hippo-memory 1.60.0 → 1.62.0

package/dist/client.js

@@ -13,8 +13,19 @@
  * Network errors (ECONNREFUSED on a stale pidfile, etc.) propagate as the
  * native fetch failure so the caller can detect them and self-heal.
  */
+import { fetchWithRetry } from './http-retry.js';
 /** A write the local server has not answered in this long is stuck; the caller treats it as delivery-unknown. */
 const SERVER_TIMEOUT_MS = 30_000;
+/** Five tries at the server's 1 s Retry-After keeps the roughly 5 s wait the CLI had before the server answered busy with 503. */
+const STORE_BUSY_ATTEMPTS = 5;
+/** The server sets Retry-After on a 503 only for a held write lock (server.ts replyFor); the auth-provider 503 has none. */
+function isStoreBusy(res) {
+    return res.status === 503 && res.headers.has('retry-after');
+}
+/** Replaying is safe because each routed write commits in one transaction and anything after it is best-effort, so a busy 503 means nothing landed. */
+function sendWrite(url, init) {
+    return fetchWithRetry(url, init, { timeoutMs: SERVER_TIMEOUT_MS, attempts: STORE_BUSY_ATTEMPTS, retryOn: isStoreBusy });
+}
 function buildHeaders(apiKey, withBody) {
     const headers = {};
     if (withBody)
@@ -57,10 +68,9 @@ async function throwForStatus(res) {
     throw new HttpResponseError(message, res.status);
 }
 export async function remember(serverUrl, apiKey, opts) {
-    const res = await fetch(`${serverUrl}/v1/memories`, {
+    const res = await sendWrite(`${serverUrl}/v1/memories`, {
         method: 'POST',
         headers: buildHeaders(apiKey, true),
-        signal: AbortSignal.timeout(SERVER_TIMEOUT_MS),
         body: JSON.stringify(opts),
     });
     if (!res.ok)
@@ -69,10 +79,9 @@ export async function remember(serverUrl, apiKey, opts) {
     return result;
 }
 export async function forget(serverUrl, apiKey, id) {
-    const res = await fetch(`${serverUrl}/v1/memories/${encodeURIComponent(id)}`, {
+    const res = await sendWrite(`${serverUrl}/v1/memories/${encodeURIComponent(id)}`, {
         method: 'DELETE',
         headers: buildHeaders(apiKey, false),
-        signal: AbortSignal.timeout(SERVER_TIMEOUT_MS),
     });
     if (!res.ok)
         await throwForStatus(res);
@@ -80,10 +89,9 @@ export async function forget(serverUrl, apiKey, id) {
     return result;
 }
 export async function promote(serverUrl, apiKey, id) {
-    const res = await fetch(`${serverUrl}/v1/memories/${encodeURIComponent(id)}/promote`, {
+    const res = await sendWrite(`${serverUrl}/v1/memories/${encodeURIComponent(id)}/promote`, {
         method: 'POST',
         headers: buildHeaders(apiKey, false),
-        signal: AbortSignal.timeout(SERVER_TIMEOUT_MS),
     });
     if (!res.ok)
         await throwForStatus(res);
@@ -91,10 +99,9 @@ export async function promote(serverUrl, apiKey, id) {
     return result;
 }
 export async function archiveRaw(serverUrl, apiKey, id, reason) {
-    const res = await fetch(`${serverUrl}/v1/memories/${encodeURIComponent(id)}/archive`, {
+    const res = await sendWrite(`${serverUrl}/v1/memories/${encodeURIComponent(id)}/archive`, {
         method: 'POST',
         headers: buildHeaders(apiKey, true),
-        signal: AbortSignal.timeout(SERVER_TIMEOUT_MS),
         body: JSON.stringify({ reason }),
     });
     if (!res.ok)

package/dist/compaction-record.d.ts

@@ -25,8 +25,6 @@ export interface CompactionRecord {
     status: CompactionStatus;
 }
 export type Log = (message: string) => void;
-/** Where the session ran: rows written through the global store keep the project the session was in. */
-export declare function compactionOrigin(hippoRoot: string, cwd: string | null): string;
 interface ScrubbedSummary {
     summary: string;
     items: string[];

