@gamaze/hicortex 0.19.6 → 0.20.1

package/README.md

@@ -4,7 +4,7 @@
 
 Your agents learn from every session — successes and mistakes. Hicortex captures experiences, distills lessons, and applies them automatically. Connect multiple agents to shared memory and they improve together, overnight.
 
-Works with **Hermes**, **OpenClaw**, **Claude Code**, **Pi**, and any MCP-compatible agent.
+Works with **Hermes**, **OpenClaw**, **Claude Code**, **Pi**, **opencode**, and any MCP-compatible agent.
 
 **Website:** [hicortex.gamaze.com](https://hicortex.gamaze.com) · **Docs:** [hicortex.gamaze.com/docs](https://hicortex.gamaze.com/docs/)
 
@@ -87,7 +87,7 @@ Bare top-level keys (`"serverUrl": …` at the root of `openclaw.json`) still wo
 | When | What | How |
 |------|------|-----|
 | Agent start | Standing identity (`## Identity`) + recent lessons fetched fresh and injected | CC SessionStart hook (calls `hicortex learnings-identity`; `lessons-context` kept as an alias so existing installed hooks don't break) / Hermes plugin `system_prompt_block` / OC `before_agent_start` hook |
-| Every prompt (0.14) | A compact **recall index** of relevant memories is injected — one line per memory; the agent lazy-loads full content with `hicortex_get` only when needed | All three harnesses call server `POST /recall-index` per turn: CC UserPromptSubmit hook (`hicortex recall-hook`), Hermes plugin `prefetch` (0.7.0; falls back to `/search` injection against a pre-0.14 server), OC `before_agent_start` hook (fires per inbound message). Turn-based dedup per session; resets on new session/compaction. Fail-soft |
+| Every prompt (0.14) | A compact **recall index** of relevant memories is injected — one line per memory; the agent lazy-loads full content with `hicortex_get` only when needed | All five harnesses call server `POST /recall-index` per turn: CC UserPromptSubmit hook (`hicortex recall-hook`), Hermes plugin `prefetch` (0.7.0; falls back to `/search` injection against a pre-0.14 server), OC `before_agent_start` hook (fires per inbound message), Pi extension `before_agent_start` (0.20), opencode plugin messages-transform hook (0.21). Turn-based dedup per session; resets on new session/compaction. Fail-soft |
 | Nightly | Denoise sessions → POST /distill → server distills + embeds + stores → consolidate (score, reflect, link, decay) | Automatic pipeline — no manual steps |
 
 **Exposure vs use (0.14):** appearing in the recall index only marks a memory as *shown* (it stops decaying while topically active); fetching it with `hicortex_get` marks it as *used* (durable strengthening). Memory importance is driven by what agents actually use, not by what was pushed at them.
@@ -158,7 +158,7 @@ Beyond auto-distilled memories and lessons, Hicortex holds a **hand-edited ident
 
 - **Storage:** plain files on the server at `~/.hicortex/identity/*.md` — one file per section (recommended starter sections `user.md` + `rules.md`, which you create — nothing is pre-populated; add more by dropping in a file). It lives outside the memories table; consolidation never touches it.
 - **Edit:** the web editor at `http://localhost:8787/identity/ui` (one tab per section, Save), or the CLI `hicortex identity show [name]` / `hicortex identity edit <name>`.
-- **Delivery:** injected into the harnesses listed in `identityClients` (default `["cc"]`; `"all"` or any subset of `cc`/`hermes`/`oc` — all three are supported since 0.13).
+- **Delivery:** injected into the harnesses listed in `identityClients` (default `["cc"]`; `"all"` or any subset of `cc`/`hermes`/`oc`/`pi`/`opencode` — CC/Hermes/OpenClaw since 0.13, Pi since 0.20, opencode since 0.21).
 - **Deletion** is filesystem-only — remove the file on the server (as the daemon user).
 
