hippo-memory 1.59.0 → 1.61.0

package/dist/connectors/github/ingest.js

@@ -69,6 +69,7 @@ function eventUpdatedAt(event) {
             return event.payload.comment.updated_at ?? null;
     }
 }
+const INSERT_EVENT_LOG_SQL = `INSERT OR IGNORE INTO github_event_log (idempotency_key, delivery_id, event_name, ingested_at, memory_id) VALUES (?, ?, ?, ?, ?)`;
 export function ingestEvent(ctx, input) {
     const idempotencyKey = computeIdempotencyKey(eventArtifactRef(input.event), eventUpdatedAt(input.event));
     // Fast path: pre-check. Avoids running the transform / opening a write tx
@@ -87,15 +88,7 @@ export function ingestEvent(ctx, input) {
         // Empty body: no memory to write, but mark seen so a retry of the same
         // empty event returns 'duplicate' (not 'skipped' again — that would
         // re-run the transform on every retry).
-        const db2 = openHippoDb(ctx.hippoRoot);
-        try {
-            db2
-                .prepare(`INSERT OR IGNORE INTO github_event_log (idempotency_key, delivery_id, event_name, ingested_at, memory_id) VALUES (?, ?, ?, ?, ?)`)
-                .run(idempotencyKey, input.deliveryId, input.event.eventName, new Date().toISOString(), null);
-        }
-        finally {
-            closeHippoDb(db2);
-        }
+        markKeySeenWithoutMemory(ctx.hippoRoot, idempotencyKey, input);
         return { status: 'skipped', memoryId: null };
     }
     // Atomic write via afterWrite. Inside writeEntry's SAVEPOINT:
@@ -105,23 +98,7 @@ export function ingestEvent(ctx, input) {
     //      the test injection) beat us, changes=0 -> throw -> SAVEPOINT rolls
     //      back our memory row. Other worker's commit stands.
     try {
-        // v1.12.0: drop the legacy `|| 'connector:github'` fallback (see slack/ingest.ts:73 for rationale).
-        const result = remember(ctx, {
-            ...opts,
-            untrusted: true,
-            afterWrite: (innerDb, memoryId) => {
-                if (input.__testInjectBeforeLog) {
-                    input.__testInjectBeforeLog(innerDb, idempotencyKey);
-                }
-                const inserted = innerDb
-                    .prepare(`INSERT OR IGNORE INTO github_event_log (idempotency_key, delivery_id, event_name, ingested_at, memory_id) VALUES (?, ?, ?, ?, ?)`)
-                    .run(idempotencyKey, input.deliveryId, input.event.eventName, new Date().toISOString(), memoryId);
-                if (Number(inserted.changes ?? 0) === 0) {
-                    throw new DuplicateIdempotencyError(idempotencyKey);
-                }
-            },
-        });
-        return { status: 'ingested', memoryId: result.id };
+        return rememberWithEventLog(ctx, input, idempotencyKey, opts);
     }
     catch (e) {
         if (e instanceof DuplicateIdempotencyError) {
@@ -140,18 +117,40 @@ export function ingestEvent(ctx, input) {
             // a transient failure — never DLQ-retry it. Mark the idempotency key
             // seen exactly like the empty-body branch above so a GitHub retry of
             // the same delivery acks as done, not error.
-            const db4 = openHippoDb(ctx.hippoRoot);
-            try {
-                db4
-                    .prepare(`INSERT OR IGNORE INTO github_event_log (idempotency_key, delivery_id, event_name, ingested_at, memory_id) VALUES (?, ?, ?, ?, ?)`)
-                    .run(idempotencyKey, input.deliveryId, input.event.eventName, new Date().toISOString(), null);
-            }
-            finally {
-                closeHippoDb(db4);
-            }
+            markKeySeenWithoutMemory(ctx.hippoRoot, idempotencyKey, input);
             return { status: 'skipped', memoryId: null };
         }
         throw e;
     }
 }
+function markKeySeenWithoutMemory(hippoRoot, idempotencyKey, input) {
+    const db = openHippoDb(hippoRoot);
+    try {
+        db
+            .prepare(INSERT_EVENT_LOG_SQL)
+            .run(idempotencyKey, input.deliveryId, input.event.eventName, new Date().toISOString(), null);
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+function rememberWithEventLog(ctx, input, idempotencyKey, opts) {
+    // v1.12.0: drop the legacy `|| 'connector:github'` fallback (see slack/ingest.ts:73 for rationale).