package/dist/compaction-record.js

@@ -1,7 +1,6 @@
 // One record per Claude Code compaction, and what turns its summary into kept memories.
 import * as fs from 'fs';
 import * as path from 'path';
-import { errorMessage, readTranscriptTail, truncateCodePointSafe } from './capture.js';
 import { isObjectLike, isStringValue } from './capture-contract.js';
 import { compactSummaryBody, parseCompactionItems, selectItemRows } from './compaction-items.js';
 import { loadConfig } from './config.js';
@@ -10,9 +9,12 @@ import { gatedWrite } from './gated-write.js';
 import { COMPACTION_MEMORY_TAG, COMPACTION_SOURCE_PREFIX, Layer, createMemory, generateId } from './memory.js';
 import { deriveOriginProject, isGlobalStoreRoot } from './project-identity.js';
 import { maskEmails, redactSecretsStrict } from './secret-detect.js';
-import { strengthenRetrievedOn, updateStats, writeEntryMirrors } from './store.js';
+import { strengthenRetrievedOn, writeEntryMirrors } from './store/entry-writes.js';
+import { isRecallBoostAblated } from './ablation.js';
+import { updateStats } from './store/index-and-stats.js';
 import { resolveTenantId } from './tenant.js';
-import { log as logger } from './log.js';
+import { errorMessage, log as logger } from './log.js';
+import { readTranscriptTail, truncateCodePointSafe } from './transcript-tail.js';
 /** PostCompact has 10 s in all (PreCompact 30 s), so a locked store must be given up on early. */
 export const COMPACTION_DB_WAIT_MS = 2000;
 /** Tested verbatim: Claude Code hands PreCompact stdout to the summariser as instructions. */
@@ -28,7 +30,7 @@ const CLAIMED_SUFFIX = '.claimed';
 /** The marker redactSecretsStrict writes; an item holding it was a secret before it was stored. */
 const REDACTED = '[REDACTED]';
 /** Where the session ran: rows written through the global store keep the project the session was in. */
-export function compactionOrigin(hippoRoot, cwd) {
+function compactionOrigin(hippoRoot, cwd) {
     if (!isGlobalStoreRoot(hippoRoot))
         return deriveOriginProject(path.dirname(hippoRoot));
     // No cwd means user-global, as stampOriginProject gives the global store; undefined would fall back to the hook's own cwd.
@@ -226,7 +228,7 @@ export function saveItems(db, hippoRoot, ctx, log) {
             }
         }
         // Said again by another session is the same signal as being recalled; the same session carrying it forward is not.
-        strengthenRetrievedOn(db, [...restated], ctx.tenantId);
+        strengthenRetrievedOn(db, [...restated], { tenantId: ctx.tenantId, recallBoostAblated: isRecallBoostAblated() });
         if (ctx.recordId !== null) {
             db.prepare(`UPDATE compactions SET items_written = ?, status = 'done' WHERE tenant_id = ? AND id = ?`).run(written.length, ctx.tenantId, ctx.recordId);
         }

