memoryrouter-codex 1.6.1 → 1.8.0

package/README.md

@@ -2,29 +2,39 @@
 
 Native Codex integration for durable MemoryRouter memory. It uses Codex's current MCP, lifecycle hooks, and `AGENTS.md` surfaces rather than pretending that model-selected MCP calls alone are automatic memory.
 
-> **Release status:** `memoryrouter-codex@1.1.0` is the published npm release. Its automatic capture is message-only: one user request plus the final assistant response, with no tool payloads.
+> **Release status:** `memoryrouter-codex` is the published npm release. Its automatic capture is message-only: one user request plus the final assistant response, with no tool payloads.
 
 ## What this integration does
 
+Every turn, automatically: **recall before the prompt, save after the turn.** What is saved is exactly two things per turn, the user's message and the assistant's final response. Tool calls, tool output, reasoning, plans, intermediate assistant messages and subagent output are never saved.
+
 | Layer | Behavior |
 | --- | --- |
-| `UserPromptSubmit` hook | Searches MemoryRouter before every prompt and injects bounded, project-scoped context as developer context. |
-| `Stop` hook | Captures only the user request and final assistant response after each completed turn. Tool names, inputs, and results are excluded. |
-| `SubagentStop` hook | Captures the stable final outcome of completed subagents without parsing their unstable transcript files. |
-| `PreCompact` / compact `SessionStart` | Checkpoints only the current user request and final assistant response when present, then recalls context before Codex continues after compaction. |
-| `SessionEnd` | Best-effort message-only final checkpoint within Codex's three-second SessionEnd budget. |
-| Remote MCP | OAuth-based explicit search/store through `https://mcp.memoryrouter.ai/mcp`. |
-| Local MCP fallback | API-key-authenticated stdio tools with strict project filtering, handles, local suppression, status, and full-vault clear confirmation. |
+| `UserPromptSubmit` hook | Searches your whole MemoryRouter vault with the prompt and injects what it finds as developer context for that turn. The vault is shared with Claude Code and every other MemoryRouter surface. Records the prompt for this turn. |
+| `Stop` hook | Saves the user's message and the final assistant response for the turn. Nothing else. |
+| `SessionStart` hook | Restores context after Codex compacts a long chat (key mode also on new/resumed chats). |
+| `SessionEnd` (key mode) | Only if the last turn never finished (interrupted), saves that turn's user message. A completed turn is never saved twice. |
+| Remote MCP | OAuth-based explicit search/store through `https://mcp.memoryrouter.ai/mcp` (`search_memories`, `store_memory`, ...). |
+| Local MCP fallback | API-key-authenticated stdio tools over the same whole vault. |
 | `AGENTS.md` | Tells Codex when to recall/store and how MemoryRouter coexists with native Memories. |
 
-MemoryRouter is the **cross-machine, cross-tool, team-shareable, and auditable** layer. Codex's native Memories remain useful as an automated local personal recall layer.
+**Two ways the hooks reach MemoryRouter (1.8.0):**
+
+- **Over your MemoryRouter sign-in (no API key).** Default when you signed in with OAuth (Codex app Settings > Plugins > Authenticate, or `codex mcp login memoryrouter`) and no key is configured. The hooks are Codex `mcp_tool` hooks that call hidden lifecycle tools on the already-connected `memoryrouter` server (`codex_turn_start`, `codex_turn_end`, `codex_session_start`) with your OAuth token and the vault you picked when you signed in. Nothing secret is written to disk.
+- **Local runtime with a Memory Key.** Used when a key is configured (`MEMORYROUTER_API_KEY`, `--api-key-stdin`, or `memoryrouter-claude`'s `~/.memoryrouter/config.json`). Same per-turn behavior.
+
+Force either with `--hooks-via mcp` or `--hooks-via command`.
+
+1.8.0 removed the `SubagentStop` and `PreCompact` capture hooks: subagent output is intermediate work, and the PreCompact checkpoint re-saved a prompt the `Stop` hook already captured.
+
+MemoryRouter is the **cross-machine, cross-tool, team-shareable, and auditable** layer: one memory across every session, repo and tool, shared by Codex, Claude Code, ChatGPT, and Claude. Codex's native Memories remain useful as an automated local personal recall layer.
 
 ## Requirements and supported surfaces
 
 - Node.js 18 or newer.
 - **Codex 0.145.0 or newer** for the complete lifecycle-hook integration. Version 0.146.0 was tested directly.
 - Local Codex CLI, ChatGPT desktop app's local Codex host, and Codex IDE extension share `config.toml` MCP configuration.
-- User/project hooks require the Codex host to support and trust command hooks. Use `/hooks` to review them.
+- Hooks must be trusted once: Codex app **Settings > Hooks**, or `/hooks` in the CLI. OAuth (`mcp_tool`) hooks need a Codex build with MCP tool hooks (the current app and CLI 0.166 have them).
 - Project `.codex` config is loaded only for trusted projects.
 - ChatGPT web does **not** read a laptop's `~/.codex/config.toml` or local hooks. Use MemoryRouter's hosted plugin/connector surface there.
 - Codex cloud environments do not automatically inherit host-local user config or secrets. A project-scope install can travel with a repository, but the environment still needs Node, project trust, package/network availability for the stdio fallback, and `MEMORYROUTER_API_KEY` for hooks.
@@ -33,19 +43,40 @@ There is no dependency on the obsolete `experimental_use_rmcp_client` setting in
 
 ## Install
 
-### Recommended: remote OAuth MCP plus automatic hooks
+### Codex app (Mac): two steps, no key
+
+1. Add the server in the app: **Settings > Plugins > Add > Add MCP server**, Type **Streamable HTTP**, Name `memoryrouter`, URL `https://mcp.memoryrouter.ai/mcp`, **Save**, then **Authenticate** and sign in (or create an account) in the browser tab that opens.
+2. In a Codex chat, paste:
+
+   > Run `npx -y memoryrouter-codex@latest init` with network access, then tell me to trust the MemoryRouter hooks in Settings > Hooks.
+
+   Then trust the three MemoryRouter hooks in **Settings > Hooks** and open a **New chat**.
+
+`init` keeps the server the app added (and its sign-in), adds the three `mcp_tool` hooks to `~/.codex/hooks.json` and the MemoryRouter guidance to `~/.codex/AGENTS.md`. The Codex CLI and IDE extension on the same Mac share all of it.
+
+### Codex CLI, OAuth (no key)
 