 ### Per-agent identity (0.13)
@@ -183,6 +183,7 @@ npx @gamaze/hicortex init                      # Set up server mode
 npx @gamaze/hicortex init --server <url>       # Set up client mode
 npx @gamaze/hicortex nightly                   # Run distill + consolidate (full nightly)
 npx @gamaze/hicortex nightly --capture-only    # Capture only, skip consolidation (safe for sub-daily runs)
+npx @gamaze/hicortex nightly --evict-only      # Memory-cap eviction only — pure DB, no capture, no LLM (idempotent; honors --dry-run)
 npx @gamaze/hicortex nightly --dry-run         # Preview without changes
 npx @gamaze/hicortex classify-domains          # Backfill domain tags over the corpus (see Memory Domains & Tags)
 npx @gamaze/hicortex classify-types            # Reclassify memory types (episode/fact/decision)
@@ -239,16 +240,19 @@ Config at `~/.hicortex/config.json`. Created by `init`. Key options:
 | `llmBreakerCooldownMs` | How long the breaker stays open before one half-open trial call goes out (default 600000 = 10 min). A failing trial re-opens it; a succeeding one resets the counter. |
 | `llmProbeTimeoutMs` | Patience of the readiness probe — one minimal 1-token generation request the nightly sends before consolidating and the daemon sends before distilling (default 60000 = 1 min). Catches a gateway that answers health/model-list queries while generation is dead; a failed probe skips consolidation (`endpoint_down`, retried next run) and answers `/distill` with a 503 so capture holds its cursor. |
 | `llmProbeTtlMs` | How long the daemon caches a `/distill` probe outcome (default 300000 = 5 min). A healthy capture cadence pays at most one probe per window; a dead endpoint turns into fast cached 503s instead of every request paying the probe timeout. |
+| `llmSingleFlight` | **Serialized LLM calls — default `true`.** At most ONE request in flight per endpoint at any moment, across every process (the daemon distilling concurrent captures, the nightly consolidating, CLI backfills take turns via a per-endpoint lock file). One Hicortex server is several callers at once, and local single-user model servers (a Mac mini or laptop serving one big-context model) can stall or crash — taking the machine with them — under two concurrent large requests. Queued calls wait their turn; batches run back-to-back. **Set `false` if your endpoint is a beefy multi-tenant service that parallelizes well and you want faster consolidation** — you opt into responsibility for the endpoint's concurrency safety. |
+| `llmSingleFlightWaitMs` | How long a queued call waits for the in-flight call before failing as endpoint-down and retrying per the normal ladder/breaker rules (default: `max(900000, llmTimeoutMs)` — a waiter never gives up before a legitimate in-flight call's own, possibly raised, ceiling expires). Only meaningful with serialization on. Note under contention: the readiness probe queues too, but its wait is capped by its own probe budget — during a long consolidation batch, `/distill` answers 503 quickly (captures cursor-hold and retry, lossless) rather than holding the socket for the full queue budget. |
 | `authToken` | Bearer token for endpoint auth. Generated on first `init` in server mode. Find the active token with `hicortex status` or in `~/.hicortex/config.json`. |
 | `corsAllowedOrigins` | Browser origins allowed to read cross-origin responses, e.g. `["https://ui.example.com"]`. **Empty by default** — the server sends no `Access-Control-Allow-Origin` and never `Allow-Credentials`, so no external web page can read its data. The bundled `/viz` and `/identity/ui` pages are same-origin and need no entry. |
 | `licenseKey` | Commercial license key (optional; for display in `hicortex status`) |
 | `backupRetention` | How many of the newest backup artifacts (`hicortex-*.tar.gz`) the backup dir keeps after each successful write (default: 7; `0` keeps all). See [Backups](#backups) |
 | _env_ `HICORTEX_DISTILL_BODY_LIMIT_MB` | Environment override for the `/distill` body limit — **wins over the `distillBodyLimitMb` config key in every mode** (that is the point: a deployment operator pins it so tenant-writable config cannot raise it). Unset = config/default applies. |
+| _env_ `HICORTEX_MEMORY_CAP` | Environment override for the memory soft cap — a **positive** value wins over the `memorySoftCap` config key in every mode; `0`/negative/malformed fall through to the config key, then the 10000 default (an env can pin a cap, never disable one — config `memorySoftCap: 0` still disables when the env is unset). Mode-agnostic operator knob: nightly eviction, the dashboard-snapshot capacity stamp, and the live dashboard gauge all resolve through the same resolver, so the enforced and displayed caps can never disagree. Drives `nightly --evict-only` the same way. |
 | `domains` | Your memory domain list (`[{name, description}]`). Scaffolded by `init`; edit freely — see [Memory Domains & Tags](#memory-domains--tags) |
 | `weakPrimaryFloor` | Minimum similarity for a no-fit memory to keep a weak domain association (default: 0.45) |
 | `moduleIndexTokenBudget` | Max tokens for domain index in lessons context (default: 500) |
 | `lessonsLimit` | Max lessons injected into an agent's session-start context (default: 10). Lessons are ranked per session by project/domain affinity + recency + strength + access, so each session sees its most-relevant slice. Lower = leaner system prompts. |
-| `identityClients` | Which harnesses inject the [identity layer](#identity-layer) at session start (default `["cc"]`; `"all"` or any subset of `cc`/`hermes`/`oc`) |
+| `identityClients` | Which harnesses inject the [identity layer](#identity-layer) at session start (default `["cc"]`; `"all"` or any subset of `cc`/`hermes`/`oc`/`pi`/`opencode`) |
 | `identityAgents` | Per-agent identity modes (0.13): `{ "<id>": "override" \| "global" \| "off" }`. Absent + no `agents/<id>/` dir → every agent gets the global set. Boot-time (restart to apply) — see [Per-agent identity](#per-agent-identity-013) |
 | `agentName` | This install's per-agent identity id sent as `?agent=`. **Unset by default** (CC shares the global identity — no `?agent=` sent). Explicit opt-in via `init --agent-name <name>`; `init --agent-name ""` clears it. An empty/whitespace value equals unset |
 | `captureCooldownHours` | Success-cooldown (hours) for the **capture watchdog** (0.17). The capture timer polls every ~20 min; the watchdog captures only if more than this has elapsed since the last *successful* capture (`state.lastNightly`). Default `6` (≈4 captures/day). A failed preflight retries on the next poll (~20 min) — so a transient fire-instant network miss costs minutes, not a day (#239) |

