@link-assistant/hive-mind 2.14.0 → 2.15.0

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @link-assistant/hive-mind
 
+## 2.15.0
+
+### Minor Changes
+
+- 29612e7: Turn off every AI tool's own cross-task memory and Claude Code's auto-mode classifier by default (issue #2178).
+
+  A hive-mind task is a disposable container that opens one pull request. The repository — commits, issues, pull requests, case studies — is meant to be the only memory it keeps, because it is the only memory a reviewer can see, correct or revert. Every agentic CLI has since grown a private cross-session store that works against that, and the largest of them (Gemini CLI's auto-memory) is a whole second agent re-reading past sessions on a second model.
+
+  `--agent-memory-disabled` is new and defaults to `true`. It applies, per tool:
+
+  - **claude** — `CLAUDE_CODE_DISABLE_AUTO_MEMORY=1`, `CLAUDE_CODE_DISABLE_ORG_MEMORY=1`, `autoMemoryEnabled: false`, and `permissions.disableAutoMode: "disable"`. The last one is what removes the classifier: auto mode is what pays for it, and the settings gate is checked before the provider and model gates, so it holds everywhere the environment-variable opt-in would not. Tasks already run `--dangerously-skip-permissions` inside a disposable container, so a classifier deciding whether an action is safe is answering a question that has already been answered.
+  - **codex** — `-c features.memories=false -c features.external_agent_memory_import=false`, on both the `codex exec` path and the `--use-agent-commander` path. Both default to off upstream today, but `memories` is a stable-stage flag, so pinning it per run is what makes the default actually hold.
+  - **gemini, qwen** — `tools.exclude: ["save_memory"]` and `experimental.autoMemory: false`, merged into the tool's settings file without disturbing anything else already there.
+  - **opencode, agent** — no cross-session memory feature was found in either; recorded explicitly so the claim can be re-checked rather than assumed.
+
+  `--no-agent-memory-disabled` opts out for codex, gemini and qwen, and when it does the policy adds no arguments at all rather than arguments set to `true`. It does not reach claude: those switches are `ENV` lines in the Docker image and settings written by `configure-claude`, neither of which sees a `solve` argv, so they stay off either way and the flag's description says so.
+
 ## 2.14.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-assistant/hive-mind",
-  "version": "2.14.0",
+  "version": "2.15.0",
   "description": "AI-powered issue solver and hive mind for collaborative problem solving",
   "main": "src/hive.mjs",
   "type": "module",

package/src/agent-commander.lib.mjs

@@ -14,6 +14,7 @@ import { detectUsageLimit } from './usage-limit.lib.mjs';
 import { applyFormalAiPricingOverride } from './formal-ai-pricing.lib.mjs'; // Issue #2119
 import { getCacheReadTokenCount, getCumulativeContextInputTokens, getOutputTokenCount } from './context-fill.lib.mjs';
 import { ensureAiToolScratchIgnored, filterAiToolScratchFromStatus } from './ai-tool-scratch.lib.mjs';
+import { CLAUDE_MEMORY_DISABLE_ENV, buildCodexMemoryDisableConfigArgs, isAgentMemoryDisabled } from './agent-memory-policy.lib.mjs'; // Issue #2178
 
 export const AGENT_COMMANDER_TOOLS = new Set(['claude', 'codex', 'opencode', 'agent', 'qwen', 'gemini']);
 
@@ -57,6 +58,12 @@ const buildClaudeToolOptions = (argv = {}) => {
   if (argv.showThinkingContent) extraEnv.CLAUDE_CODE_SHOW_THINKING = '1';
   if (argv.planModel) extraEnv.ANTHROPIC_DEFAULT_OPUS_MODEL = argv.planModel;
   if (argv.subAgentModel) extraEnv.CLAUDE_CODE_SUBAGENT_MODEL = mapClaudeSubAgentModelToEnvValue(argv.subAgentModel);
+  // Issue #2178: agent-commander spawns `claude` itself, so it needs the memory
+  // opt-out in its own env rather than relying on the settings file alone. Not
+  // gated on --agent-memory-disabled: for claude these switches are part of the
+  // quiet configuration baked into the image, and the flag governs the tools
+  // whose memory is applied per run (codex, gemini, qwen).
+  Object.assign(extraEnv, CLAUDE_MEMORY_DISABLE_ENV);
   appendExtraEnv(options, extraEnv);
 