-Obtain a MemoryRouter memory key from your account. Pass it on stdin so it does not appear in shell history:
+```bash
+npx -y memoryrouter-codex init --scope user
+codex mcp login memoryrouter
+npx -y memoryrouter-codex doctor --scope user
+```
+
+Then start Codex, trust the MemoryRouter hooks in `/hooks`, and check `/mcp verbose`.
+
+### With a Memory Key (local hook runtime)
+
+Pass the key on stdin so it does not appear in shell history:
 
 ```bash
 printf '%s' "$MEMORYROUTER_API_KEY" | \
-  npx -y memoryrouter-codex@1.1.0 init --scope user --auth oauth --api-key-stdin
+  npx -y memoryrouter-codex init --scope user --auth oauth --api-key-stdin
 
 codex mcp login memoryrouter
 memoryrouter-codex doctor --scope user
 ```
 
-Then start Codex and inspect:
+Then start Codex and inspect (trust the MemoryRouter hook definitions in `/hooks`):
 
 ```text
 /mcp verbose
@@ -54,14 +85,16 @@ Then start Codex and inspect:
 
 The API key is written to `~/.memoryrouter/codex/config.json` with mode `0600`; the directory is `0700`. It is never written to `config.toml`, `hooks.json`, `AGENTS.md`, or a repository.
 
-If you prefer not to persist the key, omit `--api-key-stdin` and ensure `MEMORYROUTER_API_KEY` is in the environment of the Codex host. Without either source, remote OAuth MCP tools can work after login, but automatic hooks intentionally become no-op/fail-open.
+Already using MemoryRouter in Claude Code? When no Codex key is configured, the hooks reuse the `memoryrouter-claude` key in `~/.memoryrouter/config.json`, so both agents use the same vault (one memory for every session, repo and tool) with no second paste. Key precedence: `MEMORYROUTER_API_KEY`, then the Codex private config, then the Claude Code config.
+
+If you prefer not to persist the key, omit `--api-key-stdin` and ensure `MEMORYROUTER_API_KEY` is in the environment of the Codex host. Without any key, `init` installs the OAuth (`mcp_tool`) hooks instead, which work as soon as you are signed in.
 
 ### Project scope
 
 ```bash
 cd /path/to/repository
 printf '%s' "$MEMORYROUTER_API_KEY" | \
-  npx -y memoryrouter-codex@1.1.0 init --scope project --auth oauth --api-key-stdin
+  npx -y memoryrouter-codex init --scope project --auth oauth --api-key-stdin
 codex mcp login memoryrouter
 ```
 
@@ -71,7 +104,7 @@ This writes managed blocks/files under the repository's `AGENTS.md` and `.codex/
 
 ```bash
 printf '%s' "$MEMORYROUTER_API_KEY" | \
-  npx -y memoryrouter-codex@1.1.0 init --scope user --auth api-key --api-key-stdin
+  npx -y memoryrouter-codex init --scope user --auth api-key --api-key-stdin
 ```
 
 This uses a local stdio MCP server and the MemoryRouter API. It does not put the memory key in Codex config. The fallback tools are:
@@ -110,25 +143,27 @@ The installer preserves unrelated TOML byte-for-byte outside its managed block.
 
 Hooks are merged into `hooks.json`; foreign hooks remain. Re-running `init` upgrades/replaces only MemoryRouter-owned handlers. `uninstall` removes only owned handlers and managed blocks.
 
-## Project identity and scoping
+## One vault per user (shared with Claude Code and every MemoryRouter surface)
+
+Since **1.7.0**, every hook call (recall before each prompt, capture after each turn, compaction checkpoints, post-compaction recall) and every local MCP tool call reads and writes your **whole vault**. No `session_id` is sent, so there is no per-session or per-repository partition. That gives you:
 
-The runtime computes:
+- **A new Codex session recalls earlier sessions**, in this repository and every other one.
+- **Codex and Claude Code share one memory.** A decision captured in Claude Code in repo A is recalled by Codex in repo B, and the other way round (requires `memoryrouter-claude` 2.7.0 or newer on the same vault).
+- **Everything else on the vault is recalled too:** saves from the hosted MCP (`store_memory` from ChatGPT, Claude, or `codex mcp login`), consolidated reflections, the server's pending buffer, and Codex envelopes from any release. Only handles you suppressed locally with `memory_forget` are hidden.
+
+**Repository tag.** Codex still computes the same `ccp_` id as Claude Code:
 
 ```text
-proj_<first 20 hex chars of SHA-256(canonical project identity)>
+ccp_<first 24 hex chars of SHA-256(canonical project identity)>
 ```
 
-Identity preference:
-
-1. Canonical `origin` git URL, with credentials removed and `.git` normalized.
-2. Git common directory (so local worktrees share a project).
-3. Absolute path fallback.
+from, in order, an explicit id (`MEMORYROUTER_PROJECT_ID` or `projectId` in `.memoryrouter.json`), the normalized git remote, the git common directory, then the directory path. It is metadata only: Codex stamps it on the turns it saves and labels recalled entries from the current repository as `this repo`. It never limits what is recalled. Only the opaque hash leaves the machine.
 
-Only the opaque handle is stored remotely. Local paths are not sent as identity metadata. A canonical remote makes identity stable across worktrees and machines.
+**One user, one vault.** When you also connect MemoryRouter over OAuth (`codex mcp login memoryrouter`, ChatGPT, Claude), pick the same vault your hook key belongs to. `init` asks `https://auth.memoryrouter.ai/v1/vault-binding` whether the hook key is the vault your OAuth connections selected: on a mismatch it stops before writing anything and names the selected vault; with no connection yet it tells you which vault to pick at login. `doctor` reports the same `one-vault` check. The response never contains a key.
 
-Automatic memories use an envelope containing project handle, stable memory handle, kind, and capture time. Retrieval requests extra semantic candidates and then **strictly filters** to the current project handle before context injection. Legacy/unscoped vault records remain available through explicit remote MCP search but are not automatically injected in project mode.
+`.memoryrouterignore` (or `enabled: false` in `.memoryrouter.json`) still disables hooks for a repository. The pre-1.7 settings `retrievalScope`, `includeGlobal`, and `memoryScope` are ignored and removed from the private config.
 
-Set `retrievalScope` to `"vault"` in the private config only if you intentionally want unscoped automatic recall.
+**Upgrading from 1.6.x.** Releases before 1.7.0 used a per-Codex-session partition (`mrcodex:<project>:<session>`), so every new session started empty and Codex never saw Claude Code's memory. When 1.7.0 shipped, those partitions (and `memoryrouter-claude`'s per-repository `ccp_` partitions) were moved into each vault's main memory server-side, with stored embeddings kept, exact repeats skipped, and unflushed buffers saved, so old memories are recalled again with nothing lost or duplicated. Re-run `init` to upgrade the installed runtime.
 
 ## Historical import (agent-driven)
 
@@ -222,15 +257,15 @@ Doctor checks Codex version, managed config, runtime version, hook count, `AGENT
 Upgrade idempotently by re-running the pinned/new package:
 