+    const result = remember(ctx, {
+        ...opts,
+        untrusted: true,
+        afterWrite: (innerDb, memoryId) => {
+            if (input.__testInjectBeforeLog) {
+                input.__testInjectBeforeLog(innerDb, idempotencyKey);
+            }
+            const inserted = innerDb
+                .prepare(INSERT_EVENT_LOG_SQL)
+                .run(idempotencyKey, input.deliveryId, input.event.eventName, new Date().toISOString(), memoryId);
+            if (Number(inserted.changes ?? 0) === 0) {
+                throw new DuplicateIdempotencyError(idempotencyKey);
+            }
+        },
+    });
+    return { status: 'ingested', memoryId: result.id };
+}
 //# sourceMappingURL=ingest.js.map

package/dist/connectors/github/tenant-routing.js

@@ -1,3 +1,4 @@
+import { envGithubAllowUnknownInstallationFallback, envTenant } from '../../env.js';
 /**
  * Resolve the tenant_id for a GitHub webhook envelope.
  *
@@ -23,8 +24,8 @@
  * replay, future MCP) gets identical protection.
  */
 export function resolveTenantForGitHub(db, args) {
-    const envFallback = () => process.env.HIPPO_TENANT?.trim() || 'default';
-    const escapeHatch = process.env.GITHUB_ALLOW_UNKNOWN_INSTALLATION_FALLBACK === '1';
+    const envFallback = () => envTenant();
+    const escapeHatch = envGithubAllowUnknownInstallationFallback();
     // SAFETY: the row comes from the SELECT above, which projects exactly one
     // column, `c`, as a COUNT(*).
     const instCount = db

package/dist/connectors/github/webhook.js

@@ -1,3 +1,4 @@
+import { envGithubWebhookSecret, envGithubWebhookSecretPrevious } from '../../env.js';
 import { verifyGitHubSignature } from './signature.js';
 import { isGitHubWebhookEnvelope, isGitHubIssueEvent, isGitHubIssueCommentEvent, isGitHubPullRequestEvent, isGitHubPullRequestReviewCommentEvent, } from './types.js';
 import { ingestEvent as ingestGitHubEvent } from './ingest.js';
@@ -7,7 +8,6 @@ import { resolveTenantForGitHub } from './tenant-routing.js';
 import { computeDeletionKey as computeGitHubDeletionKey } from './signature.js';
 import { resolveTenantId } from '../../tenant.js';
 import { openHippoDb, closeHippoDb } from '../../db.js';
-import { adminActor } from '../../api.js';
 import { HttpError, JSON_HEADERS, isHeaderString, readBody, sendJson, } from '../../http-util.js';
 /**
  * GitHub webhook receiver. Mirrors the Slack route shape but with
@@ -27,13 +27,13 @@ import { HttpError, JSON_HEADERS, isHeaderString, readBody, sendJson, } from '..
  */
 export async function handleGitHubEventsWebhook({ req, res, opts }) {
     const rawBody = await readBody(req);
-    const secret = process.env.GITHUB_WEBHOOK_SECRET;
+    const secret = envGithubWebhookSecret();
     if (!secret) {
         res.writeHead(404, JSON_HEADERS);
         res.end(JSON.stringify({ error: 'not found' }));
         return;
     }
-    const previousSecret = process.env.GITHUB_WEBHOOK_SECRET_PREVIOUS;
+    const previousSecret = envGithubWebhookSecretPrevious();
     const sigHdr = req.headers['x-hub-signature-256'];
     const eventHdr = req.headers['x-github-event'];
     const deliveryHdr = req.headers['x-github-delivery'];
@@ -51,158 +51,143 @@ export async function handleGitHubEventsWebhook({ req, res, opts }) {
     }
     // Signature OK from here on. Everything else is ACK-200; bad envelopes go
     // to the DLQ and a human can replay later.
