hippo-memory 1.55.0 → 1.57.0

package/dist/config.d.ts

@@ -140,6 +140,11 @@ export interface HippoConfig {
     agentMemories: {
         tools: string[] | null;
     };
+    /** Per-turn delivery ledger (src/recall-trace.ts): hashes, ids, counts and rejection reasons for each
+     *  pinned-only context call. Default off; read from the store the token ledger writes to. */
+    deliveryLedger: {
+        enabled: boolean;
+    };
 }
 export declare function loadConfig(hippoRoot: string): HippoConfig;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.js

@@ -85,6 +85,9 @@ const DEFAULT_CONFIG = {
     agentMemories: {
         tools: null,
     },
+    deliveryLedger: {
+        enabled: false,
+    },
 };
 function isMemoryValueConfig(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
@@ -95,6 +98,23 @@ function isDormantConfig(value) {
 function isChurnStalenessConfig(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
+function isDeliveryLedgerConfig(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+// Only `{"enabled": true}` turns it on; anything malformed warns and stays off.
+function deliveryLedgerEnabled(value) {
+    if (value === undefined)
+        return false;
+    const isObject = isDeliveryLedgerConfig(value);
+    const enabled = isObject ? value.enabled : undefined;
+    if (enabled === true || enabled === false)
+        return enabled;
+    if (isObject && enabled === undefined)
+        return false;
+    console.error(`Warning: config.json's "deliveryLedger" must be an object like {"enabled": true} ` +
+        `(got ${JSON.stringify(value)}) - using false.`);
+    return false;
+}
 function agentMemoryTools(value) {
     if (value === undefined || value === null)
         return null;
@@ -205,6 +225,7 @@ export function loadConfig(hippoRoot) {
                 enabled: churnStalenessEnabled,
             },
             agentMemories: { tools: agentMemoryTools(raw.agentMemories?.tools) },
+            deliveryLedger: { enabled: deliveryLedgerEnabled(raw.deliveryLedger) },
         };
     }
     catch (err) {

package/dist/connectors/github/webhook.d.ts

@@ -0,0 +1,19 @@
+import { type WebhookRequest } from '../../http-util.js';
+/**
+ * GitHub webhook receiver. Mirrors the Slack route shape but with
+ * GitHub-specific idioms:
+ *   1. HMAC SHA-256 over the raw body (X-Hub-Signature-256), no timestamp.
+ *   2. Event type discriminated by the X-GitHub-Event header (not body.type).
+ *   3. X-GitHub-Delivery is required audit metadata (NOT the dedupe seam - see
+ *      computeIdempotencyKey, which folds the signed body into the key so a
+ *      replayed body with a fresh delivery UUID still dedupes).
+ *   4. Tenant resolved by installation.id → github_installations, then by
+ *      repository.full_name → github_repositories (PAT-mode multi-tenant).
+ *   5. ALWAYS ACK 200 on signed envelopes (DLQ included). 401 only on bad
+ *      signature; 404 only when GITHUB_WEBHOOK_SECRET is unset (don't expose
+ *      the route's existence on builds where it's gated off).
+ *
+ * Bearer auth is skipped on purpose: server.ts checks isPublicRoute before calling this.
+ */
+export declare function handleGitHubEventsWebhook({ req, res, opts }: WebhookRequest): Promise<void>;
+//# sourceMappingURL=webhook.d.ts.map

