@openviking/dsh-memory-plugin 0.3.0 → 0.4.3

package/mcp-env.mjs

@@ -0,0 +1,33 @@
+import { fileURLToPath } from "node:url";
+
+import { MCP_SERVER_NAME } from "./config.mjs";
+import { forwardConnectionEnv } from "./shared/mcp-proxy-config.mjs";
+
+/** The same stdio proxy every other OpenViking memory integration starts. */
+export const PROXY_PATH = fileURLToPath(new URL("./servers/mcp-proxy.mjs", import.meta.url));
+
+/**
+ * Build the dsh-mcp-client config for the OpenViking stdio proxy.
+ *
+ * DSH scrubs credential-shaped names out of the environment a subprocess
+ * inherits, and the Cordis patch is invisible to one, so the proxy cannot
+ * resolve the connection the way this process did. It gets the answer instead:
+ * the resolved connection and this session's peer, forwarded with the forced
+ * `env` source so the child reads no file and lands on exactly this url, key,
+ * identity, auth mode and peer — the empty ones included.
+ */
+export function buildMcpConfig(config) {
+  // In DSH Desktop, process.execPath is Electron's executable rather than a
+  // standalone Node binary. This tells Electron to run the proxy script as
+  // Node instead of attempting to launch a second Desktop instance.
+  const env = { ELECTRON_RUN_AS_NODE: "1", ...forwardConnectionEnv(config) };
+  if (config.timeoutMs) env.OPENVIKING_TIMEOUT_MS = String(config.timeoutMs);
+  return {
+    transport: "stdio",
+    serverName: MCP_SERVER_NAME,
+    command: process.execPath,
+    args: [PROXY_PATH],
+    env,
+    toolCallTimeoutMs: config.mcpToolCallTimeoutMs,
+  };
+}

package/mcp.mjs

@@ -1,39 +1,8 @@
-import { fileURLToPath } from "node:url";
 import * as mcpClient from "@deepseek-ai/dsh-mcp-client";
 
-import { MCP_SERVER_NAME } from "./config.mjs";
+import { buildMcpConfig } from "./mcp-env.mjs";
 
-/** The same stdio proxy every other OpenViking memory integration starts. */
-export const PROXY_PATH = fileURLToPath(new URL("./servers/mcp-proxy.mjs", import.meta.url));
-
-/**
- * Build the dsh-mcp-client config for the OpenViking stdio proxy.
- *
- * The bundle's own credential resolution (`OPENVIKING_*` → `ovcli.conf` →
- * `ov.conf`, plus anything set in the Cordis patch) is forwarded through the
- * child environment: DSH scrubs credential-shaped names out of the inherited
- * env, and the patch is invisible to a subprocess, so values the runtime
- * already resolved have to be passed explicitly.
- */
-export function buildMcpConfig(config) {
-  // In DSH Desktop, process.execPath is Electron's executable rather than a
-  // standalone Node binary. This tells Electron to run the proxy script as
-  // Node instead of attempting to launch a second Desktop instance.
-  const env = { ELECTRON_RUN_AS_NODE: "1" };
-  if (config.endpoint) env.OPENVIKING_URL = config.endpoint;
-  if (config.apiKey) env.OPENVIKING_API_KEY = config.apiKey;
-  if (config.account) env.OPENVIKING_ACCOUNT = config.account;
-  if (config.user) env.OPENVIKING_USER = config.user;
-  if (config.peerId) env.OPENVIKING_PEER_ID = config.peerId;
-  return {
-    transport: "stdio",
-    serverName: MCP_SERVER_NAME,
-    command: process.execPath,
-    args: [PROXY_PATH],
-    env,
-    toolCallTimeoutMs: config.mcpToolCallTimeoutMs,
-  };
-}
+export { buildMcpConfig, PROXY_PATH } from "./mcp-env.mjs";
 
