om-memory-system 3.0.0

package/dist/services/migration-service.js

@@ -0,0 +1,307 @@
+import { existsSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { tursoShardManager } from "./turso/shard-manager.js";
+import { tursoConnectionManager } from "./turso/connection-manager.js";
+import { tursoVectorSearch } from "./turso/vector-search.js";
+import { ensureTursoReady } from "./turso/ready.js";
+import { embeddingService } from "./embedding.js";
+import { CONFIG } from "../config.js";
+import { log } from "./logger.js";
+import { formatTagsForEmbedding } from "./turso/vector-utils.js";
+import { acquireTursoOperationLock } from "./turso/operation-lock.js";
+import { withSqliteFileLockRetry } from "./turso/sqlite-handle-release.js";
+export class MigrationService {
+    isRunning = false;
+    progressCallback;
+    async detectDimensionMismatch() {
+        await ensureTursoReady();
+        const userShards = await tursoShardManager.getAllShards("user", "");
+        const projectShards = await tursoShardManager.getAllShards("project", "");
+        const allShards = [...userShards, ...projectShards];
+        const mismatches = [];
+        for (const shard of allShards) {
+            try {
+                const db = await tursoConnectionManager.getConnection(shard.dbPath);
+                const metadataResult = await db.all(`
+          SELECT key, value FROM shard_metadata
+          WHERE key IN ('embedding_dimensions', 'embedding_model')
+        `);
+                const metadata = Object.fromEntries(metadataResult.map((row) => [row.key, row.value]));
+                const storedDimensions = parseInt(String(metadata.embedding_dimensions || "0"));
+                const storedModel = String(metadata.embedding_model || "unknown");
+                if (storedDimensions !== CONFIG.embeddingDimensions) {
+                    const vectorCount = await tursoVectorSearch.countAllVectors(db);
+                    mismatches.push({
+                        shardId: shard.id,
+                        dbPath: shard.dbPath,
+                        storedDimensions,
+                        storedModel,
+                        vectorCount,
+                    });
+                }
+            }
+            catch (error) {
+                log("Migration: error checking shard", {
+                    shardId: shard.id,
+                    error: String(error),
+                });
+            }
+        }
+        return {
+            needsMigration: mismatches.length > 0,
+            configDimensions: CONFIG.embeddingDimensions,
+            configModel: CONFIG.embeddingModel,
+            shardMismatches: mismatches,
+        };
+    }
+    async migrateToNewModel(strategy, progressCallback) {
+        if (this.isRunning) {
+            throw new Error("Migration already running");
+        }
+        this.isRunning = true;
+        let releaseOperationLock;
+        this.progressCallback = progressCallback;
+        const startTime = Date.now();
+        try {
+            releaseOperationLock = acquireTursoOperationLock(`dimension-${strategy}`);
+            const mismatch = await this.detectDimensionMismatch();
+            if (!mismatch.needsMigration) {
+                return {
+                    success: true,
+                    strategy,
+                    deletedShards: 0,
+                    reEmbeddedMemories: 0,
+                    duration: Date.now() - startTime,
+                };
+            }
+            if (strategy === "fresh-start") {
+                return await this.freshStartMigration(mismatch, startTime);
+            }
+            return await this.reEmbedMigration(mismatch, startTime);
+        }
+        catch (error) {
+            log("Migration: failed", { error: String(error) });
+            return {
+                success: false,
+                strategy,
+                deletedShards: 0,
+                reEmbeddedMemories: 0,
+                duration: Date.now() - startTime,
+                error: String(error),
+            };
+        }
+        finally {
+            releaseOperationLock?.();
+            this.isRunning = false;
+            this.progressCallback = undefined;
+        }
+    }
+    async freshStartMigration(mismatch, startTime) {
+        this.reportProgress({
+            phase: "preparing",
+            processed: 0,
+            total: mismatch.shardMismatches.length,
+        });
+        let deletedShards = 0;
+        for (const [index, shardInfo] of mismatch.shardMismatches.entries()) {
+            this.reportProgress({
+                phase: "cleanup",
+                processed: index,