-    // Cheap regex extraction of installation_id / repo for DLQ rows that fail
-    // to JSON.parse - gives operators something to triage.
-    const installationFromRaw = (() => {
-        const m = rawBody.match(/"installation"\s*:\s*\{[^}]*"id"\s*:\s*(\d+)/);
-        return m ? m[1] : null;
-    })();
-    const repoFromRaw = (() => {
-        const m = rawBody.match(/"full_name"\s*:\s*"([^"]+)"/);
-        return m ? m[1] : null;
-    })();
-    if (deliveryId === null) {
-        // Body was signed but caller omitted the audit header. Park.
-        const db = openHippoDb(opts.hippoRoot);
-        try {
-            writeToGitHubDlq(db, {
-                tenantId: resolveTenantId({}),
-                rawPayload: rawBody,
-                error: 'missing X-GitHub-Delivery header',
-                bucket: 'parse_error',
-                eventName,
-                deliveryId: null,
-                signature: sigStr,
-                installationId: installationFromRaw,
-                repoFullName: repoFromRaw,
-            });
-        }
-        finally {
-            closeHippoDb(db);
-        }
-        sendJson(res, 200, { ok: true, status: 'dlq' });
-        return;
-    }
-    // Ping fires once at hook creation. Don't ingest, don't DLQ - just pong.
-    if (eventName === 'ping') {
-        sendJson(res, 200, { pong: true });
-        return;
-    }
-    const ALLOWED_EVENTS = new Set([
-        'issues',
-        'issue_comment',
-        'pull_request',
-        'pull_request_review_comment',
-    ]);
-    if (eventName === null || !ALLOWED_EVENTS.has(eventName)) {
-        const db = openHippoDb(opts.hippoRoot);
-        try {
-            writeToGitHubDlq(db, {
-                tenantId: resolveTenantId({}),
-                rawPayload: rawBody,
-                error: `unhandled event: ${eventName ?? '(missing X-GitHub-Event)'}`,
-                bucket: 'unhandled',
-                eventName,
-                deliveryId,
-                signature: sigStr,
-                installationId: installationFromRaw,
-                repoFullName: repoFromRaw,
-            });
-        }
-        finally {
-            closeHippoDb(db);
-        }
-        sendJson(res, 200, { ok: true, status: 'dlq' });
-        return;
-    }
-    let body;
+    routeSignedDelivery({ hippoRoot: opts.hippoRoot, res, rawBody, eventName, deliveryId, signature: sigStr });
+}
+const ALLOWED_EVENTS = new Set([
+    'issues',
+    'issue_comment',
+    'pull_request',
+    'pull_request_review_comment',
+]);
+function parkInDlq(d, park) {
+    const db = openHippoDb(d.hippoRoot);
     try {
-        body = JSON.parse(rawBody);
+        writeToGitHubDlq(db, {
+            tenantId: park.tenantId,
+            rawPayload: d.rawBody,
+            error: park.error,
+            bucket: park.bucket,
+            eventName: d.eventName,
+            deliveryId: d.deliveryId,
+            signature: d.signature,
+            installationId: park.installationId,
+            repoFullName: park.repoFullName,
+        });
     }
-    catch {
-        const db = openHippoDb(opts.hippoRoot);
-        try {
-            writeToGitHubDlq(db, {
-                tenantId: resolveTenantId({}),
-                rawPayload: rawBody,
-                error: 'invalid JSON',
-                bucket: 'parse_error',
-                eventName,
-                deliveryId,
-                signature: sigStr,
-                installationId: installationFromRaw,
-                repoFullName: repoFromRaw,
-            });
-        }
-        finally {
-            closeHippoDb(db);
-        }
-        sendJson(res, 200, { ok: true, status: 'dlq' });