 /**
  * Mount the tool surface. The bridge ships with dsh itself, so it resolves

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openviking/dsh-memory-plugin",
-  "version": "0.3.0",
+  "version": "0.4.3",
   "description": "OpenViking memory and context bundle for DeepSeek Harness",
   "type": "module",
   "main": "index.mjs",
@@ -14,6 +14,7 @@
     "capture.mjs",
     "lifecycle.mjs",
     "mcp.mjs",
+    "mcp-env.mjs",
     "runtime.mjs",
     "skills.mjs",
     "uri-guard.mjs",
@@ -29,21 +30,23 @@
     }
   },
   "scripts": {
+    "prepack": "node ../memory-plugin-shared/sync.mjs",
     "check": "for f in *.mjs shared/*.mjs; do node --check \"$f\" || exit 1; done && npm run check:version",
     "check:version": "node --input-type=module -e \"import {readFileSync} from 'node:fs'; const {PLUGIN_VERSION} = await import('./config.mjs'); const v = JSON.parse(readFileSync('package.json','utf8')).version; if (PLUGIN_VERSION !== v) throw new Error('PLUGIN_VERSION ' + PLUGIN_VERSION + ' does not match package.json version ' + v);\"",
     "test": "node --test *.test.mjs",
-    "prepublishOnly": "npm run check && npm test"
+    "prepublishOnly": "npm run prepack && npm run check && npm test"
   },
   "peerDependencies": {
-    "@deepseek-ai/dsh-llm": ">=0.1.0-rc.6 <0.2.0",
-    "@deepseek-ai/dsh-mcp-client": ">=0.1.0-rc.6 <0.2.0",
-    "@deepseek-ai/dsh-skill-filesystem": ">=0.1.0-rc.6 <0.2.0"
+    "@deepseek-ai/dsh-llm": ">=0.1.0-rc.6 <0.2.0 || ^0.1.5-rc.1",
+    "@deepseek-ai/dsh-mcp-client": ">=0.1.0-rc.6 <0.2.0 || ^0.1.5-rc.1",
+    "@deepseek-ai/dsh-skill-filesystem": ">=0.1.0-rc.6 <0.2.0 || ^0.1.5-rc.1"
   },
   "devDependencies": {
     "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
     "@deepseek-ai/dsh-mcp-client": "0.1.0-rc.6",
     "@deepseek-ai/dsh-skill-filesystem": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-tools": "0.1.0-rc.6"
+    "@deepseek-ai/dsh-tools": "0.1.0-rc.6",
+    "semver": "7.8.5"
   },
   "overrides": {
     "@deepseek-ai/dsh-agent": "0.1.0-rc.6",

package/runtime.mjs

@@ -1,6 +1,6 @@
-import { createUserMessage } from "@deepseek-ai/dsh-llm";
+import { isCaptureEnabled } from "./shared/capture-utils.mjs";
 import { buildProfileBlock } from "./shared/profile-inject.mjs";
-import { buildRecallBlock } from "./shared/recall-core.mjs";
+import { buildRecallBlock, isRecallEnabled } from "./shared/recall-core.mjs";
 import { deriveHarnessSessionId } from "./shared/session-model.mjs";
 import {
   dequeue,
@@ -13,6 +13,7 @@ import { resolveEffectivePeerId } from "./shared/workspace-peer.mjs";
 import {
   captureEvent,
   OPENVIKING_PLUGIN_SOURCE,
+  pluginMessage,
   promptText,
 } from "./capture.mjs";
 
@@ -22,23 +23,29 @@ export class OpenVikingRuntime {
     this.config = config;
     this.logger = logger;
     this.states = new Map();
+    this.drainTimer = null;
+    this.drainRunning = false;
+    this.drainPromise = Promise.resolve();
+    this.drainHealth = null;
   }
 
