hippo-memory 1.72.0 → 2.0.0

package/README.md

@@ -675,11 +675,13 @@ hippo sleep
 Wrap any command with `hippo watch` to auto-learn from failures:
 
 ```bash
-hippo watch "npm run build"
+hippo watch -- npm run build
 # if it fails, Hippo captures the error automatically
 # next time an agent asks about build issues, the memory is there
 ```
 
+The command runs with no shell, so each argument reaches the program as written. To run a shell line with pipes or `&&`, pass it as one string after `--shell`: `hippo watch --shell "npm test && npm run build"`.
+
 ---
 
 ## CLI Reference
@@ -736,7 +738,7 @@ hippo watch "npm run build"
 | `hippo failures [--days n]` | Failed tool calls the capture-error hook saw, by outcome, and how many errors first happened in another session |
 | `hippo embed` | Embed all memories for semantic search |
 | `hippo embed --status` | Show embedding coverage |
-| `hippo watch "<command>"` | Run command, auto-learn from failures |
+| `hippo watch -- <command> [args...]` | Run command with no shell, auto-learn from failures (`--shell "<line>"` runs one line through the shell) |
 | `hippo learn --git` | Scan recent git commits for lessons |
 | `hippo learn --git --days <n>` | Scan N days back (default: 7) |
 | `hippo learn --git --repos <paths>` | Scan multiple repos (comma-separated) |
@@ -784,8 +786,8 @@ hippo watch "npm run build"
 | `hippo dashboard` | Open web dashboard at localhost:3333 (memory health by project, and the card board); open the printed URL, which carries a per-start access token |
 | `hippo dashboard --port <n>` | Use custom port |
 | `hippo mcp` | Start MCP server (stdio transport) |
-| `hippo serve` | Start the HTTP API server for this store on `127.0.0.1:6789` (`--port <n>` or `HIPPO_PORT`; `--host <host>`, which off loopback needs `HIPPO_REQUIRE_AUTH=1`). Every request needs an API key (`hippo auth create`, then `Authorization: Bearer <key>`; the hippo CLI reads `HIPPO_API_KEY`). `HIPPO_ALLOW_KEYLESS_LOCAL=1` lets requests from this machine in without one, as host admin; `HIPPO_REQUIRE_AUTH=1` wins over it |
-| `hippo serve --tls-cert <file> --tls-key <file>` | Serve HTTPS with that PEM certificate and key (or set `HIPPO_TLS_CERT` and `HIPPO_TLS_KEY`). Without them a network bind still starts, and warns once that API keys and memory text travel in cleartext unless a TLS-terminating proxy sits in front |
+| `hippo serve` | Start the HTTP API server for this store on `127.0.0.1:6789` (`--port <n>` or `HIPPO_PORT`; `--host <host>`, which off loopback needs `HIPPO_REQUIRE_AUTH=1`). Every request needs an API key (`hippo auth create`, then `Authorization: Bearer <key>`; the hippo CLI reads `HIPPO_API_KEY`). `HIPPO_ALLOW_KEYLESS_LOCAL=1` lets requests from this machine in without one, as a member (`HIPPO_KEYLESS_LOCAL_ROLE=admin` makes them host admin, for sleep and the quarantine routes); `HIPPO_REQUIRE_AUTH=1` wins over it. Each caller gets 20 requests a second, burst 40 (`HIPPO_CALLER_RPS`; `0` turns it off). See [Security defaults](docs/UPGRADING-2.0.md#security-defaults) |
+| `hippo serve --tls-cert <file> --tls-key <file>` | Serve HTTPS with that PEM certificate and key (or set `HIPPO_TLS_CERT` and `HIPPO_TLS_KEY`). Without them a network bind refuses to start, since API keys and memory text would travel in cleartext; behind a TLS-terminating proxy, pass `--allow-cleartext` (or set `HIPPO_ALLOW_CLEARTEXT=1`) |
 
 On `heartbeat`, `block`, `review` and `complete`, a given `--run` is checked against the card's live run and the command is refused, unchanged, if the two do not match.
 