+                total: mismatch.shardMismatches.length,
+                currentShard: String(shardInfo.shardId),
+            });
+            const archivePath = await tursoShardManager.archiveShard(shardInfo.shardId, "fresh-start");
+            if (!archivePath) {
+                throw new Error(`Migration source shard ${shardInfo.shardId} no longer exists`);
+            }
+            log("Migration: archived shard for fresh start", {
+                shardId: shardInfo.shardId,
+                archivePath,
+            });
+            deletedShards++;
+        }
+        this.reportProgress({
+            phase: "complete",
+            processed: mismatch.shardMismatches.length,
+            total: mismatch.shardMismatches.length,
+        });
+        return {
+            success: true,
+            strategy: "fresh-start",
+            deletedShards,
+            reEmbeddedMemories: 0,
+            duration: Date.now() - startTime,
+        };
+    }
+    async reEmbedMigration(mismatch, startTime) {
+        await embeddingService.warmup();
+        embeddingService.clearCache();
+        const totalMemories = mismatch.shardMismatches.reduce((sum, shard) => sum + shard.vectorCount, 0);
+        this.reportProgress({
+            phase: "preparing",
+            processed: 0,
+            total: totalMemories,
+        });
+        let reEmbeddedCount = 0;
+        let processedCount = 0;
+        for (const shardInfo of mismatch.shardMismatches) {
+            this.reportProgress({
+                phase: "re-embedding",
+                processed: processedCount,
+                total: totalMemories,
+                currentShard: String(shardInfo.shardId),
+            });
+            const shard = await tursoShardManager.getShardById(shardInfo.shardId);
+            if (!shard) {
+                throw new Error(`Migration source shard ${shardInfo.shardId} no longer exists`);
+            }
+            const migrated = await tursoShardManager.withScopeWriteLock(shard.scope, shard.scopeHash, () => this.rebuildShardSafely(shard, (processed) => {
+                processedCount++;
+                this.reportProgress({
+                    phase: "re-embedding",
+                    processed: processedCount,
+                    total: totalMemories,
+                    currentShard: String(shardInfo.shardId),
+                });
+                log("Migration: memory staged for re-embed", {
+                    shardId: shardInfo.shardId,
+                    memoryId: processed,
+                });
+            }));
+            reEmbeddedCount += migrated;
+        }
+        this.reportProgress({
+            phase: "complete",
+            processed: totalMemories,
+            total: totalMemories,
+        });
+        return {
+            success: true,
+            strategy: "re-embed",
+            deletedShards: 0,
+            reEmbeddedMemories: reEmbeddedCount,
+            duration: Date.now() - startTime,
+        };
+    }
+    async rebuildShardSafely(shard, onProcessed) {
+        const sourceDb = await tursoConnectionManager.getConnection(shard.dbPath);
+        const memories = await sourceDb.all(`
+      SELECT
+        id, content, container_tag, tags, type, created_at, updated_at, metadata,
+        display_name, user_name, user_email, project_path, project_name, git_repo_url, is_pinned
+      FROM memories
+      ORDER BY created_at DESC
+    `);
+        const nonce = `${process.pid}-${Date.now()}`;
+        const stagedPath = `${shard.dbPath}.reembed-${nonce}.tmp`;
+        const backupPath = `${shard.dbPath}.pre-reembed-${nonce}.bak`;
+        const swapStatePath = `${shard.dbPath}.reembed-swap.json`;
+        try {
+            const stagedDb = await tursoConnectionManager.getConnection(stagedPath);
+            await tursoShardManager.initShardDb(stagedDb);
+            // Stage bounded batches. Model or database failures only discard this
+            // temporary shard; the source is not touched until full verification.
+            const batchSize = 50;
+            for (let offset = 0; offset < memories.length; offset += batchSize) {
+                const stagedBatch = [];
+                for (const memory of memories.slice(offset, offset + batchSize)) {
+                    const content = String(memory.content);
+                    const tags = memory.tags
+                        ? String(memory.tags)
+                            .split(",")
+                            .map((tag) => tag.trim())
+                            .filter(Boolean)
+                        : [];
+                    const embeddingInput = tags.length > 0 ? `${content}\nTags: ${tags.join(", ")}` : content;