   stateFor(session) {
     let state = this.states.get(session.id);
     if (state) return state;
     const cwd = session.header?.cwd || process.cwd();
-    const peerId = resolveEffectivePeerId({
+    const peer = resolveEffectivePeerId({
       cfg: {
         peerId: this.config.explicitPeerId,
+        peerSource: this.config.peerSource,
         workspacePeer: this.config.workspacePeer,
+        harness: this.config.harness,
       },
       cwd,
-    }).peerId;
+    });
     state = {
       dshSessionId: String(session.id),
       ovSessionId: deriveHarnessSessionId("dsh-", String(session.id)),
-      config: { ...this.config, peerId },
+      config: { ...this.config, peerId: peer.peerId, legacyPeerId: peer.legacyPeerId },
       ready: false,
       profileBlock: "",
       profileDelivered: false,
@@ -85,10 +92,11 @@ export class OpenVikingRuntime {
       state.initializationRetryable = isRetryableFailure(ensured);
       return state;
     }
-    await replayPending(
-      (path, init) => this.client.fetchJSON(path, init),
-      (stage, data) => this.log(stage, data),
-    );
+    // Replay is a write, so it stays behind the same toggle: a backlog queued
+    // while capture was on waits for a session that still writes.
+    if (isCaptureEnabled(state.config)) {
+      await this.replayPendingQueue();
+    }
     await this.refreshPendingState(state);
     const profile = await buildProfileBlock(
       (path, init, options) => this.client.fetchJSON(path, init, options),
@@ -114,12 +122,12 @@ export class OpenVikingRuntime {
       return null;
     }
     state.profileDelivered = true;
-    return pluginMessage(state.profileBlock, "instructions");
+    return pluginMessage(state.profileBlock, { form: "instructions" });
   }
 
   async recallMessage(agent, messages) {
     const state = await this.initialize(agent);
-    if (!state.ready) return null;
+    if (!state.ready || !isRecallEnabled(state.config)) return null;
     const query = promptText(messages);
     if (query.length < state.config.minQueryLength) return null;
     const block = await buildRecallBlock(
@@ -128,16 +136,17 @@ export class OpenVikingRuntime {
       query,
       {
         actorPeerId: state.config.peerId,
+        legacyPeerId: state.config.legacyPeerId,
         sessionId: state.ovSessionId,
         log: (stage, data) => this.log(stage, data),
       },
     );
-    return block ? pluginMessage(block, "recall") : null;
+    return block ? pluginMessage(block, { form: "recall" }) : null;
   }
 
   capture(session, event) {
     const state = this.stateFor(session);
-    if (!state.config.syncTurns) return;
+    if (!isCaptureEnabled(state.config)) return;
     const payload = captureEvent(event, state.config, state.toolNames);
     if (!payload) return;
     this.enqueueWrite(state, async () => {
@@ -169,6 +178,7 @@ export class OpenVikingRuntime {
   maybeCommit(session, event) {
     if (event.type !== "turn/end") return;
     const state = this.stateFor(session);
+    if (!isCaptureEnabled(state.config)) return;
     this.enqueueWrite(state, async () => {
       if (state.hasPendingWrites) return;
       if (!state.ready && !(await this.ensureState(state)).ready) return;
@@ -201,6 +211,7 @@ export class OpenVikingRuntime {
     if (state.disposing) return state.disposing;
     state.disposing = (async () => {
       this.enqueueWrite(state, async () => {
+        if (!isCaptureEnabled(state.config)) return;
         const commitPayload = {
           keep_recent_count: state.config.commitKeepRecentCount,
         };
@@ -251,7 +262,15 @@ export class OpenVikingRuntime {
     const createdAt = Math.max(Date.now(), state.pendingCreatedAt + 1);
     state.pendingCreatedAt = createdAt;
     const result = await enqueue(type, state.ovSessionId, payload, { createdAt });
-    if (result.ok) state.hasPendingWrites = true;
+    if (result.ok) {
+      // Log the latch transition only: every message that follows while the
+      // latch holds takes the cheap enqueue path, so this fires once per
+      // outage, not once per message.
+      if (!state.hasPendingWrites) {
+        this.log("pending_latched", { sessionId: state.ovSessionId, type });
+      }
+      state.hasPendingWrites = true;
+    }
     if (!result.ok) {
       this.log("pending_enqueue_error", {
         sessionId: state.ovSessionId,
@@ -286,6 +305,7 @@ export class OpenVikingRuntime {
   }
 
