@link-assistant/hive-mind 2.13.5 → 2.15.0

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @link-assistant/hive-mind
 
+## 2.15.0
+
+### Minor Changes
+
+- 29612e7: Turn off every AI tool's own cross-task memory and Claude Code's auto-mode classifier by default (issue #2178).
+
+  A hive-mind task is a disposable container that opens one pull request. The repository — commits, issues, pull requests, case studies — is meant to be the only memory it keeps, because it is the only memory a reviewer can see, correct or revert. Every agentic CLI has since grown a private cross-session store that works against that, and the largest of them (Gemini CLI's auto-memory) is a whole second agent re-reading past sessions on a second model.
+
+  `--agent-memory-disabled` is new and defaults to `true`. It applies, per tool:
+
+  - **claude** — `CLAUDE_CODE_DISABLE_AUTO_MEMORY=1`, `CLAUDE_CODE_DISABLE_ORG_MEMORY=1`, `autoMemoryEnabled: false`, and `permissions.disableAutoMode: "disable"`. The last one is what removes the classifier: auto mode is what pays for it, and the settings gate is checked before the provider and model gates, so it holds everywhere the environment-variable opt-in would not. Tasks already run `--dangerously-skip-permissions` inside a disposable container, so a classifier deciding whether an action is safe is answering a question that has already been answered.
+  - **codex** — `-c features.memories=false -c features.external_agent_memory_import=false`, on both the `codex exec` path and the `--use-agent-commander` path. Both default to off upstream today, but `memories` is a stable-stage flag, so pinning it per run is what makes the default actually hold.
+  - **gemini, qwen** — `tools.exclude: ["save_memory"]` and `experimental.autoMemory: false`, merged into the tool's settings file without disturbing anything else already there.
+  - **opencode, agent** — no cross-session memory feature was found in either; recorded explicitly so the claim can be re-checked rather than assumed.
+
+  `--no-agent-memory-disabled` opts out for codex, gemini and qwen, and when it does the policy adds no arguments at all rather than arguments set to `true`. It does not reach claude: those switches are `ENV` lines in the Docker image and settings written by `configure-claude`, neither of which sees a `solve` argv, so they stay off either way and the flag's description says so.
+
+## 2.14.0
+
+### Minor Changes
+
+- e796988: Add the experimental `--use-router` option, which stops handing a Docker-isolated task the operator's real subscription. With the flag, `~/.claude`, `~/.claude.json`, `~/.codex` and `~/.agents` are mounted only into a reference-counted `hive-mind-router` sidecar (pinned to `ghcr.io/link-assistant/router:0.119.0`) on an internal Docker network; each task is joined to that network and given its own `la_sk_…` token scoped to the one repository it works on, so every model request lands in that token's own redacted log. The sidecar runs while at least one task holds a lease and is stopped when the last one is released, with the Telegram bot reconciling leases against Docker so a killed bot cannot leave it running forever. At end of task the agent's session data is drained into the router's data volume for audit, and that volume is never removed by any code path.
+
+  GitHub is routed too: the sidecar terminates TLS itself with a certificate covering `api.github.com`, and the task container resolves that name to the router, so an unmodified `gh` is mediated without holding a GitHub credential of its own. `git` pushes through the router's `/git/*` proxy, which refuses remote-ref deletions and, from router `0.110.0`, non-fast-forward updates as well — it asks GitHub's compare API whether the proposed tip is ahead and fails closed when it cannot tell. A read-only `pre-push` hook in the task covers the same ground locally and for non-routed remotes. `--model formal-ai` is served through the router as a stored OpenAI-compatible provider, so it is audited like every other model.
+
+  Nothing changes without the flag. The remaining limits are documented and printed before every routed run: destructive GitHub API calls are blocked by HTTP method rather than by effect, so `PUT` branch protection, `PUT` rulesets, `POST` transfer and `PATCH` visibility/archived/default_branch are still forwarded (upstream `link-assistant/router#329`) — which puts branch protection itself within reach of a routed token; the Formal AI sidecar's own upstream calls are not routed; and the router resolves exact model ids only, not aliases, so the tier-shaped surface (`--plan`, `--escalate`, fallback chains) needs dated ids on a routed run. New docs: `docs/ROUTER.md`, `docs/COLLECTING-LOGS.md`, `docs/case-studies/issue-2164/` and `examples/collect-logs.mjs`.
