hippo-memory 2.0.0 → 2.1.0

package/dist/sharing/project-merge.js

@@ -1,4 +1,5 @@
-// `hippo projects`: list the project names a store holds, fold one into another, and repair old tags in one reversible pass.
+// `hippo projects`: list the project names a store holds, fold one into another, and repair old tags in one reversible
+// pass.
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { transcriptNotesProject } from '../agent-memories/claude-code.js';
@@ -41,13 +42,17 @@ export function listProjects(store) {
 }
 /** Refuses user-global and unknown: they are not projects, and folding them would leak or hide every row. */
 export function validateMergeNames(from, into) {
-    if (from.trim() === '' || into.trim() === '')
+    if (from.trim() === '' || into.trim() === '') {
         return 'both project names are required; user-global and unknown rows cannot be merged';
+    }
     if (from === into)
         return `${from} is already ${into}`;
     return null;
 }
-/** Folds project `from` into `into` for one tenant in one transaction; a dry run rolls back and writes nothing, mirrors included. */
+/**
+ * Folds project `from` into `into` for one tenant in one transaction; a dry run rolls back and writes nothing, mirrors
+ * included.
+ */
 export function mergeProjects(store, opts) {
     const refusal = validateMergeNames(opts.from, opts.into);
     if (refusal)
@@ -62,7 +67,8 @@ export function mergeProjects(store, opts) {
 function foldInTx(tx, from, into) {
     const all = tx.entries();
     const rows = all.filter((e) => e.origin_project === from);
-    // The sync renames the rest to `into`'s prefix and keeps their ids; only a note `into` already holds would show twice.
+    // The sync renames the rest to `into`'s prefix and keeps their ids; only a note `into` already holds would show
+    // twice.
     const held = new Set(all.filter((e) => e.origin_project === into && !e.superseded_by && isImport(e)).map(noteKey));
     const setAside = [];
     for (const row of rows) {
@@ -90,11 +96,18 @@ function noteKey(entry) {
     const rest = entry.source.slice(AGENT_MEMORY_SOURCE_PREFIX.length);
     return `${rest.split(':')[0]}:${rest.slice(rest.indexOf('/') + 1)}`;
 }
-/** Live imports under a project name whose exact text a user-global import holds: a session folder's notes stamped with the folder it ended in. */
+/**
+ * Live imports under a project name whose exact text a user-global import holds: a session folder's notes stamped with
+ * the folder it ended in.
+ */
 function importCopies(store) {
     const live = store.entries().filter((e) => !e.superseded_by && isImport(e));
     const userGlobal = new Set(live.filter((e) => e.origin_project === '').map((e) => duplicateKey(e.content)));
-    return live.filter((e) => e.origin_project && e.kind !== 'raw' && !e.pinned && toolTag(e.source) !== null && userGlobal.has(duplicateKey(e.content)));
+    return live.filter((e) => e.origin_project &&
+        e.kind !== 'raw' &&
+        !e.pinned &&
+        toolTag(e.source) !== null &&
+        userGlobal.has(duplicateKey(e.content)));
 }
 /** Imports to set aside. The global store also checks each Claude session folder a compaction recorded: its
  * notes under any other project are misfiled, edited or not, and a text copy in the right folder is kept. */
@@ -123,28 +136,35 @@ function strayImports(store, hippoRoot) {
     for (const [dir, ids] of owners) {
         if (ids.size !== 1)
             continue;
-        // Its names before the id, and names folded into it, are the owner's too: the next sync moves those prefixes under the id.
+        // Its names before the id, and names folded into it, are the owner's too: the next sync moves those prefixes under
+        // the id.
         const [names] = ids.values();
         const own = new Set([...names, ...foldedInto(edges, names)]);
-        for (const origin of new Set([...origins, ...own]))
+        for (const origin of new Set([...origins, ...own])) {
             (own.has(origin) ? right : wrong).add(containerPrefix('claude-code', containerId(dir, 'project', platform, origin)));
+        }
     }
     const prefix = (e) => e.source.slice(0, e.source.indexOf('/', tool.length) + 1);
     const misfiled = live.filter((e) => wrong.has(prefix(e)));
     const seen = new Set(misfiled.map((e) => e.id));
     return [...misfiled, ...copies.filter((e) => !seen.has(e.id) && !right.has(prefix(e)))];
 }
-/** The global store reads each name's recorded session folders, where a compaction's name came from its cwd; a project store folds only its own folder name. */
+/**
+ * The global store reads each name's recorded session folders, where a compaction's name came from its cwd; a project
+ * store folds only its own folder name.
+ */
 function planFolds(store, hippoRoot, globalFolds) {
     // A name someone merged into by hand stays: undoing their choice would rest on the resolver alone.
     const chosen = new Set(store.auditEvents('project_merge').map((e) => e.metadata.into));
-    if (!isGlobalStoreRoot(hippoRoot))
+    if (!isGlobalStoreRoot(hippoRoot)) {
         return { folds: ownLegacyFold(store, hippoRoot).filter((f) => !chosen.has(f.from)), collisions: [] };
+    }
     const rows = store.compactionOriginsWithCwd();
     const today = new Map();
     for (const { origin, cwd } of rows) {
-        if (fs.existsSync(cwd))
+        if (fs.existsSync(cwd)) {
             today.set(origin, (today.get(origin) ?? new Set()).add(resolveProjectIdentity(cwd).name));
+        }
     }
     const folds = [];
     const collisions = [];
@@ -161,9 +181,12 @@ function planFolds(store, hippoRoot, globalFolds) {
     const sources = new Set(folds.map((f) => f.from));
     return { folds: globalFolds ? folds.filter((f) => !sources.has(f.into)) : [], collisions };
 }
-/** A project store's rows, dormant snapshots and compaction records written before its id existed carry its folder name. */
+/**
+ * A project store's rows, dormant snapshots and compaction records written before its id existed carry its folder name.
+ */
 function ownLegacyFold(store, hippoRoot) {
-    // A shared store's rows carry their callers' names, so one matching its folder's is a member's project, not a legacy tag.
+    // A shared store's rows carry their callers' names, so one matching its folder's is a member's project, not a legacy
+    // tag.
     if (isSharedStore(hippoRoot))
         return [];
     const { name, legacyName } = resolveProjectIdentity(path.dirname(path.resolve(hippoRoot)));
@@ -174,16 +197,24 @@ function ownLegacyFold(store, hippoRoot) {
         || store.dormant().some((s) => s.entry.origin_project === legacyName);
     return held ? [{ from: legacyName, into: name }] : [];
 }
-/** Reads only, so doctor and a dry run take no write lock; merged rows are planned before any fold, so a few may re-tag differently once folds apply. */
+/**
+ * Reads only, so doctor and a dry run take no write lock; merged rows are planned before any fold, so a few may re-tag
+ * differently once folds apply.
+ */
 export function planProjectRepair(store, hippoRoot, globalFolds = true) {
     const { folds, collisions } = planFolds(store, hippoRoot, globalFolds);
-    return { copies: strayImports(store, hippoRoot).map((e) => e.id), folds, collisions, ...planUserGlobalRepair(store, folds) };
+    return {
+        copies: strayImports(store, hippoRoot).map((e) => e.id),
+        folds,
+        collisions,
+        ...planUserGlobalRepair(store, folds),
+    };
 }
 /** Parents read with `folds` already applied, so a plan matches what apply does after folding. */
 function planUserGlobalRepair(store, folds) {
     const all = store.entries();
     const renamed = new Map(folds.map((f) => [f.from, f.into]));
-    const after = (origin) => (origin ? renamed.get(origin) ?? origin : origin ?? null);
+    const after = (origin) => (origin ? (renamed.get(origin) ?? origin) : (origin ?? null));
     const origins = new Map(store.dormant().map((s) => [s.entry.id, after(s.entry.origin_project)]));
     for (const e of all)
         origins.set(e.id, after(e.origin_project));
@@ -240,7 +271,8 @@ function repairIsEmpty(r) {
     return r.copies.length + r.folds.length + r.toProject.length + r.setAside.length === 0;
 }
 /** Sleep runs repair once per store, so an upgrade needs no command. Global-store folds stay
- *  with `hippo projects repair`: their evidence is compaction folders, blind to a same-named repo that never compacted. */
+ * with `hippo projects repair`: their evidence is compaction folders, blind to a same-named repo that never compacted.
+ */
 export function repairOnceOnSleep(store) {
     if (store.repairedOnce())
         return null;

