hippo-memory 1.71.0 → 2.0.0

package/dist/importers/vault.js

@@ -5,10 +5,10 @@ import { createHash } from 'node:crypto';
 import { createMemory } from '../core/memory.js';
 import { loadVaultRawRows } from '../store/entry-reads.js';
 import { remember, archiveRaw, isPrivateScope } from '../api/index.js';
-import { assertClientScope } from '../store/recall-scope.js';
-import { RejectedValueError } from '../store/rejection.js';
+import { assertClientScope } from '../core/recall-scope.js';
+import { RejectedValueError } from '../core/api-errors.js';
 import { rejectionGuardRefuses } from '../store/rejected-values.js';
-import { withRequestStoresSync } from '../db/request-stores.js';
+import { runWithRequestStores } from '../db/request-stores.js';
 import { loadConfig } from '../core/config.js';
 import { vetSecrets } from '../util/secret-detect.js';
 import { errorMessage, log } from '../util/log.js';
@@ -18,7 +18,7 @@ import { isJsonString } from '../util/json.js';
 import { escapeLike } from '../util/escape.js';
 /** Import a markdown vault FOLDER as `kind='raw'` memories.
  *  NOT re-entrant: idempotency rests on the in-memory `existing` Map loaded once, so two concurrent runs over one vault can double-insert. */
-export function importVault(folderPath, options) {
+export async function importVault(folderPath, options) {
     const hippoRoot = options.hippoRoot;
     const identity = vaultIdentityOrThrow(options);
     if (options.global) {
@@ -34,7 +34,7 @@ export function importVault(folderPath, options) {
     }
     return syncVaultFolder(folderPath, options, identity);
 }
-function syncVaultFolder(folderPath, options, { vaultName, scope }) {
+async function syncVaultFolder(folderPath, options, { vaultName, scope }) {
     const hippoRoot = options.hippoRoot;
     const tenantId = options.tenantId ?? DEFAULT_TENANT_ID;
     const extraTags = options.extraTags ?? [];
@@ -54,15 +54,15 @@ function syncVaultFolder(folderPath, options, { vaultName, scope }) {
     const run = {
         ctx, folderPath, vaultName, scope, extraTags, dryRun, existing, seen, baseHalfLifeDays, tally,
     };
-    const importNotes = () => {
+    const importNotes = async () => {
         for (const relpath of relpaths)
-            importVaultNote(run, relpath);
+            await importVaultNote(run, relpath);
     };
     // A dry run probes the rejection guard once per changed note; one scope lets every probe share a handle.
     if (dryRun)
-        withRequestStoresSync(importNotes);
+        await runWithRequestStores(importNotes);
     else
-        importNotes();
+        await importNotes();
     // Deletion-sync: an artifactRef in the Map but not seen this run vanished from the source, so archive its raw row.
     // Per-file archiveRaw, no outer SAVEPOINT: there is no cross-file idempotency row to commit atomically.
     for (const [artifactRef, rows] of existing) {
@@ -71,7 +71,7 @@ function syncVaultFolder(folderPath, options, { vaultName, scope }) {
         for (const row of rows) {
             tally.archived++; // count even in dryRun so the preview reflects destructive deletes
             if (!dryRun)
-                archiveRaw(ctx, row.id, `source_deleted:${artifactRef}`);
+                await archiveRaw(ctx, row.id, `source_deleted:${artifactRef}`);
         }
     }
     const { total, imported, skipped, rejected, archived, redacted, entries } = tally;
@@ -82,18 +82,20 @@ function vaultIdentityOrThrow(options) {
     // sharing a basename collide on the same `vault:<name>:*` prefix and the sync archived the first one's rows.
     const vaultName = options.name?.trim();
     if (!vaultName) {
-        throw new Error('importVault requires an explicit vault name (options.name): it is the identity key for source-deletion sync and must not be inferred from the folder basename.');
+        throw new Error('importVault requires an explicit vault name (options.name): it is the identity key for source-deletion sync and must not be inferred from the folder ' +
+            'basename.');
     }
     if (vaultName.includes(':')) {
         // ':' delimits the artifactRef (vault:<name>:<relpath>); a name containing it lets another vault's prefix scan over-match and archive its rows.
         throw new Error(`vault name must not contain ':' (artifactRef delimiter): ${vaultName}`);
     }
     const scope = options.scope ?? null;
-    // Privacy guard: recall only default-denies scopes shaped `<source>:private:*` (isPrivateScope in src/store/recall-scope.ts), so a bare `private`