package/dist/agent-memories/apply.js

@@ -84,7 +84,7 @@ class ContainerRun {
                 continue;
             const source = itemSource(this.w.prefix, key, item.text);
             for (const row of rows) {
-                if (renameEntrySourceAt(this.s.db, row.tenantId, row.id, row.source, source) === 0)
+                if (renameEntrySourceAt(this.s.db, row.tenant_id, row.id, row.source, source) === 0)
                     continue;
                 this.tally.adopted++;
                 this.mirror.push({ ...row, source });
@@ -97,7 +97,7 @@ class ContainerRun {
         let moved = 0;
         for (const row of selectLiveEntriesBySourcePrefix(this.s.db, this.s.tenantId, old)) {
             const source = this.w.prefix + row.source.slice(old.length);
-            if (renameEntrySourceAndOriginAt(this.s.db, row.tenantId, row.id, { from: row.source, to: source, origin }) === 0)
+            if (renameEntrySourceAndOriginAt(this.s.db, row.tenant_id, row.id, { from: row.source, to: source, origin }) === 0)
                 continue;
             moved++;
             this.mirror.push({ ...row, source, origin_project: origin ?? row.origin_project });
@@ -150,11 +150,11 @@ class ContainerRun {
     }
     /** api.supersede's steps on this transaction; false when another writer superseded the row first. */
     supersede(old, newId) {
-        if (!supersedeEntryAt(this.s.db, old.tenantId, old.id, newId))
+        if (!supersedeEntryAt(this.s.db, old.tenant_id, old.id, newId))
             return false;
         if (old.dag_parent_id)
-            markSummaryDirtyInTx(this.s.db, old.dag_parent_id, old.tenantId, SYNC_ACTOR);
-        appendAuditEvent(this.s.db, { tenantId: old.tenantId, actor: SYNC_ACTOR, op: 'supersede', targetId: old.id, metadata: { newId } });
+            markSummaryDirtyInTx(this.s.db, old.dag_parent_id, old.tenant_id, SYNC_ACTOR);
+        appendAuditEvent(this.s.db, { tenantId: old.tenant_id, actor: SYNC_ACTOR, op: 'supersede', targetId: old.id, metadata: { newId } });
         this.mirror.push({ ...old, superseded_by: newId });
         return true;
     }

package/dist/api/assemble.js

@@ -1,5 +1,6 @@
 // Session context assembly under a token budget.
-import { requireGroup, storeFor } from '../store/index.js';
+import { requireGroup } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 import { estimateTokens } from '../util/token-text.js';
 import { passesScopeFilterForRecall, assertScopeRequestAllowed, personalScopeOf } from '../core/recall-scope.js';
 import { classifyOriginProject, projectNames } from '../core/project-identity.js';

package/dist/api/audit.d.ts

@@ -1,6 +1,6 @@
-import { type AuditEvent, type AuditOp } from '../store/audit.js';
+import type { AuditEvent, AuditOp } from '../store/audit.js';
 import { type AuditIssue, type AuditResult } from '../core/memory-audit.js';
-import { type QualityRepairResult } from '../store/quality-repair.js';
+import type { QualityRepairResult } from '../store/quality-repair.js';
 import type { KeysetPosition } from '../util/keyset.js';
 import type { Context } from './types.js';
 export interface AuditListOpts {
@@ -16,13 +16,13 @@ export declare function auditList(ctx: Context, opts: AuditListOpts): Promise<Au
 /** The pass that removes audit errors; it leads the reason on each forget row. */
 export type AuditPass = 'audit --fix' | 'sleep-audit';
 /** Delete the memories an audit marked as errors, each with its own forget row, and answer the ids that went: a pinned or raw row stays. */
-export declare function removeAuditErrors(ctx: Context, pass: AuditPass, issues: readonly AuditIssue[]): string[];
+export declare function removeAuditErrors(ctx: Context, pass: AuditPass, issues: readonly AuditIssue[]): Promise<string[]>;
 /** The caller's memories run through the quality audit; a memory that backs an object is never marked for removal. */
-export declare function auditMemoryQuality(ctx: Context): AuditResult;
+export declare function auditMemoryQuality(ctx: Context): Promise<AuditResult>;
 /** Audit repair for the caller's tenant: a preview, or with `apply` the moves of certain defects to dormant storage behind a backup. */
-export declare function repairMemoryQuality(ctx: Context, apply: boolean): QualityRepairResult;
+export declare function repairMemoryQuality(ctx: Context, apply: boolean): Promise<QualityRepairResult>;
 /** The repair sleep and the daily runner apply once per store after an upgrade; null when it already ran there. */
-export declare function repairMemoryQualityOnce(ctx: Context): QualityRepairResult | null;
+export declare function repairMemoryQualityOnce(ctx: Context): Promise<QualityRepairResult | null>;
 export interface PruneAuditOpts {
     /** Cutoff in days. Rows with `ts < (now - N days)` are deleted. */
     olderThanDays: number;
@@ -42,5 +42,5 @@ export declare function computeCutoff(days: number, now?: Date): string;
 /** Delete the caller's tenant's audit_log rows older than `olderThanDays`, then record an `audit_prune` row as `ctx.actor`; opt-in, since
  *  retention floors (HIPAA, SOX, GDPR) apply. The row is written after the DELETE, so a call never prunes its own record.
  *  Throws on non-positive days or an empty tenant. */
-export declare function pruneAuditLog(ctx: Context, opts: PruneAuditOpts): PruneAuditResult;
+export declare function pruneAuditLog(ctx: Context, opts: PruneAuditOpts): Promise<PruneAuditResult>;
 //# sourceMappingURL=audit.d.ts.map

