@remnic/core 1.1.31 → 9.3.515

package/src/connectors/codex-materialize.ts

@@ -47,6 +47,7 @@ import path from "node:path";
 import { log } from "../logger.js";
 import { readEnvVar, resolveHomeDir } from "../runtime/env.js";
 import type { MemoryFile } from "../types.js";
+import { expandTildePath } from "../utils/path.js";
 
 // ─── Types ─────────────────────────────────────────────────────────────────
 
@@ -292,6 +293,8 @@ export function materializeForNamespace(
     name: `${sanitizeSlug(r.slug)}.md`,
     body: renderRolloutSummary(r),
   }));
+  const destRolloutsDir = path.join(memoriesDir, ROLLOUT_SUBDIR);
+  const retainedRolloutNames = new Set(rolloutFiles.map((r) => r.name));
 
   // ── Idempotence check ──────────────────────────────────────────────────
   const hash = computeContentHash({
@@ -316,7 +319,13 @@ export function materializeForNamespace(
       ...rolloutFiles.map((r) => path.join(memoriesDir, ROLLOUT_SUBDIR, r.name)),
     ];
     const allPresent = requiredFiles.every((f) => fs.existsSync(f));
-    if (allPresent) {
+    const rolloutsClean =
+      !rolloutsSupplied ||
+      rolloutDirectoryMatchesRetainedSet(
+        ensureSafeRolloutsDir(memoriesDir, destRolloutsDir),
+        retainedRolloutNames,
+      );
+    if (allPresent && rolloutsClean) {
       logger.debug?.(`no-op materialization for namespace=${namespace} (hash unchanged)`);
       return {
         namespace,
@@ -329,7 +338,7 @@ export function materializeForNamespace(
       };
     }
     logger.debug?.(
-      `hash unchanged for namespace=${namespace} but managed file missing — forcing rewrite`,
+      `hash unchanged for namespace=${namespace} but managed files need refresh — forcing rewrite`,
     );
   }
 
@@ -402,8 +411,7 @@ export function materializeForNamespace(
     fs.renameSync(src, dest);
   }
 
-  const destRolloutsDir = path.join(memoriesDir, ROLLOUT_SUBDIR);
-  fs.mkdirSync(destRolloutsDir, { recursive: true });
+  const safeDestRolloutsDir = ensureSafeRolloutsDir(memoriesDir, destRolloutsDir);
   // Only garbage-collect rollout files when the caller actually supplied a
   // `rolloutSummaries` array — otherwise we'd wipe legitimately
   // user/Codex-created recap files on every session-end run, since those
@@ -411,26 +419,30 @@ export function materializeForNamespace(
   // supplied (even as an empty array — meaning "we own this dir and it
   // should be empty"), we clear the stale files we previously owned.
   if (rolloutsSupplied) {
-    const retainedRolloutNames = new Set(rolloutFiles.map((r) => r.name));
+    let existingRollouts: fs.Dirent[];
     try {
-      for (const entry of fs.readdirSync(destRolloutsDir, { withFileTypes: true })) {
-        if (!entry.isFile()) continue;
-        if (!entry.name.endsWith(".md")) continue;
-        if (retainedRolloutNames.has(entry.name)) continue;
-        try {
-          fs.unlinkSync(path.join(destRolloutsDir, entry.name));
-        } catch {
-          // ignore
-        }
+      existingRollouts = fs.readdirSync(safeDestRolloutsDir, { withFileTypes: true });
+    } catch (err) {
+      if ((err as NodeJS.ErrnoException).code !== "ENOENT") throw err;
+      existingRollouts = [];
+    }
+    for (const entry of existingRollouts) {
+      if (!entry.isFile()) continue;
+      if (!entry.name.endsWith(".md")) continue;
+      if (retainedRolloutNames.has(entry.name)) continue;
+      try {
+        fs.unlinkSync(path.join(safeDestRolloutsDir, entry.name));
+      } catch (err) {
+        throw new Error(
+          `codex-materialize: failed to prune stale rollout summary ${entry.name}: ${err instanceof Error ? err.message : String(err)}`,
+        );
       }
-    } catch {
-      // ignore — directory may not exist yet
     }
   }
 
   for (const rollout of rolloutFiles) {
     const src = path.join(tmpDir, ROLLOUT_SUBDIR, rollout.name);
-    const dest = path.join(destRolloutsDir, rollout.name);
+    const dest = path.join(safeDestRolloutsDir, rollout.name);
     fs.renameSync(src, dest);
   }
 