-        return;
+    finally {
+        closeHippoDb(db);
     }
-    if (body === undefined || !isGitHubWebhookEnvelope(body)) {
-        const db = openHippoDb(opts.hippoRoot);
-        try {
-            writeToGitHubDlq(db, {
-                tenantId: resolveTenantId({}),
-                rawPayload: rawBody,
-                error: 'not a GitHub webhook envelope',
-                bucket: 'parse_error',
-                eventName,
-                deliveryId,
-                signature: sigStr,
-                installationId: installationFromRaw,
-                repoFullName: repoFromRaw,
-            });
-        }
-        finally {
-            closeHippoDb(db);
-        }
-        sendJson(res, 200, { ok: true, status: 'dlq' });
+    sendJson(d.res, 200, { ok: true, status: 'dlq' });
+}
+function routeSignedDelivery(d) {
+    const body = parseEnvelopeOrPark(d);
+    if (body === null || d.deliveryId === null)
         return;
-    }
-    const installationId = body.installation?.id != null ? String(body.installation.id) : null;
-    const repoFullName = body.repository?.full_name ?? null;
+    const routing = {
+        installationId: body.installation?.id != null ? String(body.installation.id) : null,
+        repoFullName: body.repository?.full_name ?? null,
+    };
     // Tenant resolution. Fail closed on multi-tenant installs with unknown
     // routing - same policy as Slack.
     let resolvedTenant;
     {
-        const db = openHippoDb(opts.hippoRoot);
+        const db = openHippoDb(d.hippoRoot);
         try {
-            resolvedTenant = resolveTenantForGitHub(db, {
-                installationId,
-                repoFullName,
-            });
+            resolvedTenant = resolveTenantForGitHub(db, routing);
         }
         finally {
             closeHippoDb(db);
         }
     }
     if (resolvedTenant === null) {
-        const db = openHippoDb(opts.hippoRoot);
-        try {
-            writeToGitHubDlq(db, {
-                tenantId: null,
-                rawPayload: rawBody,
-                error: `unroutable: installation_id=${installationId ?? '(none)'} repo=${repoFullName ?? '(none)'}`,
-                bucket: 'unroutable',
-                eventName,
-                deliveryId,
-                signature: sigStr,
-                installationId,
-                repoFullName,
-            });
-        }
-        finally {
-            closeHippoDb(db);
-        }
-        sendJson(res, 200, { ok: true, status: 'dlq' });
+        parkInDlq(d, {
+            ...routing,
+            tenantId: null,
+            error: `unroutable: installation_id=${routing.installationId ?? '(none)'} repo=${routing.repoFullName ?? '(none)'}`,
+            bucket: 'unroutable',
+        });
         return;
     }
     const ctx = {
-        hippoRoot: opts.hippoRoot,
+        hippoRoot: d.hippoRoot,
+        tenantId: resolvedTenant,
+        actor: { subject: 'connector:github', role: 'admin' },
+    };
+    if (dispatchGitHubEvent(d, ctx, body, d.deliveryId, routing))
+        return;
+    // Header allow-listed but body shape didn't satisfy the matching guard.
+    parkInDlq(d, {
+        ...routing,
         tenantId: resolvedTenant,
-        actor: adminActor('connector:github'),
+        error: `body shape did not match X-GitHub-Event=${d.eventName}`,
+        bucket: 'parse_error',
+    });
+}
+/** Answers ping and parks every unusable body; returns the envelope only when ingest should go on. */
+function parseEnvelopeOrPark(d) {
+    // Cheap regex extraction of installation_id / repo for DLQ rows that fail
+    // to JSON.parse - gives operators something to triage.