package/dist/api/audit.js

@@ -1,37 +1,38 @@
 // Audit log queries and retention, and the memory-quality audit with its repair passes.
-import { pruneAuditRows } from '../store/audit.js';
 import { auditMemories } from '../core/memory-audit.js';
-import { deleteEntriesAutomatically, memoriesBackingObjects } from '../store/delete-and-batch.js';
-import { loadAllEntries } from '../store/entry-reads.js';
-import { repairAutomaticMemories, repairQualityOnce } from '../store/quality-repair.js';
 import { DAY_MS } from '../util/time.js';
-import { requireGroup, storeFor } from '../store/index.js';
+import { requireGroup } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 /** Read audit events scoped to `ctx.tenantId` on the store the request runs on. Read-only, no audit emit. */
 export async function auditList(ctx, opts) {
     return requireGroup(storeFor(ctx), 'auditLog').listAuditEvents({
         tenantId: ctx.tenantId, op: opts.op, since: opts.since, limit: opts.limit, after: opts.after,
     });
 }
+function maintenanceOf(ctx) {
+    return requireGroup(storeFor(ctx), 'auditMaintenance');
+}
 /** Delete the memories an audit marked as errors, each with its own forget row, and answer the ids that went: a pinned or raw row stays. */
-export function removeAuditErrors(ctx, pass, issues) {
+export async function removeAuditErrors(ctx, pass, issues) {
     const removals = issues
         .filter((issue) => issue.severity === 'error')
         .map((issue) => ({ id: issue.memoryId, reason: `${pass}: ${issue.reason}` }));
-    return deleteEntriesAutomatically(ctx.hippoRoot, removals, ctx.actor.subject);
+    if (removals.length === 0)
+        return [];
+    return maintenanceOf(ctx).deleteAutomatically(removals, ctx.actor.subject);
 }
-// SHORTCUT: hippo.db only, as the port has no whole-tenant read, backing-object read or automatic delete with a reason; another store kind
-// answers 501 at the open. Port groups for them once a served store must audit.
 /** The caller's memories run through the quality audit; a memory that backs an object is never marked for removal. */
-export function auditMemoryQuality(ctx) {
-    return auditMemories(loadAllEntries(ctx.hippoRoot, ctx.tenantId), memoriesBackingObjects(ctx.hippoRoot));
+export async function auditMemoryQuality(ctx) {
+    const maintenance = maintenanceOf(ctx);
+    return auditMemories(await maintenance.tenantEntries(ctx.tenantId), await maintenance.objectBackedIds());
 }
 /** Audit repair for the caller's tenant: a preview, or with `apply` the moves of certain defects to dormant storage behind a backup. */
-export function repairMemoryQuality(ctx, apply) {
-    return repairAutomaticMemories(ctx.hippoRoot, { tenantId: ctx.tenantId, apply });
+export async function repairMemoryQuality(ctx, apply) {
+    return maintenanceOf(ctx).repairQuality(ctx.tenantId, apply);
 }
 /** The repair sleep and the daily runner apply once per store after an upgrade; null when it already ran there. */
-export function repairMemoryQualityOnce(ctx) {
-    return repairQualityOnce(ctx.hippoRoot, ctx.tenantId);
+export async function repairMemoryQualityOnce(ctx) {
+    return maintenanceOf(ctx).repairQualityOnce(ctx.tenantId);
 }
 /** Cutoff ISO timestamp for N days ago; exported so tests can pin "now" without mocking Date. */
 export function computeCutoff(days, now = new Date()) {
@@ -41,7 +42,7 @@ export function computeCutoff(days, now = new Date()) {
 /** Delete the caller's tenant's audit_log rows older than `olderThanDays`, then record an `audit_prune` row as `ctx.actor`; opt-in, since
  *  retention floors (HIPAA, SOX, GDPR) apply. The row is written after the DELETE, so a call never prunes its own record.
  *  Throws on non-positive days or an empty tenant. */
-export function pruneAuditLog(ctx, opts) {
+export async function pruneAuditLog(ctx, opts) {
     if (!Number.isFinite(opts.olderThanDays) || opts.olderThanDays <= 0) {
         throw new Error(`pruneAuditLog: olderThanDays must be a positive number, got ${opts.olderThanDays}`);
     }
@@ -50,7 +51,8 @@ export function pruneAuditLog(ctx, opts) {
     }
     const dryRun = opts.dryRun === true;
     const cutoff = computeCutoff(opts.olderThanDays);
-    const count = pruneAuditRows(ctx.hippoRoot, { tenantId: ctx.tenantId, cutoff, actor: ctx.actor.subject, olderThanDays: opts.olderThanDays, dryRun });
+    const prune = { tenantId: ctx.tenantId, cutoff, actor: ctx.actor.subject, olderThanDays: opts.olderThanDays, dryRun };
+    const count = await maintenanceOf(ctx).pruneAuditRows(prune);
     return { cutoff, count, dryRun };
 }
 //# sourceMappingURL=audit.js.map

