hippo-memory 1.59.0 → 1.61.0

package/dist/client.js

@@ -13,8 +13,19 @@
  * Network errors (ECONNREFUSED on a stale pidfile, etc.) propagate as the
  * native fetch failure so the caller can detect them and self-heal.
  */
+import { fetchWithRetry } from './http-retry.js';
 /** A write the local server has not answered in this long is stuck; the caller treats it as delivery-unknown. */
 const SERVER_TIMEOUT_MS = 30_000;
+/** Five tries at the server's 1 s Retry-After keeps the roughly 5 s wait the CLI had before the server answered busy with 503. */
+const STORE_BUSY_ATTEMPTS = 5;
+/** The server sets Retry-After on a 503 only for a held write lock (server.ts replyFor); the auth-provider 503 has none. */
+function isStoreBusy(res) {
+    return res.status === 503 && res.headers.has('retry-after');
+}
+/** Replaying is safe because each routed write commits in one transaction and anything after it is best-effort, so a busy 503 means nothing landed. */
+function sendWrite(url, init) {
+    return fetchWithRetry(url, init, { timeoutMs: SERVER_TIMEOUT_MS, attempts: STORE_BUSY_ATTEMPTS, retryOn: isStoreBusy });
+}
 function buildHeaders(apiKey, withBody) {
     const headers = {};
     if (withBody)
@@ -57,10 +68,9 @@ async function throwForStatus(res) {
     throw new HttpResponseError(message, res.status);
 }
 export async function remember(serverUrl, apiKey, opts) {
-    const res = await fetch(`${serverUrl}/v1/memories`, {
+    const res = await sendWrite(`${serverUrl}/v1/memories`, {
         method: 'POST',
         headers: buildHeaders(apiKey, true),
-        signal: AbortSignal.timeout(SERVER_TIMEOUT_MS),
         body: JSON.stringify(opts),
     });
     if (!res.ok)
@@ -69,10 +79,9 @@ export async function remember(serverUrl, apiKey, opts) {
     return result;
 }
 export async function forget(serverUrl, apiKey, id) {
-    const res = await fetch(`${serverUrl}/v1/memories/${encodeURIComponent(id)}`, {
+    const res = await sendWrite(`${serverUrl}/v1/memories/${encodeURIComponent(id)}`, {
         method: 'DELETE',
         headers: buildHeaders(apiKey, false),
-        signal: AbortSignal.timeout(SERVER_TIMEOUT_MS),
     });
     if (!res.ok)
         await throwForStatus(res);
@@ -80,10 +89,9 @@ export async function forget(serverUrl, apiKey, id) {
     return result;
 }
 export async function promote(serverUrl, apiKey, id) {
-    const res = await fetch(`${serverUrl}/v1/memories/${encodeURIComponent(id)}/promote`, {
+    const res = await sendWrite(`${serverUrl}/v1/memories/${encodeURIComponent(id)}/promote`, {
         method: 'POST',
         headers: buildHeaders(apiKey, false),
-        signal: AbortSignal.timeout(SERVER_TIMEOUT_MS),
     });
     if (!res.ok)
         await throwForStatus(res);
@@ -91,10 +99,9 @@ export async function promote(serverUrl, apiKey, id) {
     return result;
 }
 export async function archiveRaw(serverUrl, apiKey, id, reason) {
-    const res = await fetch(`${serverUrl}/v1/memories/${encodeURIComponent(id)}/archive`, {
+    const res = await sendWrite(`${serverUrl}/v1/memories/${encodeURIComponent(id)}/archive`, {
         method: 'POST',
         headers: buildHeaders(apiKey, true),
-        signal: AbortSignal.timeout(SERVER_TIMEOUT_MS),
         body: JSON.stringify({ reason }),
     });
     if (!res.ok)

package/dist/compaction-record.js

@@ -1,7 +1,6 @@
 // One record per Claude Code compaction, and what turns its summary into kept memories.