 ```bash
-npx -y memoryrouter-codex@1.1.0 init --scope user
+npx -y memoryrouter-codex init --scope user
 ```
 
 Uninstall:
 
 ```bash
-npx -y memoryrouter-codex@1.1.0 uninstall --scope user
+npx -y memoryrouter-codex uninstall --scope user
 # or
-npx -y memoryrouter-codex@1.1.0 uninstall --scope project --project-dir /repo
+npx -y memoryrouter-codex uninstall --scope project --project-dir /repo
 ```
 
 Uninstall deliberately retains `~/.memoryrouter/codex/` because another project installation may use the credentials and local suppression state. Delete that private directory manually only when no integration uses it.
@@ -242,7 +277,7 @@ Uninstall deliberately retains `~/.memoryrouter/codex/` because another project
 - Tool-call records are intentionally excluded. MemoryRouter does not store tool names, tool IDs, tool inputs, tool results, commands, patches, or other `PostToolUse` payloads from automatic Codex capture. Important outcomes must appear in the final assistant response to be retained.
 - Some specialized tool paths can opt out of hooks. Codex documents hooks as a useful extension surface, not a complete enforcement boundary.
 - SessionEnd can happen after a 30-minute idle period and has a three-second maximum. It is a best-effort checkpoint; normal `Stop` capture is the primary write path.
-- Project scoping is strict for this package's automatic retrieval/local MCP. The existing hosted remote MCP server has no first-class project argument, so use local tools/hooks when cross-project isolation is required.
+- Everything shares one vault per user. Strict isolation between two bodies of work requires a separate account and vault.
 - Per-memory server deletion is not available through the current API. Local suppression and explicit full-vault clear are accurately labeled.
 - API-level idempotency is not yet available; timeout-after-acceptance duplicates remain possible.
 

package/bin/cli.cjs

@@ -23,7 +23,7 @@ function parseArgs(argv) {
 }
 
 function usage() {
-  return `memoryrouter-codex ${INTEGRATION_VERSION}\n\nUsage:\n  memoryrouter-codex init [--scope user|project] [--auth oauth|api-key]\n                          [--project-dir PATH] [--api-key-stdin]\n                          [--no-hooks] [--no-agents]\n  memoryrouter-codex doctor [--scope user|project] [--project-dir PATH] [--offline]\n  memoryrouter-codex uninstall [--scope user|project] [--project-dir PATH]\n  memoryrouter-codex reflect [--tier 1|2] [--batches N|all] [--max-tokens N] [--dry-run]\n  memoryrouter-codex import [--instructions [--run]] [--file PATH] [--dismiss] [--yes]\n  memoryrouter-codex mcp-server\n\nImport:\n  Import historical Codex conversations into your vault. --instructions\n  fetches the server's extraction prompt for the host agent to execute\n  (--run spawns it via codex exec); --file uploads a JSONL extract with a\n  preview, price quote, explicit approval (--yes for non-interactive),\n  idempotent batches, and resume; --dismiss silences the import nudge\n  permanently. Re-running --file is always safe: committed batches replay\n  for free and duplicates are never re-billed.\n\nReflect:\n  Consolidates unconsolidated memories into reflections using Codex itself as\n  the model (codex exec, you pay your own inference). Server-authored\n  instructions; resumable; no local state. --dry-run prints the checkout and\n  lets the lease expire without committing.\n  Automatic mode: when the server reports consolidation debt above its\n  threshold, the hooks spawn this same loop in the background (max 3 batches\n  per trigger, 30 minute cooldown, machine-wide lockfile at\n  ~/.memoryrouter/consolidate.lock). Opt out with "autoConsolidate": false in\n  ~/.memoryrouter/codex/config.json. Logs: ~/.memoryrouter/consolidate.log\n\nAuth modes:\n  oauth    Current remote MCP at ${'https://mcp.memoryrouter.ai/mcp'} (default).\n           Run \`codex mcp login memoryrouter\` after init. Hooks additionally\n           require MEMORYROUTER_API_KEY or a key saved with --api-key-stdin.\n  api-key  Local stdio MCP fallback plus automatic hooks. The key is read only\n           from the environment/private config, never from project files.\n\nSecure key setup:\n  printf '%s' "$MEMORYROUTER_API_KEY" | memoryrouter-codex init --api-key-stdin\n`;
+  return `memoryrouter-codex ${INTEGRATION_VERSION}\n\nUsage:\n  memoryrouter-codex init [--scope user|project] [--auth oauth|api-key]\n                          [--project-dir PATH] [--api-key-stdin]\n                          [--hooks-via mcp|command] [--no-hooks] [--no-agents]\n  memoryrouter-codex doctor [--scope user|project] [--project-dir PATH] [--offline]\n  memoryrouter-codex uninstall [--scope user|project] [--project-dir PATH]\n  memoryrouter-codex reflect [--tier 1|2] [--batches N|all] [--max-tokens N] [--dry-run]\n  memoryrouter-codex import [--instructions [--run]] [--file PATH] [--dismiss] [--yes]\n  memoryrouter-codex mcp-server\n\nImport:\n  Import historical Codex conversations into your vault. --instructions\n  fetches the server's extraction prompt for the host agent to execute\n  (--run spawns it via codex exec); --file uploads a JSONL extract with a\n  preview, price quote, explicit approval (--yes for non-interactive),\n  idempotent batches, and resume; --dismiss silences the import nudge\n  permanently. Re-running --file is always safe: committed batches replay\n  for free and duplicates are never re-billed.\n\nReflect:\n  Consolidates unconsolidated memories into reflections using Codex itself as\n  the model (codex exec, you pay your own inference). Server-authored\n  instructions; resumable; no local state. --dry-run prints the checkout and\n  lets the lease expire without committing.\n  Automatic mode: when the server reports consolidation debt above its\n  threshold, the hooks spawn this same loop in the background (max 3 batches\n  per trigger, 30 minute cooldown, machine-wide lockfile at\n  ~/.memoryrouter/consolidate.lock). Opt out with "autoConsolidate": false in\n  ~/.memoryrouter/codex/config.json. Logs: ~/.memoryrouter/consolidate.log\n\nAuth modes:\n  oauth    Current remote MCP at ${'https://mcp.memoryrouter.ai/mcp'} (default).