package/dist/sharing/search-both.d.ts

@@ -33,11 +33,15 @@ export interface HybridSearchOptions extends SearchOptions {
     summaryDeboost?: number;
     /** Propagated. Default true (1.05 boost if rebuilt within 7d). */
     summaryFreshness?: boolean;
-    /** Optional admission predicate applied to the loaded candidates of BOTH stores before ranking, cross-store dedupe and budgeting,
-     *  so an excluded row cannot shadow its admitted duplicate or saturate the budget. Undefined (recall paths never set it) means no filter. */
+    /** Optional admission predicate applied to the loaded candidates of BOTH stores before ranking, cross-store dedupe
+     * and budgeting,
+     * so an excluded row cannot shadow its admitted duplicate or saturate the budget. Undefined (recall paths never
+     * set it) means no filter. */
     entryFilter?: (entry: MemoryEntry) => boolean;
-    /** Recall scope filter for `searchBothHybrid`: absent is the only unfiltered mode; present uses `loadRecallSearchEntries` plus a JS post-filter.
-     *  `{}` = default-deny (legacy and `<source>:private:*` excluded); `{ requested: 'X' }` = exact; `{ requested: 'X', additive: true }` = default plus X.
+    /** Recall scope filter for `searchBothHybrid`: absent is the only unfiltered mode; present uses
+     * `loadRecallSearchEntries` plus a JS post-filter.
+     * `{}` = default-deny (legacy and `<source>:private:*` excluded); `{ requested: 'X' }` = exact; `{ requested: 'X',
+     * additive: true }` = default plus X.
      *  An object, not `string | null`, because the sibling `scope` option already gives null a different meaning.
      *  Do not pass `{}` casually from non-recall paths. */
     recallScope?: {