 import * as fs from 'fs';
 import * as path from 'path';
-import { errorMessage, readTranscriptTail, truncateCodePointSafe } from './capture.js';
 import { isObjectLike, isStringValue } from './capture-contract.js';
 import { compactSummaryBody, parseCompactionItems, selectItemRows } from './compaction-items.js';
 import { loadConfig } from './config.js';
@@ -10,8 +9,12 @@ import { gatedWrite } from './gated-write.js';
 import { COMPACTION_MEMORY_TAG, COMPACTION_SOURCE_PREFIX, Layer, createMemory, generateId } from './memory.js';
 import { deriveOriginProject, isGlobalStoreRoot } from './project-identity.js';
 import { maskEmails, redactSecretsStrict } from './secret-detect.js';
-import { strengthenRetrievedOn, updateStats, writeEntryMirrors } from './store.js';
+import { strengthenRetrievedOn, writeEntryMirrors } from './store/entry-writes.js';
+import { isRecallBoostAblated } from './ablation.js';
+import { updateStats } from './store/index-and-stats.js';
 import { resolveTenantId } from './tenant.js';
+import { errorMessage, log as logger } from './log.js';
+import { readTranscriptTail, truncateCodePointSafe } from './transcript-tail.js';
 /** PostCompact has 10 s in all (PreCompact 30 s), so a locked store must be given up on early. */
 export const COMPACTION_DB_WAIT_MS = 2000;
 /** Tested verbatim: Claude Code hands PreCompact stdout to the summariser as instructions. */
@@ -225,7 +228,7 @@ export function saveItems(db, hippoRoot, ctx, log) {
             }
         }
         // Said again by another session is the same signal as being recalled; the same session carrying it forward is not.
-        strengthenRetrievedOn(db, [...restated], ctx.tenantId);
+        strengthenRetrievedOn(db, [...restated], { tenantId: ctx.tenantId, recallBoostAblated: isRecallBoostAblated() });
         if (ctx.recordId !== null) {
             db.prepare(`UPDATE compactions SET items_written = ?, status = 'done' WHERE tenant_id = ? AND id = ?`).run(written.length, ctx.tenantId, ctx.recordId);
         }
@@ -262,7 +265,7 @@ export function parsePostCompactPayload(stdinText) {
         raw = JSON.parse((stdinText ?? '').trim());
     }
     catch {
-        return null;
+        return null; // non-JSON stdin is not a PostCompact payload; the caller skips it
     }
     if (!isObjectLike(raw) || !('session_id' in raw) || !isStringValue(raw.session_id) || raw.session_id === '')
         return null;
@@ -309,7 +312,7 @@ export function saveCompaction(hippoRoot, payload, log) {
             if (isSqliteBusy(err))
                 throw err;
             log(`record step failed: ${errorMessage(err)}`);
-            console.error(`hippo post-compact: record step failed: ${errorMessage(err)}`);
+            logger.error(`post-compact: record step failed: ${errorMessage(err)}`);
         }
         try {
             result.written = saveItems(db, hippoRoot, {
@@ -337,12 +340,12 @@ export function saveCompaction(hippoRoot, payload, log) {
             }
             catch (spoolErr) {
                 log(`spool failed: ${errorMessage(spoolErr)}`);
-                console.error(`hippo post-compact: spool failed: ${errorMessage(spoolErr)}`);
+                logger.error(`post-compact: spool failed: ${errorMessage(spoolErr)}`);
             }
         }
         else {
             log(`items step failed: ${errorMessage(err)}`);
-            console.error(`hippo post-compact: items step failed: ${errorMessage(err)}`);
+            logger.error(`post-compact: items step failed: ${errorMessage(err)}`);
         }
     }
     finally {
@@ -380,7 +383,7 @@ function transcriptSummary(transcriptPath, afterMs, beforeMs) {
                 lines.push(JSON.parse(raw));
             }
             catch {
-                continue;
+                continue; // the tail can start mid-line; a torn line holds no summary