package/dist/connectors/github/backfill.js

@@ -172,6 +172,82 @@ async function drainStream(ctx, url0, toIngestEvent, fetcher, token, sleep, maxI
     }
     return { ingested, pages, maxUpdatedAt, drained: true };
 }
+function issueItemToEvent(item, repository) {
+    if (!isIssuesItem(item))
+        return null;
+    // Codex P1 #2: /issues returns PRs too — skip them.
+    if (item.pull_request)
+        return null;
+    const payload = {
+        action: 'opened',
+        repository,
+        issue: {
+            number: item.number,
+            title: item.title,
+            body: item.body ?? null,
+            user: { login: item.user.login, id: item.user.id },
+            updated_at: item.updated_at,
+        },
+    };
+    return { eventName: 'issues', payload };
+}
+function issueCommentItemToEvent(item, repository) {
+    if (!isCommentItem(item))
+        return null;
+    // SAFETY: this closure only runs against the /issues/comments stream,
+    // so every item isCommentItem validates here is genuinely an
+    // IssueCommentItem; a missing issue_url is handled defensively below.
+    const c = item;
+    const issueNumber = parseTrailingNumber(c.issue_url);
+    if (issueNumber === null)
+        return null;
+    const payload = {
+        action: 'created',
+        repository,
+        issue: { number: issueNumber },
+        comment: {
+            id: c.id,
+            body: c.body ?? null,
+            user: { login: c.user.login, id: c.user.id },
+            updated_at: c.updated_at,
+        },
+    };
+    return { eventName: 'issue_comment', payload };
+}
+function prReviewCommentItemToEvent(item, repository) {
+    if (!isCommentItem(item))
+        return null;
+    // SAFETY: this closure only runs against the /pulls/comments stream,
+    // so every item isCommentItem validates here is genuinely a
+    // PrReviewCommentItem; a missing pull_request_url is handled below.
+    const c = item;
+    const prNumber = parseTrailingNumber(c.pull_request_url);
+    if (prNumber === null)
+        return null;
+    const payload = {
+        action: 'created',
+        repository,
+        pull_request: { number: prNumber },
+        comment: {
+            id: c.id,
+            body: c.body ?? null,
+            user: { login: c.user.login, id: c.user.id },
+            updated_at: c.updated_at,
+        },
+    };
+    return { eventName: 'pull_request_review_comment', payload };
+}
+/** Drains one stream, then persists its HWM only when the stream ran to the end. */
+async function backfillStream(ctx, opts, sleep, stream) {
+    const res = await drainStream(ctx, stream.url, stream.toIngestEvent, opts.fetcher, opts.token, sleep, opts.maxPerStream);
+    // v1.3.1: only advance HWM when the stream actually drained. A capped run
+    // (--max) must leave the HWM at its previous value so the next invocation
+    // re-fetches the unprocessed tail.
+    if (res.drained && res.maxUpdatedAt) {
+        writeOneHwm(ctx.hippoRoot, ctx.tenantId, opts.repoFullName, stream.column, res.maxUpdatedAt);
+    }
+    return { ingested: res.ingested, pages: res.pages };
+}
 export async function backfillRepo(ctx, opts) {
     const sleep = opts.sleepMs ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     const cursors = readCursor(ctx.hippoRoot, ctx.tenantId, opts.repoFullName);
@@ -181,101 +257,32 @@ export async function backfillRepo(ctx, opts) {
         pages: { issues: 0, issueComments: 0, prReviewComments: 0 },
     };
     // ---------- Stream 1: issues (skip PRs) ----------
-    const issuesUrl = `${API}/repos/${opts.repoFullName}/issues?state=all&per_page=100` +
-        (cursors.issues ? `&since=${encodeURIComponent(cursors.issues)}` : '');
-    const issuesRes = await drainStream(ctx, issuesUrl, (item) => {
-        if (!isIssuesItem(item))
-            return null;
-        // Codex P1 #2: /issues returns PRs too — skip them.
-        if (item.pull_request)
-            return null;
-        const payload = {
-            action: 'opened',
-            repository,
-            issue: {
-                number: item.number,
-                title: item.title,
-                body: item.body ?? null,
-                user: { login: item.user.login, id: item.user.id },
-                updated_at: item.updated_at,
-            },
-        };
-        return { eventName: 'issues', payload };
-    }, opts.fetcher, opts.token, sleep, opts.maxPerStream);
+    const issuesRes = await backfillStream(ctx, opts, sleep, {
+        url: `${API}/repos/${opts.repoFullName}/issues?state=all&per_page=100` +