+                    const vector = await embeddingService.embedWithTimeout(embeddingInput, {
+                        task: "document",
+                    });
+                    const tagsVector = tags.length > 0
+                        ? await embeddingService.embedWithTimeout(formatTagsForEmbedding(tags), {
+                            task: "document",
+                        })
+                        : undefined;
+                    stagedBatch.push({
+                        record: {
+                            id: String(memory.id),
+                            content,
+                            vector,
+                            tagsVector,
+                            containerTag: String(memory.container_tag),
+                            tags: memory.tags ? String(memory.tags) : undefined,
+                            type: memory.type ? String(memory.type) : undefined,
+                            createdAt: Number(memory.created_at),
+                            updatedAt: Number(memory.updated_at),
+                            metadata: memory.metadata ? String(memory.metadata) : undefined,
+                            displayName: memory.display_name ? String(memory.display_name) : undefined,
+                            userName: memory.user_name ? String(memory.user_name) : undefined,
+                            userEmail: memory.user_email ? String(memory.user_email) : undefined,
+                            projectPath: memory.project_path ? String(memory.project_path) : undefined,
+                            projectName: memory.project_name ? String(memory.project_name) : undefined,
+                            gitRepoUrl: memory.git_repo_url ? String(memory.git_repo_url) : undefined,
+                        },
+                        isPinned: Number(memory.is_pinned ?? 0) === 1,
+                    });
+                    onProcessed(String(memory.id));
+                }
+                await stagedDb.transaction("write", async (tx) => {
+                    for (const item of stagedBatch) {
+                        await tursoVectorSearch.insertVectorInTransaction(tx, item.record);
+                        if (item.isPinned) {
+                            await tx.execute({
+                                sql: `UPDATE memories SET is_pinned = 1 WHERE id = ?`,
+                                args: [item.record.id],
+                            });
+                        }
+                    }
+                });
+            }
+            const countRow = await stagedDb.get(`SELECT COUNT(*) AS count FROM memories`);
+            const stagedCount = Number(countRow?.count ?? 0);
+            if (stagedCount !== memories.length) {
+                throw new Error(`Migration staged count mismatch for shard ${shard.id}: expected ${memories.length}, got ${stagedCount}`);
+            }
+            await tursoConnectionManager.closeConnection(stagedPath);
+            writeFileSync(swapStatePath, JSON.stringify({ dbPath: shard.dbPath, stagedPath, backupPath }), "utf-8");
+            await tursoConnectionManager.closeConnection(shard.dbPath);
+            await withSqliteFileLockRetry(() => renameSync(shard.dbPath, backupPath));
+            try {
+                await withSqliteFileLockRetry(() => renameSync(stagedPath, shard.dbPath));
+            }
+            catch (error) {
+                await withSqliteFileLockRetry(() => renameSync(backupPath, shard.dbPath));
+                throw error;
+            }
+            await tursoShardManager.setVectorCount(shard.id, stagedCount);
+            unlinkSync(swapStatePath);
+            log("Migration: safely replaced re-embedded shard", {
+                shardId: shard.id,
+                memories: stagedCount,
+                backupPath,
+            });
+            return stagedCount;
+        }
+        catch (error) {
+            await tursoConnectionManager.closeConnection(stagedPath);
+            if (existsSync(stagedPath)) {
+                await withSqliteFileLockRetry(() => unlinkSync(stagedPath));
+            }
+            if (existsSync(swapStatePath) && existsSync(shard.dbPath)) {
+                unlinkSync(swapStatePath);
+            }
+            throw error;
+        }
+    }
+    reportProgress(progress) {
+        if (this.progressCallback) {
+            this.progressCallback(progress);
+        }
+    }
+    getStatus() {
+        return {
+            isRunning: this.isRunning,
+            configModel: CONFIG.embeddingModel,
+            configDimensions: CONFIG.embeddingDimensions,
+        };
+    }
+}
+export const migrationService = new MigrationService();