package/dist/sharing/search-both.js

@@ -10,10 +10,10 @@ import { DEFAULT_LOCAL_BUMP, DEFAULT_RECALL_BUDGET } from '../core/search-types.
 import { startQueryEmbedDeadline } from '../search/vector.js';
 import { evalNow } from '../core/ablation.js';
 import { duplicateKey } from '../util/same-text.js';
-import { errorMessage, log } from '../util/log.js';
+import { errorFields, errorMessage, log } from '../util/log.js';
 // The rows are already copied; a failed background embed only delays vectors, so it warns instead of throwing.
 export function logEmbedAllFailure(caller, err) {
-    log.warn(`${caller}: background embed failed (${errorMessage(err)}); run 'hippo embed' to backfill`);
+    log.warn(`${caller}: background embed failed (${errorMessage(err)}); run 'hippo embed' to backfill`, errorFields(err));
 }
 /** Search both local and global stores and merge: local results are boosted 1.2x to prefer project context.
  *  Returns results sorted by adjusted score within the combined token budget. */
@@ -71,9 +71,11 @@ function dedupeByContent(tagged) {
  *  Async version of searchBoth that calls hybridSearch instead of search. */
 export async function searchBothHybrid(query, localRoot, globalRoot, options = {}) {
     const { includeSuperseded, asOf, tenantId, entryFilter, recallScope } = options;
-    // With an admission filter, lift the per-store candidate cap (default 200) to a bounded 5000: excluded rows could otherwise fill the window first.
+    // With an admission filter, lift the per-store candidate cap (default 200) to a bounded 5000: excluded rows could
+    // otherwise fill the window first.
     const searchWindow = entryFilter ? 5000 : undefined;
-    // Recall mode: push the scope predicate into SQL like api.recall, so quarantine/private rows never enter the candidates, shadow duplicates or use budget.
+    // Recall mode: push the scope predicate into SQL like api.recall, so quarantine/private rows never enter the
+    // candidates, shadow duplicates or use budget.
     // The JS post-filter below is the regex-only `<source>:private:*` half plus defense in depth on exact match.
     const loadEntries = (root) => {
         if (!fs.existsSync(root))
@@ -89,30 +91,35 @@ export async function searchBothHybrid(query, localRoot, globalRoot, options = {
             })
             : loadSearchEntries(root, query, searchWindow, tenantId);
     };
-    const passesScope = (e) => !recallScope || (recallScope.additive
-        ? passesCliRecallScopeFilter(e.scope ?? null, recallScope.requested) || passesScopeFilterForRecall(e.scope ?? null, undefined, recallScope.ownScope)
-        : passesScopeFilterForRecall(e.scope ?? null, recallScope.requested, recallScope.ownScope));
+    const passesScope = (e) => !recallScope ||
+        (recallScope.additive
+            ? passesCliRecallScopeFilter(e.scope ?? null, recallScope.requested) ||
+                passesScopeFilterForRecall(e.scope ?? null, undefined, recallScope.ownScope)
+            : passesScopeFilterForRecall(e.scope ?? null, recallScope.requested, recallScope.ownScope));
     const admit = (e) => passesScope(e) && (!entryFilter || entryFilter(e));
     const localEntries = loadEntries(localRoot).filter(admit);
     const globalEntries = loadEntries(globalRoot).filter(admit);
     // The vector arm loads under the same SQL rules as loadEntries, then the same JS admission.
     const vectorCandidates = {
         tenantId,
-        scope: recallScope ? recallScopeFilter(recallScope.requested, recallScope.additive ? 'additive' : 'exact', recallScope.ownScope) : undefined,
+        scope: recallScope
+            ? recallScopeFilter(recallScope.requested, recallScope.additive ? 'additive' : 'exact', recallScope.ownScope)
+            : undefined,
         includeSuperseded: !recallScope || Boolean(includeSuperseded) || Boolean(asOf),
         admit,
     };
-    return rankBothStores(query, { local: localRoot, global: globalRoot }, { local: localEntries, global: globalEntries }, vectorCandidates, options);
+    const roots = { local: localRoot, global: globalRoot };
+    return rankBothStores(query, roots, { local: localEntries, global: globalEntries }, vectorCandidates, options);
 }
 /** Hybrid ranking of rows already loaded from each store: the local bump, one copy per text, then the shared budget. */
 export async function rankBothStores(query, roots, entries, vectorCandidates, options = {}) {
-    const { budget = DEFAULT_RECALL_BUDGET, now = evalNow(), embeddingWeight, explain, mmr, mmrLambda, localBump = DEFAULT_LOCAL_BUMP, minResults, cost, scope, includeSuperseded, asOf, summaryDeboost, summaryFreshness } = options;
+    const { budget = DEFAULT_RECALL_BUDGET, now = evalNow(), embeddingWeight, explain, mmr, mmrLambda, localBump = DEFAULT_LOCAL_BUMP, minResults, cost, scope, includeSuperseded, asOf, summaryDeboost, summaryFreshness, } = options;
     if (entries.local.length === 0 && entries.global.length === 0)
         return [];
     // One deadline for both stores, so a provider that stalls on the first is not waited on again for the second.
     const shared = {
-        budget, now, embeddingWeight, explain, mmr, mmrLambda, minResults, cost, scope, includeSuperseded, asOf, summaryDeboost, summaryFreshness,
-        vectorCandidates, queryEmbedDeadline: startQueryEmbedDeadline(),
+        budget, now, embeddingWeight, explain, mmr, mmrLambda, minResults, cost, scope, includeSuperseded, asOf,
+        summaryDeboost, summaryFreshness, vectorCandidates, queryEmbedDeadline: startQueryEmbedDeadline(),
     };
     const localResults = await hybridSearch(query, entries.local, { ...shared, hippoRoot: roots.local });
     const globalResults = await hybridSearch(query, entries.global, { ...shared, hippoRoot: roots.global });