   return options;
@@ -73,6 +80,7 @@ const buildCodexToolOptions = (argv = {}) => {
   appendExtraArgs(options, reasoningArgs);
 
   appendExtraArgs(options, buildCodexDisable1mContextConfigArgs(!!argv.disable1mContext));
+  appendExtraArgs(options, buildCodexMemoryDisableConfigArgs(isAgentMemoryDisabled(argv))); // Issue #2178
   try {
     appendExtraArgs(options, buildCodexSubSessionSizeConfigArgs(parseSubSessionSize(argv.subSessionSize)));
   } catch {

package/src/agent-memory-policy.lib.mjs

@@ -0,0 +1,305 @@
+#!/usr/bin/env node
+/**
+ * Cross-task memory is off for every agentic CLI hive-mind drives (issue #2178).
+ *
+ * A hive-mind task is a one-shot: a container is created, an issue is solved, a
+ * pull request is opened, the container is destroyed. Nothing an agent learns in
+ * one task is meant to reach the next one. The repository is the memory — commits,
+ * issues, pull requests, `docs/case-studies/` — and it is the only memory a
+ * reviewer can see, correct, or revert.
+ *
+ * Every agentic CLI now ships some form of private cross-session memory that
+ * works against that. It is not free:
+ *
+ *   - it burns inference on top of the task (Gemini CLI runs a whole background
+ *     extraction agent over past sessions; Claude Code loads a memory index into
+ *     every session);
+ *   - it carries facts between unrelated repositories with no review step;
+ *   - it makes a run irreproducible — the same prompt on the same commit behaves
+ *     differently depending on what the tool happened to remember.
+ *
+ * The permission classifiers are the same kind of waste for the same reason.
+ * Claude Code's "auto" mode pays a classifier call per tool use to decide whether
+ * an action is safe. Hive-mind tasks already run with unrestricted access inside a
+ * disposable Docker container (`--dangerously-skip-permissions`,
+ * `--dangerously-bypass-approvals-and-sandbox`, `--approval-mode yolo`), so the
+ * classifier can only ever answer a question nobody asked.
+ *
+ * This module is the single place that knows which knob turns each of these off,
+ * so `solve` and the Docker image baseline stay in agreement and a new tool
+ * version cannot quietly re-enable one of them without a test noticing.
+ *
+ * Verified against claude-code 2.1.246, codex-cli 0.148.0, gemini-cli 0.51.0,
+ * qwen-code 0.7.1 and opencode 1.18.5; see `docs/case-studies/issue-2178/`.
+ *
+ * @see https://github.com/link-assistant/hive-mind/issues/2178
+ */
+
+import fsPromises from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+/** Tools `solve --tool` accepts that this policy has something to say about. */
+export const AGENT_MEMORY_POLICY_TOOLS = Object.freeze(['claude', 'codex', 'gemini', 'qwen', 'opencode', 'agent']);
+
+/**
+ * Claude Code environment variables that switch off every cross-session memory
+ * store it can reach.
+ *
+ * `CLAUDE_CODE_DISABLE_AUTO_MEMORY` disables the per-project memory directory,
+ * and the same branch also refuses the team stores named by
+ * `CLAUDE_MEMORY_STORES`. `CLAUDE_CODE_DISABLE_ORG_MEMORY` disables the
+ * organization-wide memory sync, which is gated separately.
+ */
+export const CLAUDE_MEMORY_DISABLE_ENV = Object.freeze({
+  CLAUDE_CODE_DISABLE_AUTO_MEMORY: '1',
+  CLAUDE_CODE_DISABLE_ORG_MEMORY: '1',
+});
+
+/**
+ * Claude Code settings that switch off memory.
+ *