             }
         }
         const stamp = (line) => (isStringValue(line.timestamp) ? Date.parse(line.timestamp) : Number.NaN);
@@ -409,7 +412,7 @@ function readSpooled(file, fallbackTenantId) {
         raw = JSON.parse(fs.readFileSync(file, 'utf8'));
     }
     catch {
-        return null;
+        return null; // a half-written or vanished spool file is skipped; the caller treats null as unreadable
     }
     if (!isObjectLike(raw) || !('sessionId' in raw) || !isStringValue(raw.sessionId) || !('summary' in raw) || !isStringValue(raw.summary))
         return null;

package/dist/config.js

@@ -5,6 +5,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { DEFAULT_PHYSICS_CONFIG, mergePhysicsConfig } from './physics-config.js';
 import { DEFAULT_HALF_LIFE_DAYS } from './memory.js';
+import { log } from './log.js';
 const DEFAULT_CONFIG = {
     defaultHalfLifeDays: DEFAULT_HALF_LIFE_DAYS,
     defaultBudget: 4000,
@@ -114,7 +115,7 @@ function deliveryLedgerEnabled(value) {
         return enabled;
     if (isObject && enabled === undefined)
         return false;
-    console.error(`Warning: config.json's "deliveryLedger" must be an object like {"enabled": true} ` +
+    log.warn(`config.json's "deliveryLedger" must be an object like {"enabled": true} ` +
         `(got ${JSON.stringify(value)}) - using false.`);
     return false;
 }
@@ -127,7 +128,7 @@ function pilotHoldoutRate(value) {
         return 0;
     if (Number.isInteger(rate) && rate >= 0 && rate <= 10000)
         return rate;
-    console.error(`Warning: config.json's "pilot" must be an object like {"holdoutRateBp": 2000}, an integer from 0 to 10000 ` +
+    log.warn(`config.json's "pilot" must be an object like {"holdoutRateBp": 2000}, an integer from 0 to 10000 ` +
         `(got ${JSON.stringify(value)}) - using 0 (pilot off).`);
     return 0;
 }
@@ -136,7 +137,7 @@ function agentMemoryTools(value) {
         return null;
     if (Array.isArray(value) && value.every((t) => String(t) === t))
         return value;
-    console.error(`Warning: config.json's "agentMemories.tools" must be a list of tool ids like ["claude-code", "codex"] ` +
+    log.warn(`config.json's "agentMemories.tools" must be a list of tool ids like ["claude-code", "codex"] ` +
         `(got ${JSON.stringify(value)}) - importing none.`);
     return [];
 }
@@ -158,7 +159,7 @@ export function loadConfig(hippoRoot) {
         const memoryValueRaw = raw.memoryValue;
         const validMemoryValueConfig = memoryValueRaw === undefined || isMemoryValueConfig(memoryValueRaw);
         if (!validMemoryValueConfig) {
-            console.error(`Warning: config.json's "memoryValue" must be an object like {"enabled": true} ` +
+            log.warn(`config.json's "memoryValue" must be an object like {"enabled": true} ` +
                 `(got ${JSON.stringify(memoryValueRaw)}) - using defaults.`);
         }
         const memoryValueOverride = memoryValueRaw !== undefined && isMemoryValueConfig(memoryValueRaw) ? memoryValueRaw : {};
@@ -167,20 +168,20 @@ export function loadConfig(hippoRoot) {
         // warns and falls back to the default, which keeps faded memories.
         const dormantRaw = raw.dormant;
         if (dormantRaw !== undefined && !isDormantConfig(dormantRaw)) {
-            console.error(`Warning: config.json's "dormant" must be an object like {"enabled": false} ` +
+            log.warn(`config.json's "dormant" must be an object like {"enabled": false} ` +
                 `(got ${JSON.stringify(dormantRaw)}) - using the default (faded memories kept dormant).`);
         }
         const dormantOverride = dormantRaw !== undefined && isDormantConfig(dormantRaw) ? dormantRaw : {};
         // Only a real boolean counts: {"enabled": "false"} is a truthy string.