package/dist/cli.d.ts

@@ -8,6 +8,7 @@
  *   nightly    Run capture + consolidate (manual trigger)
  *              nightly --capture-only     Capture only, skip consolidation
  *              nightly --consolidate-only Consolidate only, skip capture (hosted service)
+ *              nightly --evict-only       Memory-cap eviction only — pure DB, no LLM (#317)
  *              nightly --status           Show nightly pipeline health check
  *   relink     Resumable link-discovery pass over the entire corpus (issue #143)
  *   dedup      Cluster + merge near-duplicate memories (issue #100)

package/dist/cli.js

@@ -9,6 +9,7 @@
  *   nightly    Run capture + consolidate (manual trigger)
  *              nightly --capture-only     Capture only, skip consolidation
  *              nightly --consolidate-only Consolidate only, skip capture (hosted service)
+ *              nightly --evict-only       Memory-cap eviction only — pure DB, no LLM (#317)
  *              nightly --status           Show nightly pipeline health check
  *   relink     Resumable link-discovery pass over the entire corpus (issue #143)
  *   dedup      Cluster + merge near-duplicate memories (issue #100)
@@ -71,11 +72,16 @@ switch (command) {
             const dryRun = args.includes("--dry-run");
             const captureOnly = args.includes("--capture-only");
             const consolidateOnly = args.includes("--consolidate-only");
+            const evictOnly = args.includes("--evict-only");
             const watchdog = args.includes("--watchdog");
             if (captureOnly && consolidateOnly) {
                 console.error("[hicortex] nightly: --capture-only and --consolidate-only are mutually exclusive");
                 process.exit(1);
             }
+            if (evictOnly && (captureOnly || consolidateOnly)) {
+                console.error("[hicortex] nightly: --evict-only is mutually exclusive with --capture-only and --consolidate-only");
+                process.exit(1);
+            }
             // Timestamp every log line. The nightly writes to a file (launchd /
             // systemd StandardOutput append) with NO per-line timestamp, which made
             // diagnosing capture gaps impossible (the #239 investigation couldn't
@@ -98,7 +104,7 @@ switch (command) {
                 }
             }
             import("./nightly.js").then(({ runNightly }) => {
-                runNightly({ dryRun, captureOnly, consolidateOnly, watchdog, recaptureWindowDays }).catch((err) => {
+                runNightly({ dryRun, captureOnly, consolidateOnly, evictOnly, watchdog, recaptureWindowDays }).catch((err) => {
                     console.error("[hicortex] Nightly pipeline failed:", err);
                     process.exit(1);
                 });
@@ -355,6 +361,7 @@ Options:
   nightly --dry-run         Preview without changes
   nightly --capture-only    Capture only, skip consolidation (safe to run multiple times/day)
   nightly --consolidate-only  Consolidate only, skip capture (hosted-service per-tenant runs)
+  nightly --evict-only      Memory-cap eviction only — pure DB, no capture, no LLM (#317)
   nightly --recapture-window <days>   Re-discover sessions quiet since <days> ago (one-shot #189 recovery)
   nightly --status          Show nightly pipeline health
   relink --dry-run          Discovery + counts only, zero writes, cursor untouched