package/dist/services/onnxruntime-resolve.d.ts

@@ -0,0 +1,24 @@
+export declare function getPinnedOnnxruntimePackageRoot(): string;
+/**
+ * Resolve the N-API layout directory shipped by the pinned onnxruntime-node
+ * package (`napi-v3` for 1.20.x, `napi-v6` for 1.22.x, …).
+ */
+export declare function getOnnxruntimeNapiDirName(platform?: NodeJS.Platform, arch?: string): string;
+export declare function getOnnxruntimeBindingPath(platform?: NodeJS.Platform, arch?: string): string;
+export declare function formatMissingOnnxruntimeBindingError(platform?: NodeJS.Platform, arch?: string): string;
+/**
+ * Rewrite onnxruntime-related init failures.
+ *
+ * When the pinned binding is absent, keep the clear "missing" message.
+ * When it is present, preserve the original error so nested-1.24 / dlopen /
+ * codesign failures are not misreported as a missing pinned binding (#210).
+ */
+export declare function formatOnnxruntimeInitError(error: unknown, platform?: NodeJS.Platform, arch?: string): Error;
+export declare function assertOnnxruntimeBindingPresent(platform?: NodeJS.Platform, arch?: string): void;
+/**
+ * Patch Module._resolveFilename so require() of onnxruntime-node / onnxruntime-common
+ * from nested transformers resolves to our direct pinned dependency stack.
+ */
+export declare function installOnnxruntimeResolveShim(): void;
+/** Install resolve shim and fail fast if the platform binding is absent. */
+export declare function prepareOnnxruntimeForTransformers(): void;