package/dist/connectors/github/webhook.js

@@ -0,0 +1,313 @@
+import { verifyGitHubSignature } from './signature.js';
+import { isGitHubWebhookEnvelope, isGitHubIssueEvent, isGitHubIssueCommentEvent, isGitHubPullRequestEvent, isGitHubPullRequestReviewCommentEvent, } from './types.js';
+import { ingestEvent as ingestGitHubEvent } from './ingest.js';
+import { handleCommentDeleted as handleGitHubCommentDeleted } from './deletion.js';
+import { writeToDlq as writeToGitHubDlq } from './dlq.js';
+import { resolveTenantForGitHub } from './tenant-routing.js';
+import { computeDeletionKey as computeGitHubDeletionKey } from './signature.js';
+import { resolveTenantId } from '../../tenant.js';
+import { openHippoDb, closeHippoDb } from '../../db.js';
+import { adminActor } from '../../api.js';
+import { HttpError, JSON_HEADERS, isHeaderString, readBody, sendJson, } from '../../http-util.js';
+/**
+ * GitHub webhook receiver. Mirrors the Slack route shape but with
+ * GitHub-specific idioms:
+ *   1. HMAC SHA-256 over the raw body (X-Hub-Signature-256), no timestamp.
+ *   2. Event type discriminated by the X-GitHub-Event header (not body.type).
+ *   3. X-GitHub-Delivery is required audit metadata (NOT the dedupe seam - see
+ *      computeIdempotencyKey, which folds the signed body into the key so a
+ *      replayed body with a fresh delivery UUID still dedupes).
+ *   4. Tenant resolved by installation.id → github_installations, then by
+ *      repository.full_name → github_repositories (PAT-mode multi-tenant).
+ *   5. ALWAYS ACK 200 on signed envelopes (DLQ included). 401 only on bad
+ *      signature; 404 only when GITHUB_WEBHOOK_SECRET is unset (don't expose
+ *      the route's existence on builds where it's gated off).
+ *
+ * Bearer auth is skipped on purpose: server.ts checks isPublicRoute before calling this.
+ */
+export async function handleGitHubEventsWebhook({ req, res, opts }) {
+    const rawBody = await readBody(req);
+    const secret = process.env.GITHUB_WEBHOOK_SECRET;
+    if (!secret) {
+        res.writeHead(404, JSON_HEADERS);
+        res.end(JSON.stringify({ error: 'not found' }));
+        return;
+    }
+    const previousSecret = process.env.GITHUB_WEBHOOK_SECRET_PREVIOUS;
+    const sigHdr = req.headers['x-hub-signature-256'];
+    const eventHdr = req.headers['x-github-event'];
+    const deliveryHdr = req.headers['x-github-delivery'];
+    const sigStr = isHeaderString(sigHdr) ? sigHdr : null;
+    const eventName = isHeaderString(eventHdr) ? eventHdr : null;
+    const deliveryId = isHeaderString(deliveryHdr) ? deliveryHdr : null;
+    if (sigStr === null ||
+        !verifyGitHubSignature({
+            rawBody,
+            signature: sigStr,
+            webhookSecret: secret,
+            previousSecret,
+        })) {
+        throw new HttpError(401, 'invalid GitHub signature');
+    }
+    // Signature OK from here on. Everything else is ACK-200; bad envelopes go
+    // to the DLQ and a human can replay later.
+    // Cheap regex extraction of installation_id / repo for DLQ rows that fail
+    // to JSON.parse - gives operators something to triage.
+    const installationFromRaw = (() => {
+        const m = rawBody.match(/"installation"\s*:\s*\{[^}]*"id"\s*:\s*(\d+)/);
+        return m ? m[1] : null;
+    })();
+    const repoFromRaw = (() => {
+        const m = rawBody.match(/"full_name"\s*:\s*"([^"]+)"/);
+        return m ? m[1] : null;
+    })();
+    if (deliveryId === null) {
+        // Body was signed but caller omitted the audit header. Park.
+        const db = openHippoDb(opts.hippoRoot);
+        try {
+            writeToGitHubDlq(db, {
+                tenantId: resolveTenantId({}),
+                rawPayload: rawBody,
+                error: 'missing X-GitHub-Delivery header',
+                bucket: 'parse_error',
+                eventName,
+                deliveryId: null,
+                signature: sigStr,
+                installationId: installationFromRaw,
+                repoFullName: repoFromRaw,
+            });
+        }
+        finally {
+            closeHippoDb(db);
+        }
+        sendJson(res, 200, { ok: true, status: 'dlq' });
+        return;
+    }
+    // Ping fires once at hook creation. Don't ingest, don't DLQ - just pong.
+    if (eventName === 'ping') {
+        sendJson(res, 200, { pong: true });