+    // Privacy guard: recall only default-denies scopes shaped `<source>:private:*` (isPrivateScope in src/core/recall-scope.ts), so a bare `private`
     // alias would be returned to no-scope callers. Reject any scope naming a `private` segment that is not a valid `<source>:private:*`.
     assertClientScope(scope);
     if (scope !== null && scope.split(':').includes('private') && !isPrivateScope(scope)) {
-        throw new Error(`vault scope '${scope}' is not recognized as private by recall (only '<source>:private:*' scopes are default-denied). Use a source-prefixed scope such as 'vault:private:${vaultName}'.`);
+        throw new Error(`vault scope '${scope}' is not recognized as private by recall (only '<source>:private:*' scopes are default-denied). ` +
+            `Use a source-prefixed scope such as 'vault:private:${vaultName}'.`);
     }
     return { vaultName, scope };
 }
@@ -118,7 +120,7 @@ function loadVaultRows(hippoRoot, tenantId, vaultName) {
     }
     return existing;
 }
-function importVaultNote(run, relpath) {
+async function importVaultNote(run, relpath) {
     const { tally } = run;
     tally.total++;
     const artifactRef = `vault:${run.vaultName}:${relpath}`;
@@ -135,7 +137,7 @@ function importVaultNote(run, relpath) {
     // Empty or frontmatter-only note: nothing storable, and the content was deleted at source, so archive prior rows (the old body must not stay searchable)
     // and skip the write. Safe because remember() is skipped, so there is no archive-then-throw hazard; the note stays in `seen` so deletion-sync skips it.
     if (body.trim().length < 3) {
-        archivePriors(run, priors, `emptied:${artifactRef}`);
+        await archivePriors(run, priors, `emptied:${artifactRef}`);
         tally.skipped++;
         return;
     }
@@ -145,13 +147,13 @@ function importVaultNote(run, relpath) {
         tally.skipped++;
         return;
     }
-    writeChangedNote(run, artifactRef, priors, body, tags);
+    await writeChangedNote(run, artifactRef, priors, body, tags);
 }
-function writeChangedNote(run, artifactRef, priors, body, tags) {
+async function writeChangedNote(run, artifactRef, priors, body, tags) {
     const { ctx, tally } = run;
     // Changed file: archive EVERY old raw row for this ref (>1 only after a concurrent double-insert), then append the new one; NEVER supersede.
     // archiveRaw commits before remember() runs, so no double-live row; a crash between them self-heals on the next import.
-    archivePriors(run, priors, `changed:${artifactRef}`);
+    await archivePriors(run, priors, `changed:${artifactRef}`);
     // remember() owns the write; the `echo` from createMemory only fills the ImportResult, with its id reconciled to the row that landed.
     const content = vetSecrets(body, tags, true).content;
     const echo = createMemory(content, {
@@ -163,7 +165,7 @@ function writeChangedNote(run, artifactRef, priors, body, tags) {
         tenantId: ctx.tenantId,
         baseHalfLifeDays: run.baseHalfLifeDays,
     });
-    if (!storeVaultNote(run, echo, content, tags, artifactRef)) {
+    if (!(await storeVaultNote(run, echo, content, tags, artifactRef))) {
         tally.rejected++;
         return;
     }
@@ -183,11 +185,11 @@ function readVaultNote(run, relpath) {
         return null;
     }
 }
-function archivePriors(run, priors, reason) {
+async function archivePriors(run, priors, reason) {
     for (const p of priors) {
         run.tally.archived++; // count the would-be archive even in dryRun (true preview)
         if (!run.dryRun)
-            archiveRaw(run.ctx, p.id, reason);
+            await archiveRaw(run.ctx, p.id, reason);
     }
 }
 function vaultNoteTags(run, hashTag, fm, body) {
@@ -219,14 +221,14 @@ function vaultEnvelopeUnchanged(priors, tags, scope) {
         }));
 }
 /** Returns false when the rejection guard refuses the note; any other error propagates. */
-function storeVaultNote(run, echo, content, tags, artifactRef) {
+async function storeVaultNote(run, echo, content, tags, artifactRef) {
     // A dry run writes nothing; it asks the guard remember() uses, so its `rejected` count matches what a real run would refuse.
     if (run.dryRun)
         return !rejectionGuardRefuses(run.ctx.hippoRoot, run.ctx.tenantId, echo.id, echo.content);
     try {
         // A rejected note must not stop the scan or the deletion sync. Its priors are archived by now, so a rerun meets
         // the same refusal and counts it again.
-        const result = remember(run.ctx, {
+        const result = await remember(run.ctx, {
             content,
             kind: 'raw',
             artifactRef,

