@remembrance-ai/opencode-plugin 0.1.52 → 0.1.55

package/skills/remembrancer/references/remembrance-payloads.md

@@ -263,11 +263,13 @@ privately, then let an organization admin use the reviewed public-propagation
 flow for a redacted, public-safe version when appropriate.
 
 If host policy blocks repository-derived content before the request reaches
-Remembrance, do not retry it through another network transport. Use local MCP
+Remembrance, do not retry it through another network transport. Report the fixed
+content-free denial alert and do not create a handoff automatically. Only when
+an organization admin explicitly requests one, use local MCP
 `queue_private_skill_import` or the bundled
-`scripts/queue-private-skill-import.mjs` helper, then have an organization admin
-upload the mode-0600 JSON at **Dashboard > Skills > Import**. A local handoff is
-not a server submission receipt.
+`scripts/queue-private-skill-import.mjs` helper, then have the admin upload the
+mode-0600 JSON at **Dashboard > Skills > Import**. A local handoff is not a
+server submission receipt.
 
 ## New skill idea
 

package/skills/remembrancer/references/remembrance-setup.md

@@ -121,15 +121,18 @@ CODEX_CLI="${CODEX_CLI:-$(command -v codex || true)}"
 This command handles both first install and update. If zsh says
 "codex: command not found", it discovers the current ChatGPT desktop bundle or
 the legacy Codex app bundle without requiring a shell alias. The final command
-opens Codex CLI so its secure hook review can be completed immediately.
+opens Codex CLI so its secure hook review can be completed immediately when
+Codex requires it.
 
 Codex will not execute plugin hooks until their exact definitions are trusted.
-In the Codex window opened by the installer, choose **Review hooks** on the
-automatic **Hooks need review** screen and trust only the Remembrance
+In the Codex window opened by the installer, if Codex shows a **Hooks need
+review** screen, choose **Review hooks** and trust only the Remembrance
 `SessionStart`, `UserPromptSubmit`, `PostToolUse`, and `Stop` hooks.
-Changed hook definitions show the same review screen again; never use the
-automation-only trust bypass for normal installation. Exit that window, then
-fully restart Codex.
+If no review screen appears, continue: Codex may be reusing an existing valid
+trust decision. Changed hook definitions show the same review screen again;
+never use the automation-only trust bypass for normal installation. Fully
+restart Codex, submit one prompt, use one Remembrance tool, complete one turn,
+and run `run_connection_doctor`.
 
 OpenClaw:
 
@@ -187,10 +190,11 @@ Integrations & MCP**, and verify query, invocation, feedback, and contribution
 receipts in both local and cloud runs.
 
 After installing any native plugin, restart the agent app/session and approve
-the runtime's trust request. For Codex, complete the automatic hook review
-above; changed hook definitions show the same review screen again. A currently
-running Codex or Claude thread usually cannot hot-load newly installed plugin
-tools.
+the runtime's trust request when one appears. For Codex, complete the hook
+review above if Codex requests it; unchanged, previously trusted definitions
+may not show another review screen. Changed hook definitions show the review
+screen again. A currently running Codex or Claude thread usually cannot
+hot-load newly installed plugin tools.
 
 ## Enterprise/org key setup
 
@@ -347,7 +351,8 @@ The MCP annotation for `propose_private_skill` is non-read-only and
 closed-world: it makes a network request, but can change only the authenticated
 organization's private review queue and cannot change publicly visible internet
 state. Closed-world does not mean zero-network. Only
-`queue_private_skill_import` is the local, zero-network fallback.
+`queue_private_skill_import` is a local, zero-network handoff tool, and it
+should run only when an organization admin explicitly requests that handoff.
 
 Example text to merge into the tenant-specific guardian policy:
 
@@ -382,12 +387,14 @@ over a user's local `[auto_review].policy`. See the official Codex
 [managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration#configure-automatic-review-policy)
 documentation for the current schema and deployment options.
 
-If the organization does not approve direct egress, keep the host denial. Use
-`queue_private_skill_import` locally, or run the bundled
-`scripts/queue-private-skill-import.mjs` helper, then have an organization
-admin upload the mode-0600 JSON at **Dashboard > Skills > Import**. The handoff
-never contains an API key or organization id, never contacts Remembrance, and
-does not count as submitted until the dashboard returns an import batch receipt.
+If the organization does not approve direct egress, keep the host denial. The
+plugin reports one content-free local alert, does not retry, and does not create
+a handoff automatically. Only when an organization admin explicitly requests a
+handoff, use `queue_private_skill_import` locally or run the bundled
+`scripts/queue-private-skill-import.mjs` helper, then have the admin upload the
+mode-0600 JSON at **Dashboard > Skills > Import**. The handoff never contains an
+API key or organization id, never contacts Remembrance, and does not count as
+submitted until the dashboard returns an import batch receipt.
 