\n           Sign in once (Codex app: Settings > Plugins > Authenticate; CLI:\n           \`codex mcp login memoryrouter\`). With no API key, the automatic\n           hooks call MemoryRouter over that same sign-in (Codex mcp_tool\n           hooks): recall before every prompt, save the prompt and the final\n           response after every turn. No key on disk. If a key is configured\n           (MEMORYROUTER_API_KEY, --api-key-stdin, or memoryrouter-claude's\n           ~/.memoryrouter/config.json) the local hook runtime is used\n           instead; force either with --hooks-via mcp|command.\n           A server you already added in the Codex app is kept as is.\n  api-key  Local stdio MCP fallback plus automatic hooks. The key is read only\n           from the environment/private config, never from project files.\n\nSecure key setup:\n  printf '%s' "$MEMORYROUTER_API_KEY" | memoryrouter-codex init --api-key-stdin\n`;
 }
 
 function optionsFromArgs(args) {
@@ -35,6 +35,7 @@ function optionsFromArgs(args) {
     agents: args.agents,
     force: Boolean(args.force),
     offline: Boolean(args.offline),
+    ...(args.hooksVia ? { hookMode: String(args.hooksVia) } : {}),
   };
   if (args.apiKeyStdin) {
     options.apiKey = fs.readFileSync(0, 'utf8').trim();
@@ -111,14 +112,40 @@ async function main() {
   }
   const options = optionsFromArgs(args);
   if (command === 'init') {
+    // One user = one vault: before writing anything, make sure the Memory Key
+    // the hooks will use is the vault selected in OAuth (codex mcp login).
+    const { loadConfig, getApiKey } = require('../runtime/config.cjs');
+    const { checkVaultBinding, vaultLabel, VaultMismatchError } = require('../runtime/vault-binding.cjs');
+    const hookKey = options.apiKey || getApiKey(process.env, loadConfig(process.env));
+    let binding = null;
+    if (hookKey && !options.offline) {
+      binding = await checkVaultBinding(hookKey);
+      if (binding.status === 'mismatch') throw new VaultMismatchError(binding);
+    }
     const result = init(options);
-    process.stdout.write(`MemoryRouter Codex ${INTEGRATION_VERSION} installed (${result.layout.scope}, ${result.auth}).\n`);
-    process.stdout.write(`  config: ${result.layout.configFile}\n`);
+    process.stdout.write(`MemoryRouter Codex ${INTEGRATION_VERSION} installed (${result.layout.scope}, ${result.auth}${result.hookMode === 'mcp' ? ', hooks over your MemoryRouter sign-in' : ''}).\n`);
+    process.stdout.write(`  config: ${result.layout.configFile}${result.adoptedServer ? ` (kept your existing "${result.adoptedServer}" server)` : ''}\n`);
     if (options.hooks !== false) process.stdout.write(`  hooks:  ${result.layout.hooksFile}\n`);
     if (options.agents !== false) process.stdout.write(`  guide:  ${result.layout.agentsFile}\n`);
-    if (result.auth === 'oauth') process.stdout.write('\nNext: codex mcp login memoryrouter\nThen open Codex and run /mcp verbose and /hooks.\n');
-    if (!result.automaticMemory) process.stdout.write('\nRemote MCP tools are configured, but automatic hooks are fail-open/no-op until MEMORYROUTER_API_KEY is available or init is re-run with --api-key-stdin.\n');
-    process.stdout.write('\nRun: memoryrouter-codex doctor\n');
+    if (binding && binding.status === 'match') process.stdout.write(`\nVault check: the hooks use the same vault you selected in OAuth, ${vaultLabel(binding)}.\n`);
+    else if (binding && binding.status === 'mixed') process.stdout.write(`\nVault check: ${binding.message}\n`);
+    else if (binding && binding.status === 'unknown') process.stdout.write(`\nVault check skipped (${binding.message}). Run doctor later to confirm one vault.\n`);
+    if (result.hookMode === 'mcp') {
+      process.stdout.write('\nAutomatic memory: before every prompt Codex searches your vault and adds what it finds as context; after every turn it saves your message and its final response (never tool calls, tool output or intermediate steps). No API key needed.\n');
+      process.stdout.write('\nNext:\n');
+      if (!result.adoptedServer) process.stdout.write('  1. Sign in: Codex app Settings > Plugins > memoryrouter > Authenticate (or run: codex mcp login memoryrouter)\n');
+      process.stdout.write(`  ${result.adoptedServer ? '1' : '2'}. Trust the MemoryRouter hooks once: Codex app Settings > Hooks (or /hooks in the CLI)\n`);
+      process.stdout.write(`  ${result.adoptedServer ? '2' : '3'}. Start a New chat\n`);
+    } else if (result.auth === 'oauth') {
+      const pick = binding && binding.vault ? ` and select the vault ${vaultLabel(binding)} (the one your hooks use)` : '';
+      process.stdout.write(`\nNext: codex mcp login memoryrouter${pick}\nThen open Codex, run /hooks and trust the MemoryRouter hooks, and check /mcp verbose.\n`);
+    }
+    else process.stdout.write('\nNext: open Codex, run /hooks, and trust the MemoryRouter hooks.\n');
+    if (result.keySource === 'claude-code-config') process.stdout.write('\nAutomatic hooks reuse your Claude Code Memory Key (~/.memoryrouter/config.json), so both agents share the same vault.\n');
+    if (!result.automaticMemory && options.hooks !== false) process.stdout.write('\nRemote MCP tools are configured, but automatic hooks are fail-open/no-op until MEMORYROUTER_API_KEY is available or init is re-run with --api-key-stdin.\n');
+    const scopeArgs = result.layout.scope === 'project' ? `--scope project --project-dir ${JSON.stringify(result.layout.root)}` : '--scope user';
+    process.stdout.write(`\nVerify: npx -y memoryrouter-codex@${INTEGRATION_VERSION} doctor ${scopeArgs}\n`);
+    process.stdout.write('One memory across every session, repo and tool: Codex, Claude Code (memoryrouter-claude) and the MemoryRouter MCP all use the same vault.\n');
     return;
   }
   if (command === 'doctor') {

package/lib/hooks.cjs

@@ -5,7 +5,14 @@ const path = require('path');