+
 ## 2.13.5
 
 ### Patch Changes

package/README.hi.md

@@ -88,6 +88,8 @@ Hive Mind में औसत प्रोग्रामर से अलग
 
 Hive Mind अपने प्रबंधित terminal, log, telemetry, upload और GitHub publication paths में पहचाने गए credentials को sanitize करता है। Scanner विफल होने पर publication रोक दिया जाता है, लेकिन यह किसी autonomous tool को किसी असंबंधित exfiltration path का उपयोग करने से नहीं रोकता। Masking contract, supported formats, maintenance process और incident-response guidance के लिए [Credential sanitization](./docs/CREDENTIAL-SANITIZATION.hi.md) देखें।
 
+डिफ़ॉल्ट रूप से Docker में आइसोलेट किए गए कार्यों को ऑपरेटर के Claude/Codex क्रेडेंशियल मिल जाते हैं। `--use-router` उन्हें रोक देता है और मॉडल ट्रैफ़िक को `hive-mind-router` sidecar से भेजता है, जिससे हर कार्य को अपना सीमित दायरे वाला टोकन और अपना request लॉग मिलता है — देखें [राउटर आइसोलेशन](./docs/ROUTER.hi.md) (प्रयोगात्मक) और [लॉग एकत्र करना](./docs/COLLECTING-LOGS.hi.md)।
+
 `hive.mjs` चलाने के लिए न्यूनतम सिस्टम आवश्यकताएँ:
 
 ```

package/README.md

@@ -88,6 +88,8 @@ We strongly recommend:
 
 Hive Mind sanitizes recognized credentials in its maintained terminal, log, telemetry, upload, and GitHub publication paths. Publication is blocked if the scanner fails, but this does not prevent an autonomous tool from using an unrelated exfiltration path. See [Credential sanitization](./docs/CREDENTIAL-SANITIZATION.md) for the masking contract, supported formats, maintenance process, and incident-response guidance.
 
+Docker-isolated tasks receive the operator's Claude/Codex credentials by default. `--use-router` withholds them and routes model traffic through a `hive-mind-router` sidecar instead, giving each task its own scoped token and its own request log — see [Router isolation](./docs/ROUTER.md) (experimental) and [Collecting logs](./docs/COLLECTING-LOGS.md).
+
 Minimum system requirements to run `hive.mjs`:
 
 ```

package/README.ru.md

@@ -88,6 +88,8 @@ Hive Mind обладает высоким уровнем творчества,
 
 Hive Mind скрывает распознанные учётные данные в обслуживаемых им путях вывода терминала, журналов, телеметрии, загрузок и публикаций GitHub. При сбое сканера публикация блокируется, однако это не мешает автономному инструменту использовать посторонний канал утечки. Соглашение о маскировании, поддерживаемые форматы, процесс сопровождения и рекомендации по реагированию на инциденты приведены в разделе [Санитизация учётных данных](./docs/CREDENTIAL-SANITIZATION.ru.md).
 
+По умолчанию задачи, изолированные в Docker, получают учётные данные Claude/Codex оператора. `--use-router` их не передаёт и вместо этого направляет трафик модели через sidecar `hive-mind-router`, выдавая каждой задаче собственный ограниченный токен и собственный журнал запросов — см. [Изоляция через роутер](./docs/ROUTER.ru.md) (экспериментально) и [Сбор журналов](./docs/COLLECTING-LOGS.ru.md).