@@ -441,7 +453,7 @@ export function materializeForNamespace(
     updated_at: now.toISOString(),
     content_hash: hash,
   };
-  fs.writeFileSync(sentinelPath, `${JSON.stringify(sentinel, null, 2)}\n`);
+  writeSentinelAtomically(sentinelPath, sentinel);
 
   try {
     fs.rmSync(tmpDir, { recursive: true, force: true });
@@ -472,14 +484,17 @@ export function materializeForNamespace(
 export function ensureSentinel(memoriesDir: string, namespace: string, now: Date = new Date()): void {
   fs.mkdirSync(memoriesDir, { recursive: true });
   const sentinelPath = path.join(memoriesDir, SENTINEL_FILE);
-  if (fs.existsSync(sentinelPath)) return;
+  if (fs.existsSync(sentinelPath)) {
+    readSentinel(sentinelPath);
+    return;
+  }
   const sentinel: SentinelFile = {
     version: MATERIALIZE_VERSION,
     namespace,
     updated_at: now.toISOString(),
     content_hash: "",
   };
-  fs.writeFileSync(sentinelPath, `${JSON.stringify(sentinel, null, 2)}\n`);
+  writeSentinelAtomically(sentinelPath, sentinel);
 }
 
 // ─── Rendering ─────────────────────────────────────────────────────────────
@@ -748,10 +763,14 @@ export function validateMemoryMd(content: string): MemoryMdValidation {
 // ─── Helpers ───────────────────────────────────────────────────────────────
 
 function resolveCodexHome(override?: string): string {
-  if (override && override.trim().length > 0) return override;
+  if (override && override.trim().length > 0) {
+    return path.resolve(expandTildePath(override.trim()));
+  }
   const fromEnv = readEnvVar("CODEX_HOME");
-  if (fromEnv && fromEnv.trim().length > 0) return fromEnv;
-  return path.join(resolveHomeDir(), ".codex");
+  if (fromEnv && fromEnv.trim().length > 0) {
+    return path.resolve(expandTildePath(fromEnv.trim()));
+  }
+  return path.resolve(resolveHomeDir(), ".codex");
 }
 
 export function resolveCodexMemoriesDir(codexHome?: string): string {
@@ -762,20 +781,108 @@ export function hasCodexMaterializeSentinel(codexHome?: string): boolean {
   return readSentinel(path.join(resolveCodexMemoriesDir(codexHome), SENTINEL_FILE)) !== null;
 }
 