+    const installationFromRaw = (() => {
+        const m = d.rawBody.match(/"installation"\s*:\s*\{[^}]*"id"\s*:\s*(\d+)/);
+        return m ? m[1] : null;
+    })();
+    const repoFromRaw = (() => {
+        const m = d.rawBody.match(/"full_name"\s*:\s*"([^"]+)"/);
+        return m ? m[1] : null;
+    })();
+    const parkRaw = (error, bucket) => {
+        parkInDlq(d, {
+            tenantId: resolveTenantId({}),
+            error,
+            bucket,
+            installationId: installationFromRaw,
+            repoFullName: repoFromRaw,
+        });
+        return null;
+    };
+    // Body was signed but caller omitted the audit header. Park.
+    if (d.deliveryId === null)
+        return parkRaw('missing X-GitHub-Delivery header', 'parse_error');
+    // Ping fires once at hook creation. Don't ingest, don't DLQ - just pong.
+    if (d.eventName === 'ping') {
+        sendJson(d.res, 200, { pong: true });
+        return null;
+    }
+    if (d.eventName === null || !ALLOWED_EVENTS.has(d.eventName)) {
+        return parkRaw(`unhandled event: ${d.eventName ?? '(missing X-GitHub-Event)'}`, 'unhandled');
+    }
+    let body;
+    try {
+        body = JSON.parse(d.rawBody);
+    }
+    catch {
+        return parkRaw('invalid JSON', 'parse_error');
+    }
+    if (body === undefined || !isGitHubWebhookEnvelope(body)) {
+        return parkRaw('not a GitHub webhook envelope', 'parse_error');
+    }
+    return body;
+}
+/** Ingests, archives or parks by event header; false when no guard matched the body. */
+function dispatchGitHubEvent(d, ctx, body, deliveryId, routing) {
+    const { res, rawBody, eventName } = d;
+    const ingest = (event) => {
+        const r = ingestGitHubEvent(ctx, { event, rawBody, deliveryId });
+        sendJson(res, 200, { ok: true, status: r.status, memoryId: r.memoryId });
+        return true;
+    };
+    const archiveComment = (event, artifactRef, updatedAt) => {
+        // The "deleted:" key namespace keeps this from colliding with the ingest key for the
+        // same artifact; a shared key would make hasSeenKey skip the archive.
+        const idempotencyKey = computeGitHubDeletionKey(artifactRef, updatedAt);
+        const r = handleGitHubCommentDeleted(ctx, {
+            artifactRef,
+            idempotencyKey,
+            deliveryId,
+            eventName: event,
+        });
+        sendJson(res, 200, { ok: true, status: r.status, archivedCount: r.archivedCount });
+        return true;
     };
     // Dispatch by event header. Type guards cross-check the body shape against
     // the header so a payload of one event type cannot satisfy another's guard.
@@ -211,57 +196,26 @@ export async function handleGitHubEventsWebhook({ req, res, opts }) {
             // GitHub does fire issues.deleted (admin-initiated). Don't archive - V1
             // policy is to log and let an operator decide. Archive could lose the
             // memory if the issue is being moved between accounts.
-            const db = openHippoDb(opts.hippoRoot);
-            try {
-                writeToGitHubDlq(db, {
-                    tenantId: resolvedTenant,
-                    rawPayload: rawBody,
-                    error: 'issues.deleted requires manual review',
-                    bucket: 'unhandled',
-                    eventName,
-                    deliveryId,
-                    signature: sigStr,
-                    installationId,
-                    repoFullName,
-                });
-            }
-            finally {
-                closeHippoDb(db);
-            }
-            sendJson(res, 200, { ok: true, status: 'dlq' });
-            return;
+            parkInDlq(d, {
+                ...routing,
+                tenantId: ctx.tenantId,
+                error: 'issues.deleted requires manual review',
+                bucket: 'unhandled',
+            });
+            return true;
         }
-        const ingestInput = { eventName: 'issues', payload: body };
-        const r = ingestGitHubEvent(ctx, { event: ingestInput, rawBody, deliveryId });
-        sendJson(res, 200, { ok: true, status: r.status, memoryId: r.memoryId });
-        return;
+        return ingest({ eventName: 'issues', payload: body });
     }
     if (eventName === 'issue_comment' && isGitHubIssueCommentEvent(body, 'issue_comment')) {
         if (body.action === 'deleted') {
             const repo = body.repository?.full_name ?? '';
             const artifactRef = `github://${repo}/issue/${body.issue.number}/comment/${body.comment.id}`;
-            // The "deleted:" key namespace keeps this from colliding with the ingest key for the
-            // same artifact; a shared key would make hasSeenKey skip the archive.