         let dormantEnabled = dormantOverride.enabled ?? DEFAULT_CONFIG.dormant.enabled;
         if (dormantEnabled !== true && dormantEnabled !== false) {
-            console.error(`Warning: config.json's "dormant.enabled" must be true or false ` +
+            log.warn(`config.json's "dormant.enabled" must be true or false ` +
                 `(got ${JSON.stringify(dormantEnabled)}) - using the default (faded memories kept dormant).`);
             dormantEnabled = DEFAULT_CONFIG.dormant.enabled;
         }
         let dormantRetentionDays = dormantOverride.retentionDays ?? DEFAULT_CONFIG.dormant.retentionDays;
         if (!Number.isFinite(dormantRetentionDays) || dormantRetentionDays < 0) {
-            console.error(`Warning: config.json's "dormant.retentionDays" must be a number of days, 0 or more ` +
+            log.warn(`config.json's "dormant.retentionDays" must be a number of days, 0 or more ` +
                 `(got ${JSON.stringify(dormantRetentionDays)}) - using ${DEFAULT_CONFIG.dormant.retentionDays}.`);
             dormantRetentionDays = DEFAULT_CONFIG.dormant.retentionDays;
         }
@@ -188,21 +189,21 @@ export function loadConfig(hippoRoot) {
         const churnStalenessRaw = raw.churnStaleness;
         const validChurnStalenessConfig = churnStalenessRaw === undefined || isChurnStalenessConfig(churnStalenessRaw);
         if (!validChurnStalenessConfig) {
-            console.error(`Warning: config.json's "churnStaleness" must be an object like {"enabled": true} ` +
+            log.warn(`config.json's "churnStaleness" must be an object like {"enabled": true} ` +
                 `(got ${JSON.stringify(churnStalenessRaw)}) - using defaults.`);
         }
         let churnStalenessEnabled = churnStalenessRaw !== undefined && isChurnStalenessConfig(churnStalenessRaw)
             ? churnStalenessRaw.enabled
             : DEFAULT_CONFIG.churnStaleness.enabled;
         if (churnStalenessEnabled !== true && churnStalenessEnabled !== false) {
-            console.error(`Warning: config.json's "churnStaleness.enabled" must be true or false ` +
+            log.warn(`config.json's "churnStaleness.enabled" must be true or false ` +
                 `(got ${JSON.stringify(churnStalenessEnabled)}) - using false.`);
             churnStalenessEnabled = false;
         }
         // Every writer starts a memory on this, and a zero or negative half-life scores zero strength, so sleep would retire it.
         let defaultHalfLifeDays = raw.defaultHalfLifeDays ?? DEFAULT_CONFIG.defaultHalfLifeDays;
         if (!Number.isFinite(defaultHalfLifeDays) || defaultHalfLifeDays <= 0) {
-            console.error(`Warning: config.json's "defaultHalfLifeDays" must be a number of days above 0 ` +
+            log.warn(`config.json's "defaultHalfLifeDays" must be a number of days above 0 ` +
                 `(got ${JSON.stringify(defaultHalfLifeDays)}) - using ${DEFAULT_CONFIG.defaultHalfLifeDays}.`);
             defaultHalfLifeDays = DEFAULT_CONFIG.defaultHalfLifeDays;
         }
@@ -247,7 +248,7 @@ export function loadConfig(hippoRoot) {
     }
     catch (err) {
         if (fs.existsSync(configPath)) {
-            console.error(`Warning: failed to parse ${configPath}: ${err instanceof Error ? err.message : err}`);
+            log.warn(`failed to parse ${configPath}: ${err instanceof Error ? err.message : err}`);
         }
         return { ...DEFAULT_CONFIG };
     }

package/dist/connectors/github/backfill.js

@@ -172,6 +172,82 @@ async function drainStream(ctx, url0, toIngestEvent, fetcher, token, sleep, maxI
     }
     return { ingested, pages, maxUpdatedAt, drained: true };
 }
+function issueItemToEvent(item, repository) {
+    if (!isIssuesItem(item))
+        return null;
+    // Codex P1 #2: /issues returns PRs too — skip them.