+ * `autoMemoryEnabled: false` is the settings-file equivalent of
+ * `CLAUDE_CODE_DISABLE_AUTO_MEMORY` — both are checked, and either one is
+ * enough, so they are set together rather than one being trusted alone.
+ */
+export const CLAUDE_MEMORY_DISABLE_SETTINGS = Object.freeze({
+  autoMemoryEnabled: false,
+});
+
+/**
+ * Claude Code `permissions` block that removes auto mode.
+ *
+ * `"disable"` is the only value the setting accepts, and it is checked before
+ * the plan-level, provider-level and model-level gates, so it holds regardless
+ * of which provider or model a task runs on. Auto mode is what pays for the
+ * classifier; with it gone the classifier has no caller.
+ */
+export const CLAUDE_AUTO_MODE_DISABLE_PERMISSIONS = Object.freeze({
+  disableAutoMode: 'disable',
+});
+
+/**
+ * Codex feature flags that hold its memory subsystem off.
+ *
+ * `memories` is the `~/.codex/memories` store Codex writes across sessions;
+ * `external_agent_memory_import` pulls another agent's memory in. Both default
+ * to off today, but `memories` is stage `stable`, so it can be switched on by a
+ * rollout or by an operator's `~/.codex/config.toml` — pinning them per run is
+ * what makes the default actually hold.
+ */
+export const CODEX_MEMORY_DISABLE_FEATURES = Object.freeze(['memories', 'external_agent_memory_import']);
+
+/**
+ * `-c key=value` overrides that turn {@link CODEX_MEMORY_DISABLE_FEATURES} off.
+ *
+ * `-c features.<name>=false` is used rather than the `--disable <name>` alias
+ * because `--disable` is documented as exactly equivalent and `-c` is accepted
+ * by every `codex exec` version hive-mind supports.
+ *
+ * @param {boolean} [disabled=true] - false returns [] so `--no-agent-memory-disabled` is a no-op.
+ * @returns {string[]}
+ */
+export const buildCodexMemoryDisableConfigArgs = (disabled = true) => {
+  if (!disabled) return [];
+  return CODEX_MEMORY_DISABLE_FEATURES.flatMap(feature => ['-c', `features.${feature}=false`]);
+};
+
+/**
+ * Tool name (as the CLI exposes it) of the Gemini-family memory writer.
+ *
+ * Gemini CLI dropped `save_memory` in 0.51 in favour of the `experimental.autoMemory`
+ * background extractor; Qwen Code, forked earlier, still ships the tool. Excluding
+ * the name covers the versions that have it and is inert on the versions that do not.
+ */
+export const GEMINI_FAMILY_MEMORY_TOOL = 'save_memory';
+
+/**
+ * Settings merged into `~/.gemini/settings.json` and `~/.qwen/settings.json`.
+ *
+ * `tools.exclude` is the nested form both CLIs resolve to (Qwen maps its legacy
+ * flat `excludeTools` onto it). `experimental.autoMemory` gates Gemini's
+ * background "skill extraction" agent, which re-reads past sessions with a second
+ * model and writes a memory index — the most expensive item on this list.
+ */
+export const GEMINI_FAMILY_MEMORY_DISABLE_SETTINGS = Object.freeze({
+  tools: Object.freeze({ exclude: Object.freeze([GEMINI_FAMILY_MEMORY_TOOL]) }),
+  experimental: Object.freeze({ autoMemory: false }),
+});
+
+/** Where each Gemini-family CLI keeps its user settings. */
+export const GEMINI_FAMILY_SETTINGS_PATHS = Object.freeze({
+  gemini: Object.freeze(['.gemini', 'settings.json']),
+  qwen: Object.freeze(['.qwen', 'settings.json']),
+});
+
+/**
+ * Tools with no cross-session memory feature to switch off.
+ *
+ * Recorded explicitly rather than left out: "we looked and there was nothing" and