+function rolloutDirectoryMatchesRetainedSet(
+  rolloutsDir: string,
+  retainedNames: Set<string>,
+): boolean {
+  let entries: fs.Dirent[];
+  try {
+    entries = fs.readdirSync(rolloutsDir, { withFileTypes: true });
+  } catch {
+    return retainedNames.size === 0;
+  }
+  for (const entry of entries) {
+    if (!entry.isFile()) continue;
+    if (!entry.name.endsWith(".md")) continue;
+    if (!retainedNames.has(entry.name)) return false;
+  }
+  return true;
+}
+
+function isPathInside(parent: string, child: string): boolean {
+  const relative = path.relative(parent, child);
+  return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+}
+
+function ensureSafeRolloutsDir(memoriesDir: string, rolloutsDir: string): string {
+  const memoriesReal = fs.realpathSync(memoriesDir);
+
+  try {
+    const stat = fs.lstatSync(rolloutsDir);
+    if (stat.isSymbolicLink()) {
+      throw new Error("is a symbolic link");
+    }
+    if (!stat.isDirectory()) {
+      throw new Error("is not a directory");
+    }
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException).code !== "ENOENT") {
+      throw new Error(
+        `codex-materialize: unsafe ${ROLLOUT_SUBDIR} directory at ${rolloutsDir}: ${
+          err instanceof Error ? err.message : String(err)
+        }`,
+      );
+    }
+    fs.mkdirSync(rolloutsDir, { recursive: true });
+  }
+
+  const rolloutsReal = fs.realpathSync(rolloutsDir);
+  if (!isPathInside(memoriesReal, rolloutsReal)) {
+    throw new Error(
+      `codex-materialize: unsafe ${ROLLOUT_SUBDIR} directory at ${rolloutsDir}: resolves outside ${memoriesDir}`,
+    );
+  }
+
+  return rolloutsDir;
+}
+
 function readSentinel(sentinelPath: string): SentinelFile | null {
   if (!fs.existsSync(sentinelPath)) return null;
   try {
     const raw = fs.readFileSync(sentinelPath, "utf-8");
     const parsed = JSON.parse(raw) as Partial<SentinelFile>;
-    if (typeof parsed !== "object" || parsed === null) return null;
+    if (
+      typeof parsed !== "object" ||
+      parsed === null ||
+      typeof parsed.version !== "number" ||
+      typeof parsed.namespace !== "string" ||
+      typeof parsed.updated_at !== "string" ||
+      typeof parsed.content_hash !== "string"
+    ) {
+      throw new Error("invalid sentinel schema");
+    }
     return {
-      version: typeof parsed.version === "number" ? parsed.version : MATERIALIZE_VERSION,
-      namespace: typeof parsed.namespace === "string" ? parsed.namespace : "",
-      updated_at: typeof parsed.updated_at === "string" ? parsed.updated_at : "",
-      content_hash: typeof parsed.content_hash === "string" ? parsed.content_hash : "",
+      version: parsed.version,
+      namespace: parsed.namespace,
+      updated_at: parsed.updated_at,
+      content_hash: parsed.content_hash,
     };
-  } catch {
-    return null;
+  } catch (err) {
+    throw new Error(
+      `codex-materialize: corrupt ${SENTINEL_FILE} sentinel at ${sentinelPath}: ${err instanceof Error ? err.message : String(err)}`,
+    );
+  }
+}
+
+function writeSentinelAtomically(
+  sentinelPath: string,
+  sentinel: SentinelFile,
+): void {
+  const tmpPath = `${sentinelPath}.${process.pid}.${Date.now()}.${Math.random()
+    .toString(16)
+    .slice(2)}.tmp`;
+  try {
+    fs.writeFileSync(tmpPath, `${JSON.stringify(sentinel, null, 2)}\n`, {
+      flag: "wx",
+    });
+    fs.renameSync(tmpPath, sentinelPath);
+  } catch (err) {
+    try {
+      fs.rmSync(tmpPath, { force: true });
+    } catch {
+      // ignore cleanup failures; preserve the original write/rename error
+    }
+    throw err;
   }
 }
 
@@ -863,12 +970,20 @@ function pruneRollouts(
 }
 
 function sanitizeSlug(slug: string): string {
-  return slug
+  const sanitized = slug
     .toLowerCase()
     .replace(/[^a-z0-9._-]+/gu, "-")
-    .replace(/^-+|-+$/gu, "")
-    .slice(0, 96)
-    || "rollout";
+    .slice(0, 96);
+  const trimmed = trimHyphenEdges(sanitized);
+  return trimmed || "rollout";
+}
+
+function trimHyphenEdges(value: string): string {
+  let start = 0;
+  let end = value.length;
+  while (start < end && value[start] === "-") start += 1;
+  while (end > start && value[end - 1] === "-") end -= 1;
+  return value.slice(start, end);
 }
 