   async refreshPendingState(state) {
+    const wasPending = state.hasPendingWrites;
     const pending = (await listPending()).filter(
       item => item.entry?.sessionId === state.ovSessionId,
     );
@@ -294,6 +314,84 @@ export class OpenVikingRuntime {
       (latest, item) => Math.max(latest, Number(item.entry?.createdAt || 0)),
       state.pendingCreatedAt,
     );
+    // Only the flip back to direct sends is logged: the recovery moment that
+    // proves the drainer worked, once per outage.
+    if (wasPending && !state.hasPendingWrites) {
+      this.log("pending_cleared", { sessionId: state.ovSessionId });
+    }
+  }
+
+  /**
+   * Replay the pending queue through this runtime's client. The session-start
+   * path calls it without options and keeps consuming retries; the drainer
+   * passes consumeRetries:false so transient failures stay retryable.
+   */
+  async replayPendingQueue(options = {}) {
+    await replayPending(
+      (path, init) => this.client.fetchJSON(path, init),
+      (stage, data) => this.log(stage, data),
+      options,
+    );
+  }
+
+  /**
+   * One drainer tick, following the session-start replay flow: probe health
+   * first and only replay when the server answers. Replays run without
+   * consuming retry budgets, then every session's latch is re-derived from
+   * the queue. An empty queue clears the latches with zero HTTP traffic, so
+   * once a transient write failure recovers, capture and commit resume on
+   * their own without restarting the long-lived dsh process.
+   */
+  async drainTick() {
+    if (this.drainRunning) return;
+    this.drainRunning = true;
+    try {
+      const pending = await listPending();
+      if (pending.length > 0) {
+        const health = await this.client.healthResult();
+        if (!health.ok) {
+          // Only the flip into the outage is logged, not every 60s probe.
+          if (this.drainHealth !== false) {
+            this.log("drain_health_down", { status: health.status || 0 });
+          }
+          this.drainHealth = false;
+        } else {
+          if (this.drainHealth === false) {
+            this.log("drain_health_restored", {});
+          }
+          this.drainHealth = true;
+          await this.replayPendingQueue({ consumeRetries: false });
+        }
+      }
+      for (const state of this.states.values()) {
+        await this.refreshPendingState(state);
+      }
+    } finally {
+      this.drainRunning = false;
+    }
+  }
+
+  /**
+   * Start the background drainer. The interval is fixed per process; each tick
+   * is single-flight, so a slow replay run never overlaps the next one.
+   */
+  startDrainer() {
+    if (this.drainTimer) return this.drainTimer;
+    const parsed = parseInt(process.env.OPENVIKING_PENDING_DRAIN_INTERVAL_MS || "", 10);
+    const intervalMs = Number.isFinite(parsed) && parsed > 0 ? parsed : 60000;
+    this.drainTimer = setInterval(() => {
+      this.drainPromise = this.drainTick().catch(error => this.log("drain_error", {
+        error: error instanceof Error ? error.message : String(error),
+      }));
+    }, intervalMs);
+    this.drainTimer.unref?.();
+    return this.drainTimer;
+  }
+
+  stopDrainer() {
+    if (!this.drainTimer) return;
+    clearInterval(this.drainTimer);
+    this.drainTimer = null;
   }
 
   async flush(session) {
@@ -306,22 +404,11 @@ export class OpenVikingRuntime {
   }
 }
 
-function pluginMessage(content, form) {
-  // dsh's own constructor: identity, normalization, and any future Message
-  // invariants come from the pinned peer instead of a hand-built object.
-  return createUserMessage({
-    content: [{ type: "text", text: content }],
-    source: {
-      kind: "plugin",
-      plugin: OPENVIKING_PLUGIN_SOURCE,
-      form,
-    },
-  });
-}
-
 function hasStartupProfile(agent) {
   const session = agent.session;
-  const ownEvents = (session?.events || []).slice(session?.header?.seedLength ?? 0);
+  const ownEvents = typeof session?.ownEvents === "function"
+    ? session.ownEvents()
+    : (session?.events || []).slice(session?.header?.seedLength ?? 0);
   const inHistory = ownEvents.some(event => (
     event?.type === "user/message" && isStartupProfile(event.data)
   ));

package/servers/mcp-proxy.mjs

@@ -4,36 +4,30 @@
  * stdio -> streamable-HTTP MCP proxy for the OpenViking DSH bundle.
  *
  * DSH's MCP bridge starts this process as a local stdio MCP server. The proxy
- * reads the same OpenViking credential sources as the in-process runtime; the
- * bundle also forwards its resolved config through the child environment, so
- * values that came from the Cordis patch survive the process boundary.
+ * resolves its connection through the same `resolveConfig()` as the in-process
+ * runtime, from the child environment the bundle builds in `mcp.mjs`: DSH
+ * scrubs credential-shaped names out of what it inherits, and values that came
+ * from the Cordis patch are invisible to a subprocess otherwise.
  */
 