package/dist/api/auth.d.ts

@@ -1,6 +1,6 @@
 import { DEFAULT_KEY_TTL_DAYS, type ApiKeyListItem, type ApiKeyListRow } from '../store/auth.js';
 import type { KeysetPosition } from '../util/keyset.js';
-import { type Context, type StoreReply } from './types.js';
+import { type Context } from './types.js';
 export interface AuthCreateOpts {
     label?: string;
     /** Defaults to `'member'`, which admin-gated routes such as `POST /v1/sleep` refuse; an admin key has to be asked for by name. */
@@ -21,7 +21,7 @@ export interface AuthCreateResult {
 }
 /** Mints a key always bound to `ctx.tenantId`; opts cannot override the tenant, or tenant A could mint a key for tenant B.
  * Admin only (ForbiddenError otherwise), and a key never outranks its minter: a resolver admin is tenant-only, so it mints members. */
-export declare function authCreate<C extends Context>(ctx: C, opts: AuthCreateOpts): StoreReply<C, AuthCreateResult>;
+export declare function authCreate(ctx: Context, opts: AuthCreateOpts): Promise<AuthCreateResult>;
 export { DEFAULT_KEY_TTL_DAYS };
 export declare const MAX_TTL_DAYS = 3650;
 export interface AuthCreateSelfOpts {
@@ -37,24 +37,23 @@ export interface AuthCreateSelfResult extends AuthCreateResult {
 }
 /** Mint a member key for the caller an auth resolver vouched for, whatever its role; the
  * binary floor, the cap's revokes, the mint and its audit rows commit or fail together. */
-export declare function authCreateSelf<C extends Context>(ctx: C, opts: AuthCreateSelfOpts): StoreReply<C, AuthCreateSelfResult>;
+export declare function authCreateSelf(ctx: Context, opts: AuthCreateSelfOpts): Promise<AuthCreateSelfResult>;
 type KeyListOpts = {
     active: boolean;
     limit?: number;
     after?: KeysetPosition;
 };
 /** One page of the caller's tenant's keys, newest first, with the row ids a next-page cursor is built from. */
-export declare function authListRows<C extends Context>(ctx: C, opts: KeyListOpts): StoreReply<C, ApiKeyListRow[]>;
+export declare function authListRows(ctx: Context, opts: KeyListOpts): Promise<ApiKeyListRow[]>;
 /** Every tenant's keys in the store, live ones only unless `active` is false; the host's own view, so the host admin only. */
 export declare function authListAllTenants(ctx: Context, active: boolean): ApiKeyListItem[];
 export interface AuthRevokeResult {
     ok: true;
     revokedAt: string;
 }
-export type AuthRevokeReply<C extends Context> = StoreReply<C, AuthRevokeResult>;
 /** Revoke a key in the caller's tenant: a member API key may revoke only itself, a resolver member only the keys it minted.
  *  The revoke and its auth_revoke row commit together on either store, so a failed audit write leaves the key live. */
-export declare function authRevoke<C extends Context>(ctx: C, keyId: string): AuthRevokeReply<C>;
+export declare function authRevoke(ctx: Context, keyId: string): Promise<AuthRevokeResult>;
 /** The tenant that owns `keyId`, or undefined for an unknown key. Host admin only: it reads across tenants,
  * so the local CLI can run revoke and grant in the key's own tenant. */
 export declare function authKeyTenant(ctx: Context, keyId: string): Promise<string | undefined>;