 /**

package/src/connectors/index.test.ts

@@ -86,6 +86,142 @@ async function withEnv(
   }
 }
 
+test("removeConnector rejects path-like connector IDs before building config paths", async (t) => {
+  const sandbox = makeSandbox(t);
+  const outsidePath = path.join(sandbox.root, "outside.json");
+  fs.writeFileSync(outsidePath, "must survive\n");
+
+  await withEnv(
+    {
+      HOME: sandbox.home,
+      USERPROFILE: sandbox.home,
+      XDG_CONFIG_HOME: sandbox.xdgConfigHome,
+    },
+    () => {
+      const result = removeConnector(`../../${path.basename(outsidePath, ".json")}`);
+
+      assert.equal(result.status, "skipped");
+      assert.equal(result.reason, "invalid-connector-id");
+      assert.equal(fs.readFileSync(outsidePath, "utf8"), "must survive\n");
+    },
+  );
+});
+
+test("installConnector rejects path-like connector IDs before building config paths", async (t) => {
+  const sandbox = makeSandbox(t);
+  const outsidePath = path.join(sandbox.root, "outside.json");
+  fs.writeFileSync(outsidePath, "must survive\n");
+
+  await withEnv(
+    {
+      HOME: sandbox.home,
+      USERPROFILE: sandbox.home,
+      XDG_CONFIG_HOME: sandbox.xdgConfigHome,
+    },
+    () => {
+      const result = installConnector({
+        connectorId: `../../${path.basename(outsidePath, ".json")}`,
+      });
+
+      assert.equal(result.status, "error");
+      assert.match(result.message, /Invalid connector ID/);
+      assert.equal(fs.readFileSync(outsidePath, "utf8"), "must survive\n");
+    },
+  );
+});
+
+test("loadRegistry does not overwrite malformed registry.json", async (t) => {
+  const sandbox = makeSandbox(t);
+
+  await withEnv(
+    {
+      HOME: sandbox.home,
+      USERPROFILE: sandbox.home,
+      XDG_CONFIG_HOME: sandbox.xdgConfigHome,
+    },
+    () => {
+      const regDir = path.join(sandbox.xdgConfigHome, "engram", ".engram-connectors");
+      fs.mkdirSync(regDir, { recursive: true });
+      const regPath = path.join(regDir, "registry.json");
+      const malformed = "{ invalid registry json\n";
+      fs.writeFileSync(regPath, malformed);
+
+      const registry = loadRegistry();
+
+      assert.ok(registry.connectors.some((connector) => connector.id === "codex-cli"));
+      assert.equal(fs.readFileSync(regPath, "utf8"), malformed);
+    },
+  );
+});
+
+test("loadRegistry filters custom connectors with invalid IDs", async (t) => {
+  const sandbox = makeSandbox(t);
+
+  await withEnv(
+    {
+      HOME: sandbox.home,
+      USERPROFILE: sandbox.home,
+      XDG_CONFIG_HOME: sandbox.xdgConfigHome,
+    },
+    () => {
+      const regDir = path.join(sandbox.xdgConfigHome, "engram", ".engram-connectors");
+      fs.mkdirSync(regDir, { recursive: true });
+      const regPath = path.join(regDir, "registry.json");
+      fs.writeFileSync(
+        regPath,
+        JSON.stringify(
+          {
+            connectors: [
+              {
+                id: "custom-agent",
+                name: "Custom Agent",
+                version: "1.0.0",
+                description: "valid custom connector",
+                capabilities: {
+                  observe: false,
+                  recall: true,
+                  store: false,
+                  search: false,
+                  entities: false,
+                  realtimeSync: false,
+                  batch: false,
+                  connectionType: "http",
+                },
+              },
+              {
+                id: "../../outside",
+                name: "Path Escape",
+                version: "1.0.0",
+                description: "invalid custom connector",
+                capabilities: {
+                  observe: false,
+                  recall: true,
+                  store: false,
+                  search: false,
+                  entities: false,
+                  realtimeSync: false,
+                  batch: false,
+                  connectionType: "http",
+                },
+              },
+            ],
+          },
+          null,
+          2,
+        ),
+      );
+
+      const registry = loadRegistry();
+
+      assert.ok(registry.connectors.some((connector) => connector.id === "custom-agent"));
+      assert.equal(
+        registry.connectors.some((connector) => connector.id === "../../outside"),
+        false,
+      );
+    },
+  );
+});
+
 test("installConnector persists resolved codexHome from $CODEX_HOME", async (t) => {
   const sandbox = makeSandbox(t);
 
@@ -1152,16 +1288,17 @@ test(
         fs.mkdirSync(connectorsDir, { recursive: true });
         const configPath = path.join(connectorsDir, "codex-cli.json");
 
-        // Monkey-patch fs.writeFileSync to throw only when writing the codex-cli
-        // config file — this simulates a disk-full / EPERM condition that happens
-        // AFTER installCodexMemoryExtension() has already completed.
-        const originalWriteFileSync = fs.writeFileSync.bind(fs);
+        // Monkey-patch the atomic final rename to throw only when publishing the
+        // codex-cli config file. writeSecretFileSync now writes a temp file first,
+        // then renames into place, so this simulates a final commit failure that
+        // happens AFTER installCodexMemoryExtension() has already completed.
+        const originalRenameSync = fs.renameSync.bind(fs);
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        const mock = t.mock.method(fs, "writeFileSync", (...args: [any, any, any?]) => {
-          if (String(args[0]) === configPath) {
+        const mock = t.mock.method(fs, "renameSync", (...args: [any, any]) => {
+          if (String(args[1]) === configPath) {
             throw new Error("ENOSPC: no space left on device (simulated)");
           }
-          return originalWriteFileSync(...args);
+          return originalRenameSync(...args);
         });
 