 import { resolve as resolvePath } from "node:path";
 import { fileURLToPath } from "node:url";
 import { resolveConfig } from "../config.mjs";
-import { resolveOpenVikingCredentials } from "../shared/credentials.mjs";
 import { createLogger } from "../shared/debug-log.mjs";
-import { buildMcpProxyConfig } from "../shared/mcp-proxy-config.mjs";
+import { toMcpProxyConfig } from "../shared/mcp-proxy-config.mjs";
 import { createOpenVikingMcpProxy } from "../shared/mcp-proxy-core.mjs";
 
 export function readProxyConfig(env = process.env, cwd = process.cwd()) {
   const cfg = resolveConfig({}, env, cwd);
-  const creds = resolveOpenVikingCredentials(env);
-  return buildMcpProxyConfig({
-    baseUrl: cfg.endpoint,
-    apiKey: cfg.apiKey,
-    account: cfg.account,
-    user: cfg.user,
-    peerId: cfg.peerId,
-    userAgent: cfg.userAgent,
-    timeoutMs: cfg.requestTimeoutMs,
-    debug: Boolean(env.OV_DEBUG_LOG),
-    debugLogPath: env.OV_DEBUG_LOG,
-    credentialSource: creds.credentialSource,
-    credentialPath: creds.cliPath || creds.ovPath,
-    watchedPaths: [creds.cliPath, creds.ovPath, creds.cliPathCandidate],
+  return toMcpProxyConfig(cfg, {
     env,
+    // Not gated through `resolveMcpActorPeerId` like the other proxies: DSH's
+    // parent process resolves the peer per session and hands it over in the
+    // child env. Empty means it has none, and deriving one from wherever DSH
+    // launched this process would send a peer the runtime does not.
+    peerId: String(env.OPENVIKING_PEER_ID || "").trim(),
+    debug: Boolean(env.OV_DEBUG_LOG),
+    debugLogPath: env.OV_DEBUG_LOG || "",
   });
 }
 

package/shared/capture-utils.mjs

@@ -1,4 +1,6 @@
 // GENERATED FROM examples/memory-plugin-shared/lib. DO NOT EDIT.
+import { applyInputFilters, compileInputFilters } from "./input-filters.mjs";
+
 const TEXT_BLOCK_TYPES = new Set(["text", "input_text", "output_text"]);
 const TOOL_CALL_TYPES = new Set([
   "tool_call",
@@ -152,7 +154,7 @@ function toolId(block) {
 
 function toolStatus(block, kind) {
   if (kind === "call") return "running";
-  if (block?.is_error || block?.error || block?.state?.error) return "error";
+  if (block?.is_error || block?.isError || block?.state?.isError || block?.error || block?.state?.error) return "error";
   const status = oneLine(block?.status || block?.state?.status || "");
   return status || "completed";
 }
@@ -264,7 +266,13 @@ export function extractTextFromPayload(payload, options = {}) {
   return chunks.join("\n\n");
 }
 
-function collectToolNamesByIdFromEntries(entries) {
+/**
+ * Map every tool call id in a transcript to the name of the tool it invoked.
+ *
+ * A result block names the call by id only, so the name has to come from the
+ * call that preceded it. Pass the map as `toolNameById` to the extractors.
+ */
+export function collectToolNamesByIdFromEntries(entries) {
   const map = {};
   for (const entry of entries || []) {
     const payload = entry?.payload && typeof entry.payload === "object" ? entry.payload : entry;
@@ -354,6 +362,53 @@ export function extractPartsFromPayload(payload, options = {}) {
   return parts;
 }
 
