## Context Confirmed via \`wrangler kv key list\` on the prod \`INSTALLATIONS\` namespace: \`\`\` [ { "name": "triggers:conn_0dviUelZu80E9zZSrAa_v" }, { "name": "triggers:conn_I1KBBnrohC6orbVqXPIcv" } ] \`\`\` Two \`triggers:*\` entries (good — TRIGGER_CONFIGURE populated them) but zero \`installation:*\` entries. Webhook deliveries have been arriving correctly and immediately skipping with \`no mapping for installation=120173638\` because the first OAuth completed before the User-Agent fix was deployed — \`captureInstallationMappings\` silently caught the 403 from \`GET /user/installations\` and never wrote anything. ## Fix - New \`InstallationStore.hasAnyForConnection(connectionId)\` method — single KV \`list({ prefix: 'connection::', limit: 1 })\`. - New \`ensureInstallationMappings()\` wrapper: no-op if the connection already has mappings, otherwise runs the full capture. - Injected into \`buildUpstreamTools\`' execute path in \`mcp-proxy.ts\` so the next MCP tool call each affected user makes auto-rebuilds their mapping. - \`onChange\` in \`main.ts\` now uses the \`ensureInstallationMappings\` variant too (same effect for the common path, cheaper for repeat OAuth refreshes). ## Test plan - [ ] After merge + deploy, issue a single MCP tool call from an already-connected user. Expect \`[Installation] Mapped () → \` in worker logs. - [ ] Re-run \`bunx wrangler kv key list --namespace-id c81656fe... --remote\` — should now include \`installation:*\` and \`connection::*\` entries. - [ ] Create an issue on a repo where the App is installed. Expect \`[Webhook] → delivery=... event=github.issues.opened …\` followed by \`[Webhook] ✓ delivery=... mesh callback delivered (2xx)\`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- ## Summary by cubic Automatically rebuilds missing GitHub installation mappings during MCP tool calls, fixing skipped webhooks for affected users without re-auth. Adds a cheap pre-check and only runs the full capture when needed. - **Bug Fixes** - Added `InstallationStore.hasAnyForConnection(connectionId)` using KV `list({ prefix: 'connection::', limit: 1 })`. - Introduced `ensureInstallationMappings(token, connectionId, store)` to capture mappings only when absent. - Wired into `buildUpstreamTools` execute in `mcp-proxy.ts`, and switched `main.ts` `onChange` to use it. - Addresses cases where `captureInstallationMappings` previously swallowed `403` from `GET /user/installations`, leaving no `installation:*` keys. ^{Written for commit ef6e1c9f39f6a3ea1fcce586ad8597a5abe83f0e. Summary will update on new commits.}