package/dist/index.d.ts

@@ -20,7 +20,7 @@ export { initStore } from './store/open.js';
 export { writeEntry } from './store/entry-writes.js';
 export { loadAllEntries, readEntry } from './store/entry-reads.js';
 export { deleteEntry } from './store/delete-and-batch.js';
-export { loadSearchEntries, loadRecallSearchEntries } from './store/search-rows.js';
+export { loadSearchEntries, loadRecallEntries, type RecallSearchEntriesOptions } from './store/search-rows.js';
 export { loadIndex, rebuildIndex, loadSessionDecayContext, SessionDecayContext } from './store/index-and-stats.js';
 export { saveActiveTaskSnapshot, loadActiveTaskSnapshot, loadFreshActiveTaskSnapshot, SNAPSHOT_AMBIENT_MAX_AGE_MS, closeTaskSnapshotsForSession, clearActiveTaskSnapshot, appendSessionEvent, listSessionEvents, type ContinuityKey, } from './store/sessions.js';
 export { listMemoryConflicts, replaceDetectedConflicts, resolveConflict } from './store/conflicts.js';
@@ -32,10 +32,11 @@ export { consolidate } from './consolidate/sleep.js';
 export { ConsolidationResult } from './consolidate/run.js';
 export { sleep, type SleepOpts, type SleepResult } from './api/sleep.js';
 export { strengthBucket } from './consolidate/dedupe.js';
-export { isEmbeddingAvailable, getEmbedding } from './store/embeddings/local.js';
-export { cosineSimilarity, embedMemory, embedAll, } from './store/embeddings/index.js';
+export { isEmbeddingAvailable, getEmbedding } from './embeddings/local.js';
+export { cosineSimilarity } from './store/embeddings/index.js';
+export { embedMemory, embedAll } from './search/embed-memories.js';
 export { loadEmbeddingIndex, saveEmbeddingIndex } from './store/vector-index.js';
-export { captureError, extractLessons, partitionLessons, deduplicateLesson, runWatched, fetchGitLog, } from './learn/autolearn.js';
+export { captureError, extractLessons, partitionLessons, deduplicateLesson, runWatched, type RunWatchedOptions, fetchGitLog, } from './learn/autolearn.js';
 export { getGlobalRoot, initGlobal, promoteToGlobal } from './sharing/global-store.js';
 export { searchBoth, searchBothHybrid, HybridSearchOptions } from './sharing/search-both.js';
 export { syncGlobalToLocal } from './sharing/global-sync.js';