+            (cursors.issues ? `&since=${encodeURIComponent(cursors.issues)}` : ''),
+        column: 'issues_hwm',
+        toIngestEvent: (item) => issueItemToEvent(item, repository),
+    });
     result.ingested.issues = issuesRes.ingested;
     result.pages.issues = issuesRes.pages;
-    // v1.3.1: only advance HWM when the stream actually drained. A capped run
-    // (--max) must leave the HWM at its previous value so the next invocation
-    // re-fetches the unprocessed tail.
-    if (issuesRes.drained && issuesRes.maxUpdatedAt) {
-        writeOneHwm(ctx.hippoRoot, ctx.tenantId, opts.repoFullName, 'issues_hwm', issuesRes.maxUpdatedAt);
-    }
     // ---------- Stream 2: repo-level issue comments ----------
-    const commentsUrl = `${API}/repos/${opts.repoFullName}/issues/comments?per_page=100` +
-        (cursors.issueComments
-            ? `&since=${encodeURIComponent(cursors.issueComments)}`
-            : '');
-    const commentsRes = await drainStream(ctx, commentsUrl, (item) => {
-        if (!isCommentItem(item))
-            return null;
-        // SAFETY: this closure only runs against the /issues/comments stream,
-        // so every item isCommentItem validates here is genuinely an
-        // IssueCommentItem; a missing issue_url is handled defensively below.
-        const c = item;
-        const issueNumber = parseTrailingNumber(c.issue_url);
-        if (issueNumber === null)
-            return null;
-        const payload = {
-            action: 'created',
-            repository,
-            issue: { number: issueNumber },
-            comment: {
-                id: c.id,
-                body: c.body ?? null,
-                user: { login: c.user.login, id: c.user.id },
-                updated_at: c.updated_at,
-            },
-        };
-        return { eventName: 'issue_comment', payload };
-    }, opts.fetcher, opts.token, sleep, opts.maxPerStream);
+    const commentsRes = await backfillStream(ctx, opts, sleep, {
+        url: `${API}/repos/${opts.repoFullName}/issues/comments?per_page=100` +
+            (cursors.issueComments ? `&since=${encodeURIComponent(cursors.issueComments)}` : ''),
+        column: 'issue_comments_hwm',
+        toIngestEvent: (item) => issueCommentItemToEvent(item, repository),
+    });
     result.ingested.issueComments = commentsRes.ingested;
     result.pages.issueComments = commentsRes.pages;
-    if (commentsRes.drained && commentsRes.maxUpdatedAt) {
-        writeOneHwm(ctx.hippoRoot, ctx.tenantId, opts.repoFullName, 'issue_comments_hwm', commentsRes.maxUpdatedAt);
-    }
     // ---------- Stream 3: repo-level PR review comments ----------
-    const prCommentsUrl = `${API}/repos/${opts.repoFullName}/pulls/comments?per_page=100` +
-        (cursors.prReviewComments
-            ? `&since=${encodeURIComponent(cursors.prReviewComments)}`
-            : '');
-    const prCommentsRes = await drainStream(ctx, prCommentsUrl, (item) => {
-        if (!isCommentItem(item))
-            return null;
-        // SAFETY: this closure only runs against the /pulls/comments stream,
-        // so every item isCommentItem validates here is genuinely a
-        // PrReviewCommentItem; a missing pull_request_url is handled below.
-        const c = item;
-        const prNumber = parseTrailingNumber(c.pull_request_url);
-        if (prNumber === null)
-            return null;
-        const payload = {
-            action: 'created',
-            repository,
-            pull_request: { number: prNumber },
-            comment: {
-                id: c.id,
-                body: c.body ?? null,
-                user: { login: c.user.login, id: c.user.id },
-                updated_at: c.updated_at,
-            },
-        };
-        return { eventName: 'pull_request_review_comment', payload };
-    }, opts.fetcher, opts.token, sleep, opts.maxPerStream);
+    const prCommentsRes = await backfillStream(ctx, opts, sleep, {
+        url: `${API}/repos/${opts.repoFullName}/pulls/comments?per_page=100` +
+            (cursors.prReviewComments ? `&since=${encodeURIComponent(cursors.prReviewComments)}` : ''),
+        column: 'pr_review_comments_hwm',
+        toIngestEvent: (item) => prReviewCommentItemToEvent(item, repository),
+    });
     result.ingested.prReviewComments = prCommentsRes.ingested;
     result.pages.prReviewComments = prCommentsRes.pages;
-    if (prCommentsRes.drained && prCommentsRes.maxUpdatedAt) {
-        writeOneHwm(ctx.hippoRoot, ctx.tenantId, opts.repoFullName, 'pr_review_comments_hwm', prCommentsRes.maxUpdatedAt);
-    }
     return result;
 }
 //# sourceMappingURL=backfill.js.map