package/dist/sharing/share.d.ts

@@ -2,7 +2,8 @@ import { MemoryEntry } from '../core/memory.js';
 /** Tags whose rows only a hand-run share or promote may copy to the global store; derived rows inherit them. */
 export declare const NEVER_AUTO_SHARE_TAGS: ReadonlySet<string>;
 export declare function neverAutoShareTags(sources: readonly MemoryEntry[]): string[];
-/** Tags whose rows sleep keeps as written: never merged, never sent to LLM extraction. Conflict detection keeps its own list. */
+/** Tags whose rows sleep keeps as written: never merged, never
+ * sent to LLM extraction. Conflict detection keeps its own list. */
 export declare const NO_MERGE_TAGS: ReadonlySet<string>;
 /** The transfer score a memory needs before sleep or `hippo share --auto` copies it to the global store. */
 export declare const AUTO_SHARE_MIN_SCORE = 0.6;
@@ -16,7 +17,8 @@ export declare function shareMemory(localRoot: string, id: string, options?: {
     tenantId?: string;
     skipEmbed?: boolean;
 }): MemoryEntry | null;
-/** List all projects that contributed memories to the global store, parsed from 'shared:<project>:' or 'promoted:<path>' sources.
+/** List all projects that contributed memories to the global store, parsed from 'shared:<project>:' or
+ * 'promoted:<path>' sources.
  *  `tenantId` filters to one tenant; undefined is host-wide (legacy callers: CLI standalone, dashboard). */
 export declare function listPeers(globalRoot?: string, tenantId?: string): Array<{
     project: string;
@@ -28,8 +30,10 @@ type AutoShareStats = {
     rejectedSkipped?: number;
     neverAutoShareSkipped?: number;
 };
-/** Auto-share local memories with high transfer scores, not already global and without a NEVER_AUTO_SHARE_TAGS tag; `options.tenantId` scopes the LOCAL read.
- *  `options.stats` is an opt-in out-param: `secretSkipped` counts shares the secret veto prevented, `rejectedSkipped` rejection refusals (0 under `dryRun`). */
+/** Auto-share local memories with high transfer scores, not already global and without a NEVER_AUTO_SHARE_TAGS tag;
+ * `options.tenantId` scopes the LOCAL read.
+ * `options.stats` is an opt-in out-param: `secretSkipped` counts shares the secret veto prevented, `rejectedSkipped`
+ * rejection refusals (0 under `dryRun`). */
 export declare function autoShare(localRoot: string, options?: {
     minScore?: number;
     dryRun?: boolean;