+        return;
+    }
+    const ALLOWED_EVENTS = new Set([
+        'issues',
+        'issue_comment',
+        'pull_request',
+        'pull_request_review_comment',
+    ]);
+    if (eventName === null || !ALLOWED_EVENTS.has(eventName)) {
+        const db = openHippoDb(opts.hippoRoot);
+        try {
+            writeToGitHubDlq(db, {
+                tenantId: resolveTenantId({}),
+                rawPayload: rawBody,
+                error: `unhandled event: ${eventName ?? '(missing X-GitHub-Event)'}`,
+                bucket: 'unhandled',
+                eventName,
+                deliveryId,
+                signature: sigStr,
+                installationId: installationFromRaw,
+                repoFullName: repoFromRaw,
+            });
+        }
+        finally {
+            closeHippoDb(db);
+        }
+        sendJson(res, 200, { ok: true, status: 'dlq' });
+        return;
+    }
+    let body;
+    try {
+        body = JSON.parse(rawBody);
+    }
+    catch {
+        const db = openHippoDb(opts.hippoRoot);
+        try {
+            writeToGitHubDlq(db, {
+                tenantId: resolveTenantId({}),
+                rawPayload: rawBody,
+                error: 'invalid JSON',
+                bucket: 'parse_error',
+                eventName,
+                deliveryId,
+                signature: sigStr,
+                installationId: installationFromRaw,
+                repoFullName: repoFromRaw,
+            });
+        }
+        finally {
+            closeHippoDb(db);
+        }
+        sendJson(res, 200, { ok: true, status: 'dlq' });
+        return;
+    }
+    if (body === undefined || !isGitHubWebhookEnvelope(body)) {
+        const db = openHippoDb(opts.hippoRoot);
+        try {
+            writeToGitHubDlq(db, {
+                tenantId: resolveTenantId({}),
+                rawPayload: rawBody,
+                error: 'not a GitHub webhook envelope',
+                bucket: 'parse_error',
+                eventName,
+                deliveryId,
+                signature: sigStr,
+                installationId: installationFromRaw,
+                repoFullName: repoFromRaw,
+            });
+        }
+        finally {
+            closeHippoDb(db);
+        }
+        sendJson(res, 200, { ok: true, status: 'dlq' });
+        return;
+    }
+    const installationId = body.installation?.id != null ? String(body.installation.id) : null;
+    const repoFullName = body.repository?.full_name ?? null;
+    // Tenant resolution. Fail closed on multi-tenant installs with unknown
+    // routing - same policy as Slack.
+    let resolvedTenant;
+    {
+        const db = openHippoDb(opts.hippoRoot);
+        try {
+            resolvedTenant = resolveTenantForGitHub(db, {
+                installationId,
+                repoFullName,
+            });
+        }
+        finally {
+            closeHippoDb(db);
+        }
+    }
+    if (resolvedTenant === null) {
+        const db = openHippoDb(opts.hippoRoot);
+        try {
+            writeToGitHubDlq(db, {
+                tenantId: null,
+                rawPayload: rawBody,
+                error: `unroutable: installation_id=${installationId ?? '(none)'} repo=${repoFullName ?? '(none)'}`,
+                bucket: 'unroutable',
+                eventName,
+                deliveryId,
+                signature: sigStr,
+                installationId,
+                repoFullName,
+            });
+        }
+        finally {
+            closeHippoDb(db);
+        }
+        sendJson(res, 200, { ok: true, status: 'dlq' });
+        return;
+    }
+    const ctx = {
+        hippoRoot: opts.hippoRoot,
+        tenantId: resolvedTenant,
+        actor: adminActor('connector:github'),
+    };
+    // Dispatch by event header. Type guards cross-check the body shape against
+    // the header so a payload of one event type cannot satisfy another's guard.
+    if (eventName === 'issues' && isGitHubIssueEvent(body, 'issues')) {
+        if (body.action === 'deleted') {
+            // GitHub does fire issues.deleted (admin-initiated). Don't archive - V1
+            // policy is to log and let an operator decide. Archive could lose the
+            // memory if the issue is being moved between accounts.
+            const db = openHippoDb(opts.hippoRoot);
+            try {