package/dist/consolidate.d.ts

@@ -285,6 +285,27 @@ export declare function stageDecayPrune(db: Database.Database, dryRun: boolean):
  * (recall top-k competes against the long tail). Override via `memorySoftCap`.
  */
 export declare const DEFAULT_MEMORY_SOFT_CAP = 10000;
+/**
+ * Resolve the effective soft cap (#317): a positive finite HICORTEX_MEMORY_CAP
+ * env wins over the `memorySoftCap` config key, which wins over
+ * DEFAULT_MEMORY_SOFT_CAP. The env is the PRICING boundary — in the hosted
+ * stack the cap is a per-plan parameter the provider pins into the tenant .env
+ * (docker exec inherits container env, so the eviction path sees it), and the
+ * tenant's config.json is bind-mounted writable at /data, so config-only
+ * resolution would let a tenant raise or disable its own cap. Same
+ * env-wins-precedence pattern as resolveTokenCap (token-budget.ts) and
+ * resolveBodyLimitMb (mcp-server.ts).
+ *
+ * Deliberate asymmetry with resolveTokenCap: a MALFORMED/0/negative env falls
+ * through (an env can pin a cap but never disable one), while config 0 is
+ * still honored as the #245 opt-out (indefinite growth) when the env is unset
+ * — env unset → config → default is exactly the pre-#317 behavior, so a
+ * self-hosted install that never hears about the env sees no change. Pure —
+ * exported for tests; every consumer (nightly eviction + snapshot stamp,
+ * dashboard live headline) must route through this ONE function so the
+ * enforced cap and the displayed cap cannot disagree.
+ */
+export declare function resolveMemorySoftCap(configVal: unknown): number;
 export declare function stageMemoryCapEviction(db: Database.Database, dryRun: boolean, cap: number): {
     cap: number;
     evicted: number;