package/dist/index.js

@@ -21,7 +21,7 @@ export { initStore } from './store/open.js';
 export { writeEntry } from './store/entry-writes.js';
 export { loadAllEntries, readEntry } from './store/entry-reads.js';
 export { deleteEntry } from './store/delete-and-batch.js';
-export { loadSearchEntries, loadRecallSearchEntries } from './store/search-rows.js';
+export { loadSearchEntries, loadRecallEntries } from './store/search-rows.js';
 export { loadIndex, rebuildIndex, loadSessionDecayContext } from './store/index-and-stats.js';
 export { saveActiveTaskSnapshot, loadActiveTaskSnapshot, loadFreshActiveTaskSnapshot, SNAPSHOT_AMBIENT_MAX_AGE_MS, closeTaskSnapshotsForSession, clearActiveTaskSnapshot, appendSessionEvent, listSessionEvents, } from './store/sessions.js';
 export { listMemoryConflicts, replaceDetectedConflicts, resolveConflict } from './store/conflicts.js';
@@ -36,8 +36,9 @@ export { sleep } from './api/sleep.js';
 // Announced public in CHANGELOG 1.26.3 but never re-exported; the rest of dedupe.js stays internal.
 export { strengthBucket } from './consolidate/dedupe.js';
 // Feature 1: Embedding search
-export { isEmbeddingAvailable, getEmbedding } from './store/embeddings/local.js';
-export { cosineSimilarity, embedMemory, embedAll, } from './store/embeddings/index.js';
+export { isEmbeddingAvailable, getEmbedding } from './embeddings/local.js';
+export { cosineSimilarity } from './store/embeddings/index.js';
+export { embedMemory, embedAll } from './search/embed-memories.js';
 export { loadEmbeddingIndex, saveEmbeddingIndex } from './store/vector-index.js';
 // Feature 2: Auto-learn from errors
 export { captureError, extractLessons, partitionLessons, deduplicateLesson, runWatched, fetchGitLog, } from './learn/autolearn.js';

package/dist/learn/autolearn.d.ts

@@ -15,9 +15,21 @@ export declare function partitionLessons(lessons: string[]): {
 /** Check if a substantially similar memory already exists: true if overlap > threshold (default 0.7).
  *  `tenantId` applies only on the root-string overload; a pre-loaded MemoryEntry[] is already scoped, so it is ignored there. */
 export declare function deduplicateLesson(hippoRootOrEntries: string | MemoryEntry[], lesson: string, threshold?: number, tenantId?: string): boolean;
-/** Run a command in a shell, streaming stderr live; never pass text the caller did not write.
- *  Returns: { exitCode, stderr }. */
-export declare function runWatched(command: string): Promise<{
+/** A transfer command that has not exited in this long is hung on a prompt or a dead remote. */
+export declare const RUN_WATCHED_DEADLINE_MS: number;
+/** The command passed its deadline and was killed. */
+export declare class RunWatchedTimeoutError extends Error {
+    readonly deadlineMs: number;
+    readonly stderr: string;
+    constructor(deadlineMs: number, stderr: string);
+}
+export interface RunWatchedOptions {
+    /** Join argv with spaces and run it as one shell command line; only for text the caller wrote itself. */
+    shell?: boolean;
+}
+/** Run argv[0] with the rest as its arguments and no shell, so `;`, `&` and `$()` reach it literally; stderr streams live.
+ *  Returns: { exitCode, stderr } with only the last 64 KiB of stderr; rejects with RunWatchedTimeoutError past `deadlineMs`. */
+export declare function runWatched(argv: readonly string[], deadlineMs?: number, opts?: RunWatchedOptions): Promise<{
     exitCode: number;
     stderr: string;
 }>;