package/dist/services/onnxruntime-resolve.js

@@ -0,0 +1,174 @@
+/**
+ * Force resolution of `onnxruntime-node` (and its `onnxruntime-common`) to this
+ * package's direct dependency stack.
+ *
+ * OpenCode installs plugins nested under its own cache. npm/Arborist only honors
+ * `overrides` at the install root, so `@huggingface/transformers` would otherwise
+ * keep nested `onnxruntime-node@1.24.3` (no darwin/x64 binding). See #184 / #158 / #210.
+ *
+ * We pin onnxruntime-node@1.20.1:
+ * - 1.21.0–1.23.2 crash during macOS Ort::Env process-exit teardown (#225 /
+ *   microsoft/onnxruntime#24579); the fix shipped in 1.24.1
+ * - fixed releases still lack darwin/x64 binaries (microsoft/onnxruntime#27961)
+ * - OpenCode's embedded Bun 1.3.14 surfaces the teardown failure as SIGILL
+ *
+ * Transformers must be loaded via its CJS export so this Module._resolveFilename
+ * shim applies; the ESM entry's static `import "onnxruntime-node"` bypasses it.
+ */
+import { createRequire } from "node:module";
+import { existsSync, readdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { createRuntimeRequire } from "./runtime-require.js";
+const PACKAGE_NAME = "onnxruntime-node";
+const COMMON_PACKAGE = "onnxruntime-common";
+const PINNED_VERSION_HINT = "1.20.1";
+const requireFromHere = createRuntimeRequire(import.meta);
+let shimInstalled = false;
+let pinnedPackageRoot = null;
+let pinnedNodeEntry = null;
+let pinnedCommonEntry = null;
+function getPinnedOnnxruntimeEntry() {
+    if (pinnedNodeEntry)
+        return pinnedNodeEntry;
+    pinnedNodeEntry = requireFromHere.resolve(PACKAGE_NAME);
+    return pinnedNodeEntry;
+}
+function getPinnedOnnxruntimeCommonEntry() {
+    if (pinnedCommonEntry)
+        return pinnedCommonEntry;
+    // Resolve common from the pinned node package so we always get the pinned stack,
+    // whether the package manager hoists it or nests it under onnxruntime-node.
+    pinnedCommonEntry = createRequire(getPinnedOnnxruntimeEntry()).resolve(COMMON_PACKAGE);
+    return pinnedCommonEntry;
+}
+export function getPinnedOnnxruntimePackageRoot() {
+    if (pinnedPackageRoot)
+        return pinnedPackageRoot;
+    const entry = getPinnedOnnxruntimeEntry();
+    // package entry is typically …/dist/index.js — walk up to package root
+    let dir = dirname(entry);
+    for (let i = 0; i < 4; i++) {
+        if (existsSync(join(dir, "package.json"))) {
+            pinnedPackageRoot = dir;
+            return dir;
+        }
+        dir = dirname(dir);
+    }
+    pinnedPackageRoot = dirname(entry);
+    return pinnedPackageRoot;
+}
+/**
+ * Resolve the N-API layout directory shipped by the pinned onnxruntime-node
+ * package (`napi-v3` for 1.20.x, `napi-v6` for 1.22.x, …).
+ */
+export function getOnnxruntimeNapiDirName(platform = process.platform, arch = process.arch) {
+    const binDir = join(getPinnedOnnxruntimePackageRoot(), "bin");
+    if (!existsSync(binDir))
+        return "napi-v3";
+    let entries;
+    try {
+        entries = readdirSync(binDir, { withFileTypes: true })
+            .filter((entry) => entry.isDirectory() && /^napi-v\d+$/.test(entry.name))
+            .map((entry) => entry.name)
+            .sort((a, b) => Number(a.slice("napi-v".length)) - Number(b.slice("napi-v".length)));
+    }
+    catch {
+        return "napi-v3";
+    }
+    // Prefer a layout that actually contains the platform binding.
+    for (let i = entries.length - 1; i >= 0; i--) {
+        const name = entries[i];
+        if (existsSync(join(binDir, name, platform, arch, "onnxruntime_binding.node"))) {
+            return name;
+        }
+    }
+    return entries.at(-1) ?? "napi-v3";
+}
+export function getOnnxruntimeBindingPath(platform = process.platform, arch = process.arch) {
+    return join(getPinnedOnnxruntimePackageRoot(), "bin", getOnnxruntimeNapiDirName(platform, arch), platform, arch, "onnxruntime_binding.node");
+}
+export function formatMissingOnnxruntimeBindingError(platform = process.platform, arch = process.arch) {
+    const bindingPath = getOnnxruntimeBindingPath(platform, arch);
+    const intelHint = platform === "darwin" && arch === "x64"
+        ? ` On Intel Mac (darwin/x64), onnxruntime-node@1.21.0–1.23.2 can crash Bun 1.3.14 on process exit (#225), while fixed releases still lack an x64 binding; omms pins ${PINNED_VERSION_HINT}. If this persists after updating, clear OpenCode's plugin cache (~/.cache/opencode/packages/om-memory-system@*, or opencode-mem@* on pre-migration installs) and reinstall, or configure remote embeddings via embeddingApiUrl + embeddingApiKey.`