         const result = installConnector({

package/src/connectors/index.ts

@@ -530,6 +530,20 @@ const BUILTIN_CONNECTORS: ConnectorManifest[] = [
 // ── Registry management ───────────────────────────────────────────────────
 
 const REGISTRY_DIR_NAME = ".engram-connectors";
+const CONNECTOR_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+
+function isValidConnectorId(connectorId: unknown): connectorId is string {
+  return typeof connectorId === "string" && CONNECTOR_ID_PATTERN.test(connectorId);
+}
+
+function isConnectorManifest(value: unknown): value is ConnectorManifest {
+  return (
+    typeof value === "object" &&
+    value !== null &&
+    !Array.isArray(value) &&
+    isValidConnectorId((value as { id?: unknown }).id)
+  );
+}
 
 export function getRegistryPath(): string {
   const xdgConfigHome = readEnvVar("XDG_CONFIG_HOME");
@@ -552,28 +566,35 @@ export function loadRegistry(): ConnectorRegistry {
     return registry;
   }
 
-  const raw = fs.readFileSync(regPath, "utf8");
   try {
+    const raw = fs.readFileSync(regPath, "utf8");
     const parsed = JSON.parse(raw);
+    if (
+      typeof parsed !== "object" ||
+      parsed === null ||
+      !Array.isArray((parsed as { connectors?: unknown }).connectors)
+    ) {
+      throw new Error("invalid registry schema");
+    }
     // Built-ins always take precedence over persisted entries with the same ID.
     // This ensures that upgraded manifests (e.g. newly-added requiresToken: true)
     // are never shadowed by stale registry.json entries from an older version.
     // Only connectors whose IDs are NOT in BUILTIN_CONNECTORS are preserved from
     // the persisted file — those are genuine user-added custom connectors.
     const builtinIds = new Set(BUILTIN_CONNECTORS.map((b) => b.id));
-    const customOnly = (parsed.connectors ?? []).filter((c: ConnectorManifest) => !builtinIds.has(c.id));
+    const customOnly = (parsed as { connectors: unknown[] }).connectors.filter(
+      (c): c is ConnectorManifest => isConnectorManifest(c) && !builtinIds.has(c.id),
+    );
     const merged = [...BUILTIN_CONNECTORS, ...customOnly];
     return {
       connectors: merged,
       registryPath: regPath,
     };
   } catch {
-    const registry: ConnectorRegistry = {
+    return {
       connectors: BUILTIN_CONNECTORS,
       registryPath: regPath,
     };
-    saveRegistry(registry);
-    return registry;
   }
 }
 
@@ -601,7 +622,9 @@ export function listConnectors(): {
           const config = JSON.parse(
             fs.readFileSync(path.join(connectorsDir, entry), "utf8"),
           );
-          installedIds.add(config.connectorId as string);
+          if (isValidConnectorId(config.connectorId)) {
+            installedIds.add(config.connectorId);
+          }
         } catch {
           // ignore malformed configs
         }
@@ -647,6 +670,9 @@ export function listConnectors(): {
 // for a connector — connector.json never contains it.
 
 export function getConnectorToken(connectorId: string): string | undefined {
+  if (!isValidConnectorId(connectorId)) {
+    return undefined;
+  }
   try {
     return loadTokenStore().tokens.find((t) => t.connector === connectorId)?.token;
   } catch {
@@ -696,6 +722,16 @@ function compactConnectorConfigOverrides(rawUserConfig: Record<string, unknown>)
 // ── Install connector ───────────────────────────────────────────────────────
 
 export function installConnector(options: InstallOptions): InstallResult {
+  if (!isValidConnectorId(options.connectorId)) {
+    return {
+      connectorId: options.connectorId,
+      status: "error",
+      message:
+        `Invalid connector ID ${JSON.stringify(options.connectorId)}. ` +
+        "Connector IDs must match [A-Za-z0-9][A-Za-z0-9._-]*.",
+    };
+  }
+
   const registry = loadRegistry();
   const manifest = registry.connectors.find((c) => c.id === options.connectorId);
 
@@ -1567,6 +1603,17 @@ export function installConnector(options: InstallOptions): InstallResult {
 
 export function removeConnector(connectorId: string): RemoveResult {
   const configDir = getConnectorsDir();
+  if (!isValidConnectorId(connectorId)) {
+    return {
+      connectorId,
+      configPath: configDir,
+      status: "skipped",
+      reason: "invalid-connector-id",
+      message:
+        `Removal aborted: invalid connector ID ${JSON.stringify(connectorId)}. ` +
+        "Connector IDs must match [A-Za-z0-9][A-Za-z0-9._-]*.",
+    };
+  }
   const configPath = path.join(configDir, `${connectorId}.json`);
 