+
 Минимальные системные требования для запуска `hive.mjs`:
 
 ```

package/README.zh.md

@@ -88,6 +88,8 @@ Hive Mind 具备与普通程序员无异的高度创造力。当需求不明确
 
 Hive Mind 会在其维护的终端、日志、遥测、上传和 GitHub 发布路径中清理可识别的凭证。如果扫描器失败，发布会被阻止；但这无法阻止自主工具通过不相关的路径泄露数据。有关掩码约定、支持的格式、维护流程和事件响应指南，请参阅[凭证清理](./docs/CREDENTIAL-SANITIZATION.zh.md)。
 
+默认情况下，Docker 隔离的任务会拿到操作者的 Claude/Codex 凭据。`--use-router` 不再传入这些凭据，而是让模型流量经由 `hive-mind-router` sidecar 转发，使每个任务获得仅限自身的令牌和自己的请求日志——参见[路由器隔离](./docs/ROUTER.zh.md)（实验性）与[收集日志](./docs/COLLECTING-LOGS.zh.md)。
+
 运行 `hive.mjs` 的最低系统要求：
 
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-assistant/hive-mind",
-  "version": "2.13.5",
+  "version": "2.15.0",
   "description": "AI-powered issue solver and hive mind for collaborative problem solving",
   "main": "src/hive.mjs",
   "type": "module",

package/src/agent-commander.lib.mjs

@@ -14,6 +14,7 @@ import { detectUsageLimit } from './usage-limit.lib.mjs';
 import { applyFormalAiPricingOverride } from './formal-ai-pricing.lib.mjs'; // Issue #2119
 import { getCacheReadTokenCount, getCumulativeContextInputTokens, getOutputTokenCount } from './context-fill.lib.mjs';
 import { ensureAiToolScratchIgnored, filterAiToolScratchFromStatus } from './ai-tool-scratch.lib.mjs';
+import { CLAUDE_MEMORY_DISABLE_ENV, buildCodexMemoryDisableConfigArgs, isAgentMemoryDisabled } from './agent-memory-policy.lib.mjs'; // Issue #2178
 
 export const AGENT_COMMANDER_TOOLS = new Set(['claude', 'codex', 'opencode', 'agent', 'qwen', 'gemini']);
 
@@ -57,6 +58,12 @@ const buildClaudeToolOptions = (argv = {}) => {
   if (argv.showThinkingContent) extraEnv.CLAUDE_CODE_SHOW_THINKING = '1';
   if (argv.planModel) extraEnv.ANTHROPIC_DEFAULT_OPUS_MODEL = argv.planModel;
   if (argv.subAgentModel) extraEnv.CLAUDE_CODE_SUBAGENT_MODEL = mapClaudeSubAgentModelToEnvValue(argv.subAgentModel);
+  // Issue #2178: agent-commander spawns `claude` itself, so it needs the memory
+  // opt-out in its own env rather than relying on the settings file alone. Not
+  // gated on --agent-memory-disabled: for claude these switches are part of the
+  // quiet configuration baked into the image, and the flag governs the tools
+  // whose memory is applied per run (codex, gemini, qwen).
+  Object.assign(extraEnv, CLAUDE_MEMORY_DISABLE_ENV);
   appendExtraEnv(options, extraEnv);
 
   return options;
@@ -73,6 +80,7 @@ const buildCodexToolOptions = (argv = {}) => {
   appendExtraArgs(options, reasoningArgs);
 
   appendExtraArgs(options, buildCodexDisable1mContextConfigArgs(!!argv.disable1mContext));
+  appendExtraArgs(options, buildCodexMemoryDisableConfigArgs(isAgentMemoryDisabled(argv))); // Issue #2178
   try {
     appendExtraArgs(options, buildCodexSubSessionSizeConfigArgs(parseSubSessionSize(argv.subSessionSize)));
   } catch {

package/src/agent-memory-policy.lib.mjs

@@ -0,0 +1,305 @@
+#!/usr/bin/env node
+/**
+ * Cross-task memory is off for every agentic CLI hive-mind drives (issue #2178).
+ *
+ * A hive-mind task is a one-shot: a container is created, an issue is solved, a
+ * pull request is opened, the container is destroyed. Nothing an agent learns in
+ * one task is meant to reach the next one. The repository is the memory — commits,
+ * issues, pull requests, `docs/case-studies/` — and it is the only memory a
+ * reviewer can see, correct, or revert.
+ *
+ * Every agentic CLI now ships some form of private cross-session memory that
+ * works against that. It is not free:
+ *
+ *   - it burns inference on top of the task (Gemini CLI runs a whole background
+ *     extraction agent over past sessions; Claude Code loads a memory index into
+ *     every session);
+ *   - it carries facts between unrelated repositories with no review step;
+ *   - it makes a run irreproducible — the same prompt on the same commit behaves
+ *     differently depending on what the tool happened to remember.
+ *
+ * The permission classifiers are the same kind of waste for the same reason.
+ * Claude Code's "auto" mode pays a classifier call per tool use to decide whether
+ * an action is safe. Hive-mind tasks already run with unrestricted access inside a
+ * disposable Docker container (`--dangerously-skip-permissions`,
+ * `--dangerously-bypass-approvals-and-sandbox`, `--approval-mode yolo`), so the
+ * classifier can only ever answer a question nobody asked.