package/dist/sharing/share.js

@@ -5,7 +5,7 @@ import * as path from 'path';
 import { generateId, COMPACTION_MEMORY_TAG } from '../core/memory.js';
 import { AGENT_MEMORY_SOURCE_PREFIX, AGENT_MEMORY_TAGS } from '../core/agent-memory-tools.js';
 import { writeEntriesSkippingRejected, writeEntry } from '../store/entry-writes.js';
-import { loadAllEntries, loadEntryTextKeys, readEntry } from '../store/entry-reads.js';
+import { loadAllEntries, loadEntriesWithSignals, loadEntryTextKeys, readEntry, } from '../store/entry-reads.js';
 import { tallySources } from '../store/candidates.js';
 import { isPersonalScope } from '../core/recall-scope.js';
 import { fallbackOrigin } from '../core/project-identity.js';
@@ -37,7 +37,8 @@ export const NEVER_AUTO_SHARE_TAGS = new Set([
 export function neverAutoShareTags(sources) {
     return [...NEVER_AUTO_SHARE_TAGS].filter((tag) => sources.some((s) => s.tags.includes(tag)));
 }
-/** Tags whose rows sleep keeps as written: never merged, never sent to LLM extraction. Conflict detection keeps its own list. */
+/** Tags whose rows sleep keeps as written: never merged, never
+ * sent to LLM extraction. Conflict detection keeps its own list. */
 export const NO_MERGE_TAGS = new Set([
     'extracted',
     'session-digest',
@@ -46,6 +47,13 @@ export const NO_MERGE_TAGS = new Set([
 ]);
 /** The transfer score a memory needs before sleep or `hippo share --auto` copies it to the global store. */
 export const AUTO_SHARE_MIN_SCORE = 0.6;
+/** Every trait that lifts transferScore above 0.5 or makes autoShare skip a row before scoring it. */
+const AUTO_SHARE_SIGNALS = {
+    tags: [...TRANSFERABLE_TAGS, ...NEVER_AUTO_SHARE_TAGS],
+    sourcePrefix: AGENT_MEMORY_SOURCE_PREFIX,
+    minRetrievals: 3,
+    valences: ['negative', 'critical'],
+};
 /** Estimate how well a memory would transfer to other projects.
  *  Returns 0..1 where >0.5 = good candidate for sharing. */
 export function transferScore(entry) {
@@ -70,7 +78,8 @@ export function transferScore(entry) {
 /** Share a memory to the global store with attribution (source enriched with project path and timestamp).
  *  Returns the new entry, or null if the transfer score is too low. */
 export function shareMemory(localRoot, id, options = {}) {
-    // tenantId is optional for single-tenant callers (autoShare passes only `{ force: true }`); MCP/REST hosts MUST pass it so tenant A cannot share
+    // tenantId is optional for single-tenant callers (autoShare passes only `{ force: true }`); MCP/REST hosts MUST pass
+    // it so tenant A cannot share
     // tenant B's memory to global (readEntry returns null on a cross-tenant lookup).
     const entry = readEntry(localRoot, id, options.tenantId);
     if (!entry)
@@ -81,19 +90,22 @@ export function shareMemory(localRoot, id, options = {}) {
     initGlobal();
     const globalRoot = getGlobalRoot();
     writeEntry(globalRoot, globalEntry);
-    // Embed here unless the caller opts out: autoShare sets skipEmbed to batch one embedAll(), since embedMemory rewrites the whole index per call.
+    // Embed here unless the caller opts out: autoShare sets skipEmbed to batch one embedAll(), since embedMemory rewrites
+    // the whole index per call.
     if (!options.skipEmbed) {
         void embedMemory(globalRoot, globalEntry);
     }
     return globalEntry;
 }
-/** The global copy of a local row, or null when its transfer score is too low and `force` is off; throws when the row may not be shared. */
+/** The global copy of a local row, or null when its transfer score is too low and `force` is off; throws when the
+ * row may not be shared. */
 function toGlobalEntry(localRoot, entry, force) {
     assertShareable(entry, entry.id);
     const score = transferScore(entry);
     if (score < 0.3 && !force)
         return null;
-    // The label keeps the folder name for a user-global row; a NULL row gets `shared::`, which originFromSource reads as no project.
+    // The label keeps the folder name for a user-global row; a NULL
+    // row gets `shared::`, which originFromSource reads as no project.
     const fallbackName = path.basename(path.resolve(localRoot, '..'));
     const originName = entry.origin_project ?? fallbackOrigin(localRoot);
     const label = originName === '' ? fallbackName : (originName ?? '');
@@ -105,7 +117,8 @@ function toGlobalEntry(localRoot, entry, force) {
     };
 }
 function assertShareable(entry, id) {
-    // Secret veto: secrets never reach the global store, even with --force; throw loudly, since a silent null reads as "low transfer score" and invites retries.
+    // Secret veto: secrets never reach the global store, even with --force; throw loudly, since a silent null reads as
+    // "low transfer score" and invites retries.
     const secret = detectSecret(entry);
     if (secret.flagged) {
         throw new BadRequestError(`Refusing to share ${id} to the global store: content matches secret material (${secret.reason}). ` +
@@ -113,13 +126,15 @@ function assertShareable(entry, id) {
     }
     // A quarantined row is unreviewed input, not a lesson; sharing it would spread poison globally.
     if (isQuarantineScope(entry.scope)) {
-        throw new BadRequestError(`Refusing to share ${id}: it is quarantined pending review. Approve it first via 'hippo quarantine approve ${id}'.`);
+        throw new BadRequestError(`Refusing to share ${id}: it is quarantined pending review. ` +
+            `Approve it first via 'hippo quarantine approve ${id}'.`);
     }
     if (isPersonalScope(entry.scope ?? null)) {
         throw new BadRequestError(`Refusing to share ${id}: it is a personal memory and stays with its owner on this server.`);
     }
 }
-/** List all projects that contributed memories to the global store, parsed from 'shared:<project>:' or 'promoted:<path>' sources.
+/** List all projects that contributed memories to the global store, parsed from 'shared:<project>:' or
+ * 'promoted:<path>' sources.
  *  `tenantId` filters to one tenant; undefined is host-wide (legacy callers: CLI standalone, dashboard). */
 export function listPeers(globalRoot, tenantId) {
     const root = globalRoot ?? getGlobalRoot();
@@ -158,8 +173,9 @@ export function listPeers(globalRoot, tenantId) {
 }
 function isAutoShareCandidate(entry, globalContentSet, minScore, stats) {
     // shareMemory refuses quarantined and personal rows; filtering here keeps sleep from aborting on one.
-    if (isQuarantineScope(entry.scope ?? null) || isPersonalScope(entry.scope ?? null) || !isReusable(entry))
+    if (isQuarantineScope(entry.scope ?? null) || isPersonalScope(entry.scope ?? null) || !isReusable(entry)) {
         return false;
+    }
     // Before the score: these rows describe one project only, and a git seed's 'error' tag clears the bar.
     if (entry.tags.some((t) => NEVER_AUTO_SHARE_TAGS.has(t)) || entry.source.startsWith(AGENT_MEMORY_SOURCE_PREFIX)) {
         if (stats)
@@ -172,7 +188,8 @@ function isAutoShareCandidate(entry, globalContentSet, minScore, stats) {
     // Skip if already shared (same text apart from spacing)
     if (globalContentSet.has(duplicateKey(entry.content)))
         return false;
-    // Secret veto, checked LAST so the stats counter only counts rows it withheld (a row failing the score or dedupe gate was never going to share).
+    // Secret veto, checked LAST so the stats counter only counts rows it withheld (a row failing the score or dedupe gate
+    // was never going to share).
     // shareMemory would throw here; filtering keeps the sleep pipeline fail-safe.
     if (detectSecret(entry).flagged) {
         if (stats)
@@ -181,7 +198,8 @@ function isAutoShareCandidate(entry, globalContentSet, minScore, stats) {
     }
     return true;
 }
-// A row the GLOBAL store's rejection tombstones refuse is audited and skipped, so it cannot abort the autoShare sleep phase.
+// A row the GLOBAL store's rejection tombstones refuse is audited and skipped, so it cannot abort the autoShare sleep
+// phase.
 // The candidates are rows already held, written in one transaction; the caller embeds once via embedAll() afterwards.
 function shareCandidates(localRoot, globalRoot, candidates, stats) {
     const shared = [];
@@ -205,11 +223,17 @@ function shareCandidates(localRoot, globalRoot, candidates, stats) {
     }
     return shared;
 }
-/** Auto-share local memories with high transfer scores, not already global and without a NEVER_AUTO_SHARE_TAGS tag; `options.tenantId` scopes the LOCAL read.
- *  `options.stats` is an opt-in out-param: `secretSkipped` counts shares the secret veto prevented, `rejectedSkipped` rejection refusals (0 under `dryRun`). */
+/** Auto-share local memories with high transfer scores, not already global and without a NEVER_AUTO_SHARE_TAGS tag;
+ * `options.tenantId` scopes the LOCAL read.
+ * `options.stats` is an opt-in out-param: `secretSkipped` counts shares the secret veto prevented, `rejectedSkipped`
+ * rejection refusals (0 under `dryRun`). */
 export function autoShare(localRoot, options = {}) {
     const { minScore = AUTO_SHARE_MIN_SCORE, dryRun = false } = options;
-    const localEntries = loadAllEntries(localRoot, options.tenantId);
+    // A row with none of these signals scores at most 0.5, so above that
+    // bar only signal rows can share or count as never-auto-share skips.
+    const localEntries = minScore > 0.5
+        ? loadEntriesWithSignals(localRoot, AUTO_SHARE_SIGNALS, options.tenantId)
+        : loadAllEntries(localRoot, options.tenantId);
     initGlobal();
     const globalRoot = getGlobalRoot();
     // Host-wide read. The global store IS the union across all tenants;