+    if (item.pull_request)
+        return null;
+    const payload = {
+        action: 'opened',
+        repository,
+        issue: {
+            number: item.number,
+            title: item.title,
+            body: item.body ?? null,
+            user: { login: item.user.login, id: item.user.id },
+            updated_at: item.updated_at,
+        },
+    };
+    return { eventName: 'issues', payload };
+}
+function issueCommentItemToEvent(item, repository) {
+    if (!isCommentItem(item))
+        return null;
+    // SAFETY: this closure only runs against the /issues/comments stream,
+    // so every item isCommentItem validates here is genuinely an
+    // IssueCommentItem; a missing issue_url is handled defensively below.
+    const c = item;
+    const issueNumber = parseTrailingNumber(c.issue_url);
+    if (issueNumber === null)
+        return null;
+    const payload = {
+        action: 'created',
+        repository,
+        issue: { number: issueNumber },
+        comment: {
+            id: c.id,
+            body: c.body ?? null,
+            user: { login: c.user.login, id: c.user.id },
+            updated_at: c.updated_at,
+        },
+    };
+    return { eventName: 'issue_comment', payload };
+}
+function prReviewCommentItemToEvent(item, repository) {
+    if (!isCommentItem(item))
+        return null;
+    // SAFETY: this closure only runs against the /pulls/comments stream,
+    // so every item isCommentItem validates here is genuinely a
+    // PrReviewCommentItem; a missing pull_request_url is handled below.
+    const c = item;
+    const prNumber = parseTrailingNumber(c.pull_request_url);
+    if (prNumber === null)
+        return null;
+    const payload = {
+        action: 'created',
+        repository,
+        pull_request: { number: prNumber },
+        comment: {
+            id: c.id,
+            body: c.body ?? null,
+            user: { login: c.user.login, id: c.user.id },
+            updated_at: c.updated_at,
+        },
+    };
+    return { eventName: 'pull_request_review_comment', payload };
+}
+/** Drains one stream, then persists its HWM only when the stream ran to the end. */
+async function backfillStream(ctx, opts, sleep, stream) {
+    const res = await drainStream(ctx, stream.url, stream.toIngestEvent, opts.fetcher, opts.token, sleep, opts.maxPerStream);
+    // v1.3.1: only advance HWM when the stream actually drained. A capped run
+    // (--max) must leave the HWM at its previous value so the next invocation
+    // re-fetches the unprocessed tail.
+    if (res.drained && res.maxUpdatedAt) {
+        writeOneHwm(ctx.hippoRoot, ctx.tenantId, opts.repoFullName, stream.column, res.maxUpdatedAt);
+    }
+    return { ingested: res.ingested, pages: res.pages };
+}
 export async function backfillRepo(ctx, opts) {
     const sleep = opts.sleepMs ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     const cursors = readCursor(ctx.hippoRoot, ctx.tenantId, opts.repoFullName);
@@ -181,101 +257,32 @@ export async function backfillRepo(ctx, opts) {
         pages: { issues: 0, issueComments: 0, prReviewComments: 0 },
     };
     // ---------- Stream 1: issues (skip PRs) ----------
-    const issuesUrl = `${API}/repos/${opts.repoFullName}/issues?state=all&per_page=100` +
-        (cursors.issues ? `&since=${encodeURIComponent(cursors.issues)}` : '');
-    const issuesRes = await drainStream(ctx, issuesUrl, (item) => {
-        if (!isIssuesItem(item))
-            return null;
-        // Codex P1 #2: /issues returns PRs too — skip them.