+ * "nobody looked" are different states, and only the first one stays true without
+ * someone re-checking. The test for this module asserts the list, so a future
+ * reader can see the claim was made deliberately.
+ */
+export const TOOLS_WITHOUT_MEMORY_FEATURE = Object.freeze(['opencode', 'agent']);
+
+/**
+ * Is the policy on for this run?
+ *
+ * Reads `--agent-memory-disabled`, which defaults to true. Only an explicit
+ * `--no-agent-memory-disabled` turns it off, so an argv object that predates the
+ * flag (or omits it) still gets the policy.
+ *
+ * @param {Object} [argv]
+ */
+export const isAgentMemoryDisabled = (argv = {}) => argv?.agentMemoryDisabled !== false;
+
+const isPlainObject = value => !!value && typeof value === 'object' && !Array.isArray(value);
+
+/**
+ * Merge `desired` into `target` in place, returning the dotted paths that changed.
+ *
+ * Arrays are unioned rather than replaced so an operator's own `tools.exclude`
+ * entries survive; scalars are overwritten, because the whole point is that the
+ * policy wins.
+ *
+ * `__proto__`, `constructor` and `prototype` are skipped outright. Today this
+ * function is only ever handed {@link GEMINI_FAMILY_MEMORY_DISABLE_SETTINGS}, a
+ * frozen literal whose keys are all ordinary, so none of them can occur — but
+ * that is a fact about the caller, not about the function, and callers change
+ * (CodeQL `js/prototype-pollution-utility`). The guard is written as explicit
+ * comparisons rather than a lookup in a shared set because that is the shape the
+ * query recognises as a barrier, and a guard a scanner cannot see is one that
+ * gets reported again every time someone touches the file.
+ */
+const mergeSettings = (target, desired, prefix = '') => {
+  const changed = [];
+  for (const [key, value] of Object.entries(desired)) {
+    if (key === '__proto__' || key === 'constructor' || key === 'prototype') continue;
+    const dotted = prefix ? `${prefix}.${key}` : key;
+    if (isPlainObject(value)) {
+      if (!isPlainObject(target[key])) target[key] = {};
+      changed.push(...mergeSettings(target[key], value, dotted));
+      continue;
+    }
+    if (Array.isArray(value)) {
+      const existing = Array.isArray(target[key]) ? target[key] : [];
+      const merged = [...existing];
+      let added = false;
+      for (const entry of value) {
+        if (!merged.includes(entry)) {
+          merged.push(entry);
+          added = true;
+        }
+      }
+      if (added || !Array.isArray(target[key])) {
+        target[key] = merged;
+        changed.push(dotted);
+      }
+      continue;
+    }
+    if (target[key] !== value) {
+      target[key] = value;
+      changed.push(dotted);
+    }
+  }
+  return changed;
+};
+
+/**
+ * Resolve the settings file a Gemini-family CLI reads.
+ *
+ * @param {'gemini'|'qwen'} tool
+ * @param {Object} [options]
+ * @param {string} [options.homeDir]
+ * @returns {string|null} null when the tool has no Gemini-family settings file.
+ */
+export const resolveGeminiFamilySettingsPath = (tool, { homeDir = os.homedir() } = {}) => {
+  const segments = GEMINI_FAMILY_SETTINGS_PATHS[tool];
+  if (!segments) return null;
+  return path.join(homeDir, ...segments);
+};
+
+/**
+ * Write {@link GEMINI_FAMILY_MEMORY_DISABLE_SETTINGS} into a Gemini-family
+ * settings file, preserving everything already there.
+ *
