forget-connect 0.5.2 → 0.6.1

package/src/core.js

@@ -43,6 +43,19 @@ export const MEMORY_RULES = [
   RULES_END,
 ].join("\n");
 
+export const CODEX_MEMORY_RULES = [
+  RULES_START,
+  "# Memory (Forget)",
+  "You have the user's long-term memory via the `forget` MCP server.",
+  "At session start and on resume/continue requests, call `prepare_codex_context` once with a short query for the current work and the exact current working directory as `client_workdir`. Use only its project-bound results. If it returns `project_unresolved`, `empty`, or `unavailable`, continue without memory; do not fall back to generic autopilot or cross-project task state.",
+  "Whenever the user refers to their own past decisions, preferences, plans, people, or prior discussions, call `search_memories` FIRST. For project-specific history, prefer `prepare_codex_context(query, client_workdir)` so another project's state cannot enter the capsule.",
+  "Results may carry a `trust` label: green (user-stated or tool-observed) is safe to act on; yellow (agent-inferred or self-summarized) requires confirmation before real-world action; red is superseded; unlabeled is yellow.",
+  "When the user states a durable decision, preference, or lasting fact, save it with `add_memory`; use `source_role=\"user\"` only for the user's own words and check `get_event_status` before claiming the write completed. Never record a planned action as completed without evidence.",
+  "Use `supersede_memory` to retire a wrong fact and `confirm_memory` when evidence verifies a provisional claim. When a context trace materially influenced work, call `record_context_outcome` with the memory ids actually used or rejected.",
+  "Use `team_read` and `team_note` only for explicit agent collaboration, never as a substitute for personal memory.",
+  RULES_END,
+].join("\n");
+
 export class ConfigError extends Error {
   constructor(message) {
     super(message);
@@ -315,16 +328,16 @@ function removeRulesBlock(text, startMarker, endMarker) {
   return left || right;
 }
 
-export function installRules(raw, { migrateLegacy = true } = {}) {
+export function installRules(raw, { migrateLegacy = true, rules = MEMORY_RULES } = {}) {
   let next = raw;
   if (migrateLegacy) {
     next = removeRulesBlock(next, LEGACY_RULES_START, LEGACY_RULES_END);
   }
   const bounds = findManagedBlock(next, RULES_START, RULES_END);
   if (bounds) {
-    return next.slice(0, bounds.start) + MEMORY_RULES + next.slice(bounds.end);
+    return next.slice(0, bounds.start) + rules + next.slice(bounds.end);
   }
-  return next ? `${next}\n${MEMORY_RULES}\n` : `${MEMORY_RULES}\n`;
+  return next ? `${next}\n${rules}\n` : `${rules}\n`;
 }
 
 export function removeRules(raw) {
@@ -579,10 +592,10 @@ function rulesConnected(raw) {
   }
 }
 
-function rulesCurrent(raw) {
+function rulesCurrent(raw, rules = MEMORY_RULES) {
   try {
     const bounds = findManagedBlock(raw, RULES_START, RULES_END);
-    return Boolean(bounds && raw.slice(bounds.start, bounds.end) === MEMORY_RULES);
+    return Boolean(bounds && raw.slice(bounds.start, bounds.end) === rules);
   } catch {
     return false;
   }
@@ -602,7 +615,10 @@ export async function inspectClients(clients, { url = "", apiKey = "", urlFor =
         client,
         config: configConnected(client, configRaw),
         rules: client.rulesPath ? rulesConnected(rulesRaw) : null,
-        rulesCurrent: client.rulesPath ? rulesCurrent(rulesRaw) : null,
+        rulesCurrent: client.rulesPath ? rulesCurrent(
+          rulesRaw,
+          client.id === "codex" ? CODEX_MEMORY_RULES : MEMORY_RULES,
+        ) : null,
         ...expected,
       };
     }),
@@ -631,8 +647,8 @@ export async function buildPlan(
   }
   const changes = [];
   for (const client of clients) {
-    // urlFor lets connect scope each client into its own memory pool
-    // (/mcp/{app}/http/{user}) while everything else shares one plan.
+    // urlFor lets every provider share one vault scope while retaining its
+    // own query profile and provenance in the installed URL.
     const clientUrl = urlFor ? urlFor(client) : url;
     const configRaw = await readOptional(client.configPath);
     let configNext;
@@ -665,7 +681,10 @@ export async function buildPlan(
     if (client.rulesPath && installInstructionRules) {
       const rulesRaw = await readOptional(client.rulesPath);
       const rulesNext = action === "connect"
-        ? installRules(rulesRaw, { migrateLegacy })
+        ? installRules(rulesRaw, {
+          migrateLegacy,
+          rules: client.id === "codex" ? CODEX_MEMORY_RULES : MEMORY_RULES,
+        })
         : removeRules(rulesRaw);
       addChange(
         changes,