-        if (item.pull_request)
-            return null;
-        const payload = {
-            action: 'opened',
-            repository,
-            issue: {
-                number: item.number,
-                title: item.title,
-                body: item.body ?? null,
-                user: { login: item.user.login, id: item.user.id },
-                updated_at: item.updated_at,
-            },
-        };
-        return { eventName: 'issues', payload };
-    }, opts.fetcher, opts.token, sleep, opts.maxPerStream);
+    const issuesRes = await backfillStream(ctx, opts, sleep, {
+        url: `${API}/repos/${opts.repoFullName}/issues?state=all&per_page=100` +
+            (cursors.issues ? `&since=${encodeURIComponent(cursors.issues)}` : ''),
+        column: 'issues_hwm',
+        toIngestEvent: (item) => issueItemToEvent(item, repository),
+    });
     result.ingested.issues = issuesRes.ingested;
     result.pages.issues = issuesRes.pages;
-    // v1.3.1: only advance HWM when the stream actually drained. A capped run
-    // (--max) must leave the HWM at its previous value so the next invocation
-    // re-fetches the unprocessed tail.
-    if (issuesRes.drained && issuesRes.maxUpdatedAt) {
-        writeOneHwm(ctx.hippoRoot, ctx.tenantId, opts.repoFullName, 'issues_hwm', issuesRes.maxUpdatedAt);
-    }
     // ---------- Stream 2: repo-level issue comments ----------
-    const commentsUrl = `${API}/repos/${opts.repoFullName}/issues/comments?per_page=100` +
-        (cursors.issueComments
-            ? `&since=${encodeURIComponent(cursors.issueComments)}`
-            : '');
-    const commentsRes = await drainStream(ctx, commentsUrl, (item) => {
-        if (!isCommentItem(item))
-            return null;
-        // SAFETY: this closure only runs against the /issues/comments stream,
-        // so every item isCommentItem validates here is genuinely an
-        // IssueCommentItem; a missing issue_url is handled defensively below.
-        const c = item;
-        const issueNumber = parseTrailingNumber(c.issue_url);
-        if (issueNumber === null)
-            return null;
-        const payload = {
-            action: 'created',
-            repository,
-            issue: { number: issueNumber },
-            comment: {
-                id: c.id,
-                body: c.body ?? null,
-                user: { login: c.user.login, id: c.user.id },
-                updated_at: c.updated_at,
-            },
-        };
-        return { eventName: 'issue_comment', payload };
-    }, opts.fetcher, opts.token, sleep, opts.maxPerStream);
+    const commentsRes = await backfillStream(ctx, opts, sleep, {
+        url: `${API}/repos/${opts.repoFullName}/issues/comments?per_page=100` +
+            (cursors.issueComments ? `&since=${encodeURIComponent(cursors.issueComments)}` : ''),
+        column: 'issue_comments_hwm',
+        toIngestEvent: (item) => issueCommentItemToEvent(item, repository),
+    });
     result.ingested.issueComments = commentsRes.ingested;
     result.pages.issueComments = commentsRes.pages;
-    if (commentsRes.drained && commentsRes.maxUpdatedAt) {
-        writeOneHwm(ctx.hippoRoot, ctx.tenantId, opts.repoFullName, 'issue_comments_hwm', commentsRes.maxUpdatedAt);
-    }
     // ---------- Stream 3: repo-level PR review comments ----------
-    const prCommentsUrl = `${API}/repos/${opts.repoFullName}/pulls/comments?per_page=100` +
-        (cursors.prReviewComments
-            ? `&since=${encodeURIComponent(cursors.prReviewComments)}`
-            : '');
-    const prCommentsRes = await drainStream(ctx, prCommentsUrl, (item) => {
-        if (!isCommentItem(item))
-            return null;
-        // SAFETY: this closure only runs against the /pulls/comments stream,
-        // so every item isCommentItem validates here is genuinely a
-        // PrReviewCommentItem; a missing pull_request_url is handled below.