package/dist/learn/autolearn.js

@@ -1,6 +1,7 @@
 /** Auto-learn from errors and git history.
  *  Agents learn from failures without explicit hippo remember calls. */
-import { execSync, execFileSync, spawn } from 'child_process';
+import { execFileSync, spawn } from 'child_process';
+import { spawnArgv } from '../util/spawn-argv.js';
 import { createMemory, Layer, DEFAULT_HALF_LIFE_DAYS } from '../core/memory.js';
 import { loadAllEntries } from '../store/entry-reads.js';
 import { textOverlap } from '../util/tokenize.js';
@@ -97,25 +98,46 @@ export function deduplicateLesson(hippoRootOrEntries, lesson, threshold = 0.7, t
     }
     return false;
 }
-/** Run a command in a shell, streaming stderr live; never pass text the caller did not write.
- *  Returns: { exitCode, stderr }. */
-export function runWatched(command) {
-    return new Promise((resolve) => {
-        // Use shell: true so the command string is handled by the shell as-is
-        const child = spawn(command, { shell: true, stdio: ['inherit', 'inherit', 'pipe'], windowsHide: true });
-        const stderrChunks = [];
-        child.stderr.on('data', (chunk) => {
-            stderrChunks.push(chunk);
-            // Also pass through to terminal
+/** The most stderr `runWatched` returns; the terminal still gets all of it. */
+const STDERR_TAIL_BYTES = 64 * 1024;
+/** A transfer command that has not exited in this long is hung on a prompt or a dead remote. */
+export const RUN_WATCHED_DEADLINE_MS = 30 * 60_000;
+/** The command passed its deadline and was killed. */
+export class RunWatchedTimeoutError extends Error {
+    deadlineMs;
+    stderr;
+    constructor(deadlineMs, stderr) {
+        super(`the command did not exit within ${deadlineMs} ms and was killed`);
+        this.deadlineMs = deadlineMs;
+        this.stderr = stderr;
+        this.name = 'RunWatchedTimeoutError';
+    }
+}
+/** Run argv[0] with the rest as its arguments and no shell, so `;`, `&` and `$()` reach it literally; stderr streams live.
+ *  Returns: { exitCode, stderr } with only the last 64 KiB of stderr; rejects with RunWatchedTimeoutError past `deadlineMs`. */
+export function runWatched(argv, deadlineMs = RUN_WATCHED_DEADLINE_MS, opts = {}) {
+    return new Promise((resolve, reject) => {
+        const options = { stdio: ['inherit', 'inherit', 'pipe'], windowsHide: true };
+        const child = opts.shell ? spawn(argv.join(' '), { ...options, windowsHide: true, shell: true }) : spawnArgv(argv, options);
+        let tail = Buffer.alloc(0);
+        child.stderr?.on('data', (chunk) => {
+            tail = Buffer.concat([tail, chunk]);
+            if (tail.length > STDERR_TAIL_BYTES)
+                tail = tail.subarray(tail.length - STDERR_TAIL_BYTES);
             process.stderr.write(chunk);
         });
+        // SHORTCUT: kills the direct child only (the shell or cmd.exe when there is one); on Windows a grandchild can outlive it.
+        // A process-tree kill is the upgrade path.
+        const timer = setTimeout(() => {
+            child.kill('SIGKILL');
+            reject(new RunWatchedTimeoutError(deadlineMs, tail.toString('utf8')));
+        }, deadlineMs);
         child.on('close', (code) => {
-            resolve({
-                exitCode: code ?? 1,
-                stderr: Buffer.concat(stderrChunks).toString('utf8'),
-            });
+            clearTimeout(timer);
+            resolve({ exitCode: code ?? 1, stderr: tail.toString('utf8') });
         });
         child.on('error', (err) => {
+            clearTimeout(timer);
             resolve({ exitCode: 1, stderr: err.message });
         });
     });
@@ -123,7 +145,7 @@ export function runWatched(command) {
 /** Check whether a directory is a git work tree. */
 export function isGitRepo(cwd) {
     try {
-        const raw = execSync('git rev-parse --is-inside-work-tree', {
+        const raw = execFileSync('git', ['rev-parse', '--is-inside-work-tree'], {
             encoding: 'utf8',
             cwd,
             timeout: 10000,

package/dist/learn/churn-git.js

@@ -3,12 +3,13 @@ import { execFileSync } from 'child_process';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
-import { DAY_MS } from '../util/time.js';
+import { DAY_MS, MINUTE_MS } from '../util/time.js';
 import { errorMessage } from '../util/log.js';
+import { isJsonObject, isJsonString } from '../util/json.js';
 // A `git log --name-status` dump can run to tens of MB; default 1MB pipe would truncate it.
 const GIT_MAX_BUFFER = 64 * 1024 * 1024;
 // Longer than the 10 s of one-line git reads because a full log dump on a large repo is slow, yet bounded so a wedged git cannot stall sleep.
-const GIT_TIMEOUT_MS = 60_000;
+const GIT_TIMEOUT_MS = MINUTE_MS;
 /** A real git failure (not git grep's expected exit-1-no-match). Callers abort the whole run on this. */
 export class GitReadError extends Error {
 }
@@ -93,9 +94,17 @@ export function packageScriptsAt(repoRoot, rev) {
         return {};
     const raw = runGit(['show', `${rev}:package.json`], repoRoot);
     try {
-        // SAFETY: optional chaining makes a `null` or scalar package.json read as "no scripts".
         const parsed = JSON.parse(raw);
-        return parsed?.scripts ?? {};
+        const scripts = isJsonObject(parsed) ? parsed.scripts : undefined;
+        if (!isJsonObject(scripts))
+            return {};
+        const out = {};
+        for (const [name, command] of Object.entries(scripts)) {
+            if (!isJsonString(command))
+                return {};
+            out[name] = command;
+        }
+        return out;
     }
     catch (err) {
         if (err instanceof SyntaxError)