+        : ` Configure remote embeddings via embeddingApiUrl + embeddingApiKey, or reinstall the plugin so onnxruntime-node@${PINNED_VERSION_HINT} is used.`;
+    return `Local embedding native binding missing for ${platform}/${arch} at ${bindingPath}.${intelHint}`;
+}
+/**
+ * Rewrite onnxruntime-related init failures.
+ *
+ * When the pinned binding is absent, keep the clear "missing" message.
+ * When it is present, preserve the original error so nested-1.24 / dlopen /
+ * codesign failures are not misreported as a missing pinned binding (#210).
+ */
+export function formatOnnxruntimeInitError(error, platform = process.platform, arch = process.arch) {
+    const message = error instanceof Error ? error.message : String(error);
+    const isOnnxRelated = message.includes("onnxruntime_binding.node") ||
+        message.includes("onnxruntime-node") ||
+        message.includes("onnxruntime-common") ||
+        /napi-v\d+\/[^/]+\/[^/]+/.test(message);
+    if (!isOnnxRelated) {
+        return error instanceof Error ? error : new Error(message);
+    }
+    const bindingPath = getOnnxruntimeBindingPath(platform, arch);
+    if (!existsSync(bindingPath)) {
+        return new Error(formatMissingOnnxruntimeBindingError(platform, arch), { cause: error });
+    }
+    const intelHint = platform === "darwin" && arch === "x64"
+        ? ` On Intel Mac nested installs, @huggingface/transformers may resolve onnxruntime-node@1.24+ (no x64 binding); omms pins ${PINNED_VERSION_HINT} via a CJS resolve shim.`
+        : "";
+    return new Error(`ONNX runtime failed to load despite pinned binding being present at ${bindingPath}. Original error: ${message}.${intelHint} If this persists after updating, clear OpenCode's plugin cache (~/.cache/opencode/packages/om-memory-system@*, or opencode-mem@* on pre-migration installs) and reinstall, or configure remote embeddings via embeddingApiUrl + embeddingApiKey.`, { cause: error });
+}
+export function assertOnnxruntimeBindingPresent(platform = process.platform, arch = process.arch) {
+    const bindingPath = getOnnxruntimeBindingPath(platform, arch);
+    if (!existsSync(bindingPath)) {
+        throw new Error(formatMissingOnnxruntimeBindingError(platform, arch));
+    }
+}
+function resolvePinnedRequest(request, packageName, pinnedEntry) {
+    if (request !== packageName && !request.startsWith(`${packageName}/`)) {
+        return null;
+    }
+    try {
+        if (packageName === PACKAGE_NAME) {
+            return requireFromHere.resolve(request);
+        }
+        return createRequire(getPinnedOnnxruntimeEntry()).resolve(request);
+    }
+    catch {
+        if (request === packageName)
+            return pinnedEntry;
+        return null;
+    }
+}
+/**
+ * Patch Module._resolveFilename so require() of onnxruntime-node / onnxruntime-common
+ * from nested transformers resolves to our direct pinned dependency stack.
+ */
+export function installOnnxruntimeResolveShim() {
+    if (shimInstalled)
+        return;
+    // Resolve our pin first so a missing direct dep fails before transformers loads.
+    const pinnedEntry = getPinnedOnnxruntimeEntry();
+    const pinnedCommon = getPinnedOnnxruntimeCommonEntry();
+    const Module = requireFromHere("node:module");
+    const original = Module._resolveFilename;
+    Module._resolveFilename = function (request, parent, isMain, options) {
+        // Only intercept the onnx stack. Forwarding every other request through a
+        // wrapped _resolveFilename is required, but must not alter Bun --compile
+        // parent handling for unrelated packages (#210 follow-up).
+        const pinnedNode = resolvePinnedRequest(request, PACKAGE_NAME, pinnedEntry);
+        if (pinnedNode)
+            return pinnedNode;
+        const pinnedCommonResolved = resolvePinnedRequest(request, COMMON_PACKAGE, pinnedCommon);
+        if (pinnedCommonResolved)
+            return pinnedCommonResolved;
+        return original.call(this, request, parent, isMain, options);
+    };
+    shimInstalled = true;
+}
+/** Install resolve shim and fail fast if the platform binding is absent. */
+export function prepareOnnxruntimeForTransformers() {
+    installOnnxruntimeResolveShim();
+    assertOnnxruntimeBindingPresent();
+}