package/src/doctor.js

@@ -9,6 +9,29 @@ export const REQUIRED_TOOLS = [
   "record_context_outcome",
   "record_task_state",
   "get_task_state",
+  "catalog_search",
+  "product_quote",
+  "grant_create",
+  "agent_consult",
+  "receipt_verify",
+  "grant_revoke",
+];
+export const CODEX_REQUIRED_TOOLS = [
+  "prepare_codex_context",
+  "search_memories",
+  "add_memory",
+  "supersede_memory",
+  "confirm_memory",
+  "get_event_status",
+  "record_context_outcome",
+  "team_read",
+  "team_note",
+  "catalog_search",
+  "product_quote",
+  "grant_create",
+  "agent_consult",
+  "receipt_verify",
+  "grant_revoke",
 ];
 
 function addSensitiveValueVariants(variants, value) {

package/src/hooks.js

@@ -1,8 +1,7 @@
 // The hooks layer is the product thesis made real: memory that arrives
-// without being asked. Claude Code gets four harness hooks — a session-start
-// context capsule, per-turn push recall with conflict-zone alerts, and
-// session capture feeding the outcome flywheel. Other clients (Codex,
-// Desktop) rely on instruction rules until they grow hook systems.
+// without being asked. Claude Code and Codex share the same scripts and
+// ownership rules, while each receives only lifecycle events its client
+// actually emits. Desktop continues to rely on instruction rules.
 //
 // First rule of touching ~/.claude/settings.json: it is the user's file.
 // Foreign hooks (other tools register there too) must survive connect,
@@ -20,6 +19,7 @@ export const HOOK_SCRIPTS = [
   "forget_sessionstart.py",
   "forget_turnrecall.py",
   "forget_capture.py",
+  "forget_bstate.py", // compact structured working state shared by both clients
   "forget_project.py", // shared project-boundary detection (imported by the others)
   "forget_projecttag.py", // PreToolUse: stamps memory/task writes with the cwd's project
 ];
@@ -47,6 +47,9 @@ export function hooksDirFor(options = {}) {
 export function settingsPathFor(options = {}) {
   const env = options.env ?? process.env;
   const home = options.home ?? env.HOME ?? env.USERPROFILE ?? os.homedir();
+  if (options.clientId === "codex") {
+    return path.join(env.CODEX_HOME ?? path.join(home, ".codex"), "hooks.json");
+  }
   return path.join(home, ".claude", "settings.json");
 }
 
@@ -55,8 +58,8 @@ export function hookCommand(script, { hooksDir, url }) {
   return `FORGET_MCP_URL=${shellQuote(url)} python3 ${shellQuote(scriptPath)}`;
 }
 
-export function hookEntries({ hooksDir, url }) {
-  return {
+export function hookEntries({ hooksDir, url, clientId = "claude-code" }) {
+  const shared = {
     SessionStart: {
       command: hookCommand("forget_sessionstart.py", { hooksDir, url }),
       timeout: 12,
@@ -67,6 +70,23 @@ export function hookEntries({ hooksDir, url }) {
       timeout: 6,
       statusMessage: "forget: checking relevant memories",
     },
+  };
+  if (clientId === "codex") {
+    return {
+      ...shared,
+      SessionStart: {
+        ...shared.SessionStart,
+        matcher: "startup|resume|compact",
+      },
+      Stop: {
+        command: hookCommand("forget_capture.py", { hooksDir, url }),
+        timeout: 10,
+        statusMessage: "forget: capturing turn + outcome",
+      },
+    };
+  }
+  return {
+    ...shared,
     PreCompact: {
       command: hookCommand("forget_capture.py", { hooksDir, url }),
       timeout: 10,
@@ -127,10 +147,11 @@ function validatedHooks(config, label) {
   return hooks;
 }
 