+ * Never throws. A task that cannot write the settings file is still a task worth
+ * running: the failure costs inference, not correctness, and the caller logs it.
+ *
+ * @param {Object} [params]
+ * @param {'gemini'|'qwen'} params.tool
+ * @param {string} [params.settingsPath] - Overrides the tool's default location (tests).
+ * @param {string} [params.homeDir]
+ * @param {Function} [params.log]
+ * @param {Object} [params.fsImpl] - `node:fs/promises`-shaped, for tests.
+ * @returns {Promise<{applied: boolean, path: string|null, changed: string[], error: string|null}>}
+ */
+export const ensureGeminiFamilyMemoryDisabled = async ({ tool, settingsPath, homeDir = os.homedir(), log, fsImpl = fsPromises } = {}) => {
+  const resolvedPath = settingsPath || resolveGeminiFamilySettingsPath(tool, { homeDir });
+  if (!resolvedPath) return { applied: false, path: null, changed: [], error: null };
+
+  let settings = {};
+  try {
+    const parsed = JSON.parse(await fsImpl.readFile(resolvedPath, 'utf-8'));
+    if (isPlainObject(parsed)) settings = parsed;
+  } catch (error) {
+    if (error?.code !== 'ENOENT' && log) {
+      await log(`⚠️  Could not read ${resolvedPath}: ${error.message}`, { verbose: true });
+    }
+  }
+
+  const changed = mergeSettings(settings, GEMINI_FAMILY_MEMORY_DISABLE_SETTINGS);
+  try {
+    if (changed.length > 0) {
+      await fsImpl.mkdir(path.dirname(resolvedPath), { recursive: true });
+      await fsImpl.writeFile(resolvedPath, JSON.stringify(settings, null, 2));
+    }
+    if (log) {
+      await log(`🧠 Cross-task memory ${changed.length > 0 ? 'disabled' : 'already disabled'} for ${tool} in ${resolvedPath} (issue #2178)`, { verbose: true });
+    }
+    return { applied: true, path: resolvedPath, changed, error: null };
+  } catch (error) {
+    const message = error?.message || String(error);
+    if (log) await log(`⚠️  Could not write ${resolvedPath}: ${message}`, { verbose: true });
+    return { applied: false, path: resolvedPath, changed: [], error: message };
+  }
+};
+
+/**
+ * One line describing what the policy does for a tool, for `--verbose` logs and
+ * for the docs to quote without drifting from the code.
+ *
+ * @param {string} tool
+ * @returns {string}
+ */
+export const describeAgentMemoryPolicy = tool => {
+  switch (tool) {
+    case 'claude':
+      return `settings ${JSON.stringify({ ...CLAUDE_MEMORY_DISABLE_SETTINGS, permissions: CLAUDE_AUTO_MODE_DISABLE_PERMISSIONS })}, env ${Object.keys(CLAUDE_MEMORY_DISABLE_ENV).join(', ')}`;
+    case 'codex':
+      return buildCodexMemoryDisableConfigArgs(true).join(' ');
+    case 'gemini':
+    case 'qwen':
+      return `settings ${JSON.stringify(GEMINI_FAMILY_MEMORY_DISABLE_SETTINGS)}`;
+    default:
+      return TOOLS_WITHOUT_MEMORY_FEATURE.includes(tool) ? 'no cross-session memory feature to disable' : 'no policy recorded for this tool';
+  }
+};
+
+export default {
+  AGENT_MEMORY_POLICY_TOOLS,
+  CLAUDE_AUTO_MODE_DISABLE_PERMISSIONS,
+  CLAUDE_MEMORY_DISABLE_ENV,
+  CLAUDE_MEMORY_DISABLE_SETTINGS,
+  CODEX_MEMORY_DISABLE_FEATURES,
+  GEMINI_FAMILY_MEMORY_DISABLE_SETTINGS,
+  GEMINI_FAMILY_MEMORY_TOOL,
+  GEMINI_FAMILY_SETTINGS_PATHS,
+  TOOLS_WITHOUT_MEMORY_FEATURE,
+  buildCodexMemoryDisableConfigArgs,
+  describeAgentMemoryPolicy,
+  ensureGeminiFamilyMemoryDisabled,
+  isAgentMemoryDisabled,
+  resolveGeminiFamilySettingsPath,
+};