package/dist/api/auth.js

@@ -1,10 +1,10 @@
 // API key management: create, list, revoke, and grant or ungrant restricted scopes.
 import { BadRequestError, ForbiddenError, NotFoundError } from '../core/api-errors.js';
 import { DEFAULT_KEY_TTL_DAYS, listApiKeys, mintApiKey, } from '../store/auth.js';
-import { storeFor } from '../store/index.js';
+import { requireGroup } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 import { changeScopeGrant } from '../store/sqlite/local.js';
 import { DAY_MS } from '../util/time.js';
-import { andThen, notPorted, onStore } from './on-store.js';
 import { requireHostAdmin } from './types.js';
 const API_KEY_SUBJECT = 'api_key:';
 /** The key id an API-key actor's subject names, or null for any other actor. */
@@ -13,13 +13,12 @@ function keyIdOfSubject(subject) {
 }
 /** Mints a key always bound to `ctx.tenantId`; opts cannot override the tenant, or tenant A could mint a key for tenant B.
  * Admin only (ForbiddenError otherwise), and a key never outranks its minter: a resolver admin is tenant-only, so it mints members. */
-export function authCreate(ctx, opts) {
-    // The key and its auth_create row commit together on either store, so a failed audit write leaves no key.
-    return onStore(ctx, (port) => {
-        const keyWrites = port.keyWrites ?? notPorted(port, 'keyWrites');
-        const { plaintext, mint } = adminKeyMint(ctx, opts);
-        return andThen(keyWrites.createApiKey(mint), () => createResult(mint, plaintext));
-    });
+export async function authCreate(ctx, opts) {
+    // The key and its auth_create row commit together on every store, so a failed audit write leaves no key.
+    const keyWrites = requireGroup(storeFor(ctx), 'keyWrites');
+    const { plaintext, mint } = adminKeyMint(ctx, opts);
+    await keyWrites.createApiKey(mint);
+    return createResult(mint, plaintext);
 }
 /** A key row in the caller's tenant, made here so only its hash ever reaches a store. */
 function newKey(ctx, fields) {
@@ -70,12 +69,11 @@ function assertSelfMintOpts({ ttlDays, perSubject }) {
 }
 /** Mint a member key for the caller an auth resolver vouched for, whatever its role; the
  * binary floor, the cap's revokes, the mint and its audit rows commit or fail together. */
-export function authCreateSelf(ctx, opts) {
-    return onStore(ctx, (port) => {
-        const keyWrites = port.keyWrites ?? notPorted(port, 'keyWrites');
-        const { plaintext, mint } = selfKeyMint(ctx, opts);
-        return andThen(keyWrites.createSelfApiKey(mint), () => selfResult(mint, plaintext));
-    });
+export async function authCreateSelf(ctx, opts) {
+    const keyWrites = requireGroup(storeFor(ctx), 'keyWrites');
+    const { plaintext, mint } = selfKeyMint(ctx, opts);
+    await keyWrites.createSelfApiKey(mint);
+    return selfResult(mint, plaintext);
 }
 function selfKeyMint(ctx, opts) {
     if (!ctx.actor.viaAuthResolver) {
@@ -97,21 +95,20 @@ function selfResult({ key }, plaintext) {
     return { keyId: key.keyId, plaintext, tenantId: key.tenantId, role: 'member', expiresAt: key.expiresAt };
 }
 /** One page of the caller's tenant's keys, newest first, with the row ids a next-page cursor is built from. */
-export function authListRows(ctx, opts) {
-    return onStore(ctx, (port) => listRows(ctx, port, opts));
+export async function authListRows(ctx, opts) {
+    return listRows(ctx, storeFor(ctx), opts);
 }
 /** Every tenant's keys in the store, live ones only unless `active` is false; the host's own view, so the host admin only. */
 export function authListAllTenants(ctx, active) {
     requireHostAdmin(ctx, "Listing every tenant's keys");
     return listApiKeys(ctx.hippoRoot, { active });
 }
-function listRows(ctx, port, opts) {
-    const keyWrites = port.keyWrites ?? notPorted(port, 'keyWrites');
+async function listRows(ctx, store, opts) {
+    const keyWrites = requireGroup(store, 'keyWrites');
     const keyId = memberKeyIdOf(ctx.actor);
-    return andThen(keyId === null ? undefined : port.findApiKey(keyId), (record) => {
-        const filter = memberListFilter(ctx.actor, record?.ownerSubject);
-        return filter === null ? [] : keyWrites.listApiKeys({ ...opts, tenantId: ctx.tenantId, ...filter });
-    });
+    const record = keyId === null ? undefined : await store.findApiKey(keyId);
+    const filter = memberListFilter(ctx.actor, record?.ownerSubject);
+    return filter === null ? [] : keyWrites.listApiKeys({ ...opts, tenantId: ctx.tenantId, ...filter });
 }
 /** The key id of a member API key caller, whose owner decides what it lists; null for any other caller. */
 function memberKeyIdOf(actor) {
@@ -144,16 +141,14 @@ function assertMayRevoke(ctx, keyId, row) {
 }
 /** Revoke a key in the caller's tenant: a member API key may revoke only itself, a resolver member only the keys it minted.
  *  The revoke and its auth_revoke row commit together on either store, so a failed audit write leaves the key live. */
-export function authRevoke(ctx, keyId) {
-    return onStore(ctx, (port) => {
-        const keyAudit = port.keyAudit ?? notPorted(port, 'keyAudit');
-        assertMemberKeyRevokesSelf(ctx, keyId);
-        return andThen(port.findApiKey(keyId), (record) => {
-            assertMayRevoke(ctx, keyId, keyOwnerOf(record));
-            const revoke = { tenantId: ctx.tenantId, keyId, actor: ctx.actor.subject, at: new Date().toISOString() };
-            return andThen(keyAudit.revokeApiKey(revoke), (revokedAt) => ({ ok: true, revokedAt }));
-        });
-    });
+export async function authRevoke(ctx, keyId) {
+    const store = storeFor(ctx);
+    const keyAudit = requireGroup(store, 'keyAudit');
+    assertMemberKeyRevokesSelf(ctx, keyId);
+    const record = await store.findApiKey(keyId);
+    assertMayRevoke(ctx, keyId, keyOwnerOf(record));
+    const revoke = { tenantId: ctx.tenantId, keyId, actor: ctx.actor.subject, at: new Date().toISOString() };
+    return { ok: true, revokedAt: await keyAudit.revokeApiKey(revoke) };
 }
 function assertMemberKeyRevokesSelf(ctx, keyId) {
     if (ctx.actor.role !== 'admin' && !ctx.actor.viaAuthResolver && keyIdOfSubject(ctx.actor.subject) !== keyId) {