+ *
+ * This module is the single place that knows which knob turns each of these off,
+ * so `solve` and the Docker image baseline stay in agreement and a new tool
+ * version cannot quietly re-enable one of them without a test noticing.
+ *
+ * Verified against claude-code 2.1.246, codex-cli 0.148.0, gemini-cli 0.51.0,
+ * qwen-code 0.7.1 and opencode 1.18.5; see `docs/case-studies/issue-2178/`.
+ *
+ * @see https://github.com/link-assistant/hive-mind/issues/2178
+ */
+
+import fsPromises from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+/** Tools `solve --tool` accepts that this policy has something to say about. */
+export const AGENT_MEMORY_POLICY_TOOLS = Object.freeze(['claude', 'codex', 'gemini', 'qwen', 'opencode', 'agent']);
+
+/**
+ * Claude Code environment variables that switch off every cross-session memory
+ * store it can reach.
+ *
+ * `CLAUDE_CODE_DISABLE_AUTO_MEMORY` disables the per-project memory directory,
+ * and the same branch also refuses the team stores named by
+ * `CLAUDE_MEMORY_STORES`. `CLAUDE_CODE_DISABLE_ORG_MEMORY` disables the
+ * organization-wide memory sync, which is gated separately.
+ */
+export const CLAUDE_MEMORY_DISABLE_ENV = Object.freeze({
+  CLAUDE_CODE_DISABLE_AUTO_MEMORY: '1',
+  CLAUDE_CODE_DISABLE_ORG_MEMORY: '1',
+});
+
+/**
+ * Claude Code settings that switch off memory.
+ *
+ * `autoMemoryEnabled: false` is the settings-file equivalent of
+ * `CLAUDE_CODE_DISABLE_AUTO_MEMORY` — both are checked, and either one is
+ * enough, so they are set together rather than one being trusted alone.
+ */
+export const CLAUDE_MEMORY_DISABLE_SETTINGS = Object.freeze({
+  autoMemoryEnabled: false,
+});
+
+/**
+ * Claude Code `permissions` block that removes auto mode.
+ *
+ * `"disable"` is the only value the setting accepts, and it is checked before
+ * the plan-level, provider-level and model-level gates, so it holds regardless
+ * of which provider or model a task runs on. Auto mode is what pays for the
+ * classifier; with it gone the classifier has no caller.
+ */
+export const CLAUDE_AUTO_MODE_DISABLE_PERMISSIONS = Object.freeze({
+  disableAutoMode: 'disable',
+});
+
+/**
+ * Codex feature flags that hold its memory subsystem off.
+ *
+ * `memories` is the `~/.codex/memories` store Codex writes across sessions;
+ * `external_agent_memory_import` pulls another agent's memory in. Both default
+ * to off today, but `memories` is stage `stable`, so it can be switched on by a
+ * rollout or by an operator's `~/.codex/config.toml` — pinning them per run is
+ * what makes the default actually hold.
+ */
+export const CODEX_MEMORY_DISABLE_FEATURES = Object.freeze(['memories', 'external_agent_memory_import']);
+
+/**
+ * `-c key=value` overrides that turn {@link CODEX_MEMORY_DISABLE_FEATURES} off.
+ *
+ * `-c features.<name>=false` is used rather than the `--disable <name>` alias
+ * because `--disable` is documented as exactly equivalent and `-c` is accepted
+ * by every `codex exec` version hive-mind supports.
+ *
+ * @param {boolean} [disabled=true] - false returns [] so `--no-agent-memory-disabled` is a no-op.
+ * @returns {string[]}
+ */
+export const buildCodexMemoryDisableConfigArgs = (disabled = true) => {
+  if (!disabled) return [];
+  return CODEX_MEMORY_DISABLE_FEATURES.flatMap(feature => ['-c', `features.${feature}=false`]);
+};
+
+/**
+ * Tool name (as the CLI exposes it) of the Gemini-family memory writer.
+ *
+ * Gemini CLI dropped `save_memory` in 0.51 in favour of the `experimental.autoMemory`
+ * background extractor; Qwen Code, forked earlier, still ships the tool. Excluding
+ * the name covers the versions that have it and is inert on the versions that do not.
+ */
+export const GEMINI_FAMILY_MEMORY_TOOL = 'save_memory';
+
+/**
+ * Settings merged into `~/.gemini/settings.json` and `~/.qwen/settings.json`.