 If Codex still sees `<your org key>` after restart, remove stale
 `REMEMBRANCE_API_KEY` exports from shell profiles such as `~/.zshrc` and
@@ -776,6 +783,17 @@ npx skills add dreamarkinc/remembrance-skills --skill remembrancer
 The entry skill is REST-only and self-contained. The same skill directory can
 be copied to ".agents/skills/remembrancer/SKILL.md" for compatible providers.
 
+## Verified client updates
+
+Native plugins and local MCP check the credential-free public release manifest
+at startup and through `run_connection_doctor`. The check sends no API key,
+fails open when the registry is unavailable, and never runs a command returned
+by the network. When a newer verified release exists, the agent must ask before
+running the update command bundled with its installed client, then tell the user
+which Codex, Claude Code, Cursor, OpenClaw, VS Code, OpenCode, or MCP host must
+be reloaded, reopened, or fully restarted. Set
+`REMEMBRANCE_CLIENT_UPDATE_CHECK=0` to disable only this advisory check.
+
 ## Validate after setup
 
 1. Start a fresh agent session.
@@ -830,10 +848,12 @@ be copied to ".agents/skills/remembrancer/SKILL.md" for compatible providers.
    that should not appear anonymously.
 13. With an organization submission key, submit one disposable redacted skill
    through propose_private_skill and verify it appears only in that
-   organization's review queue. If host policy denies the export, run
-   queue_private_skill_import instead, upload its JSON in the dashboard, and
-   verify the agent reports a local queue receipt separately from the server
-   import receipt.
+   organization's review queue. In a separate negative scenario, simulate a
+   host-policy denial and verify the plugin reports the fixed content-free alert
+   once, persists no blocked content, performs no retry, and creates no handoff.
+   Test queue_private_skill_import only as a separate administrator-requested
+   manual handoff, with its local receipt distinguished from a server import
+   receipt.
 14. If using local MCP, verify local_signing_identity in get_connection_status.
    A missing opaque identity initializes automatically on the first signed
    contribution; bootstrap_agent_identity with no arguments is an optional
@@ -843,10 +863,13 @@ be copied to ".agents/skills/remembrancer/SKILL.md" for compatible providers.
 
 - "Plugin installed, but no tools": restart the agent app/session; confirm the
   plugin is enabled and contains the runtime-specific manifest. For Codex,
-  launch the installer-provided command, choose **Review hooks** on the
-  automatic review screen, and trust only the listed Remembrance hooks. Exit
-  that window and fully restart Codex; updates that change hooks show the same
-  review screen again.
+  launch the installer-provided command. If Codex shows a hook review, choose
+  **Review hooks** and trust only the listed Remembrance hooks; if it does not,
+  continue because Codex may be reusing an existing valid trust decision.
+  Fully restart Codex, submit one prompt, use one Remembrance tool, complete one
+  turn, and run `run_connection_doctor`. If the lifecycle remains incomplete,
+  update or reinstall the plugin and repeat the check. Updates that change
+  hooks show the review screen again.
 - "Agent has tools but does not use them": first verify a concrete query receipt,
   then test a short contextual follow-up such as "fix these issues". Native
   prompt hooks should inject a full-conversation query reminder, and completion

package/src/index.mjs

@@ -37,6 +37,8 @@
 import { readFileSync } from "node:fs";
 import process from "node:process";
 import {
+  HOST_POLICY_ALERT_TEXT,
+  checkForClientUpdate,
   clearHighMatchSurfaceForExplicitSelection,
   clearHighMatchSurfaceIfOpened,
   debugLog,
@@ -44,11 +46,13 @@ import {
   directSelectionFromResponse,
   highMatchFromResponse,
   markCurrentEngagementHandled,
+  markHostPolicyAlertDelivered,
   recordDirectiveFollowThroughForTool,
   recordDirectSelectionSurface,
   recordDirectiveSurface,
   recordHighMatchSurface,
   recordPluginLifecycleHealth,
+  recordHostPolicyDenial,
   recordRegistryUse,
   recordTaskEligibility,
   recordValueEpisodeSurface,
@@ -182,6 +186,12 @@ export function toolNameFromEvent(input, output) {
     input?.toolName,
     output?.tool,
     output?.toolName,
+    input?.properties?.tool,
+    input?.properties?.toolName,
+    input?.properties?.permission,
+    output?.properties?.tool,
+    output?.properties?.toolName,
+    output?.properties?.permission,
   ]) {
     if (typeof candidate === "string" && candidate.trim()) {
       return candidate;
@@ -221,11 +231,36 @@ export const Remembrance = async (context = {}) => {
   const queriedMessages = new Set();
   const messageSessions = new Map();
   const pendingGuidance = new Map();
+  const pendingClientUpdates = new Map();
   const userMessages = new Map();
   const pendingTextParts = new Map();
 