+/**
+ * Prune blank text parts and run `cfg.captureFilters` over the ones that remain.
+ *
+ * One drop verdict is taken per turn, on the aggregate of its text parts; the
+ * individual parts are then rewritten with the substitutions only, so a rule can
+ * never both keep and drop the same turn. Tool call/result parts are carried
+ * through untouched — filters match conversation text, not tool payloads — but a
+ * turn dropped on its text takes its tool parts with it.
+ */
+export function filterCaptureParts(parts, role, cfg = {}) {
+  const kept = [];
+  for (const part of parts || []) {
+    if (!part) continue;
+    if (part.type !== "text") {
+      kept.push(part);
+      continue;
+    }
+    const text = typeof part.text === "string" ? part.text.trim() : "";
+    if (!text) continue;
+    kept.push(text === part.text ? part : { ...part, text });
+  }
+
+  const blank = { parts: kept, dropped: false };
+  const compiled = compileInputFilters(cfg?.captureFilters);
+  if (!compiled.rules.length || kept.length === 0) return blank;
+
+  const textParts = kept.filter((part) => part.type === "text");
+  if (textParts.length === 0) return blank;
+
+  const verdict = applyInputFilters(textParts.map((part) => part.text).join("\n\n"), compiled.rules, {
+    role,
+  });
+  if (verdict.dropped) return { parts: [], dropped: true };
+
+  const out = [];
+  for (const part of kept) {
+    if (part.type !== "text") {
+      out.push(part);
+      continue;
+    }
+    const shaped = applyInputFilters(part.text, compiled.rules, { role, substituteOnly: true });
+    if (!shaped.text) continue;
+    out.push(shaped.text === part.text ? part : { ...part, text: shaped.text });
+  }
+  return { parts: out, dropped: out.length === 0 };
+}
+
 export function extractCaptureTurns(rolloutEntries, cfg = {}) {
   const toolNameById = collectToolNamesByIdFromEntries(rolloutEntries);
   const turns = [];
@@ -371,14 +426,37 @@ export function extractCaptureTurns(rolloutEntries, cfg = {}) {
       toolMaxChars: cfg.captureToolMaxChars,
       toolNameById,
     });
-    const decision = shouldCaptureText(rawText, role, cfg);
-    if (!decision.shouldCapture && parts.length === 0) continue;
+    const shaped = filterCaptureParts(parts, role, cfg);
+    if (shaped.dropped) continue;
+    // With parts on the wire the drop decision was already taken above, so the
+    // text path only runs the filters for the `content` fallback. That also
+    // keeps `turn.text` faithful for callers that scan it for trigger words.
+    const decision = shouldCaptureText(rawText, role, cfg, { filters: shaped.parts.length === 0 });
+    if (!decision.shouldCapture && shaped.parts.length === 0) continue;
     const text = decision.shouldCapture ? decision.text : "";
-    turns.push({ role, text, parts });
+    turns.push({ role, text, parts: shaped.parts });
   }
   return turns;
 }
 
+/**
+ * Index of the last turn that came from a human prompt, or -1.
+ *
+ * `role === "user"` alone is not enough: normalizeCaptureRole() maps tool
+ * results onto the user role too, and those carry `tool` parts rather than
+ * `text` parts. Used by the post-compact shrink path to find where the current
+ * interaction starts.
+ */
+export function findLastHumanTurnIndex(turns) {
+  const list = Array.isArray(turns) ? turns : [];
+  for (let i = list.length - 1; i >= 0; i -= 1) {
+    const turn = list[i];
+    if (turn?.role !== "user") continue;
+    if (turn.parts?.some((part) => part?.type === "text")) return i;
+  }
+  return -1;
+}
+
 export function normalizeCaptureRole(role) {
   const value = normalizeType(role);
   if (value === "user") return "user";
@@ -457,12 +535,24 @@ function stripInjectedDigestBlocks(text) {
   return out.join("\n");
 }
 