+ *
+ * `tools.exclude` is the nested form both CLIs resolve to (Qwen maps its legacy
+ * flat `excludeTools` onto it). `experimental.autoMemory` gates Gemini's
+ * background "skill extraction" agent, which re-reads past sessions with a second
+ * model and writes a memory index — the most expensive item on this list.
+ */
+export const GEMINI_FAMILY_MEMORY_DISABLE_SETTINGS = Object.freeze({
+  tools: Object.freeze({ exclude: Object.freeze([GEMINI_FAMILY_MEMORY_TOOL]) }),
+  experimental: Object.freeze({ autoMemory: false }),
+});
+
+/** Where each Gemini-family CLI keeps its user settings. */
+export const GEMINI_FAMILY_SETTINGS_PATHS = Object.freeze({
+  gemini: Object.freeze(['.gemini', 'settings.json']),
+  qwen: Object.freeze(['.qwen', 'settings.json']),
+});
+
+/**
+ * Tools with no cross-session memory feature to switch off.
+ *
+ * Recorded explicitly rather than left out: "we looked and there was nothing" and
+ * "nobody looked" are different states, and only the first one stays true without
+ * someone re-checking. The test for this module asserts the list, so a future
+ * reader can see the claim was made deliberately.
+ */
+export const TOOLS_WITHOUT_MEMORY_FEATURE = Object.freeze(['opencode', 'agent']);
+
+/**
+ * Is the policy on for this run?
+ *
+ * Reads `--agent-memory-disabled`, which defaults to true. Only an explicit
+ * `--no-agent-memory-disabled` turns it off, so an argv object that predates the
+ * flag (or omits it) still gets the policy.
+ *
+ * @param {Object} [argv]
+ */
+export const isAgentMemoryDisabled = (argv = {}) => argv?.agentMemoryDisabled !== false;
+
+const isPlainObject = value => !!value && typeof value === 'object' && !Array.isArray(value);
+
+/**
+ * Merge `desired` into `target` in place, returning the dotted paths that changed.
+ *
+ * Arrays are unioned rather than replaced so an operator's own `tools.exclude`
+ * entries survive; scalars are overwritten, because the whole point is that the
+ * policy wins.
+ *
+ * `__proto__`, `constructor` and `prototype` are skipped outright. Today this
+ * function is only ever handed {@link GEMINI_FAMILY_MEMORY_DISABLE_SETTINGS}, a
+ * frozen literal whose keys are all ordinary, so none of them can occur — but
+ * that is a fact about the caller, not about the function, and callers change
+ * (CodeQL `js/prototype-pollution-utility`). The guard is written as explicit
+ * comparisons rather than a lookup in a shared set because that is the shape the
+ * query recognises as a barrier, and a guard a scanner cannot see is one that
+ * gets reported again every time someone touches the file.
+ */
+const mergeSettings = (target, desired, prefix = '') => {
+  const changed = [];
+  for (const [key, value] of Object.entries(desired)) {
+    if (key === '__proto__' || key === 'constructor' || key === 'prototype') continue;
+    const dotted = prefix ? `${prefix}.${key}` : key;
+    if (isPlainObject(value)) {
+      if (!isPlainObject(target[key])) target[key] = {};
+      changed.push(...mergeSettings(target[key], value, dotted));
+      continue;
+    }
+    if (Array.isArray(value)) {
+      const existing = Array.isArray(target[key]) ? target[key] : [];
+      const merged = [...existing];
+      let added = false;
+      for (const entry of value) {
+        if (!merged.includes(entry)) {
+          merged.push(entry);
+          added = true;
+        }
+      }
+      if (added || !Array.isArray(target[key])) {
+        target[key] = merged;
+        changed.push(dotted);
+      }
+      continue;
+    }
+    if (target[key] !== value) {
+      target[key] = value;
+      changed.push(dotted);
+    }
+  }
+  return changed;
+};
+
+/**
+ * Resolve the settings file a Gemini-family CLI reads.
+ *
+ * @param {'gemini'|'qwen'} tool
+ * @param {Object} [options]
+ * @param {string} [options.homeDir]
+ * @returns {string|null} null when the tool has no Gemini-family settings file.