package/dist/learn/extract.d.ts

@@ -1,4 +1,5 @@
 import { MemoryEntry, EmotionalValence } from '../core/memory.js';
+import { type AnthropicMessageFailure } from '../util/anthropic-messages.js';
 export interface ExtractedFact {
     content: string;
     tags: string[];
@@ -8,8 +9,8 @@ export interface ExtractOptions {
     apiKey: string;
     model?: string;
     fetcher?: typeof fetch;
-    /** Told why a call produced nothing, so callers can surface it instead of guessing. */
-    onError?: (msg: string) => void;
+    /** Told why a call produced nothing, so callers can surface it instead of guessing; `failure` is set when the API call itself failed. */
+    onError?: (msg: string, failure?: AnthropicMessageFailure) => void;
 }
 export declare function extractFacts(text: string, opts: ExtractOptions): Promise<ExtractedFact[]>;
 export declare function storeExtractedFacts(hippoRoot: string, source: MemoryEntry, facts: ExtractedFact[]): MemoryEntry[];

package/dist/learn/extract.js

@@ -1,20 +1,22 @@
 import { Layer, createMemory } from '../core/memory.js';
 import { writeEntry } from '../store/entry-writes.js';
 import { loadConfig } from '../core/config.js';
-import { RejectedValueError } from '../store/rejection.js';
+import { RejectedValueError } from '../core/api-errors.js';
 import { redactSecretsStrict } from '../util/secret-detect.js';
 import { describeMessageFailure, sendAnthropicMessage } from '../util/anthropic-messages.js';
 import { neverAutoShareTags } from '../sharing/share.js';
 import { errorMessage, log } from '../util/log.js';
 import { isJsonString } from '../util/json.js';
 import { certainDefect } from '../core/memory-quality.js';
-const EXTRACTION_PROMPT = `You are extracting factual statements from a conversation or memory entry. Extract 1-8 standalone factual statements that would be useful to remember later.
+const EXTRACTION_PROMPT = `You are extracting factual statements from a conversation or memory entry. ` +
+    `Extract 1-8 standalone factual statements that would be useful to remember later.
 
 Rules:
 - Each fact must be a complete, standalone sentence
 - Include the speaker's name in every fact (e.g. "Alice prefers..." not "She prefers...")
 - Preserve specific details: names, numbers, dates, paths, IDs
-- Return a JSON array of objects with: content (string), tags (array of "speaker:X" and "topic:Y" strings), valence ("neutral", "positive", "negative", or "critical")
+- Return a JSON array of objects with: content (string), tags (array of "speaker:X" and "topic:Y" strings), ` +
+    `valence ("neutral", "positive", "negative", or "critical")
 - Return an empty array [] for small talk with no extractable facts
 - Output ONLY the JSON array, no preamble or explanation
 
@@ -31,7 +33,7 @@ export async function extractFacts(text, opts) {
         fetcher: opts.fetcher,
     });
     if (!reply.ok) {
-        opts.onError?.(describeMessageFailure(reply.failure));
+        opts.onError?.(describeMessageFailure(reply.failure), reply.failure);
         return [];
     }
     try {
@@ -116,7 +118,7 @@ function buildExtractedEntry(fact, source, inheritedTags, baseHalfLifeDays) {
             scope: source.scope,
             // Without it createMemory stamps 'default', and extracted facts leave
             // the tenant of the episodic memory they were extracted from.
-            tenantId: source.tenantId,
+            tenantId: source.tenant_id,
             baseHalfLifeDays,
         }), origin_project: source.origin_project };
 }