package/dist/api/conflicts.js

@@ -26,7 +26,7 @@ export function resolveMemoryConflict(ctx, conflictId, opts) {
     if (loadEntriesByIds(ctx.hippoRoot, pair, ctx.tenantId).filter(isLive).length < pair.length) {
         throw new NotFoundError(`conflict ${conflictId} names a memory that is superseded, archived or quarantined`);
     }
-    const resolved = resolveConflict(ctx.hippoRoot, conflictId, opts.keepId, opts.forget === true, ctx.tenantId, {
+    const resolved = resolveConflict(ctx.hippoRoot, { conflictId, keepId: opts.keepId, forgetLoser: opts.forget === true, tenantId: ctx.tenantId }, {
         rejectLoserValue: opts.rejectLoser === true,
         reason: opts.reason,
         rejectedBy: ctx.actor.subject,

package/dist/api/context-auto.js

@@ -1,4 +1,5 @@
 import { execFileSync } from 'child_process';
+import { errorFields, log } from '../util/log.js';
 const MAX_DIFF_TERMS = 10;
 const SKIPPED_PATH_TERMS = ['src', 'dist', 'test', 'tests', 'node_modules', 'index'];
 // stderr is dropped because git's warnings (line-ending notices, for one) would otherwise become query terms.
@@ -23,8 +24,9 @@ export function autoDetectContext() {
             return branch.replace(/[-_/]/g, ' ');
         }
     }
-    catch {
-        // Not a git repo or git missing: no query, so the caller lists by strength.
+    catch (err) {
+        // Not a git repo, git missing or a timeout: no query, so the caller lists by strength.
+        log.debug('auto context: no git-derived query', errorFields(err));
     }
     return '';
 }