+                writeToGitHubDlq(db, {
+                    tenantId: resolvedTenant,
+                    rawPayload: rawBody,
+                    error: 'issues.deleted requires manual review',
+                    bucket: 'unhandled',
+                    eventName,
+                    deliveryId,
+                    signature: sigStr,
+                    installationId,
+                    repoFullName,
+                });
+            }
+            finally {
+                closeHippoDb(db);
+            }
+            sendJson(res, 200, { ok: true, status: 'dlq' });
+            return;
+        }
+        const ingestInput = { eventName: 'issues', payload: body };
+        const r = ingestGitHubEvent(ctx, { event: ingestInput, rawBody, deliveryId });
+        sendJson(res, 200, { ok: true, status: r.status, memoryId: r.memoryId });
+        return;
+    }
+    if (eventName === 'issue_comment' && isGitHubIssueCommentEvent(body, 'issue_comment')) {
+        if (body.action === 'deleted') {
+            const repo = body.repository?.full_name ?? '';
+            const artifactRef = `github://${repo}/issue/${body.issue.number}/comment/${body.comment.id}`;
+            // The "deleted:" key namespace keeps this from colliding with the ingest key for the
+            // same artifact; a shared key would make hasSeenKey skip the archive.
+            const idempotencyKey = computeGitHubDeletionKey(artifactRef, body.comment.updated_at ?? null);
+            const r = handleGitHubCommentDeleted(ctx, {
+                artifactRef,
+                idempotencyKey,
+                deliveryId,
+                eventName,
+            });
+            sendJson(res, 200, { ok: true, status: r.status, archivedCount: r.archivedCount });
+            return;
+        }
+        const ingestInput = { eventName: 'issue_comment', payload: body };
+        const r = ingestGitHubEvent(ctx, { event: ingestInput, rawBody, deliveryId });
+        sendJson(res, 200, { ok: true, status: r.status, memoryId: r.memoryId });
+        return;
+    }
+    if (eventName === 'pull_request' && isGitHubPullRequestEvent(body, 'pull_request')) {
+        const ingestInput = { eventName: 'pull_request', payload: body };
+        const r = ingestGitHubEvent(ctx, { event: ingestInput, rawBody, deliveryId });
+        sendJson(res, 200, { ok: true, status: r.status, memoryId: r.memoryId });
+        return;
+    }
+    if (eventName === 'pull_request_review_comment' &&
+        isGitHubPullRequestReviewCommentEvent(body, 'pull_request_review_comment')) {
+        if (body.action === 'deleted') {
+            const repo = body.repository?.full_name ?? '';
+            const artifactRef = `github://${repo}/pull/${body.pull_request.number}/review_comment/${body.comment.id}`;
+            // Same "deleted:" key namespace as the issue_comment branch above.
+            const idempotencyKey = computeGitHubDeletionKey(artifactRef, body.comment.updated_at ?? null);
+            const r = handleGitHubCommentDeleted(ctx, {
+                artifactRef,
+                idempotencyKey,
+                deliveryId,
+                eventName,
+            });
+            sendJson(res, 200, { ok: true, status: r.status, archivedCount: r.archivedCount });
+            return;
+        }
+        const ingestInput = {
+            eventName: 'pull_request_review_comment',
+            payload: body,
+        };
+        const r = ingestGitHubEvent(ctx, { event: ingestInput, rawBody, deliveryId });
+        sendJson(res, 200, { ok: true, status: r.status, memoryId: r.memoryId });
+        return;
+    }
+    // Header allow-listed but body shape didn't satisfy the matching guard.
+    {
+        const db = openHippoDb(opts.hippoRoot);
+        try {
+            writeToGitHubDlq(db, {
+                tenantId: resolvedTenant,
+                rawPayload: rawBody,
+                error: `body shape did not match X-GitHub-Event=${eventName}`,
+                bucket: 'parse_error',
+                eventName,
+                deliveryId,
+                signature: sigStr,
+                installationId,
+                repoFullName,
+            });
+        }
+        finally {
+            closeHippoDb(db);
+        }
+        sendJson(res, 200, { ok: true, status: 'dlq' });
+        return;
+    }
+}
+//# sourceMappingURL=webhook.js.map