package/src/claude-quiet-config.lib.mjs

@@ -4,8 +4,12 @@ import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 
+// Issue #2178: memory and auto mode are governed by one cross-tool policy module
+// so `solve` cannot disagree with the Docker image baseline about what "off" means.
+import { CLAUDE_AUTO_MODE_DISABLE_PERMISSIONS, CLAUDE_MEMORY_DISABLE_ENV, CLAUDE_MEMORY_DISABLE_SETTINGS } from './agent-memory-policy.lib.mjs';
+
 export const REQUIRED_CLAUDE_QUIET_ENV = Object.freeze({
-  CLAUDE_CODE_DISABLE_AUTO_MEMORY: '1',
+  ...CLAUDE_MEMORY_DISABLE_ENV,
   CLAUDE_CODE_DISABLE_CRON: '1',
   CLAUDE_CODE_DISABLE_TERMINAL_TITLE: '1',
   CLAUDE_CODE_DISABLE_CLAUDE_MDS: '1',
@@ -20,7 +24,7 @@ export const REQUIRED_CLAUDE_QUIET_ENV = Object.freeze({
 });
 
 export const REQUIRED_CLAUDE_QUIET_SETTINGS = Object.freeze({
-  autoMemoryEnabled: false,
+  ...CLAUDE_MEMORY_DISABLE_SETTINGS,
   spinnerTipsEnabled: false,
   awaySummaryEnabled: false,
   feedbackSurveyRate: 0,
@@ -38,6 +42,7 @@ export const REQUIRED_CLAUDE_QUIET_ATTRIBUTION = Object.freeze({
 });
 
 export const REQUIRED_CLAUDE_QUIET_PERMISSIONS = Object.freeze({
+  ...CLAUDE_AUTO_MODE_DISABLE_PERMISSIONS,
   defaultMode: 'bypassPermissions',
 });
 

package/src/codex.lib.mjs

@@ -40,6 +40,7 @@ import { buildAuthRemedyLines, buildFormalAiEnvExports, isPrepareOnly, logPrepar
 import { buildFormalAiPricingInfo } from './formal-ai-pricing.lib.mjs'; // Issue #2119
 import { classifyRetryableError, createTransientRetryBudget, prepareRetryAfterError, waitWithCountdown } from './tool-retry.lib.mjs';
 import { parseSubSessionSize, buildCodexSubSessionSizeConfigArgs, buildCodexDisable1mContextConfigArgs } from './sub-session-size.lib.mjs'; // Issue #1706
+import { buildCodexMemoryDisableConfigArgs, isAgentMemoryDisabled } from './agent-memory-policy.lib.mjs'; // Issue #2178
 import { getCumulativeContextInputTokens } from './context-fill.lib.mjs';
 import { deployHandoffSkill } from './handoff-skill.lib.mjs'; // Issue #1877
 import { applyCodexCapabilityEnv, runCodexCapabilityPreflight } from './codex-capability-preflight.lib.mjs'; // Issue #2074
@@ -708,9 +709,15 @@ export const executeCodexCommand = async params => {
     for (const arg of subSessionSizeArgs) {
       codexArgs += ` ${shellQuote(arg)}`;
     }
+    // Issue #2178: a hive-mind task must not remember anything a reviewer cannot see.
+    const memoryDisableArgs = buildCodexMemoryDisableConfigArgs(isAgentMemoryDisabled(argv));
+    for (const arg of memoryDisableArgs) {
+      codexArgs += ` ${shellQuote(arg)}`;
+    }
     if (argv.verbose) {
       if (disable1mArgs.length) await log(`📊 Codex --disable-1m-context: ${disable1mArgs.join(' ')}`, { verbose: true });
       if (subSessionSizeArgs.length) await log(`📊 Codex --sub-session-size: ${subSessionSizeArgs.join(' ')}`, { verbose: true });
+      if (memoryDisableArgs.length) await log(`🧠 Codex cross-task memory disabled: ${memoryDisableArgs.join(' ')} (issue #2178)`, { verbose: true });
     }
     // Issue #2130: re-export the Formal AI environment inside the `sh -lc` script so a
     // stale `formal-ai with --global` block in the operator profile cannot override it.

package/src/gemini.lib.mjs

@@ -31,6 +31,7 @@ import { getCumulativeContextInputTokens, toTokenCount } from './context-fill.li
 import { ensureAiToolScratchIgnored, filterAiToolScratchFromStatus } from './ai-tool-scratch.lib.mjs';
 import { getTerminalEventCompletionHealth } from './tool-run-health.lib.mjs'; // Issue #1990
 import { takeJsonRecords } from './json-stream.lib.mjs'; // Issue #2119
+import { ensureGeminiFamilyMemoryDisabled, isAgentMemoryDisabled } from './agent-memory-policy.lib.mjs'; // Issue #2178
 
 const shellQuote = value => `"${String(value).replaceAll('\\', '\\\\').replaceAll('"', '\\"')}"`;
 