+ */
+export const resolveGeminiFamilySettingsPath = (tool, { homeDir = os.homedir() } = {}) => {
+  const segments = GEMINI_FAMILY_SETTINGS_PATHS[tool];
+  if (!segments) return null;
+  return path.join(homeDir, ...segments);
+};
+
+/**
+ * Write {@link GEMINI_FAMILY_MEMORY_DISABLE_SETTINGS} into a Gemini-family
+ * settings file, preserving everything already there.
+ *
+ * Never throws. A task that cannot write the settings file is still a task worth
+ * running: the failure costs inference, not correctness, and the caller logs it.
+ *
+ * @param {Object} [params]
+ * @param {'gemini'|'qwen'} params.tool
+ * @param {string} [params.settingsPath] - Overrides the tool's default location (tests).
+ * @param {string} [params.homeDir]
+ * @param {Function} [params.log]
+ * @param {Object} [params.fsImpl] - `node:fs/promises`-shaped, for tests.
+ * @returns {Promise<{applied: boolean, path: string|null, changed: string[], error: string|null}>}
+ */
+export const ensureGeminiFamilyMemoryDisabled = async ({ tool, settingsPath, homeDir = os.homedir(), log, fsImpl = fsPromises } = {}) => {
+  const resolvedPath = settingsPath || resolveGeminiFamilySettingsPath(tool, { homeDir });
+  if (!resolvedPath) return { applied: false, path: null, changed: [], error: null };
+
+  let settings = {};
+  try {
+    const parsed = JSON.parse(await fsImpl.readFile(resolvedPath, 'utf-8'));
+    if (isPlainObject(parsed)) settings = parsed;
+  } catch (error) {
+    if (error?.code !== 'ENOENT' && log) {
+      await log(`⚠️  Could not read ${resolvedPath}: ${error.message}`, { verbose: true });
+    }
+  }
+
+  const changed = mergeSettings(settings, GEMINI_FAMILY_MEMORY_DISABLE_SETTINGS);
+  try {
+    if (changed.length > 0) {
+      await fsImpl.mkdir(path.dirname(resolvedPath), { recursive: true });
+      await fsImpl.writeFile(resolvedPath, JSON.stringify(settings, null, 2));
+    }
+    if (log) {
+      await log(`🧠 Cross-task memory ${changed.length > 0 ? 'disabled' : 'already disabled'} for ${tool} in ${resolvedPath} (issue #2178)`, { verbose: true });
+    }
+    return { applied: true, path: resolvedPath, changed, error: null };
+  } catch (error) {
+    const message = error?.message || String(error);
+    if (log) await log(`⚠️  Could not write ${resolvedPath}: ${message}`, { verbose: true });
+    return { applied: false, path: resolvedPath, changed: [], error: message };
+  }
+};
+
+/**
+ * One line describing what the policy does for a tool, for `--verbose` logs and
+ * for the docs to quote without drifting from the code.
+ *
+ * @param {string} tool
+ * @returns {string}
+ */
+export const describeAgentMemoryPolicy = tool => {
+  switch (tool) {
+    case 'claude':
+      return `settings ${JSON.stringify({ ...CLAUDE_MEMORY_DISABLE_SETTINGS, permissions: CLAUDE_AUTO_MODE_DISABLE_PERMISSIONS })}, env ${Object.keys(CLAUDE_MEMORY_DISABLE_ENV).join(', ')}`;
+    case 'codex':
+      return buildCodexMemoryDisableConfigArgs(true).join(' ');
+    case 'gemini':
+    case 'qwen':
+      return `settings ${JSON.stringify(GEMINI_FAMILY_MEMORY_DISABLE_SETTINGS)}`;
+    default:
+      return TOOLS_WITHOUT_MEMORY_FEATURE.includes(tool) ? 'no cross-session memory feature to disable' : 'no policy recorded for this tool';
+  }
+};
+
+export default {
+  AGENT_MEMORY_POLICY_TOOLS,
+  CLAUDE_AUTO_MODE_DISABLE_PERMISSIONS,
+  CLAUDE_MEMORY_DISABLE_ENV,
+  CLAUDE_MEMORY_DISABLE_SETTINGS,
+  CODEX_MEMORY_DISABLE_FEATURES,
+  GEMINI_FAMILY_MEMORY_DISABLE_SETTINGS,
+  GEMINI_FAMILY_MEMORY_TOOL,
+  GEMINI_FAMILY_SETTINGS_PATHS,
+  TOOLS_WITHOUT_MEMORY_FEATURE,
+  buildCodexMemoryDisableConfigArgs,
+  describeAgentMemoryPolicy,
+  ensureGeminiFamilyMemoryDisabled,
+  isAgentMemoryDisabled,
+  resolveGeminiFamilySettingsPath,
+};

package/src/claude-quiet-config.lib.mjs

@@ -4,8 +4,12 @@ import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 
+// Issue #2178: memory and auto mode are governed by one cross-tool policy module
+// so `solve` cannot disagree with the Docker image baseline about what "off" means.