   // For codex-cli, read the saved config BEFORE touching anything so we have
@@ -2088,19 +2135,43 @@ function sanitizeHermesPort(port: number | string): number {
 }
 
 /**
- * Write a file with owner-only (0o600) permissions.
+ * Atomically write a file with owner-only (0o600) permissions.
  *
- * Used for any file that may contain a bearer token. writeFileSync's `mode`
- * option only applies when the file is newly created, so we also chmod
- * afterwards to tighten permissions on pre-existing files. The chmod is
- * best-effort on platforms that don't support POSIX modes.
+ * Used for any file that may contain a bearer token. Write to a unique temp file
+ * in the destination directory, chmod the temp file, then rename into place so a
+ * failed write cannot truncate or corrupt the existing connector config.
  */
 function writeSecretFileSync(filePath: string, data: string): void {
-  fs.writeFileSync(filePath, data, { mode: 0o600 });
+  const dir = path.dirname(filePath);
+  const base = path.basename(filePath);
+  const tmpPath = path.join(
+    dir,
+    `.${base}.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}.tmp`,
+  );
+  let wroteTemp = false;
   try {
-    fs.chmodSync(filePath, 0o600);
-  } catch {
-    /* best-effort on non-POSIX filesystems */
+    fs.writeFileSync(tmpPath, data, { mode: 0o600, flag: "wx" });
+    wroteTemp = true;
+    try {
+      fs.chmodSync(tmpPath, 0o600);
+    } catch {
+      /* best-effort on non-POSIX filesystems */
+    }
+    fs.renameSync(tmpPath, filePath);
+    try {
+      fs.chmodSync(filePath, 0o600);
+    } catch {
+      /* best-effort on non-POSIX filesystems */
+    }
+  } catch (err) {
+    if (wroteTemp) {
+      try {
+        fs.unlinkSync(tmpPath);
+      } catch {
+        /* best-effort temp cleanup */
+      }
+    }
+    throw err;
   }
 }
 

package/src/connectors/live/github.test.ts

@@ -9,6 +9,7 @@ import {
   isTransientGitHubError,
   validateGitHubConfig,
   type GitHubComment,
+  type GitHubDiscussionComment,
   type GitHubFetchFn,
   type GitHubSyncResult,
 } from "./github.js";
@@ -631,6 +632,52 @@ test("discussion comments are fetched when includeDiscussions is true", async ()
   assert.equal(discussionFetched, true);
 });
 
+test("discussion comments are imported from discussion-shaped responses", async () => {
+  const updatedAt = "2026-04-26T10:00:00.000Z";
+  const discussion: GitHubDiscussionComment = {
+    id: 1,
+    body: "Synthetic discussion note",
+    author: { login: SYNTHETIC_LOGIN },
+    createdAt: "2026-04-26T09:59:00.000Z",
+    updatedAt,
+    url: "https://example.test/discussions/1",
+  };
+  const fetchFn = makeFetch([
+    {
+      match: (url) => url.includes("/discussions"),
+      respond: () => ({ status: 200, data: [discussion] }),
+    },
+    {
+      match: () => true,
+      respond: () => ({ status: 200, data: [] }),
+    },
+  ]);
+
+  const connector = createGitHubConnector({ fetchFn });
+  const config = connector.validateConfig({
+    ...SYNTHETIC_CONFIG,
+    includeDiscussions: true,
+  });
+  const cursor = makeGitHubCursor({});
+
+  const result = (await connector.syncIncremental({
+    cursor,
+    config,
+  })) as GitHubSyncResult;
+
+  assert.equal(result.newDocs.length, 1);
+  assert.equal(
+    result.newDocs[0]?.source.externalId,
+    `${REPO_A}/discussion/1`,
+  );
+  assert.equal(result.newDocs[0]?.source.externalRevision, updatedAt);
+  assert.equal(
+    result.newDocs[0]?.source.externalUrl,
+    "https://example.test/discussions/1",
+  );
+  assert.equal(result.newDocs[0]?.content, "Synthetic discussion note");
+});
+
 // ---------------------------------------------------------------------------
 // Error classification
 // ---------------------------------------------------------------------------