package/dist/api/context-select.js

@@ -6,8 +6,7 @@ import { auditQueryFields, recordAuditEvent } from '../store/audit.js';
 import { isWorthSurfacing } from '../core/memory-quality.js';
 import { rankBothStores } from '../sharing/search-both.js';
 import { evalNow, strengthAblation } from '../core/ablation.js';
-import { hybridSearch } from '../search/hybrid.js';
-import { physicsSearchIn } from '../search/physics-search.js';
+import { searchByEngine } from '../search/engine.js';
 import { DEFAULT_LOCAL_BUMP } from '../core/search-types.js';
 import { compareScoredResults } from '../core/compare.js';
 import { scopeMatch } from '../core/active-scope.js';
@@ -279,24 +278,13 @@ async function searchLocalRows(ctx, plan, options) {
     const localCost = cost && ((r) => price(r.entry, primaryIsGlobal));
     const vectorCandidates = contextVectorSpec(ctx, plan, admit);
     const store = plan.local.store;
-    const ctxResults = usePhysicsCtx
-        ? await physicsSearchIn({ root: ctx.hippoRoot, store }, query, localEntries, {
-            budget: left,
-            minResults,
-            cost: localCost,
-            physicsConfig: ctxConfig.physics,
-            scope: plan.activeScope,
-            vectorCandidates,
-        })
-        : await hybridSearch(query, localEntries, {
-            budget: left,
-            minResults,
-            cost: localCost,
-            hippoRoot: ctx.hippoRoot,
-            scope: plan.activeScope,
-            vectorCandidates,
-            store,
-        });
+    const ctxResults = await searchByEngine({ root: ctx.hippoRoot, store }, query, localEntries, usePhysicsCtx ? ctxConfig.physics : null, {
+        budget: left,
+        minResults,
+        cost: localCost,
+        scope: plan.activeScope,
+        vectorCandidates,
+    });
     return ctxResults.map((r) => ({
         entry: r.entry,
         score: r.score,

package/dist/api/context.js

@@ -16,10 +16,10 @@ import { promptTokens } from '../core/prompt-recall.js';
 import { detectSecret } from '../util/secret-detect.js';
 import { isSessionDigestRow } from '../core/session-digest-row.js';
 import { addAmbientTallies, ambientStateFromTallies } from '../core/ambient.js';
-import { requireGroup, sqliteStore, storeFor } from '../store/index.js';
+import { hasGroup, requireGroup, sqliteStore } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 import { passesScopeFilterForRecall, assertScopeRequestAllowed, personalScopeOf } from '../core/recall-scope.js';
 import { finiteOr, selectBySearch, selectPinned, selectStrongest, } from './context-select.js';
-import { andThen, onStore } from './on-store.js';
 import { strengthenOf } from './recall-record.js';
 import { ownerOrSubject } from './types.js';
 export { oneCopyPerMemory } from './context-select.js';
@@ -54,7 +54,7 @@ function sourceOf(store) {
 // The pinned-only branch needs pins and recent-N candidates, not the corpus.
 async function loadAmbientEntries(source, tenantId, options) {
     const { pinnedOnly, recent, admit, recheck, window, recall, onQualityDrop } = options;
-    const ownTenant = (e) => e.tenantId === tenantId;
+    const ownTenant = (e) => e.tenant_id === tenantId;
     if (!pinnedOnly) {
         const rows = 'query' in window
             ? await source.store.searchRecallEntries(window.query, {
@@ -139,7 +139,7 @@ function warnIsolationIgnored(hippoRoot) {
 }
 /** Which stores this read can draw on, and what kind the primary one is. */
 function storesInReach(ctx, opts, local) {
-    const other = local.store.kind !== 'sqlite' ? local.store : undefined;
+    const other = hasGroup(local.store, 'localFiles') ? undefined : local.store;
     // Global memories do not establish a project boundary for task state.
     const hasLocal = other !== undefined || isInitialized(ctx.hippoRoot);
     const globalRoot = getGlobalRoot();
@@ -363,7 +363,7 @@ async function traceEmptyContext(ctx, opts, plan) {
     };
     // The empty reply is already decided, so a lost trace is logged and the call still answers.
     try {
-        await onStore(ctx, (port) => port.finishRecall({ goalLog: [], audit: [], trace }));
+        await storeFor(ctx).finishRecall({ goalLog: [], audit: [], trace });
     }
     catch (error) {
         rethrowIfSqliteBlocked(error);
@@ -387,11 +387,13 @@ async function recordRetrieval(ctx, opts, plan, selected, activeSnapshot) {
         })),
     };
     const writes = { goalLog: [], audit: [], trace, strengthen: strengthenOf(ctx, retrievedIds) };
-    // hippo.db keeps the ids as its last recall, which feeds only outcomeForLastRecall, and it alone reads a second root.
-    await onStore(ctx, (port, local) => andThen(local.finishLastRecall(writes, plan.hasGlobal ? plan.globalRoot : undefined), (traceId) => {
-        plan.obs?.traced(traceId);
-        return port.bumpRecallStats(selected.length);
-    }));
+    // The last recall feeds only outcomeForLastRecall, so a store that keeps none still finishes the recall without one.
+    const store = storeFor(ctx);
+    const traceId = store.lastRecall
+        ? await store.lastRecall.finishRecall(writes, plan.hasGlobal ? plan.globalRoot : undefined)
+        : await store.finishRecall(writes).then(() => null);
+    plan.obs?.traced(traceId);
+    await store.bumpRecallStats(selected.length);
     // Replace selectedItems entries with markRetrieved-updated copies so
     // the returned ContextResult reflects post-recall state.
     const items = selected.map((s) => ({