package/dist/services/privacy.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Replace every `<private>…</private>` region with `[REDACTED]`.
+ *
+ * Scans tags with a depth counter rather than matching pairs with a single
+ * regex, so that the two malformed shapes fail *closed*:
+ *
+ * - An **unclosed** `<private>` redacts to the end of the input. A non-greedy
+ *   pair match found no closing tag and left the region untouched, so a typo or
+ *   a truncated message stored the content verbatim.
+ * - **Nested** tags close at the outer tag, not the first inner one. Pair
+ *   matching ended the region at the inner `</private>`, releasing the rest of
+ *   the outer region and leaving a stray `</private>` in the output.
+ *
+ * Erring toward redaction is the only safe direction here: the caller persists
+ * this string, so a wrong guess in the other direction is an unrecoverable
+ * disclosure, while over-redacting merely loses text the user can retype.
+ *
+ * A `</private>` with no opener is markup rather than content, so it is dropped
+ * instead of being surfaced to the user as if it were part of their text.
+ */
+export declare function stripPrivateContent(content: string): string;
+/**
+ * True when nothing survives redaction — the caller refuses such a write rather
+ * than storing a message that is private in its entirety.
+ */
+export declare function isFullyPrivate(content: string): boolean;

package/dist/services/privacy.js

@@ -0,0 +1,69 @@
+const REDACTED = "[REDACTED]";
+// `<private>` / `</private>`, case-insensitive, tolerating whitespace inside the
+// tag (`<private >`) the way an XML parser would.
+const PRIVATE_TAG = /<(\/?)private\s*>/gi;
+/**
+ * Replace every `<private>…</private>` region with `[REDACTED]`.
+ *
+ * Scans tags with a depth counter rather than matching pairs with a single
+ * regex, so that the two malformed shapes fail *closed*:
+ *
+ * - An **unclosed** `<private>` redacts to the end of the input. A non-greedy
+ *   pair match found no closing tag and left the region untouched, so a typo or
+ *   a truncated message stored the content verbatim.
+ * - **Nested** tags close at the outer tag, not the first inner one. Pair
+ *   matching ended the region at the inner `</private>`, releasing the rest of
+ *   the outer region and leaving a stray `</private>` in the output.
+ *
+ * Erring toward redaction is the only safe direction here: the caller persists
+ * this string, so a wrong guess in the other direction is an unrecoverable
+ * disclosure, while over-redacting merely loses text the user can retype.
+ *
+ * A `</private>` with no opener is markup rather than content, so it is dropped
+ * instead of being surfaced to the user as if it were part of their text.
+ */
+export function stripPrivateContent(content) {
+    if (!content.includes("<")) {
+        return content;
+    }
+    let result = "";
+    let depth = 0;
+    let cursor = 0;
+    PRIVATE_TAG.lastIndex = 0;
+    let match;
+    while ((match = PRIVATE_TAG.exec(content)) !== null) {
+        const isClosing = match[1] === "/";
+        if (!isClosing) {
+            if (depth === 0) {
+                result += content.slice(cursor, match.index);
+            }
+            depth++;
+            cursor = PRIVATE_TAG.lastIndex;
+            continue;
+        }
+        if (depth === 0) {
+            // Stray closing tag: emit the text before it, drop the tag itself.
+            result += content.slice(cursor, match.index);
+            cursor = PRIVATE_TAG.lastIndex;
+            continue;
+        }
+        depth--;
+        if (depth === 0) {
+            result += REDACTED;
+        }
+        cursor = PRIVATE_TAG.lastIndex;
+    }
+    if (depth > 0) {
+        // Unclosed region: everything from the opening tag onward stays private.
+        return result + REDACTED;
+    }
+    return result + content.slice(cursor);
+}
+/**
+ * True when nothing survives redaction — the caller refuses such a write rather
+ * than storing a message that is private in its entirety.
+ */
+export function isFullyPrivate(content) {
+    const stripped = stripPrivateContent(content).trim();
+    return stripped === REDACTED || stripped === "";
+}

package/dist/services/request-timeouts.d.ts

@@ -0,0 +1,9 @@
+export declare const EXTERNAL_PROFILE_CLEANUP_TIMEOUT_MS = 60000;
+export declare const OPENCODE_PROFILE_CLEANUP_TIMEOUT_MS = 300000;
+export declare const NODE_HTTP_IDLE_TIMEOUT_MS: number;
+/**
+ * Upper bound an OpenCode v2 model request waits for the per-prompt memory
+ * search started in the `prompt` hook. On timeout the request proceeds
+ * without memory rather than stalling the agent.
+ */
+export declare const V2_RETRIEVAL_TIMEOUT_MS = 5000;

package/dist/services/request-timeouts.js

@@ -0,0 +1,11 @@
+export const EXTERNAL_PROFILE_CLEANUP_TIMEOUT_MS = 60_000;
+export const OPENCODE_PROFILE_CLEANUP_TIMEOUT_MS = 300_000;
+const HTTP_TIMEOUT_GRACE_MS = 30_000;
+export const NODE_HTTP_IDLE_TIMEOUT_MS = Math.max(EXTERNAL_PROFILE_CLEANUP_TIMEOUT_MS, OPENCODE_PROFILE_CLEANUP_TIMEOUT_MS) +
+    HTTP_TIMEOUT_GRACE_MS;
+/**
+ * Upper bound an OpenCode v2 model request waits for the per-prompt memory
+ * search started in the `prompt` hook. On timeout the request proceeds
+ * without memory rather than stalling the agent.
+ */
+export const V2_RETRIEVAL_TIMEOUT_MS = 5_000;

package/dist/services/runtime-require.d.ts

@@ -0,0 +1,17 @@
+export type RuntimeImportMeta = ImportMeta & {
+    require?: NodeRequire;
+    path?: string;
+    dirname?: string;
+    dir?: string;
+    resolve?: (specifier: string) => string;
+};
+/**
+ * Build a require() for resolving/loading packages next to this plugin module.
+ * Throws a concrete diagnostic when no usable Bun/Node anchor exists.
+ *
+ * Prefer a path/url-anchored createRequire over Bun's import.meta.require when a
+ * concrete file anchor exists. In OpenCode's Bun --compile host, import.meta.url
+ * and import.meta.path are still valid for dynamically imported plugins even when
+ * some require referrers later surface as `from ''` (#210).
+ */
+export declare function createRuntimeRequire(meta: RuntimeImportMeta): NodeRequire;