package/dist/store/ambient.js

@@ -4,9 +4,11 @@ import { SECRET_TAGS } from '../util/secret-detect.js';
 import { onHandle, openStore } from './open.js';
 import { jsonList } from './candidates.js';
 import { originInSql } from '../core/project-identity.js';
-import { AMBIENT_FRESH_WINDOW_MS, HIGH_SCHEMA_FIT_ABOVE, isErrorTagged } from '../core/ambient.js';
+import { AMBIENT_FRESH_WINDOW_MS, isErrorTagged } from '../core/ambient.js';
+import { HIGH_SCHEMA_FIT } from '../core/memory.js';
 import { placeholders } from '../util/sql.js';
-// SHORTCUT: mirrors loadContextCandidates' WHERE (request-path snapshots pin the match); share it once store.ts is split.
+// SHORTCUT: mirrors loadContextCandidates' WHERE (request-path snapshots pin the match); share it once store.ts is
+// split.
 function contextRowsWhere(tenantId, filter) {
     const where = ['tenant_id = ?', `COALESCE(superseded_by, '') = ''`, `COALESCE(kind, '') != 'archived'`];
     const params = [tenantId];
@@ -25,12 +27,14 @@ function contextRowsWhere(tenantId, filter) {
     }
     return { where, params };
 }
-/** A secret tag's row, the half of detectSecret SQL can check; the LIKEs only skip json_each on rows that cannot match. */
+/** A secret tag's row, the half of detectSecret SQL can check; the LIKEs only skip json_each on rows that cannot
+ * match. */
 function secretTaggedSql() {
     const tags = [...SECRET_TAGS];
     return {
         sql: `((${tags.map(() => 'tags_json LIKE ?').join(' OR ')})
-      AND EXISTS (SELECT 1 FROM json_each(${jsonList('tags_json')}) WHERE lower(value) IN (${placeholders(tags.length)})))`,
+      AND EXISTS (SELECT 1 FROM json_each(${jsonList('tags_json')}) WHERE lower(value) IN
+      (${placeholders(tags.length)})))`,
         params: [...tags.map((t) => `%"${t}"%`), ...tags],
     };
 }
@@ -57,7 +61,7 @@ export function loadAmbientTallies(hippoRoot, tenantId, filter) {
       '[' || COALESCE(group_concat(${jsonList('tags_json')}, ','), '') || ']' AS tagLists
       FROM memories
       WHERE ${where.join(' AND ')}
-        AND ((${originInSql(filter.currentProject)} AND origin_project != '') OR NOT ${secret.sql})`).get(freshAfter, HIGH_SCHEMA_FIT_ABOVE, ...params, ...filter.currentProject, ...secret.params);
+        AND ((${originInSql(filter.currentProject)} AND origin_project != '') OR NOT ${secret.sql})`).get(freshAfter, HIGH_SCHEMA_FIT, ...params, ...filter.currentProject, ...secret.params);
         const tagCounts = new Map();
         let errors = 0;
         const lists = /* SAFETY: jsonList yields an array per row, joined into one array */ JSON.parse(row.tagLists);