+import { CLAUDE_AUTO_MODE_DISABLE_PERMISSIONS, CLAUDE_MEMORY_DISABLE_ENV, CLAUDE_MEMORY_DISABLE_SETTINGS } from './agent-memory-policy.lib.mjs';
+
 export const REQUIRED_CLAUDE_QUIET_ENV = Object.freeze({
-  CLAUDE_CODE_DISABLE_AUTO_MEMORY: '1',
+  ...CLAUDE_MEMORY_DISABLE_ENV,
   CLAUDE_CODE_DISABLE_CRON: '1',
   CLAUDE_CODE_DISABLE_TERMINAL_TITLE: '1',
   CLAUDE_CODE_DISABLE_CLAUDE_MDS: '1',
@@ -20,7 +24,7 @@ export const REQUIRED_CLAUDE_QUIET_ENV = Object.freeze({
 });
 
 export const REQUIRED_CLAUDE_QUIET_SETTINGS = Object.freeze({
-  autoMemoryEnabled: false,
+  ...CLAUDE_MEMORY_DISABLE_SETTINGS,
   spinnerTipsEnabled: false,
   awaySummaryEnabled: false,
   feedbackSurveyRate: 0,
@@ -38,6 +42,7 @@ export const REQUIRED_CLAUDE_QUIET_ATTRIBUTION = Object.freeze({
 });
 
 export const REQUIRED_CLAUDE_QUIET_PERMISSIONS = Object.freeze({
+  ...CLAUDE_AUTO_MODE_DISABLE_PERMISSIONS,
   defaultMode: 'bypassPermissions',
 });
 

package/src/codex.lib.mjs

@@ -40,6 +40,7 @@ import { buildAuthRemedyLines, buildFormalAiEnvExports, isPrepareOnly, logPrepar
 import { buildFormalAiPricingInfo } from './formal-ai-pricing.lib.mjs'; // Issue #2119
 import { classifyRetryableError, createTransientRetryBudget, prepareRetryAfterError, waitWithCountdown } from './tool-retry.lib.mjs';
 import { parseSubSessionSize, buildCodexSubSessionSizeConfigArgs, buildCodexDisable1mContextConfigArgs } from './sub-session-size.lib.mjs'; // Issue #1706
+import { buildCodexMemoryDisableConfigArgs, isAgentMemoryDisabled } from './agent-memory-policy.lib.mjs'; // Issue #2178
 import { getCumulativeContextInputTokens } from './context-fill.lib.mjs';
 import { deployHandoffSkill } from './handoff-skill.lib.mjs'; // Issue #1877
 import { applyCodexCapabilityEnv, runCodexCapabilityPreflight } from './codex-capability-preflight.lib.mjs'; // Issue #2074
@@ -708,9 +709,15 @@ export const executeCodexCommand = async params => {
     for (const arg of subSessionSizeArgs) {
       codexArgs += ` ${shellQuote(arg)}`;
     }
+    // Issue #2178: a hive-mind task must not remember anything a reviewer cannot see.
+    const memoryDisableArgs = buildCodexMemoryDisableConfigArgs(isAgentMemoryDisabled(argv));
+    for (const arg of memoryDisableArgs) {
+      codexArgs += ` ${shellQuote(arg)}`;
+    }
     if (argv.verbose) {
       if (disable1mArgs.length) await log(`📊 Codex --disable-1m-context: ${disable1mArgs.join(' ')}`, { verbose: true });
       if (subSessionSizeArgs.length) await log(`📊 Codex --sub-session-size: ${subSessionSizeArgs.join(' ')}`, { verbose: true });
+      if (memoryDisableArgs.length) await log(`🧠 Codex cross-task memory disabled: ${memoryDisableArgs.join(' ')} (issue #2178)`, { verbose: true });
     }
     // Issue #2130: re-export the Formal AI environment inside the `sh -lc` script so a
     // stale `formal-ai with --global` block in the operator profile cannot override it.