console.log(`Hippo Dashboard running at http://localhost:${boundPort}/?token=${token}`);
+    const url = `http://localhost:${boundPort}/?token=${token}`;
+    if (process.stdout.isTTY) {
+        console.log(`Hippo Dashboard running at ${url}`);
+    }
+    else {
+        // Captured stdout lands in logs, so the token goes to an owner-only file, created fresh so its mode holds.
+        const file = path.join(hippoRoot, DASHBOARD_URL_FILE);
+        fs.rmSync(file, { force: true });
+        fs.writeFileSync(file, `${url}\n`, { flag: 'wx', mode: 0o600 });
+        console.log(`Hippo Dashboard running at http://localhost:${boundPort}/ (open the URL with its token from ${file})`);
+    }
     if (distUiDir !== null)
         console.log(`Serving React UI from ${distUiDir}`);
     console.log('Press Ctrl+C to stop.');
@@ -406,7 +417,7 @@ export function serveDashboard(hippoRoot, port = 3333, token = randomBytes(32).t
     server.listen(port, '127.0.0.1', () => {
         // SAFETY: listen() was given a TCP port, so address() is AddressInfo, never a pipe name.
         const boundPort = server.address().port;
-        printDashboardBanner(boundPort, token, hasDistUi ? distUiDir : null);
+        printDashboardBanner(hippoRoot, boundPort, token, hasDistUi ? distUiDir : null);
     });
     return server;
 }

package/dist/db/busy.d.ts

@@ -1,12 +1,7 @@
 import type { DatabaseSyncLike } from './sqlite.js';
 export declare function isSqliteBusy(cause: unknown): boolean;
-export declare const STORE_BUSY_MESSAGE = "store busy (another hippo process holds the write lock); retry shortly";
-/** A store behind the port throws this when its lock wait runs out, so the server answers 503 as it does for a busy hippo.db. */
-export declare class StoreBusyError extends Error {
-    constructor(message?: string, options?: ErrorOptions);
-}
-/** A held lock in any store: SQLite's busy codes or a port's StoreBusyError. */
-export declare function isStoreBusy<E>(error: E): boolean;
+/** The lock wait of an open that names none: its busy_timeout and every explicit wait below. */
+export declare const DEFAULT_BUSY_WAIT_MS = 5000;
 export declare function execWithBusyRetry(db: DatabaseSyncLike, sql: string, timeoutMs?: number): void;
 /** Waits for the lock past busy_timeout when given; ignored inside a caller's transaction, which already holds it. */
 export interface WriteScopeOptions {