 const { atomicWrite, readText } = require('./managed.cjs');
 const { INTEGRATION_VERSION } = require('../runtime/constants.cjs');
 
+// The hidden Codex lifecycle tools on the MemoryRouter MCP server
+// (mcp-server/src/tools/codex-hooks.ts).
+const MCP_HOOK_TOOLS = new Set(['codex_turn_start', 'codex_turn_end', 'codex_session_start']);
+
 function isOwnedHook(handler) {
+  if (handler?.type === 'mcp_tool') {
+    return handler.server === 'memoryrouter' && MCP_HOOK_TOOLS.has(handler.tool);
+  }
   return handler?.type === 'command' && typeof handler.command === 'string' &&
     (/memoryrouter[\\/]runtime[\\/]hook\.cjs/.test(handler.command) || /memoryrouter-codex(?:@[^ ]+)?\s+hook\b/.test(handler.command));
 }
@@ -49,16 +56,47 @@ function managedGroups(runtimeDir, scope) {
     ...(statusMessage ? { statusMessage } : {}),
     ...(additionalContextLimit ? { additionalContextLimit } : {}),
   });
+  // Per turn: recall before the prompt, save the user's prompt and the final
+  // assistant response after the turn. Nothing in between (no tool calls, tool
+  // output, reasoning, subagent output). SessionEnd only saves the prompt of a
+  // last turn that never finished (interrupted), see runtime/hook.cjs flush.
   return {
     SessionStart: [{ matcher: 'startup|resume|clear|compact', hooks: [handler('session-start', 8, 'Recalling MemoryRouter context', 3500)] }],
-    UserPromptSubmit: [{ hooks: [handler('inject', 8, 'Searching project memory', 3500)] }],
-    Stop: [{ hooks: [handler('capture', 18, 'Saving durable project memory')] }],
-    SubagentStop: [{ hooks: [handler('capture-subagent', 15, 'Saving durable subagent outcome')] }],
-    PreCompact: [{ matcher: 'manual|auto', hooks: [handler('flush', 18, 'Saving memory before compaction')] }],
+    UserPromptSubmit: [{ hooks: [handler('inject', 8, 'Searching MemoryRouter', 3500)] }],
+    Stop: [{ hooks: [handler('capture', 18, 'Saving to MemoryRouter')] }],
     SessionEnd: [{ hooks: [handler('flush', 3)] }],
   };
 }
 
+/**
+ * OAuth hooks: no API key and no local runtime. Codex calls hidden tools on the
+ * already-authenticated `memoryrouter` MCP server (`type: "mcp_tool"`), with
+ * the user's OAuth token and the vault picked during sign-in.
+ *   UserPromptSubmit -> codex_turn_start: recall for this prompt (returned as
+ *     developer context), then save the prompt.
+ *   Stop -> codex_turn_end: save the final assistant message.
+ *   SessionStart (compact) -> codex_session_start: restore context right after
+ *     Codex compacts a long chat.
+ * Codex does not support mcp_tool hooks on SessionEnd; none is needed.
+ */
+function mcpManagedGroups(serverName = 'memoryrouter') {
+  const turn = { session_id: '${session_id}', turn_id: '${turn_id}', cwd: '${cwd}' };
+  return {
+    // Only after compaction: on startup/resume/clear the first prompt's
+    // codex_turn_start recall already injects context (no double injection).
+    SessionStart: [{
+      matcher: 'compact',
+      hooks: [{ type: 'mcp_tool', server: serverName, tool: 'codex_session_start', input: { session_id: '${session_id}', cwd: '${cwd}', source: '${source}' }, timeout: 12, statusMessage: 'Recalling MemoryRouter context' }],
+    }],
+    UserPromptSubmit: [{
+      hooks: [{ type: 'mcp_tool', server: serverName, tool: 'codex_turn_start', input: { prompt: '${prompt}', ...turn }, timeout: 12, statusMessage: 'Searching MemoryRouter' }],
+    }],
+    Stop: [{
+      hooks: [{ type: 'mcp_tool', server: serverName, tool: 'codex_turn_end', input: { last_assistant_message: '${last_assistant_message}', ...turn }, timeout: 15, statusMessage: 'Saving to MemoryRouter' }],
+    }],
+  };
+}
+
 function parseHooks(file) {
   const raw = readText(file);
   if (!raw.trim()) return { description: 'Lifecycle hooks for this Codex configuration.', hooks: {} };
@@ -71,18 +109,19 @@ function parseHooks(file) {
   }
 }
 
-function installHooks(file, runtimeDir, scope) {
+function installHooks(file, runtimeDir, scope, options = {}) {
   const current = parseHooks(file);
   const clean = cleanOwnedHooks(current);
   clean.description = clean.description || 'Lifecycle hooks for this Codex configuration.';
   clean.hooks = clean.hooks || {};
-  for (const [event, groups] of Object.entries(managedGroups(runtimeDir, scope))) {
+  const groupsToInstall = options.mode === 'mcp' ? mcpManagedGroups(options.serverName) : managedGroups(runtimeDir, scope);
+  for (const [event, groups] of Object.entries(groupsToInstall)) {
     clean.hooks[event] = [...(clean.hooks[event] || []), ...groups];
   }
   const rendered = `${JSON.stringify(clean, null, 2)}\n`;
   const previous = readText(file);
   atomicWrite(file, rendered);
-  return { changed: rendered !== previous, file, events: Object.keys(managedGroups(runtimeDir, scope)) };
+  return { changed: rendered !== previous, file, mode: options.mode === 'mcp' ? 'mcp' : 'command', events: Object.keys(groupsToInstall) };
 }
 
 function uninstallHooks(file) {
@@ -99,4 +138,4 @@ function uninstallHooks(file) {
   return { changed: true, file };
 }
 
-module.exports = { isOwnedHook, cleanOwnedHooks, commandFor, managedGroups, parseHooks, installHooks, uninstallHooks };
+module.exports = { isOwnedHook, cleanOwnedHooks, commandFor, managedGroups, mcpManagedGroups, MCP_HOOK_TOOLS, parseHooks, installHooks, uninstallHooks };

package/lib/installer.cjs

@@ -4,14 +4,14 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const { execFileSync } = require('child_process');
-const { codexHome, dataHome, loadConfig, saveConfig, configPath } = require('../runtime/config.cjs');
+const { codexHome, dataHome, loadConfig, saveConfig, configPath, getApiKey, apiKeySource } = require('../runtime/config.cjs');
 const { resolveProject } = require('../runtime/project.cjs');
 const { MCP_ENDPOINT, INTEGRATION_VERSION } = require('../runtime/constants.cjs');
 const {
   installToml, uninstallToml, installAgents, uninstallAgents, readText, replaceBlock,
-  hasUnmanagedMemoryRouterTable, TOML_START, TOML_END, AGENTS_START, AGENTS_END,