package/dist/consolidate.js

@@ -50,12 +50,14 @@ exports.buildSupersessionPrompt = buildSupersessionPrompt;
 exports.parseSupersessionReply = parseSupersessionReply;
 exports.stageSupersession = stageSupersession;
 exports.stageDecayPrune = stageDecayPrune;
+exports.resolveMemorySoftCap = resolveMemorySoftCap;
 exports.stageMemoryCapEviction = stageMemoryCapEviction;
 exports.runConsolidation = runConsolidation;
 exports.msUntilHour = msUntilHour;
 exports.scheduleConsolidation = scheduleConsolidation;
 const retrieval_js_1 = require("./retrieval.js");
 const storage = __importStar(require("./storage.js"));
+const config_read_js_1 = require("./config-read.js");
 const prompts_js_1 = require("./prompts.js");
 const node_crypto_1 = require("node:crypto");
 const features_js_1 = require("./features.js");
@@ -291,11 +293,16 @@ function parseJsonLenient(text, fallback) {
 // ---------------------------------------------------------------------------
 // Stage 1: Pre-check
 // ---------------------------------------------------------------------------
-function readLastConsolidated() {
-    return (0, state_js_1.loadState)().lastConsolidated ?? "";
+function readLastConsolidated(stateDir) {
+    // stateDir-optional for backcompat; runConsolidation threads its own
+    // stateDir so the skip decision reads the SAME state the run writes
+    // (previously this read the ambient home — a split-brain where a test or
+    // CLI caller with an isolated stateDir decided "skip" from the operator's
+    // real ~/.hicortex watermark).
+    return (0, state_js_1.loadState)(stateDir).lastConsolidated ?? "";
 }
-function stagePrecheck(db) {
-    const lastTs = readLastConsolidated();
+function stagePrecheck(db, stateDir) {
+    const lastTs = readLastConsolidated(stateDir);
     const lastDt = lastTs || "1970-01-01T00:00:00.000Z";
     const newMemories = storage.getMemoriesSince(db, lastDt);
     if (newMemories.length === 0) {
@@ -1261,6 +1268,41 @@ function stageDecayPrune(db, dryRun) {
  * (recall top-k competes against the long tail). Override via `memorySoftCap`.
  */
 exports.DEFAULT_MEMORY_SOFT_CAP = 10000;
+/** Env override for the soft cap (#317). Hosted: provider-set via the tenant
+ *  .env, tenant-immutable at runtime (same posture as HICORTEX_TOKEN_CAP).
+ *  Self-hosted: an operator knob — mode-agnostic, never branches on
+ *  hostedMode. */
+const MEMORY_CAP_ENV = "HICORTEX_MEMORY_CAP";
+/**
+ * Resolve the effective soft cap (#317): a positive finite HICORTEX_MEMORY_CAP
+ * env wins over the `memorySoftCap` config key, which wins over
+ * DEFAULT_MEMORY_SOFT_CAP. The env is the PRICING boundary — in the hosted
+ * stack the cap is a per-plan parameter the provider pins into the tenant .env
+ * (docker exec inherits container env, so the eviction path sees it), and the
+ * tenant's config.json is bind-mounted writable at /data, so config-only
+ * resolution would let a tenant raise or disable its own cap. Same
+ * env-wins-precedence pattern as resolveTokenCap (token-budget.ts) and
+ * resolveBodyLimitMb (mcp-server.ts).
+ *
+ * Deliberate asymmetry with resolveTokenCap: a MALFORMED/0/negative env falls
+ * through (an env can pin a cap but never disable one), while config 0 is
+ * still honored as the #245 opt-out (indefinite growth) when the env is unset
+ * — env unset → config → default is exactly the pre-#317 behavior, so a
+ * self-hosted install that never hears about the env sees no change. Pure —
+ * exported for tests; every consumer (nightly eviction + snapshot stamp,
+ * dashboard live headline) must route through this ONE function so the
+ * enforced cap and the displayed cap cannot disagree.
+ */
+function resolveMemorySoftCap(configVal) {
+    const envCap = Number(process.env[MEMORY_CAP_ENV]);
+    if (Number.isFinite(envCap) && envCap > 0)
+        return envCap;
+    // Reuse the disk→runtime boundary validator (warn-on-rejected-value) so the
+    // config half behaves byte-for-byte like the pre-#317 readNonNegativeConfig
+    // call sites: absent → default, valid non-negative (incl. 0 = disabled)
+    // passes through, invalid → warn + default.
+    return (0, config_read_js_1.readNonNegativeConfig)({ memorySoftCap: configVal }, "memorySoftCap", exports.DEFAULT_MEMORY_SOFT_CAP);
+}
 function stageMemoryCapEviction(db, dryRun, cap) {
     // `0` = explicitly disabled (current/legacy behaviour). The guard is on `<=`
     // not `===` to also absorb a stray negative (readNonNegativeConfig already
@@ -1335,7 +1377,7 @@ memorySoftCap) {
         stages: {},
     };
     // Stage 1: Pre-check
-    const precheck = stagePrecheck(db);
+    const precheck = stagePrecheck(db, stateDir);
     // Also check for unscored memories
     const unscored = storage.getUnscoredMemories(db);
     const newIds = new Set(precheck.newMemories.map((m) => m.id));
@@ -1343,7 +1385,15 @@ memorySoftCap) {
         ...precheck.newMemories,
         ...unscored.filter((m) => !newIds.has(m.id)),
     ];
-    const skip = scoreMemories.length === 0;
+    // #194 no-fit scope: untagged rows (domain IS NULL) stay in the
+    // re-evaluation scope — the decay/re-attempt contract ("re-halves once per
+    // run while still below the floor") is work even on a quiet night with
+    // nothing new. The skip below gated on new+unscored only, which the tests
+    // never caught because stagePrecheck used to read the AMBIENT (always
+    // empty in the suite) state instead of the run's own watermark — threading
+    // stateDir (#357) exposed the divergence between test and production.
+    const nofitInScope = db.prepare("SELECT COUNT(*) AS n FROM memories WHERE domain IS NULL").get().n;
+    const skip = scoreMemories.length === 0 && nofitInScope === 0;
     report.stages.precheck = {
         skip,
         reason: skip
@@ -1413,8 +1463,18 @@ memorySoftCap) {
         report.status = "failed";
         console.error("[hicortex] Consolidation pipeline error:", err);
     }
-    // Update last-consolidated timestamp
-    if (!dryRun && report.status === "completed") {
+    // Update last-consolidated timestamp. #357: the stages fail SOFT, so a run
+    // against an endpoint that died mid-way still reports status "completed"
+    // here — advancing the timestamp made state.json disagree with the
+    // nightly's breaker-open override to endpoint_down (observed 0.20.0 soak:
+    // endpoint_down reported, lastConsolidated advanced anyway). Gate on the
+    // SAME signal the nightly's override reads (llm.breakerOpen) so the two
+    // sites agree for the breaker case — keep this condition and the override
+    // in nightly.ts in sync if either ever grows. (Sibling soft-fail paths —
+    // e.g. a sustained-429 run, which never accrues to the breaker because a
+    // 429 proves the endpoint answers — still advance; that is the #337
+    // taxonomy working as designed.)
+    if (!dryRun && report.status === "completed" && !llm.breakerOpen) {
         (0, state_js_1.updateState)((s) => {
             s.lastConsolidated = new Date().toISOString();
             return s;