package/dist/learn/forward-claim-detector.js

@@ -7,7 +7,8 @@ const FORWARD_CLAIM_PATTERNS = [
     // Verb + duration tail: requires `<verb> take <N> <unit>`, because a bare `will take` matched `who will take ownership of auth?`.
     new RegExp(String.raw `\b(?:will|should|gonna|going\s+to)\s+take\s+${DURATION_TAIL}`, 'i'),
     // Ship + by/in + duration-or-day: a bare `ship in` matched `how does this ship in Docker?`, so a duration tail or literal day-of-week is required.
-    new RegExp(String.raw `\bship(?:ping|s)?\s+(?:by|in)\s+(?:(?:about|around)\s+)?(?:next\s+)?(?:${DURATION_TAIL}|(?:monday|tuesday|wednesday|thursday|friday|saturday|sunday))\b`, 'i'),
+    new RegExp(String.raw `\bship(?:ping|s)?\s+(?:by|in)\s+(?:(?:about|around)\s+)?(?:next\s+)?` +
+        String.raw `(?:${DURATION_TAIL}|(?:monday|tuesday|wednesday|thursday|friday|saturday|sunday))\b`, 'i'),
     /\bestimate(?:d)?\s+(?:at\s+)?(?:~|≈|about|around)?\s*\d+/i,
     /\b(?:by|in|within)\s+(?:about|around|~)?\s*\d+\s*(?:day|week|month|hour)s?\b/i,
     /\bETA\s*(?:is|:)?\s*\d+/i,
@@ -17,7 +18,8 @@ const FORWARD_CLAIM_PATTERNS = [
     /(?<=^|\s)~\s*\d+\s*(?:day|week|month|hour)s?\b/i,
     // Should + verb + duration tail. Same tightening as the leading 'will
     // take' rule: 'should ship by EOD' must include a quantifier.
-    new RegExp(String.raw `\bshould\s+(?:be|ship|finish|complete|land)\s+(?:by|in|within)\s+(?:(?:about|around)\s+)?(?:next\s+)?(?:${DURATION_TAIL}|(?:monday|tuesday|wednesday|thursday|friday|saturday|sunday))\b`, 'i'),
+    new RegExp(String.raw `\bshould\s+(?:be|ship|finish|complete|land)\s+(?:by|in|within)\s+(?:(?:about|around)\s+)?(?:next\s+)?` +
+        String.raw `(?:${DURATION_TAIL}|(?:monday|tuesday|wednesday|thursday|friday|saturday|sunday))\b`, 'i'),
 ];
 /** Pronouns, function words and modal verbs the regex set already gates on; dropped before class resolution so overlap comes from domain tokens. */
 const STOP_WORDS = new Set([

package/dist/learn/invalidation.d.ts

@@ -1,3 +1,4 @@
+import { type HippoStore } from '../store/port.js';
 import { type MemoryEntry } from '../core/memory.js';
 export interface InvalidationTarget {
     from: string;
@@ -28,7 +29,7 @@ export declare function extractInvalidationTarget(message: string): Invalidation
 export declare function invalidateMatching(hippoRoot: string, target: InvalidationTarget, tenantId?: string, options?: InvalidationOptions): InvalidationResult;
 /** invalidateMatching for a batch: matches against `live`, the caller's list of the tenant's rows, and keeps it current.
  *  Each match is read again before it is weakened, so a row another writer changed since the list was read is never written back stale. */
-export declare function invalidateMatchingAmong(hippoRoot: string, live: MemoryEntry[], target: InvalidationTarget, tenantId?: string): InvalidationResult;
+export declare function invalidateMatchingAmong(store: HippoStore, live: MemoryEntry[], target: InvalidationTarget, tenantId?: string): Promise<InvalidationResult>;
 export interface ChurnRefs {
     paths: string[];
     symbols: string[];