package/dist/store/audit-event.d.ts

@@ -11,7 +11,7 @@ export interface AuditOptions {
 /** Emit an audit event for a mutation. Never throws: the SQLite store stays the source of truth,
  * and a failed audit write shows up as missing rows. */
 export declare function audit(db: ReturnType<typeof openHippoDb>, op: AuditOp, options?: AuditOptions): void;
-/** Refusal audit for the rejected-value guard, written by the transaction owner after rollback so the caller's own rollback cannot claw it back.
- * Best-effort like `audit()`: never throws. */
+/** Refusal audit for the rejected-value guard, written by the transaction owner after rollback so the caller's own
+ * rollback cannot claw it back. Best-effort like `audit()`: never throws. */
 export declare function auditRejectionRefusal(db: ReturnType<typeof openHippoDb>, err: RejectedValueError, actor: string): void;
 //# sourceMappingURL=audit-event.d.ts.map

package/dist/store/audit-event.js

@@ -18,9 +18,14 @@ export function audit(db, op, options = {}) {
         reportAuditWriteFailure(op, String(error), targetId);
     }
 }
-/** Refusal audit for the rejected-value guard, written by the transaction owner after rollback so the caller's own rollback cannot claw it back.
- * Best-effort like `audit()`: never throws. */
+/** Refusal audit for the rejected-value guard, written by the transaction owner after rollback so the caller's own
+ * rollback cannot claw it back. Best-effort like `audit()`: never throws. */
 export function auditRejectionRefusal(db, err, actor) {
-    audit(db, 'reject_refusal', { targetId: err.entryId, metadata: { digest: err.digest, reason: err.reason }, actor, tenantId: err.tenantId });
+    audit(db, 'reject_refusal', {
+        targetId: err.entryId,
+        metadata: { digest: err.digest, reason: err.reason },
+        actor,
+        tenantId: err.tenantId,
+    });
 }
 //# sourceMappingURL=audit-event.js.map

package/dist/store/audit.d.ts

@@ -53,14 +53,16 @@ export interface ListAuditAfterOpts {
 /** Cursor read: events with id > afterId, ascending. Retention prune leaves gaps in the ids,
  * so resume from the last id returned, never from a count. */
 export declare function listAuditEventsAfter(db: DatabaseSyncLike, opts: ListAuditAfterOpts): AuditEvent[];
-/** Latest time each target got a good outcome, from the audit rows, read on a handle of its own; unlike queryAuditEvents it has no row cap. */
+/** Latest time each target got a good outcome, from the audit rows, read on a handle of its own; unlike
+ * queryAuditEvents it has no row cap. */
 export declare function confirmedOutcomeTimes(hippoRoot: string, tenantId: string): Map<string, string>;
 /** An audit row that did not land, with what its write threw. */
 export interface FailedAuditEvent {
     event: AppendAuditOpts;
     error: unknown;
 }
-/** Appends each event as its own write on one handle, so a row that fails drops only itself. Returns the rows that failed, for the caller to report. */
+/** Appends each event as its own write on one handle, so a row that fails drops only itself. Returns the rows that
+ * failed, for the caller to report. */
 export declare function recordAuditEventsRowByRow(hippoRoot: string, events: readonly AppendAuditOpts[]): FailedAuditEvent[];
 export interface AuditPrune {
     tenantId: string;
@@ -71,6 +73,7 @@ export interface AuditPrune {
     /** Count the rows and delete nothing. */
     dryRun: boolean;
 }
-/** Deletes a tenant's audit rows older than the cutoff and records the prune in the same write scope, so neither lands alone; returns the row count. */
+/** Deletes a tenant's audit rows older than the cutoff and records the prune in the same write scope, so neither lands
+ * alone; returns the row count. */
 export declare function pruneAuditRows(hippoRoot: string, prune: AuditPrune): number;
 //# sourceMappingURL=audit.d.ts.map