package/dist/dashboard.js

@@ -361,7 +361,10 @@ function handleDashboardData(db, query, config) {
     // Headline = live corpus (the chart shows history; the headline shows now).
     // `memory_soft_cap` (#245): resolve from the live config (the source of
     // truth for "what cap is in force right now"), defaulting to the production
-    // default. The page renders no gauge when it's 0 (disabled).
+    // default. The page renders no gauge when it's 0 (disabled). #317: routes
+    // through resolveMemorySoftCap so a HICORTEX_MEMORY_CAP env pin is honored
+    // here too — the DISPLAYED cap can never disagree with the ENFORCED cap
+    // (both consumers share the one resolver).
     //
     // `tokens` (#246): period accrual from state.json (the same single source
     // the throttle check reads, so the dashboard always agrees with the runtime
@@ -372,7 +375,7 @@ function handleDashboardData(db, query, config) {
         total_memories: live.totals.mem,
         uses_per_showing: live.adoption?.uses_per_showing ?? null,
         cold_count: live.adoption?.cold_count ?? 0,
-        memory_soft_cap: (0, config_read_js_1.readNonNegativeConfig)(config ?? {}, "memorySoftCap", consolidate_js_1.DEFAULT_MEMORY_SOFT_CAP),
+        memory_soft_cap: (0, consolidate_js_1.resolveMemorySoftCap)(config?.memorySoftCap),
         tokens: {
             used: tokenState?.total ?? 0,
             cap: (0, config_read_js_1.readNonNegativeConfig)(config ?? {}, "llmTokensPerMonth", 0),