package/dist/api/drill-down.js

@@ -1,5 +1,6 @@
 // DAG drill-down from a summary to its children.
-import { requireGroup, storeFor } from '../store/index.js';
+import { requireGroup } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 import { estimateTokens } from '../util/token-text.js';
 import { passesScopeFilterForRecall, personalScopeOf } from '../core/recall-scope.js';
 import { classifyOriginProject } from '../core/project-identity.js';

package/dist/api/forget.d.ts

@@ -1,12 +1,12 @@
 import { type RejectFlowResult } from '../trust/reject-flow.js';
-import { type Context, type StoreReply } from './types.js';
+import { type Context } from './types.js';
 /** Delete a memory by id. Reach is checked inside the delete's write scope, and a
  * row out of reach answers as not found, so a caller learns nothing about it. */
 export interface ForgetResult {
     ok: true;
     id: string;
 }
-export declare function forget<C extends Context>(ctx: C, id: string): StoreReply<C, ForgetResult>;
+export declare function forget(ctx: Context, id: string): Promise<ForgetResult>;
 export interface RejectOpts {
     /** By-id form: reject the CURRENT content of an existing memory. */
     memoryId?: string;

package/dist/api/forget.js

@@ -1,16 +1,15 @@
 // Forget a memory, and reject or unreject a value so it cannot be stored again.
 import { BadRequestError, NotFoundError } from '../core/api-errors.js';
 import { rejectValue, unrejectValue } from '../trust/reject-flow.js';
-import { andThen, notPorted, onStore } from './on-store.js';
+import { requireGroup } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 import { requireHostAdmin } from './types.js';
 import { getMemory } from './memories.js';
 import { canTouchScope, personalScopeOf } from '../core/recall-scope.js';
-export function forget(ctx, id) {
-    return onStore(ctx, (port) => {
-        const entryWrites = port.entryWrites ?? notPorted(port, 'entryWrites');
-        const removal = { tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), id };
-        return andThen(entryWrites.forget(removal), () => ({ ok: true, id }));
-    });
+export async function forget(ctx, id) {
+    const entryWrites = requireGroup(storeFor(ctx), 'entryWrites');
+    await entryWrites.forget({ tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), id });
+    return { ok: true, id };
 }
 /** Tombstones a value's normalized digest so a matching write is refused everywhere until `unreject`; pass exactly one of `memoryId` or `value`.
  * `memoryId` also removes every live tenant row with that digest (not others' personal rows); `reason` is required. Throws on an unknown id or both/neither. */

package/dist/api/graph.js

@@ -1,4 +1,5 @@
-import { requireGroup, storeFor } from '../store/index.js';
+import { requireGroup } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 /** The entity/relation rows behind GET /v1/graph, as the caller's role, scopes and owner may see them. */
 export async function graphRows(ctx, query) {
     const { role, scopes, owner } = ctx.actor;

package/dist/api/learn.d.ts

@@ -28,7 +28,7 @@ export interface LearnResult {
     }>;
 }
 /** Learn from `repoPath`'s last `days` of commits into the caller's tenant. Host admin only. */
-export declare function learn(ctx: Context, opts: LearnOpts): LearnResult;
+export declare function learn(ctx: Context, opts: LearnOpts): Promise<LearnResult>;
 export type { InvalidationOptions, InvalidationResult, InvalidationTarget };
 /** `hippo invalidate`: weakens the caller's tenant's memories that reference `target.from`, or only the one `options.onlyId` names. */
 export declare function invalidateMemories(ctx: Context, target: InvalidationTarget, options: InvalidationOptions): InvalidationResult;