-        const c = item;
-        const prNumber = parseTrailingNumber(c.pull_request_url);
-        if (prNumber === null)
-            return null;
-        const payload = {
-            action: 'created',
-            repository,
-            pull_request: { number: prNumber },
-            comment: {
-                id: c.id,
-                body: c.body ?? null,
-                user: { login: c.user.login, id: c.user.id },
-                updated_at: c.updated_at,
-            },
-        };
-        return { eventName: 'pull_request_review_comment', payload };
-    }, opts.fetcher, opts.token, sleep, opts.maxPerStream);
+    const prCommentsRes = await backfillStream(ctx, opts, sleep, {
+        url: `${API}/repos/${opts.repoFullName}/pulls/comments?per_page=100` +
+            (cursors.prReviewComments ? `&since=${encodeURIComponent(cursors.prReviewComments)}` : ''),
+        column: 'pr_review_comments_hwm',
+        toIngestEvent: (item) => prReviewCommentItemToEvent(item, repository),
+    });
     result.ingested.prReviewComments = prCommentsRes.ingested;
     result.pages.prReviewComments = prCommentsRes.pages;
-    if (prCommentsRes.drained && prCommentsRes.maxUpdatedAt) {
-        writeOneHwm(ctx.hippoRoot, ctx.tenantId, opts.repoFullName, 'pr_review_comments_hwm', prCommentsRes.maxUpdatedAt);
-    }
     return result;
 }
 //# sourceMappingURL=backfill.js.map

package/dist/connectors/github/cli-impl.js

@@ -9,6 +9,7 @@
  *   - hippo github dlq list
  *   - hippo github dlq replay <id> [--force]
  */
+import { envGithubToken, envGithubWebhookSecret, envGithubWebhookSecretPrevious } from '../../env.js';
 import { adminActor } from '../../api.js';
 import { openHippoDb, closeHippoDb } from '../../db.js';
 import { resolveTenantId } from '../../tenant.js';
@@ -52,6 +53,7 @@ function parsedToIngestEvent(parsed, eventName) {
     }
     return null;
 }
+// Console lines below are the `hippo github` command's printed result and usage text, so they stay off the logger.
 export function printGithubBackfillUsage() {
     console.log('hippo github backfill --repo <owner/name> [--since ISO] [--max <N>]');
     console.log('  --repo   GitHub repository in owner/name format (required, e.g. acme/widgets)');
@@ -69,7 +71,7 @@ export async function cmdGithubBackfill(hippoRoot, flags, fetcher = realGitHubFe
         printGithubBackfillUsage();
         process.exit(2);
     }
-    const token = process.env.GITHUB_TOKEN;
+    const token = envGithubToken();
     if (!token) {
         console.error('GITHUB_TOKEN is not set. Backfill requires a personal access token with repo read scope.');
         process.exit(2);
@@ -165,8 +167,8 @@ export async function cmdGithubDlqReplay(hippoRoot, args, flags) {
     // real hook so `replay` actually re-runs the ingest path.
     const result = await replayDlqEntry(ctx, id, {
         force,
-        webhookSecret: process.env.GITHUB_WEBHOOK_SECRET,
-        previousSecret: process.env.GITHUB_WEBHOOK_SECRET_PREVIOUS,
+        webhookSecret: envGithubWebhookSecret(),
+        previousSecret: envGithubWebhookSecretPrevious(),
         ingestHook: async (innerCtx, args) => {
             const parsed = JSON.parse(args.rawPayload);
             const event = parsedToIngestEvent(parsed, args.eventName);

package/dist/connectors/github/dlq.js

@@ -104,61 +104,13 @@ export async function replayDlqEntry(ctx, id, opts = {}) {
     }
     // Signature verification (current secret, not the one in effect when DLQed).
     if (!opts.force && opts.webhookSecret) {
-        if (!row.signature) {
-            return {
-                ok: false,
-                status: 'sig_missing',
-                memoryId: null,
-                retryCount: row.retryCount,
-                reason: 'row has no signature (legacy, or redacted before storing); pass --force to replay',
-            };
-        }
-        const sigOk = verifyGitHubSignature({
-            rawBody: row.rawPayload,
-            signature: row.signature,
-            webhookSecret: opts.webhookSecret,
-            previousSecret: opts.previousSecret,
-        });
-        if (!sigOk) {
-            bumpRetryCount(ctx.hippoRoot, id);
-            return {
-                ok: false,
-                status: 'sig_fail',
-                memoryId: null,
-                retryCount: row.retryCount + 1,
-                reason: 'signature did not verify against current GITHUB_WEBHOOK_SECRET; pass --force to replay anyway',
-            };
-        }
-    }
-    // Parse + envelope guard.