package/dist/identity-store.d.ts

@@ -227,9 +227,9 @@ export declare const IDENTITY_SIZE_WARN_BYTES = 16384;
 /** Backcompat alias for the pre-rename name (#264). */
 export declare const CONTEXT_SIZE_WARN_BYTES = 16384;
 /** Harness names that may inject the identity layer. */
-export declare const KNOWN_IDENTITY_CLIENTS: readonly ["cc", "hermes", "oc"];
+export declare const KNOWN_IDENTITY_CLIENTS: readonly ["cc", "hermes", "oc", "pi", "opencode"];
 /** Backcompat alias for the pre-rename name (#264). */
-export declare const KNOWN_CONTEXT_CLIENTS: readonly ["cc", "hermes", "oc"];
+export declare const KNOWN_CONTEXT_CLIENTS: readonly ["cc", "hermes", "oc", "pi", "opencode"];
 export interface ResolvedIdentityClients {
     /** The resolved, de-duped list of known client names. */
     clients: string[];
@@ -240,7 +240,7 @@ export interface ResolvedIdentityClients {
 export type ResolvedContextClients = ResolvedIdentityClients;
 /**
  * Normalize the raw `identityClients` config value (spec §2):
- *  - `"all"` (any case)      → ["cc","hermes","oc"]
+ *  - `"all"` (any case)      → ["cc","hermes","oc","pi","opencode"]
  *  - array                   → lowercase, keep known names (de-duped), collect dropped unknowns
  *  - missing / non-array-non-"all" → default ["cc"]
  * The resolved list is echoed by GET /identity as `clients` so each harness's

package/dist/identity-store.js

@@ -467,12 +467,12 @@ exports.CONTEXT_SIZE_WARN_BYTES = exports.IDENTITY_SIZE_WARN_BYTES;
 // Config — identityClients normalization
 // ---------------------------------------------------------------------------
 /** Harness names that may inject the identity layer. */
-exports.KNOWN_IDENTITY_CLIENTS = ["cc", "hermes", "oc"];
+exports.KNOWN_IDENTITY_CLIENTS = ["cc", "hermes", "oc", "pi", "opencode"];
 /** Backcompat alias for the pre-rename name (#264). */
 exports.KNOWN_CONTEXT_CLIENTS = exports.KNOWN_IDENTITY_CLIENTS;
 /**
  * Normalize the raw `identityClients` config value (spec §2):
- *  - `"all"` (any case)      → ["cc","hermes","oc"]
+ *  - `"all"` (any case)      → ["cc","hermes","oc","pi","opencode"]
  *  - array                   → lowercase, keep known names (de-duped), collect dropped unknowns
  *  - missing / non-array-non-"all" → default ["cc"]
  * The resolved list is echoed by GET /identity as `clients` so each harness's

package/dist/init.d.ts

@@ -6,7 +6,9 @@
  *   2. Remote HC server (HICORTEX_SERVER_URL — any reachable host:port)
  *   3. OC plugin installed (~/.openclaw/openclaw.json)
  *   4. CC MCP already registered (~/.claude/settings.json)
- *   5. Existing DB (~/.hicortex/ or ~/.openclaw/data/)
+ *   5. Hermes present (~/.hermes) / Pi present (~/.pi/agent) /
+ *      opencode present (~/.config/opencode or ~/.local/share/opencode)
+ *   6. Existing DB (~/.hicortex/ or ~/.openclaw/data/)
  *
  * Actions:
  *   - Install persistent daemon (launchd/systemd)
@@ -23,6 +25,13 @@ import type { DomainDef } from "./types.js";
  *   - "registered" — listed but connection not confirmed (server down / not restarted)
  */
 export declare function parseMcpListStatus(mcpListOutput: string): "connected" | "registered" | "missing";
+/**
+ * The client config's serverUrl BEFORE this run re-points it — the value init
+ * last wrote into the Hermes plugin's config (so the plugin step can tell an
+ * init-owned URL from a user-set one). Exported for tests.
+ */
+export declare function readPreviousServerUrl(configPath: string): string | undefined;
+export declare function setupHermes(serverUrl: string, authToken: string, previousServerUrl?: string): void;
 /**
  * Parse a KEY=VALUE env file (e.g. ~/.hermes/.env or ~/.claude/settings.json env block).
  * Handles: comments (#), quoted values, empty lines.