-export function connectHooksSettings(raw, { hooksDir, url }) {
-  const config = parseJsonStrict(raw, "settings.json");
-  const hooks = validatedHooks(config, "settings.json");
-  for (const [event, entry] of Object.entries(hookEntries({ hooksDir, url }))) {
+export function connectHooksSettings(raw, { hooksDir, url, clientId = "claude-code" }) {
+  const label = clientId === "codex" ? "hooks.json" : "settings.json";
+  const config = parseJsonStrict(raw, label);
+  const hooks = validatedHooks(config, label);
+  for (const [event, entry] of Object.entries(hookEntries({ hooksDir, url, clientId }))) {
     const groups = withoutOurHooks(hooks[event] ?? []);
     const group = {
       hooks: [{
@@ -148,10 +169,11 @@ export function connectHooksSettings(raw, { hooksDir, url }) {
   return `${JSON.stringify(config, null, 2)}\n`;
 }
 
-export function disconnectHooksSettings(raw) {
-  const config = parseJsonStrict(raw, "settings.json");
+export function disconnectHooksSettings(raw, { clientId = "claude-code" } = {}) {
+  const label = clientId === "codex" ? "hooks.json" : "settings.json";
+  const config = parseJsonStrict(raw, label);
   if (config.hooks === undefined) return raw;
-  const hooks = validatedHooks(config, "settings.json");
+  const hooks = validatedHooks(config, label);
   let touched = false;
   for (const [event, groups] of Object.entries(hooks)) {
     const cleaned = withoutOurHooks(groups);
@@ -168,15 +190,19 @@ export function disconnectHooksSettings(raw) {
   return `${JSON.stringify(config, null, 2)}\n`;
 }
 
-export function hooksInstalled(raw, { hooksDir } = {}) {
+export function hooksInstalled(raw, { hooksDir, clientId = "claude-code" } = {}) {
   let config;
   try {
-    config = parseJsonStrict(raw, "settings.json");
+    config = parseJsonStrict(raw, clientId === "codex" ? "hooks.json" : "settings.json");
   } catch {
     return false;
   }
   if (!isObject(config.hooks)) return false;
-  const events = Object.keys(hookEntries({ hooksDir: hooksDir ?? "", url: "http://x" }));
+  const events = Object.keys(hookEntries({
+    hooksDir: hooksDir ?? "",
+    url: "http://x",
+    clientId,
+  }));
   return events.every((event) => {
     const groups = config.hooks[event];
     return Array.isArray(groups) && groups.some(
@@ -214,20 +240,23 @@ export async function installHookScripts(hooksDir) {
   return written;
 }
 
-export async function inspectHooks({ env } = {}) {
+export async function inspectHooks({ env, clientId = "claude-code" } = {}) {
   const hooksDir = hooksDirFor({ env });
-  const settingsPath = settingsPathFor({ env });
+  const settingsPath = settingsPathFor({ env, clientId });
   let settingsRaw = "";
   try {
     settingsRaw = await readFile(settingsPath, "utf8");
   } catch {
     settingsRaw = "";
   }
-  const registered = hooksInstalled(settingsRaw, { hooksDir });
+  const registered = hooksInstalled(settingsRaw, { hooksDir, clientId });
   let scriptsPresent = true;
+  let sendsKey = true;
   for (const script of HOOK_SCRIPTS) {
     try {
-      await readFile(path.join(hooksDir, script), "utf8");
+      const body = await readFile(path.join(hooksDir, script), "utf8");
+      // only scripts that call the server need the Bearer helper
+      if (body.includes("FORGET_MCP_URL") && !body.includes("_auth_headers")) sendsKey = false;
     } catch {
       scriptsPresent = false;
     }
@@ -238,6 +267,7 @@ export async function inspectHooks({ env } = {}) {
   return {
     registered,
     scripts_present: scriptsPresent,
+    sends_key: sendsKey,
     python3,
     // registered-but-broken is a failure; absent hooks are a legitimate
     // choice (--no-hooks), so they don't fail the check