package/dist/store/audit.js

@@ -27,7 +27,8 @@ export const AUDIT_OPS = [
     'recall_autodebias_hint_no_class_match', // telemetry: forward-claim detected, no class scored
     'recall_autodebias_hint_tiebreak', // telemetry: forward-claim detected, two or more classes tied
     'recall_anchor_detected_query_repeat', // emitted by the anchoring detector when the same query returns the same top-1
-    'recall_anchor_detected_memory_dominance', // emitted by the anchoring detector when one memory wins top-1 across distinct queries
+    // emitted by the anchoring detector when one memory wins top-1 across distinct queries
+    'recall_anchor_detected_memory_dominance',
     'recall_anchor_skipped_no_session', // telemetry: no sessionId, so ring tracking was skipped
     'recall_availability_detected', // emitted when the availability/recency-bias hint fires
     'decision_create', // emitted by saveDecision
@@ -124,7 +125,8 @@ export function queryAuditEvents(db, opts) {
     const limit = Math.max(1, Math.min(opts.limit ?? DEFAULT_LIST_LIMIT, 10001));
     // SAFETY: AUDIT_COLUMNS names exactly the AuditRow columns, in this order.
     const rows = db
-        .prepare(`SELECT ${AUDIT_COLUMNS} FROM audit_log WHERE ${where.join(' AND ')}${after.sql} ORDER BY ts DESC, id DESC LIMIT ?`)
+        .prepare(`SELECT ${AUDIT_COLUMNS} FROM audit_log WHERE ${where.join(' AND ')}${after.sql} ORDER BY ts DESC, id DESC ` +
+        `LIMIT ?`)
         .all(...params, ...after.params, limit);
     return rows.map(rowToAuditEvent);
 }
@@ -166,7 +168,8 @@ function deleteAuditBefore(db, tenantId, cutoff) {
         .run(tenantId, cutoff);
     return Number(result.changes ?? 0);
 }
-/** Latest time each target got a good outcome, from the audit rows, read on a handle of its own; unlike queryAuditEvents it has no row cap. */
+/** Latest time each target got a good outcome, from the audit rows, read on a handle of its own; unlike
+ * queryAuditEvents it has no row cap. */
 export function confirmedOutcomeTimes(hippoRoot, tenantId) {
     const db = openHippoDb(hippoRoot);
     try {
@@ -208,7 +211,8 @@ function safeJsonParse(raw, id) {
         return {};
     }
 }
-/** Appends each event as its own write on one handle, so a row that fails drops only itself. Returns the rows that failed, for the caller to report. */
+/** Appends each event as its own write on one handle, so a row that fails drops only itself. Returns the rows that
+ * failed, for the caller to report. */
 export function recordAuditEventsRowByRow(hippoRoot, events) {
     const db = openHippoDb(hippoRoot);
     try {
@@ -227,7 +231,8 @@ export function recordAuditEventsRowByRow(hippoRoot, events) {
         closeHippoDb(db);
     }
 }
-/** Deletes a tenant's audit rows older than the cutoff and records the prune in the same write scope, so neither lands alone; returns the row count. */
+/** Deletes a tenant's audit rows older than the cutoff and records the prune in the same write scope, so neither lands
+ * alone; returns the row count. */
 export function pruneAuditRows(hippoRoot, prune) {
     const { tenantId, cutoff, actor, olderThanDays } = prune;
     const db = openHippoDb(hippoRoot);
@@ -237,7 +242,12 @@ export function pruneAuditRows(hippoRoot, prune) {
         return withWriteScope(db, 'audit_prune', () => {
             const count = deleteAuditBefore(db, tenantId, cutoff);
             // Written after the delete with ts = now, so the cutoff just applied cannot take it.
-            appendAuditEvent(db, { tenantId, actor, op: 'audit_prune', metadata: { cutoff, count, dryRun: false, olderThanDays } });
+            appendAuditEvent(db, {
+                tenantId,
+                actor,
+                op: 'audit_prune',
+                metadata: { cutoff, count, dryRun: false, olderThanDays },
+            });
             return count;
         });
     }

package/dist/store/auth.d.ts

@@ -62,7 +62,8 @@ export interface VerifiedApiKey {
     scopes: string[];
     ownerSubject?: string | null;
 }
-/** One api_keys row and its scope grants as a store returns it, revoked or not; the core checks the secret, the role and the expiry. */
+/** One api_keys row and its scope grants as a store returns it, revoked or not; the core checks the secret, the role
+ * and the expiry. */
 export interface ApiKeyRecord {
     keyHash: string;
     tenantId: string;
@@ -87,7 +88,8 @@ export declare class VerifiedKeyCache {
     has(keyHash: string, plaintext: string): boolean;
     add(keyHash: string, plaintext: string): void;
 }
-/** A caller's limit on scrypt work, called once per derivation: it may throw to refuse `derive` or hold it in a queue. */
+/** A caller's limit on scrypt work, called once per derivation: it may throw to refuse `derive` or hold it in a
+ * queue. */
 type DerivationBound = (keyId: string, derive: () => Promise<Buffer>) => Promise<Buffer>;
 /** Verify a bearer API key against `store`, null when invalid. The key's row is read on every
  * call, so a revoke, expiry, role or scope change by any process applies on the next one. */