+  hasUnmanagedMemoryRouterTable, externalRemoteServerName, TOML_START, TOML_END, AGENTS_START, AGENTS_END,
 } = require('./managed.cjs');
-const { installHooks, uninstallHooks, isOwnedHook, managedGroups, parseHooks } = require('./hooks.cjs');
+const { installHooks, uninstallHooks, isOwnedHook, managedGroups, mcpManagedGroups, parseHooks } = require('./hooks.cjs');
 
 function resolveLayout(options = {}) {
   const env = options.env || process.env;
@@ -54,6 +54,9 @@ function preflight(layout, options = {}) {
   const configText = readText(layout.configFile);
   // Validate marker pairs before any file is changed.
   replaceBlock(configText, TOML_START, TOML_END, '');
+  // A remote MemoryRouter server the user added themselves (Codex app:
+  // Settings > Plugins > Add MCP server) is adopted as is, never an error.
+  if (options.auth !== 'api-key' && externalRemoteServerName(configText, MCP_ENDPOINT)) return;
   if (hasUnmanagedMemoryRouterTable(configText) && !options.force) {
     throw new Error(`An unmanaged [mcp_servers.memoryrouter] table already exists in ${layout.configFile}. Re-run with --force after reviewing the migration backup.`);
   }
@@ -61,16 +64,41 @@ function preflight(layout, options = {}) {
   if (options.agents !== false) replaceBlock(readText(layout.agentsFile), AGENTS_START, AGENTS_END, '');
 }
 
+/**
+ * How the automatic hooks reach MemoryRouter.
+ * - 'mcp': Codex `mcp_tool` hooks call MemoryRouter's hidden lifecycle tools
+ *   over the signed-in OAuth MCP connection. No API key on disk.
+ * - 'command': the local Node runtime with a Memory Key (api-key mode, or
+ *   OAuth users who also configured a key, e.g. shared with Claude Code).
+ */
+function resolveHookMode(options, auth, env) {
+  if (options.hookMode === 'mcp' || options.hookMode === 'command') return options.hookMode;
+  if (auth === 'api-key') return 'command';
+  const key = options.apiKey || getApiKey(env, loadConfig(options.env));
+  return key ? 'command' : 'mcp';
+}
+
 function init(options = {}) {
   const layout = resolveLayout(options);
   const auth = options.auth || 'oauth';
   if (!['oauth', 'api-key'].includes(auth)) throw new Error('--auth must be oauth or api-key');
-  preflight(layout, options);
+  if (options.hookMode && !['mcp', 'command'].includes(options.hookMode)) throw new Error('--hooks-via must be mcp or command');
+  const env = options.env || process.env;
+  preflight(layout, { ...options, auth });
+  const hookMode = resolveHookMode(options, auth, env);
+  if (hookMode === 'mcp' && auth === 'api-key') throw new Error('--hooks-via mcp needs the OAuth MCP server (--auth oauth).');
   copyRuntime(layout.runtimeDir);
   const results = [];
-  results.push(installToml(layout.configFile, { auth, scope: layout.scope, runtimeDir: layout.runtimeDir, force: options.force }));
-  if (options.hooks !== false) results.push(installHooks(layout.hooksFile, layout.runtimeDir, layout.scope));
-  if (options.agents !== false) results.push(installAgents(layout.agentsFile));
+  const adoptedServer = auth === 'oauth' ? externalRemoteServerName(readText(layout.configFile), MCP_ENDPOINT) : null;
+  if (adoptedServer) {
+    // Leave the user's own server table (and its sign-in) untouched.
+    results.push({ changed: false, file: layout.configFile, adopted: adoptedServer });
+  } else {
+    results.push(installToml(layout.configFile, { auth, scope: layout.scope, runtimeDir: layout.runtimeDir, force: options.force }));
+  }
+  const serverName = adoptedServer || 'memoryrouter';
+  if (options.hooks !== false) results.push(installHooks(layout.hooksFile, layout.runtimeDir, layout.scope, { mode: hookMode, serverName }));
+  if (options.agents !== false) results.push(installAgents(layout.agentsFile, { hookMode }));
 
   if (options.apiKey) {
     const current = loadConfig(options.env);
@@ -81,6 +109,9 @@ function init(options = {}) {
     installedAt: new Date().toISOString(),
     scope: layout.scope,
     auth,
+    hookMode,
+    serverName,
+    adoptedServer: Boolean(adoptedServer),
     configFile: layout.configFile,
     hooksFile: options.hooks === false ? null : layout.hooksFile,
     agentsFile: options.agents === false ? null : layout.agentsFile,
@@ -90,7 +121,16 @@ function init(options = {}) {
   fs.mkdirSync(manifestDir, { recursive: true, mode: 0o700 });
   const manifestName = Buffer.from(`${layout.scope}:${layout.root}`).toString('base64url');
   fs.writeFileSync(path.join(manifestDir, `${manifestName}.json`), `${JSON.stringify(manifest, null, 2)}\n`, { mode: 0o600 });
-  return { layout, auth, results, automaticMemory: Boolean(options.apiKey || process.env.MEMORYROUTER_API_KEY || loadConfig(options.env).apiKey) };
+  return {
+    layout,
+    auth,
+    hookMode,
+    serverName,
+    adoptedServer,
+    results,
+    automaticMemory: options.hooks !== false && (hookMode === 'mcp' || Boolean(options.apiKey || getApiKey(env, loadConfig(options.env)))),
+    keySource: options.apiKey ? 'codex-config' : apiKeySource(env, loadConfig(options.env)),
+  };
 }
 
 function uninstall(options = {}) {
@@ -168,7 +208,9 @@ async function doctor(options = {}) {
   else if (!versionAtLeast(codex.version, [0, 145, 0])) addCheck(checks, 'codex-version', 'error', `${codex.output} is too old for the lifecycle hooks used here. Upgrade to Codex 0.145.0 or newer.`);
   else addCheck(checks, 'codex-version', 'pass', `${codex.output} supports current hooks and remote MCP configuration.`);
 
-  addCheck(checks, 'mcp-config', configText.includes(TOML_START) && configText.includes('[mcp_servers.memoryrouter]') ? 'pass' : 'error',
+  const adopted = externalRemoteServerName(configText, MCP_ENDPOINT);
+  if (adopted) addCheck(checks, 'mcp-config', 'pass', `MemoryRouter MCP server "${adopted}" (added in the Codex app or by hand) is configured.`);
+  else addCheck(checks, 'mcp-config', configText.includes(TOML_START) && configText.includes('[mcp_servers.memoryrouter]') ? 'pass' : 'error',
     configText.includes(TOML_START) ? 'Managed MemoryRouter MCP configuration is present.' : 'Managed MemoryRouter MCP configuration is missing.');