+  async function observeHostPolicyDenial({
+    eventType,
+    sessionId,
+    toolName,
+    value,
+  }) {
+    const observation = recordHostPolicyDenial(
+      {
+        surface: SURFACE,
+        sessionId,
+        eventType,
+        toolName,
+        value,
+        pluginVersion: version,
+      },
+      env,
+    );
+    if (!observation) return false;
+    await notify(client, HOST_POLICY_ALERT_TEXT, "error");
+    markHostPolicyAlertDelivered(SURFACE, sessionId, observation.id, env);
+    return true;
+  }
+
   function clearSessionState(sessionId) {
     pendingGuidance.delete(sessionId);
+    pendingClientUpdates.delete(sessionId);
     for (const [messageId, trackedSessionId] of messageSessions) {
       if (trackedSessionId !== sessionId) continue;
       messageSessions.delete(messageId);
@@ -265,10 +300,24 @@ export const Remembrance = async (context = {}) => {
     try {
       const sessionId = sessionIdFromEvent(event, event);
       recordLifecycle("session_start", sessionId);
+      const clientUpdate = await (
+        context.clientUpdateCheck ?? checkForClientUpdate
+      )(
+        {
+          surface: SURFACE,
+          currentVersion: version,
+        },
+        env,
+      ).catch(() => null);
+      if (clientUpdate?.notice) {
+        pendingClientUpdates.set(sessionId, clientUpdate.notice);
+      }
       await notify(
         client,
-        `Remembrance ${version} is active. Relevant memory is added before eligible turns; ` +
-          "run_connection_doctor verifies the active connection and gives one exact next step without exposing the key.",
+        clientUpdate?.latest_version
+          ? `Remembrance ${version} is active; ${clientUpdate.latest_version} is available. The agent will ask before updating, and the host must be restarted afterward.`
+          : `Remembrance ${version} is active. Relevant memory is added before eligible turns; ` +
+              "run_connection_doctor verifies the active connection and gives one exact next step without exposing the key.",
       );
     } catch (error) {
       debugLog(env, "opencode_session_created_failed", {
@@ -334,7 +383,13 @@ export const Remembrance = async (context = {}) => {
     try {
       const sessionId = sessionIdFromEvent(input, output);
       const guidance = pendingGuidance.get(sessionId);
-      if (!guidance || !Array.isArray(output?.system)) return;
+      const updateNotice = pendingClientUpdates.get(sessionId);
+      if (!Array.isArray(output?.system)) return;
+      if (updateNotice) {
+        output.system.push(updateNotice);
+        pendingClientUpdates.delete(sessionId);
+      }
+      if (!guidance) return;
       output.system.push(guidance.text);
       pendingGuidance.delete(sessionId);
       // Delivery happened: only now is the guidance actually in the model's
@@ -453,6 +508,22 @@ export const Remembrance = async (context = {}) => {
           await handleSessionIdle(event);
           return;
         }
+        if (
+          event.type === "permission.replied" ||
+          event.type === "session.error"
+        ) {
+          const serialized = JSON.stringify(event);
+          const inferredTool = /remembrance/i.test(serialized)
+            ? toolNameFromEvent(event, event) || "remembrance"
+            : toolNameFromEvent(event, event);
+          await observeHostPolicyDenial({
+            eventType: event.type,
+            sessionId: sessionIdFromEvent(event, event),
+            toolName: inferredTool,
+            value: event,
+          });
+          return;
+        }
         if (event.type === "session.deleted") {
           clearSessionState(sessionIdFromEvent(event, event));
         }
@@ -468,11 +539,19 @@ export const Remembrance = async (context = {}) => {
     "tool.execute.after": async (input, output) => {
       try {
         const sessionId = sessionIdFromEvent(input, output);
-        recordLifecycle("tool_observer", sessionId);
         const tool = toolNameFromEvent(input, output);
         if (!tool) return;
         const normalizedTool = tool.toLowerCase();
-        if (toolResponseIndicatesFailure(output)) return;
+        if (toolResponseIndicatesFailure(output)) {
+          await observeHostPolicyDenial({
+            eventType: "tool.execute.after",
+            sessionId,
+            toolName: tool,
+            value: output,
+          });
+          return;
+        }
+        recordLifecycle("tool_observer", sessionId);
         if (normalizedTool.endsWith("query_skills")) {
           if (queryResponseHasMatches(output)) {
             recordRegistryUse(sessionId, env);