package/dist/connectors/github/cli-impl.js

@@ -9,6 +9,7 @@
  *   - hippo github dlq list
  *   - hippo github dlq replay <id> [--force]
  */
+import { envGithubToken, envGithubWebhookSecret, envGithubWebhookSecretPrevious } from '../../env.js';
 import { adminActor } from '../../api.js';
 import { openHippoDb, closeHippoDb } from '../../db.js';
 import { resolveTenantId } from '../../tenant.js';
@@ -70,7 +71,7 @@ export async function cmdGithubBackfill(hippoRoot, flags, fetcher = realGitHubFe
         printGithubBackfillUsage();
         process.exit(2);
     }
-    const token = process.env.GITHUB_TOKEN;
+    const token = envGithubToken();
     if (!token) {
         console.error('GITHUB_TOKEN is not set. Backfill requires a personal access token with repo read scope.');
         process.exit(2);
@@ -166,8 +167,8 @@ export async function cmdGithubDlqReplay(hippoRoot, args, flags) {
     // real hook so `replay` actually re-runs the ingest path.
     const result = await replayDlqEntry(ctx, id, {
         force,
-        webhookSecret: process.env.GITHUB_WEBHOOK_SECRET,
-        previousSecret: process.env.GITHUB_WEBHOOK_SECRET_PREVIOUS,
+        webhookSecret: envGithubWebhookSecret(),
+        previousSecret: envGithubWebhookSecretPrevious(),
         ingestHook: async (innerCtx, args) => {
             const parsed = JSON.parse(args.rawPayload);
             const event = parsedToIngestEvent(parsed, args.eventName);

package/dist/connectors/github/dlq.js

@@ -104,61 +104,13 @@ export async function replayDlqEntry(ctx, id, opts = {}) {
     }
     // Signature verification (current secret, not the one in effect when DLQed).
     if (!opts.force && opts.webhookSecret) {
-        if (!row.signature) {
-            return {
-                ok: false,
-                status: 'sig_missing',
-                memoryId: null,
-                retryCount: row.retryCount,
-                reason: 'row has no signature (legacy, or redacted before storing); pass --force to replay',
-            };
-        }
-        const sigOk = verifyGitHubSignature({
-            rawBody: row.rawPayload,
-            signature: row.signature,
-            webhookSecret: opts.webhookSecret,
-            previousSecret: opts.previousSecret,
-        });
-        if (!sigOk) {
-            bumpRetryCount(ctx.hippoRoot, id);
-            return {
-                ok: false,
-                status: 'sig_fail',
-                memoryId: null,
-                retryCount: row.retryCount + 1,
-                reason: 'signature did not verify against current GITHUB_WEBHOOK_SECRET; pass --force to replay anyway',
-            };
-        }
-    }
-    // Parse + envelope guard.
-    let parsed;
-    try {
-        parsed = JSON.parse(row.rawPayload);
-    }
-    catch (e) {
-        bumpRetryCount(ctx.hippoRoot, id);
-        // SAFETY: this is a best-effort error message only; property access on
-        // any JS value is safe (undefined if absent), preserving the existing
-        // lenient formatting even when something non-Error was thrown.
-        const message = e.message;
-        return {
-            ok: false,
-            status: 'parse_error',