package/dist/learn/invalidation.js

@@ -1,6 +1,8 @@
-import { addTagToEntries, writeEntriesSeparately } from '../store/entry-writes.js';
+import { addTagToEntries, writeEntriesTogether } from '../store/entry-writes.js';
 import { confirmedOutcomeTimes } from '../store/audit.js';
-import { chunked, loadAllEntries, loadEntriesByIds } from '../store/entry-reads.js';
+import { loadAllEntries, loadEntriesMentioning, readEntry } from '../store/entry-reads.js';
+import { requireGroup } from '../store/port.js';
+import { chunked } from '../util/chunked.js';
 import { CHURN_STALE_TAG } from '../core/memory.js';
 import { GitReadError, gitLsFilesAtHead, fetchChurnWindowLog, gitGrepPresence, resolveCommitBefore, packageScriptsAt, } from './churn-git.js';
 const HEADLINE_CHARS = 60;
@@ -46,20 +48,27 @@ export function extractInvalidationTarget(message) {
  *  Tag matching is EXACT: the FULL pattern must equal a tag, so a pattern merely containing a common tag word cannot mass-weaken every memory with that tag. */
 export function invalidateMatching(hippoRoot, target, tenantId, options) {
     // tenantId opt-in: when set, only that tenant's memories are weakened; undefined is host-wide.
-    // options.onlyId filters this tenant-scoped list rather than looking up an id directly, so another tenant's id is invisible here.
-    const { result, weakened } = weakenMatches(loadAllEntries(hippoRoot, tenantId), target, options);
-    writeEntriesSeparately(hippoRoot, weakened);
+    // The onlyId read is tenant-scoped too, so another tenant's id is invisible here.
+    const entries = options?.onlyId === undefined
+        ? loadEntriesMentioning(hippoRoot, invalidationTokenize(target.from), target.from.toLowerCase().trim(), tenantId)
+        : [readEntry(hippoRoot, options.onlyId, tenantId)].filter((entry) => entry !== null);
+    const { result, weakened } = weakenMatches(entries, target, options);
+    writeEntriesTogether(hippoRoot, weakened);
     return result;
 }
 /** invalidateMatching for a batch: matches against `live`, the caller's list of the tenant's rows, and keeps it current.
  *  Each match is read again before it is weakened, so a row another writer changed since the list was read is never written back stale. */
-export function invalidateMatchingAmong(hippoRoot, live, target, tenantId) {
+export async function invalidateMatchingAmong(store, live, target, tenantId) {
     const seen = weakenMatches(live, target, { dryRun: true }).result;
     const ids = [...seen.targets, ...seen.skippedPinned];
-    // loadEntriesByIds reads at most 500 ids a call.
-    const fresh = new Map(chunked(ids, 500).flatMap((chunk) => loadEntriesByIds(hippoRoot, chunk, tenantId)).map((entry) => [entry.id, entry]));
+    const fresh = new Map();
+    // The port reads at most 500 ids a call.
+    for (const chunk of chunked(ids, 500))
+        for (const entry of await store.entriesByIds(chunk, tenantId))
+            fresh.set(entry.id, entry);
     const { result, weakened } = weakenMatches(ids.flatMap((id) => fresh.get(id) ?? []), target);
-    writeEntriesSeparately(hippoRoot, weakened);
+    if (weakened.length > 0)
+        await requireGroup(store, 'lessonWrites').writeTogether(weakened);
     const byId = new Map(weakened.map((entry) => [entry.id, entry]));
     for (let i = 0; i < live.length; i++)
         live[i] = byId.get(live[i].id) ?? live[i];

package/dist/mcp/admin-tools.d.ts

@@ -1,8 +1,8 @@
 import { type ToolCall } from './protocol.js';
 export declare function runPredictBaserateTool({ args, ctx, hippoRoot, tenantId }: ToolCall): Promise<string>;
-export declare function runStatusTool({ hippoRoot, config, tenantId }: ToolCall): string;
+export declare function runStatusTool({ ctx, hippoRoot, config, tenantId }: ToolCall): string;
 export declare function runConflictsTool(call: ToolCall): string;
 export declare function runResolveTool({ args, ctx, hippoRoot, tenantId }: ToolCall): string;
-export declare function runShareTool({ args, ctx, hippoRoot, tenantId }: ToolCall): string;
+export declare function runShareTool({ args, ctx, hippoRoot, tenantId }: ToolCall): Promise<string>;
 export declare function runPeersTool({ tenantId }: ToolCall): string;
 //# sourceMappingURL=admin-tools.d.ts.map