+/**
+ * Drop everything in a turn that the conversation did not put there.
+ *
+ * Recall injects a context block into the prompt, and the host adds notes of
+ * its own; captured back unchanged, this turn's injection becomes next turn's
+ * memory and the loop feeds on itself. Formatting the conversation did author
+ * — newlines, code fences — survives.
+ */
 export function sanitizeCapturedText(text) {
   let value = String(text || "");
   value = value
     .replace(/\u0000/g, "")
     .replace(/<openviking-context\b[^>]*>[\s\S]*?<\/openviking-context>/gi, " ")
     .replace(/<relevant-memor(?:y|ies)\b[^>]*>[\s\S]*?<\/relevant-memor(?:y|ies)>/gi, " ")
+    // Claude Code wraps its own out-of-band notes to the model in these two
+    // shapes. They are the host talking to itself, not the conversation.
+    .replace(/<system-reminder\b[^>]*>[\s\S]*?<\/system-reminder>/gi, " ")
+    .replace(/^[ \t]*\[Subagent Context\][^\n]*$/gim, " ")
     .replace(/^\s*Sender\s*\([^)]+\)\s*```[\s\S]*?```\s*/gim, " ")
     .replace(/^\s*Conversation (?:metadata|info):\s*```[\s\S]*?```\s*/gim, " ")
     .replace(/^\s*\[?\d{4}-\d{2}-\d{2}[T ][^\]\n]{3,80}\]?\s*/gm, "")
@@ -486,12 +576,38 @@ function isPunctuationOnly(text) {
   return !/[a-z0-9\u3400-\u9fff]/i.test(text);
 }
 
-export function shouldCaptureText(text, role, cfg = {}) {
+/**
+ * Is capture on for this config?
+ *
+ * The switch has four spellings in the wild: a boolean `autoCapture`, opencode's
+ * `{ enabled }` object, dsh and pi's `syncTurns`, and the global `enabled`
+ * that turns the whole plugin off. Reading it here rather than in each loader
+ * is what keeps it from drifting a fifth time — and any spelling that says off
+ * wins, so a config that disables capture under an older name still disables it.
+ */
+export function isCaptureEnabled(cfg = {}) {
+  for (const value of [cfg.enabled, cfg.autoCapture, cfg.capture, cfg.syncTurns]) {
+    if (value === false) return false;
+    if (value && typeof value === "object" && !Array.isArray(value) && value.enabled === false) return false;
+  }
+  return true;
+}
+
+export function shouldCaptureText(text, role, cfg = {}, { filters = true } = {}) {
   const maxLength = cfg.captureMaxLength || 24000;
   const sanitized = sanitizeCapturedText(text);
   if (!sanitized) return { shouldCapture: false, reason: "empty", text: "" };
 
-  const capped = truncateCaptureText(sanitized, maxLength);
+  let capped = truncateCaptureText(sanitized, maxLength);
+  if (filters) {
+    const compiled = compileInputFilters(cfg?.captureFilters);
+    if (compiled.rules.length) {
+      const verdict = applyInputFilters(capped, compiled.rules, { role });
+      if (verdict.dropped) return { shouldCapture: false, reason: "filtered", text: "" };
+      capped = verdict.text;
+      if (!capped) return { shouldCapture: false, reason: "empty", text: "" };
+    }
+  }
   const compact = oneLine(capped);
   const isToolSummary = /^\[tool-(?:call|result)\b/i.test(compact);
 
@@ -513,3 +629,26 @@ export function shouldCaptureText(text, role, cfg = {}) {
 
   return { shouldCapture: true, reason: "ok", text: capped };
 }
+
+/**
+ * Apply the capture filter to a list of `{ role, content }` turns.
+ *
+ * The harnesses that compose `agent-hook-runtime` used to send whatever their
+ * transcript parser produced: an acknowledgement, a slash command, a stray
+ * `ok`, or a turn far past `captureMaxLength` all reached the extractor
+ * verbatim. This is the same decision every other harness makes, in one place,
+ * so a thin harness gets it by calling rather than by reimplementing it.
+ *
+ * Returns the surviving turns with `content` replaced by the sanitized and
+ * capped text, and the dropped ones with the reason, for the debug log.
+ */
+export function filterCaptureTurns(turns, cfg = {}) {
+  const kept = [];
+  const dropped = [];
+  for (const turn of Array.isArray(turns) ? turns : []) {
+    const decision = shouldCaptureText(turn?.content, turn?.role, cfg);
+    if (decision.shouldCapture) kept.push({ ...turn, content: decision.text });
+    else dropped.push({ role: turn?.role, reason: decision.reason });
+  }
+  return { kept, dropped };
+}