-            memoryId: null,
-            retryCount: row.retryCount + 1,
-            reason: `still unparseable: ${message}`,
-        };
-    }
-    if (!isGitHubWebhookEnvelope(parsed)) {
-        bumpRetryCount(ctx.hippoRoot, id);
-        return {
-            ok: false,
-            status: 'unhandled',
-            memoryId: null,
-            retryCount: row.retryCount + 1,
-            reason: 'not a GitHub webhook envelope',
-        };
+        const sigFailure = checkReplaySignature(ctx.hippoRoot, id, row, opts.webhookSecret, opts.previousSecret);
+        if (sigFailure)
+            return sigFailure;
     }
+    const envelopeFailure = checkReplayEnvelope(ctx.hippoRoot, id, row);
+    if (envelopeFailure)
+        return envelopeFailure;
     // Without an ingest hook this is a dry-run validation. Bump and report.
     if (!opts.ingestHook) {
         bumpRetryCount(ctx.hippoRoot, id);
@@ -190,4 +142,65 @@ export async function replayDlqEntry(ctx, id, opts = {}) {
         retryCount: row.retryCount + 1,
     };
 }
+/** The failure result when the row cannot pass the signature gate, else null. */
+function checkReplaySignature(hippoRoot, id, row, webhookSecret, previousSecret) {
+    if (!row.signature) {
+        return {
+            ok: false,
+            status: 'sig_missing',
+            memoryId: null,
+            retryCount: row.retryCount,
+            reason: 'row has no signature (legacy, or redacted before storing); pass --force to replay',
+        };
+    }
+    const sigOk = verifyGitHubSignature({
+        rawBody: row.rawPayload,
+        signature: row.signature,
+        webhookSecret,
+        previousSecret,
+    });
+    if (!sigOk) {
+        bumpRetryCount(hippoRoot, id);
+        return {
+            ok: false,
+            status: 'sig_fail',
+            memoryId: null,
+            retryCount: row.retryCount + 1,
+            reason: 'signature did not verify against current GITHUB_WEBHOOK_SECRET; pass --force to replay anyway',
+        };
+    }
+    return null;
+}
+/** Parse + envelope guard; the failure result after bumping the count, else null. */
+function checkReplayEnvelope(hippoRoot, id, row) {
+    let parsed;
+    try {
+        parsed = JSON.parse(row.rawPayload);
+    }
+    catch (e) {
+        bumpRetryCount(hippoRoot, id);
+        // SAFETY: this is a best-effort error message only; property access on
+        // any JS value is safe (undefined if absent), preserving the existing
+        // lenient formatting even when something non-Error was thrown.
+        const message = e.message;
+        return {
+            ok: false,
+            status: 'parse_error',
+            memoryId: null,
+            retryCount: row.retryCount + 1,
+            reason: `still unparseable: ${message}`,
+        };
+    }
+    if (!isGitHubWebhookEnvelope(parsed)) {
+        bumpRetryCount(hippoRoot, id);
+        return {
+            ok: false,
+            status: 'unhandled',
+            memoryId: null,
+            retryCount: row.retryCount + 1,
+            reason: 'not a GitHub webhook envelope',
+        };
+    }
+    return null;
+}
 //# sourceMappingURL=dlq.js.map