package/dist/connectors/slack/webhook.d.ts

@@ -0,0 +1,22 @@
+import { type WebhookRequest } from '../../http-util.js';
+/**
+ * Slack Events API webhook. Auth is signature-based (HMAC over the raw
+ * body with SLACK_SIGNING_SECRET); Bearer is NOT required, which is why
+ * this route is in PUBLIC_ROUTES. The route is responsible for:
+ *   1. Echoing the one-time url_verification challenge.
+ *   2. Verifying the HMAC on every other inbound payload.
+ *   3. Resolving body.team_id → tenantId via slack_workspaces, falling
+ *      back to HIPPO_TENANT then 'default'.
+ *   4. Dispatching event_callback envelopes to ingestMessage /
+ *      handleMessageDeleted.
+ *   5. Parking malformed or unhandled payloads in slack_dlq and STILL
+ *      ACKing 200 - Slack retries forever otherwise.
+ *
+ * When SLACK_SIGNING_SECRET is unset we return 404, not
+ * 503, so an external probe cannot distinguish "route gated off by config"
+ * from "route does not exist on this build".
+ *
+ * Bearer auth is skipped on purpose: server.ts checks isPublicRoute before calling this.
+ */
+export declare function handleSlackEventsWebhook({ req, res, opts }: WebhookRequest): Promise<void>;
+//# sourceMappingURL=webhook.d.ts.map