   addCheck(checks, 'runtime', runtimeVersion === INTEGRATION_VERSION ? 'pass' : 'error',
     runtimeVersion ? `Installed runtime version is ${runtimeVersion}; package version is ${INTEGRATION_VERSION}.` : 'Managed runtime is missing.');
@@ -176,22 +218,40 @@ async function doctor(options = {}) {
   let hooks = null;
   try { hooks = hooksText ? JSON.parse(hooksText) : null; } catch { /* handled */ }
   const owned = hooks ? Object.values(hooks.hooks || {}).flat().flatMap(group => group.hooks || []).filter(isOwnedHook) : [];
-  const expectedOwned = Object.values(managedGroups(layout.runtimeDir, layout.scope)).flat().flatMap(group => group.hooks || []).length;
-  addCheck(checks, 'hooks', owned.length === expectedOwned ? 'pass' : 'error', owned.length ? `${owned.length} of ${expectedOwned} managed lifecycle hooks found.` : 'Managed lifecycle hooks are missing or hooks.json is invalid.');
+  const mcpHooks = owned.filter(handler => handler.type === 'mcp_tool');
+  const expectedOwned = mcpHooks.length
+    ? Object.values(mcpManagedGroups()).flat().flatMap(group => group.hooks || []).length
+    : Object.values(managedGroups(layout.runtimeDir, layout.scope)).flat().flatMap(group => group.hooks || []).length;
+  addCheck(checks, 'hooks', owned.length === expectedOwned ? 'pass' : 'error', owned.length
+    ? `${owned.length} of ${expectedOwned} managed lifecycle hooks found${mcpHooks.length ? ' (over the signed-in MCP connection, no API key needed)' : ''}. Trust them once in Codex: app Settings > Hooks, or /hooks in the CLI.`
+    : 'Managed lifecycle hooks are missing or hooks.json is invalid.');
   addCheck(checks, 'agents', agentsText.includes(AGENTS_START) ? 'pass' : 'warn', agentsText.includes(AGENTS_START) ? 'Managed AGENTS.md guidance is present.' : 'Managed AGENTS.md guidance is missing.');
 
   const cfg = loadConfig(options.env);
-  const key = process.env.MEMORYROUTER_API_KEY || cfg.apiKey;
-  if (!key) addCheck(checks, 'automatic-auth', 'warn', 'No MemoryRouter API key is available. Remote OAuth tools can work after `codex mcp login memoryrouter`, but automatic hook retrieval/capture is disabled.');
+  const keyEnv = options.env || process.env;
+  const key = getApiKey(keyEnv, cfg);
+  const keyFrom = apiKeySource(keyEnv, cfg);
+  if (!key && mcpHooks.length) addCheck(checks, 'automatic-auth', 'pass', 'Automatic recall and saving use your MemoryRouter sign-in (OAuth). No API key needed.');
+  else if (!key) addCheck(checks, 'automatic-auth', 'warn', 'No MemoryRouter API key is available. Remote OAuth tools can work after `codex mcp login memoryrouter`, but automatic hook retrieval/capture is disabled.');
   else {
     try {
       const { stats } = require('../runtime/api.cjs');
       const response = options.offline ? { ok: true, status: 0 } : await stats(key, { apiBase: cfg.apiBase, timeoutMs: 6000, retries: 0 });
-      addCheck(checks, 'automatic-auth', response.ok ? 'pass' : 'error', options.offline ? 'API key is configured (network check skipped).' : response.ok ? 'API key is valid; automatic retrieval/capture is active.' : `API key validation failed (HTTP ${response.status}).`);
+      addCheck(checks, 'automatic-auth', response.ok ? 'pass' : 'error', options.offline ? 'API key is configured (network check skipped).' : response.ok ? `API key is valid${keyFrom === 'claude-code-config' ? ' (reusing the Claude Code key in ~/.memoryrouter/config.json)' : ''}; automatic retrieval/capture is active.` : `API key validation failed (HTTP ${response.status}).`);
     } catch (error) { addCheck(checks, 'automatic-auth', 'error', `API key validation failed: ${error.message}`); }
+    if (!options.offline) {
+      const { checkVaultBinding, vaultLabel } = require('../runtime/vault-binding.cjs');
+      const binding = await checkVaultBinding(key, { env: options.env || process.env, timeoutMs: 5000 });
+      const levels = { match: 'pass', mismatch: 'error', mixed: 'warn', 'not-connected': 'info', unknown: 'warn' };
+      addCheck(checks, 'one-vault', levels[binding.status] || 'warn',
+        binding.status === 'match' ? `Hooks and your OAuth connection use the same vault ${vaultLabel(binding)}.`
+          : binding.status === 'not-connected' ? `No MemoryRouter OAuth connection yet. When you run \`codex mcp login memoryrouter\`, select ${vaultLabel(binding)}.`
+          : binding.status === 'unknown' ? `Vault match not checked (${binding.message}).`
+          : binding.message);
+    }
   }
 
-  if (configText.includes('auth = "oauth"')) {
+  if (configText.includes('auth = "oauth"') || adopted) {
     if (options.offline) {
       addCheck(checks, 'oauth-discovery', 'warn', 'OAuth discovery check skipped in offline mode.');
       addCheck(checks, 'oauth-session', 'info', 'Browser consent/token issuance is user-specific. Run `codex mcp login memoryrouter`; then `/mcp verbose`. Doctor does not claim login completion without interactive consent.');
@@ -222,10 +282,11 @@ async function doctor(options = {}) {
     ? `Codex native Memories are enabled${externalDisabled ? ' and external-context generation is disabled.' : '. Consider [memories] disable_on_external_context = true to avoid re-extracting MemoryRouter-assisted chats.'}`
     : 'Codex native Memories are off or configured in another layer. This integration does not overwrite native-memory settings.');
 
-  const project = resolveProject(layout.root);
-  addCheck(checks, 'project-identity', project.portable ? 'pass' : 'warn', project.portable
-    ? `Project handle ${project.handle} is derived from a canonical git remote and is stable across worktrees/machines.`
-    : `Project handle ${project.handle} falls back to a local ${project.source}; add an origin remote for cross-machine identity.`);
+  // One vault per user: report the scope plainly, plus the repository label
+  // that captures from this directory carry (metadata only, never a wall).
+  const identityDir = layout.scope === 'user' ? (options.projectDir || process.cwd()) : layout.root;