package/dist/connectors/github/ingest.js

@@ -69,6 +69,7 @@ function eventUpdatedAt(event) {
             return event.payload.comment.updated_at ?? null;
     }
 }
+const INSERT_EVENT_LOG_SQL = `INSERT OR IGNORE INTO github_event_log (idempotency_key, delivery_id, event_name, ingested_at, memory_id) VALUES (?, ?, ?, ?, ?)`;
 export function ingestEvent(ctx, input) {
     const idempotencyKey = computeIdempotencyKey(eventArtifactRef(input.event), eventUpdatedAt(input.event));
     // Fast path: pre-check. Avoids running the transform / opening a write tx
@@ -87,15 +88,7 @@ export function ingestEvent(ctx, input) {
         // Empty body: no memory to write, but mark seen so a retry of the same
         // empty event returns 'duplicate' (not 'skipped' again — that would
         // re-run the transform on every retry).
-        const db2 = openHippoDb(ctx.hippoRoot);
-        try {
-            db2
-                .prepare(`INSERT OR IGNORE INTO github_event_log (idempotency_key, delivery_id, event_name, ingested_at, memory_id) VALUES (?, ?, ?, ?, ?)`)
-                .run(idempotencyKey, input.deliveryId, input.event.eventName, new Date().toISOString(), null);
-        }
-        finally {
-            closeHippoDb(db2);
-        }
+        markKeySeenWithoutMemory(ctx.hippoRoot, idempotencyKey, input);
         return { status: 'skipped', memoryId: null };
     }
     // Atomic write via afterWrite. Inside writeEntry's SAVEPOINT:
@@ -105,23 +98,7 @@ export function ingestEvent(ctx, input) {
     //      the test injection) beat us, changes=0 -> throw -> SAVEPOINT rolls
     //      back our memory row. Other worker's commit stands.
     try {
-        // v1.12.0: drop the legacy `|| 'connector:github'` fallback (see slack/ingest.ts:73 for rationale).
-        const result = remember(ctx, {
-            ...opts,
-            untrusted: true,
-            afterWrite: (innerDb, memoryId) => {
-                if (input.__testInjectBeforeLog) {
-                    input.__testInjectBeforeLog(innerDb, idempotencyKey);
-                }
-                const inserted = innerDb
-                    .prepare(`INSERT OR IGNORE INTO github_event_log (idempotency_key, delivery_id, event_name, ingested_at, memory_id) VALUES (?, ?, ?, ?, ?)`)
-                    .run(idempotencyKey, input.deliveryId, input.event.eventName, new Date().toISOString(), memoryId);
-                if (Number(inserted.changes ?? 0) === 0) {
-                    throw new DuplicateIdempotencyError(idempotencyKey);
-                }
-            },
-        });
-        return { status: 'ingested', memoryId: result.id };
+        return rememberWithEventLog(ctx, input, idempotencyKey, opts);
     }
     catch (e) {
         if (e instanceof DuplicateIdempotencyError) {
@@ -140,18 +117,40 @@ export function ingestEvent(ctx, input) {
             // a transient failure — never DLQ-retry it. Mark the idempotency key
             // seen exactly like the empty-body branch above so a GitHub retry of
             // the same delivery acks as done, not error.
-            const db4 = openHippoDb(ctx.hippoRoot);
-            try {
-                db4
-                    .prepare(`INSERT OR IGNORE INTO github_event_log (idempotency_key, delivery_id, event_name, ingested_at, memory_id) VALUES (?, ?, ?, ?, ?)`)
-                    .run(idempotencyKey, input.deliveryId, input.event.eventName, new Date().toISOString(), null);
-            }
-            finally {
-                closeHippoDb(db4);
-            }
+            markKeySeenWithoutMemory(ctx.hippoRoot, idempotencyKey, input);
             return { status: 'skipped', memoryId: null };
         }
         throw e;
     }
 }
+function markKeySeenWithoutMemory(hippoRoot, idempotencyKey, input) {
+    const db = openHippoDb(hippoRoot);
+    try {
+        db
+            .prepare(INSERT_EVENT_LOG_SQL)
+            .run(idempotencyKey, input.deliveryId, input.event.eventName, new Date().toISOString(), null);
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+function rememberWithEventLog(ctx, input, idempotencyKey, opts) {
+    // v1.12.0: drop the legacy `|| 'connector:github'` fallback (see slack/ingest.ts:73 for rationale).
+    const result = remember(ctx, {
+        ...opts,
+        untrusted: true,
+        afterWrite: (innerDb, memoryId) => {
+            if (input.__testInjectBeforeLog) {
+                input.__testInjectBeforeLog(innerDb, idempotencyKey);
+            }
+            const inserted = innerDb
+                .prepare(INSERT_EVENT_LOG_SQL)
+                .run(idempotencyKey, input.deliveryId, input.event.eventName, new Date().toISOString(), memoryId);
+            if (Number(inserted.changes ?? 0) === 0) {
+                throw new DuplicateIdempotencyError(idempotencyKey);
+            }
+        },
+    });
+    return { status: 'ingested', memoryId: result.id };
+}
 //# sourceMappingURL=ingest.js.map

package/dist/connectors/github/tenant-routing.js

@@ -1,3 +1,4 @@
+import { envGithubAllowUnknownInstallationFallback, envTenant } from '../../env.js';
 /**
  * Resolve the tenant_id for a GitHub webhook envelope.
  *
@@ -23,8 +24,8 @@
  * replay, future MCP) gets identical protection.
  */
 export function resolveTenantForGitHub(db, args) {
-    const envFallback = () => process.env.HIPPO_TENANT?.trim() || 'default';
-    const escapeHatch = process.env.GITHUB_ALLOW_UNKNOWN_INSTALLATION_FALLBACK === '1';
+    const envFallback = () => envTenant();
+    const escapeHatch = envGithubAllowUnknownInstallationFallback();
     // SAFETY: the row comes from the SELECT above, which projects exactly one
     // column, `c`, as a COUNT(*).
     const instCount = db