-    let parsed;
-    try {
-        parsed = JSON.parse(row.rawPayload);
-    }
-    catch (e) {
-        bumpRetryCount(ctx.hippoRoot, id);
-        // SAFETY: this is a best-effort error message only; property access on
-        // any JS value is safe (undefined if absent), preserving the existing
-        // lenient formatting even when something non-Error was thrown.
-        const message = e.message;
-        return {
-            ok: false,
-            status: 'parse_error',
-            memoryId: null,
-            retryCount: row.retryCount + 1,
-            reason: `still unparseable: ${message}`,
-        };
-    }
-    if (!isGitHubWebhookEnvelope(parsed)) {
-        bumpRetryCount(ctx.hippoRoot, id);
-        return {
-            ok: false,
-            status: 'unhandled',
-            memoryId: null,
-            retryCount: row.retryCount + 1,
-            reason: 'not a GitHub webhook envelope',
-        };
+        const sigFailure = checkReplaySignature(ctx.hippoRoot, id, row, opts.webhookSecret, opts.previousSecret);
+        if (sigFailure)
+            return sigFailure;
     }
+    const envelopeFailure = checkReplayEnvelope(ctx.hippoRoot, id, row);
+    if (envelopeFailure)
+        return envelopeFailure;
     // Without an ingest hook this is a dry-run validation. Bump and report.
     if (!opts.ingestHook) {
         bumpRetryCount(ctx.hippoRoot, id);
@@ -190,4 +142,65 @@ export async function replayDlqEntry(ctx, id, opts = {}) {
         retryCount: row.retryCount + 1,
     };
 }
+/** The failure result when the row cannot pass the signature gate, else null. */
+function checkReplaySignature(hippoRoot, id, row, webhookSecret, previousSecret) {
+    if (!row.signature) {
+        return {
+            ok: false,
+            status: 'sig_missing',
+            memoryId: null,
+            retryCount: row.retryCount,
+            reason: 'row has no signature (legacy, or redacted before storing); pass --force to replay',
+        };
+    }
+    const sigOk = verifyGitHubSignature({
+        rawBody: row.rawPayload,
+        signature: row.signature,
+        webhookSecret,
+        previousSecret,
+    });
+    if (!sigOk) {
+        bumpRetryCount(hippoRoot, id);
+        return {
+            ok: false,
+            status: 'sig_fail',
+            memoryId: null,
+            retryCount: row.retryCount + 1,
+            reason: 'signature did not verify against current GITHUB_WEBHOOK_SECRET; pass --force to replay anyway',
+        };
+    }
+    return null;
+}
+/** Parse + envelope guard; the failure result after bumping the count, else null. */
+function checkReplayEnvelope(hippoRoot, id, row) {
+    let parsed;
+    try {
+        parsed = JSON.parse(row.rawPayload);
+    }
+    catch (e) {
+        bumpRetryCount(hippoRoot, id);
+        // SAFETY: this is a best-effort error message only; property access on
+        // any JS value is safe (undefined if absent), preserving the existing
+        // lenient formatting even when something non-Error was thrown.
+        const message = e.message;
+        return {
+            ok: false,
+            status: 'parse_error',
+            memoryId: null,
+            retryCount: row.retryCount + 1,
+            reason: `still unparseable: ${message}`,
+        };
+    }
+    if (!isGitHubWebhookEnvelope(parsed)) {
+        bumpRetryCount(hippoRoot, id);
+        return {
+            ok: false,
+            status: 'unhandled',
+            memoryId: null,
+            retryCount: row.retryCount + 1,
+            reason: 'not a GitHub webhook envelope',
+        };
+    }
+    return null;
+}
 //# sourceMappingURL=dlq.js.map