+  const project = resolveProject(identityDir, { env: options.env, config: loadConfig(options.env) });
+  addCheck(checks, 'memory-scope', 'pass', `One vault for everything: every Codex session, every repository, Claude Code (memoryrouter-claude), and the MemoryRouter MCP read and write the same memory. Captures from this directory are tagged ${project.handle} (${project.source}) so recall can label them; the tag never limits what is recalled.`);
   addCheck(checks, 'cloud-surface', layout.scope === 'project' ? 'info' : 'warn', layout.scope === 'project'
     ? 'Project config/hooks can travel with the repository, but cloud environments must trust the project, install Node, and provide MEMORYROUTER_API_KEY. ChatGPT web does not consume local Codex config; use a hosted plugin/connector there.'
     : 'User-scope config covers local CLI, desktop app, and IDE on this host. Codex cloud and ChatGPT web do not inherit this machine-local config.');

package/lib/managed.cjs

@@ -53,6 +53,26 @@ function removeUnmanagedMemoryRouterTables(text) {
   return kept.join('\n').replace(/\n{3,}/g, '\n\n');
 }
 
+/**
+ * The MCP server name the user already connected to MemoryRouter's remote
+ * endpoint outside our managed block (for example the Codex app's
+ * Settings > Plugins > Add MCP server), or null. Returns the first
+ * `[mcp_servers.<name>]` whose `url` is the MemoryRouter MCP endpoint.
+ */
+function externalRemoteServerName(text, endpoint) {
+  const stripped = replaceBlock(text, TOML_START, TOML_END, '');
+  const lines = stripped.split('\n');
+  let current = null;
+  for (const line of lines) {
+    const table = line.match(/^\s*\[mcp_servers\.("?)([^\]".]+)\1\]\s*(?:#.*)?$/);
+    if (table) { current = table[2]; continue; }
+    if (/^\s*\[/.test(line)) { current = null; continue; }
+    const url = line.match(/^\s*url\s*=\s*"([^"]+)"/);
+    if (current && url && url[1].replace(/\/+$/, '') === endpoint.replace(/\/+$/, '')) return current;
+  }
+  return null;
+}
+
 function tomlString(value) { return JSON.stringify(String(value)); }
 
 function mcpBlock({ auth = 'oauth', scope = 'user', runtimeDir }) {
@@ -129,13 +149,16 @@ function uninstallToml(file) {
   return { changed: true, file };
 }
 
-function agentsBlock() {
-  return `## MemoryRouter memory\n\n- MemoryRouter is the durable cross-machine, cross-tool, and team/auditable memory layer. Codex native Memories may remain enabled as the local personal recall layer.\n- Automatic hooks search project-scoped memory before each prompt and capture completed turns when a MemoryRouter API key is configured.\n- For explicit recall, search MemoryRouter before answering questions about prior decisions, preferences, incidents, or unfinished work. Depending on auth mode, the tool is named \`search_memories\` or \`memory_search\`.\n- Store only concise, durable decisions, preferences, facts, and incident outcomes. Depending on auth mode, use \`store_memory\` or \`memory_store\`. Do not duplicate a completed turn that hooks already captured.\n- Keep and cite returned \`mrh_...\` handles when a specific memory must be referenced later.\n- Project scope is derived from the canonical git remote when available, so worktrees and machines share identity without uploading local paths.\n- If MemoryRouter is offline, continue the task without memory; never block work on recall or capture.`;
+function agentsBlock(options = {}) {
+  const automatic = options.hookMode === 'mcp'
+    ? '- Automatic hooks (over the signed-in MemoryRouter connection) search the vault before each prompt and add what they find as context, then save each completed turn: the user\'s message and your final response only, never tool calls, tool output or intermediate steps.\n'
+    : '- Automatic hooks search the vault before each prompt and save each completed turn (the user\'s message and your final response only) when a MemoryRouter API key is configured.\n';
+  return `## MemoryRouter memory\n\n- MemoryRouter is the durable cross-machine, cross-tool, and team/auditable memory layer. Codex native Memories may remain enabled as the local personal recall layer.\n${automatic}- For explicit recall, search MemoryRouter before answering questions about prior decisions, preferences, incidents, or unfinished work. Depending on auth mode, the tool is named \`search_memories\` or \`memory_search\`.\n- Store only concise, durable decisions, preferences, facts, and incident outcomes. Depending on auth mode, use \`store_memory\` or \`memory_store\`. Do not duplicate a completed turn that hooks already captured.\n- Keep and cite returned \`mrh_...\` handles when a specific memory must be referenced later.\n- Project scope is derived from the canonical git remote when available, so worktrees and machines share identity without uploading local paths. It is the same project memory Claude Code uses through memoryrouter-claude, so decisions made in either agent are available in both.\n- If MemoryRouter is offline, continue the task without memory; never block work on recall or capture.`;
 }
 
-function installAgents(file) {
+function installAgents(file, options = {}) {
   const current = readText(file);
-  const updated = replaceBlock(current, AGENTS_START, AGENTS_END, agentsBlock());
+  const updated = replaceBlock(current, AGENTS_START, AGENTS_END, agentsBlock(options));
   atomicWrite(file, updated);
   return { changed: updated !== current, file };
 }
@@ -158,6 +181,7 @@ module.exports = {
   atomicWrite,
   replaceBlock,
   hasUnmanagedMemoryRouterTable,
+  externalRemoteServerName,
   removeUnmanagedMemoryRouterTables,
   mcpBlock,
   installToml,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "memoryrouter-codex",
-  "version": "1.6.1",
-  "description": "Automatic, project-scoped MemoryRouter memory for OpenAI Codex",
+  "version": "1.8.0",
+  "description": "Automatic MemoryRouter memory for OpenAI Codex: one vault shared by every session, repo and tool, including Claude Code",
   "license": "MIT",
   "type": "commonjs",
   "bin": {