package/dist/connectors/slack/webhook.js

@@ -0,0 +1,203 @@
+import { verifySlackSignature } from './signature.js';
+import { isSlackEventEnvelope, isSlackMessageEvent } from './types.js';
+import { ingestMessage } from './ingest.js';
+import { handleMessageDeleted } from './deletion.js';
+import { writeToDlq } from './dlq.js';
+import { resolveTenantForTeam } from './tenant-routing.js';
+import { resolveTenantId } from '../../tenant.js';
+import { openHippoDb, closeHippoDb } from '../../db.js';
+import { adminActor } from '../../api.js';
+import { HttpError, JSON_HEADERS, isHeaderString, isJsonObjectRecord, readBody, sendJson, } from '../../http-util.js';
+/**
+ * Slack Events API webhook. Auth is signature-based (HMAC over the raw
+ * body with SLACK_SIGNING_SECRET); Bearer is NOT required, which is why
+ * this route is in PUBLIC_ROUTES. The route is responsible for:
+ *   1. Echoing the one-time url_verification challenge.
+ *   2. Verifying the HMAC on every other inbound payload.
+ *   3. Resolving body.team_id → tenantId via slack_workspaces, falling
+ *      back to HIPPO_TENANT then 'default'.
+ *   4. Dispatching event_callback envelopes to ingestMessage /
+ *      handleMessageDeleted.
+ *   5. Parking malformed or unhandled payloads in slack_dlq and STILL
+ *      ACKing 200 - Slack retries forever otherwise.
+ *
+ * When SLACK_SIGNING_SECRET is unset we return 404, not
+ * 503, so an external probe cannot distinguish "route gated off by config"
+ * from "route does not exist on this build".
+ *
+ * Bearer auth is skipped on purpose: server.ts checks isPublicRoute before calling this.
+ */
+export async function handleSlackEventsWebhook({ req, res, opts }) {
+    const rawBody = await readBody(req);
+    const secret = process.env.SLACK_SIGNING_SECRET;
+    if (!secret) {
+        res.writeHead(404, JSON_HEADERS);
+        res.end(JSON.stringify({ error: 'not found' }));
+        return;
+    }
+    const previousSecret = process.env.SLACK_SIGNING_SECRET_PREVIOUS;
+    const sig = req.headers['x-slack-signature'];
+    const tsHdr = req.headers['x-slack-request-timestamp'];
+    const sigStr = isHeaderString(sig) ? sig : null;
+    const tsStr = isHeaderString(tsHdr) ? tsHdr : null;
+    if (sigStr === null ||
+        tsStr === null ||
+        !verifySlackSignature({
+            rawBody,
+            timestamp: tsStr,
+            signature: sigStr,
+            signingSecret: secret,
+            previousSecret,
+        })) {
+        throw new HttpError(401, 'invalid Slack signature');
+    }
+    // Cheap regex extracts team_id from a (possibly malformed) raw body so the
+    // DLQ row carries it for triage even when JSON.parse fails.
+    const teamIdFromRaw = (() => {
+        const m = rawBody.match(/"team_id"\s*:\s*"([^"]+)"/);
+        return m ? m[1] : null;
+    })();
+    let body;
+    try {
+        body = JSON.parse(rawBody);
+    }
+    catch {
+        // Attribute the parse failure to the originating workspace via the regex-extracted
+        // team_id; a null or unknown team writes tenantId=null, which lands as '__unroutable__'.
+        const db = openHippoDb(opts.hippoRoot);
+        try {
+            const parseFailTenant = teamIdFromRaw !== null ? resolveTenantForTeam(db, teamIdFromRaw) : null;
+            writeToDlq(db, {
+                tenantId: parseFailTenant, // null → '__unroutable__' sentinel
+                teamId: teamIdFromRaw,
+                rawPayload: rawBody,
+                error: 'invalid JSON',
+                bucket: 'parse_error',
+                signature: sigStr,
+                slackTimestamp: tsStr,
+            });
+        }
+        finally {
+            closeHippoDb(db);
+        }
+        sendJson(res, 200, { ok: true, status: 'dlq' });
+        return;
+    }
+    if (isJsonObjectRecord(body)) {
+        const bodyRecord = body;
+        if (bodyRecord.type === 'url_verification') {
+            sendJson(res, 200, {
+                challenge: String(bodyRecord.challenge ?? ''),
+            });
+            return;
+        }
+    }
+    // Resolve tenant, failing closed: when slack_workspaces is non-empty
+    // and the team_id is unknown, resolveTenantForTeam returns null and we
+    // park the envelope in slack_dlq with bucket='unroutable'. Mandatory ACK
+    // 200 so Slack stops retrying; do NOT call ingest.
+    let resolvedTenant = null;
+    if (body !== undefined && isSlackEventEnvelope(body)) {
+        const db = openHippoDb(opts.hippoRoot);
+        try {
+            resolvedTenant = resolveTenantForTeam(db, body.team_id);
+        }
+        finally {
+            closeHippoDb(db);
+        }
+        if (resolvedTenant === null) {
+            const db2 = openHippoDb(opts.hippoRoot);
+            try {
+                writeToDlq(db2, {
+                    tenantId: null, // unroutable - stored as '__unroutable__'
+                    teamId: body.team_id,
+                    rawPayload: rawBody,
+                    error: `unroutable team_id: ${body.team_id}`,
+                    bucket: 'unroutable',
+                    signature: sigStr,
+                    slackTimestamp: tsStr,
+                });
+            }
+            finally {
+                closeHippoDb(db2);
+            }
+            sendJson(res, 200, { ok: true, status: 'dlq' });
+            return;
+        }
+    }
+    else {
+        // Non-envelope payload: use env tenant for the DLQ row's bookkeeping.
+        resolvedTenant = resolveTenantId({});
+    }
+    const ctx = {
+        hippoRoot: opts.hippoRoot,
+        tenantId: resolvedTenant,
+        actor: adminActor('connector:slack'),
+    };
+    if (body === undefined || !isSlackEventEnvelope(body)) {
+        const db = openHippoDb(ctx.hippoRoot);
+        try {
+            writeToDlq(db, {
+                tenantId: ctx.tenantId,
+                teamId: teamIdFromRaw,
+                rawPayload: rawBody,
+                error: 'not an event_callback envelope',
+                bucket: 'parse_error',
+                signature: sigStr,
+                slackTimestamp: tsStr,
+            });
+        }
+        finally {
+            closeHippoDb(db);
+        }
+        sendJson(res, 200, { ok: true, status: 'dlq' });
+        return;
+    }
+    const inner = body.event;
+    if (isSlackMessageEvent(inner)) {
+        if (inner.subtype === 'message_deleted' && inner.deleted_ts) {
+            const r = handleMessageDeleted(ctx, {
+                teamId: body.team_id,
+                channelId: inner.channel,
+                deletedTs: inner.deleted_ts,
+                eventId: body.event_id,
+            });
+            sendJson(res, 200, { ok: true, status: r.status });
+            return;
+        }
+        const r = ingestMessage(ctx, {
+            teamId: body.team_id,
+            // channel privacy isn't on the inner event; use channel_type as a
+            // proxy. 'group'|'im'|'mpim' → private. 'channel' → public. Unknown
+            // → private (fail closed).
+            channel: {
+                id: inner.channel,
+                is_private: inner.channel_type !== 'channel',
+                is_im: inner.channel_type === 'im',
+                is_mpim: inner.channel_type === 'mpim',
+            },
+            message: inner,
+            eventId: body.event_id,
+        });
+        sendJson(res, 200, { ok: true, status: r.status, memoryId: r.memoryId });
+        return;
+    }
+    const db = openHippoDb(ctx.hippoRoot);
+    try {
+        writeToDlq(db, {
+            tenantId: ctx.tenantId,
+            teamId: body.team_id,
+            rawPayload: rawBody,
+            error: `unhandled event type: ${inner.type ?? 'unknown'}`,
+            bucket: 'parse_error',
+            signature: sigStr,
+            slackTimestamp: tsStr,
+        });
+    }
+    finally {
+        closeHippoDb(db);
+    }
+    sendJson(res, 200, { ok: true, status: 'dlq' });
+    return;
+}
+//# sourceMappingURL=webhook.js.map