@@ -421,6 +422,10 @@ export const executeGeminiCommand = async params => {
     await log(`   Load: ${resourcesBefore.load}`, { verbose: true });
 
     const mappedModel = mapModelToId(argv.model || defaultModels.gemini);
+    // Issue #2178: the repository is the only memory a hive-mind task keeps, so
+    // `save_memory` and the background auto-memory extractor are switched off
+    // before the CLI reads its settings.
+    if (isAgentMemoryDisabled(argv)) await ensureGeminiFamilyMemoryDisabled({ tool: 'gemini', log });
     // Issue #2130: Formal AI runs the native CLI against a local Formal AI server (no argv wrapper).
     const toolInvocation = await resolveFormalAiToolExecution({ tool: 'gemini', model: argv.model || defaultModels.gemini, toolPath: geminiPath, workdir: tempDir, log, verbose: argv.verbose, prepareOnly: isPrepareOnly(argv) });
     const geminiEnv = { ...process.env, ...toolInvocation.env };

package/src/qwen.lib.mjs

@@ -32,6 +32,7 @@ import { ensureAiToolScratchIgnored, filterAiToolScratchFromStatus } from './ai-
 import { getTerminalEventCompletionHealth } from './tool-run-health.lib.mjs'; // Issue #1990
 import { takeJsonRecords } from './json-stream.lib.mjs'; // Issue #2119
 import { stringifyErrorValue } from './error-text.lib.mjs'; // Issue #2141
+import { ensureGeminiFamilyMemoryDisabled, isAgentMemoryDisabled } from './agent-memory-policy.lib.mjs'; // Issue #2178
 
 export const mapModelToId = model => qwenModels[model] || model;
 
@@ -524,6 +525,9 @@ export const executeQwenCommand = async params => {
     await log(`   Load: ${resourcesBefore.load}`, { verbose: true });
 
     const mappedModel = mapModelToId(argv.model || defaultModels.qwen);
+    // Issue #2178: Qwen Code still ships the `save_memory` tool it inherited from
+    // Gemini CLI. Exclude it so nothing this task learns outlives the container.
+    if (isAgentMemoryDisabled(argv)) await ensureGeminiFamilyMemoryDisabled({ tool: 'qwen', log });
     // Issue #2130: Formal AI runs the native CLI against a local Formal AI server (no argv wrapper).
     const toolInvocation = await resolveFormalAiToolExecution({ tool: 'qwen', model: argv.model || defaultModels.qwen, toolPath: qwenPath, workdir: tempDir, log, verbose: argv.verbose, prepareOnly: isPrepareOnly(argv) });
     const qwenEnv = { ...process.env, ...toolInvocation.env };

package/src/solve.config.lib.mjs

@@ -603,6 +603,11 @@ export const SOLVE_OPTION_DEFINITIONS = {
     description: 'Disable Claude Code built-in tools and MCP servers that have no value (and may be harmful) in autonomous headless runs: AskUserQuestion, CronCreate/Delete/List, EnterPlanMode/ExitPlanMode, EnterWorktree/ExitWorktree, Monitor, NotebookEdit, PushNotification, RemoteTrigger, ScheduleWakeup, and the claude.ai Gmail/Drive/Calendar OAuth connectors. Default: true. Use --no-useless-tools-disabled to keep them enabled. Supported for --tool claude (issue #1627).',
     default: true,
   },
+  'agent-memory-disabled': {
+    type: 'boolean',
+    description: "Disable every AI tool's own cross-task memory and permission classifier, so the repository stays the only memory a task keeps. For --tool codex: -c features.memories=false and -c features.external_agent_memory_import=false. For --tool gemini and --tool qwen: tools.exclude=[save_memory] and experimental.autoMemory=false. --tool opencode and --tool agent have no cross-session memory feature. Default: true; --no-agent-memory-disabled lets those tools keep their own memory. For --tool claude the same switches (CLAUDE_CODE_DISABLE_AUTO_MEMORY, CLAUDE_CODE_DISABLE_ORG_MEMORY, autoMemoryEnabled=false, permissions.disableAutoMode=disable) are part of the quiet configuration baked into the Docker image, so they stay off regardless of this flag (issue #2178).",
+    default: true,
+  },
   'auto-gh-configuration-repair': {
     type: 'boolean',
     description: 'Automatically repair git configuration using gh-setup-git-identity --repair when git identity is not configured. Requires gh-setup-git-identity to be installed.',