-            const idempotencyKey = computeGitHubDeletionKey(artifactRef, body.comment.updated_at ?? null);
-            const r = handleGitHubCommentDeleted(ctx, {
-                artifactRef,
-                idempotencyKey,
-                deliveryId,
-                eventName,
-            });
-            sendJson(res, 200, { ok: true, status: r.status, archivedCount: r.archivedCount });
-            return;
+            return archiveComment(eventName, artifactRef, body.comment.updated_at ?? null);
         }
-        const ingestInput = { eventName: 'issue_comment', payload: body };
-        const r = ingestGitHubEvent(ctx, { event: ingestInput, rawBody, deliveryId });
-        sendJson(res, 200, { ok: true, status: r.status, memoryId: r.memoryId });
-        return;
+        return ingest({ eventName: 'issue_comment', payload: body });
     }
     if (eventName === 'pull_request' && isGitHubPullRequestEvent(body, 'pull_request')) {
-        const ingestInput = { eventName: 'pull_request', payload: body };
-        const r = ingestGitHubEvent(ctx, { event: ingestInput, rawBody, deliveryId });
-        sendJson(res, 200, { ok: true, status: r.status, memoryId: r.memoryId });
-        return;
+        return ingest({ eventName: 'pull_request', payload: body });
     }
     if (eventName === 'pull_request_review_comment' &&
         isGitHubPullRequestReviewCommentEvent(body, 'pull_request_review_comment')) {
@@ -269,45 +223,10 @@ export async function handleGitHubEventsWebhook({ req, res, opts }) {
             const repo = body.repository?.full_name ?? '';
             const artifactRef = `github://${repo}/pull/${body.pull_request.number}/review_comment/${body.comment.id}`;
             // Same "deleted:" key namespace as the issue_comment branch above.
-            const idempotencyKey = computeGitHubDeletionKey(artifactRef, body.comment.updated_at ?? null);
-            const r = handleGitHubCommentDeleted(ctx, {
-                artifactRef,
-                idempotencyKey,
-                deliveryId,
-                eventName,
-            });
-            sendJson(res, 200, { ok: true, status: r.status, archivedCount: r.archivedCount });
-            return;
+            return archiveComment(eventName, artifactRef, body.comment.updated_at ?? null);
         }
-        const ingestInput = {
-            eventName: 'pull_request_review_comment',
-            payload: body,
-        };
-        const r = ingestGitHubEvent(ctx, { event: ingestInput, rawBody, deliveryId });
-        sendJson(res, 200, { ok: true, status: r.status, memoryId: r.memoryId });
-        return;
-    }
-    // Header allow-listed but body shape didn't satisfy the matching guard.
-    {
-        const db = openHippoDb(opts.hippoRoot);
-        try {
-            writeToGitHubDlq(db, {
-                tenantId: resolvedTenant,
-                rawPayload: rawBody,
-                error: `body shape did not match X-GitHub-Event=${eventName}`,
-                bucket: 'parse_error',
-                eventName,
-                deliveryId,
-                signature: sigStr,
-                installationId,
-                repoFullName,
-            });
-        }
-        finally {
-            closeHippoDb(db);
-        }
-        sendJson(res, 200, { ok: true, status: 'dlq' });
-        return;
+        return ingest({ eventName: 'pull_request_review_comment', payload: body });
     }
+    return false;
 }
 //# sourceMappingURL=webhook.js.map