package/dist/consolidate.js

@@ -7,9 +7,10 @@
  * 3. Stats tracking
  */
 import { evalNow, isRecallBoostAblated } from './ablation.js';
-import { Layer, calculateStrength, canAutoDelete, createMemory } from './memory.js';
+import { Layer, calculateStrength, canAutoDelete, createMemory, markRetrieved } from './memory.js';
 import { loadAllEntries, batchWriteAndDelete, appendConsolidationRun, replaceDetectedConflicts, loadSessionDecayContext, incrementSleepCount, findPromotableSessions, traceExistsForSession, listSessionEvents, memoriesBackingObjects, } from './store.js';
-import { textOverlap, markRetrieved, tokenize } from './search.js';
+import { textOverlap } from './search.js';
+import { tokenize } from './tokenize.js';
 import { compareEntryIdentity } from './compare.js';
 import { duplicateKey, mergedText } from './same-text.js';
 import { successorAfterRetirement } from './merged-row.js';

package/dist/context-auto.d.ts

@@ -0,0 +1,3 @@
+/** A context query from the cwd's git state ('' means `getContext` lists by strength); kept out of the api layer, which never shells out. */
+export declare function autoDetectContext(): string;
+//# sourceMappingURL=context-auto.d.ts.map

package/dist/context-auto.js

@@ -0,0 +1,34 @@
+import { execSync } from 'child_process';
+const SKIPPED_PATH_TERMS = ['src', 'dist', 'test', 'tests', 'node_modules', 'index'];
+/** A context query from the cwd's git state ('' means `getContext` lists by strength); kept out of the api layer, which never shells out. */
+export function autoDetectContext() {
+    try {
+        const diff = execSync('git diff --name-only HEAD 2>&1', {
+            encoding: 'utf8',
+            timeout: 3000,
+            windowsHide: true,
+        }).trim();
+        if (diff) {
+            const terms = diff
+                .split('\n')
+                .flatMap((f) => f.replace(/[/\\.]/g, ' ').split(/\s+/))
+                .filter((t) => t.length > 2 && !SKIPPED_PATH_TERMS.includes(t))
+                .slice(0, 10);
+            if (terms.length > 0)
+                return terms.join(' ');
+        }
+        const branch = execSync('git branch --show-current 2>&1', {
+            encoding: 'utf8',
+            timeout: 3000,
+            windowsHide: true,
+        }).trim();
+        if (branch && branch !== 'main' && branch !== 'master') {
+            return branch.replace(/[-_/]/g, ' ');
+        }
+    }
+    catch {
+        // Not a git repo or git missing: no query, so the caller lists by strength.
+    }
+    return '';
+}
+//# sourceMappingURL=context-auto.js.map

package/dist/customer-notes.js

@@ -20,7 +20,8 @@
  * Lifecycle: active -> superseded (a corrected version) or active -> closed (retired).
  */
 import { openHippoDb, closeHippoDb } from './db.js';
-import { writeEntry, assertTenantId } from './store.js';
+import { writeEntry } from './store.js';
+import { assertTenantId } from './tenant.js';
 import { markGraphDirty, removeGraphEntitiesForObject } from './graph.js';
 import { createMemory, Layer } from './memory.js';
 import { appendAuditEvent } from './audit.js';