open-memex 0.7.0-alpha.11 → 0.7.0-alpha.15

package/AGENTS.md

@@ -14,7 +14,7 @@ via `prepublishOnly` — Node refuses `--experimental-strip-types` for files und
 - **CLI** (`src/cli.ts`) and smoke tests run under **Node 22+** with `--experimental-strip-types`. SQLite here is `better-sqlite3` (native module).
 - **MCP server** (`src/mcp.ts`, stdio) runs under **Node 22+** with `--experimental-strip-types`. It exposes the same eleven memory tools to any MCP client (VS Code Copilot, Cursor, Claude Code). **stdout is the protocol channel — never log to stdout in `mcp.ts`; diagnostics go to stderr.**
 
-`src/store/db.ts` picks the backend at runtime by sniffing `globalThis.Bun`. Both backends share the same surface (`new Database(path)`, `.exec`, `.prepare().run/all/get`, `.close`). Any DB code you write must stay on that common subset — do not import `better-sqlite3` or `bun:sqlite` directly outside `db.ts`.
+`src/store/db.ts` picks the backend at runtime by sniffing `globalThis.Bun`. Both backends share the same surface (`new Database(path)`, `.exec`, `.prepare().run/all/get`, `.close`). Any DB code you write must stay on that common subset — do not import `better-sqlite3` or `bun:sqlite` directly outside `db.ts`. The Node driver is pinned to the `better-sqlite3` 13 N-API line (D72): the pre-13 `node::ObjectWrap` build aborts intermittently on Node 24.19+ when a prepared statement is finalized by GC.
 
 Tool logic is host-agnostic and lives in `src/tools/ops.ts` (plain functions + shared zod arg shapes + `TOOL_DESCRIPTIONS`). `src/tools/memory.ts` (opencode) and `src/mcp.ts` are thin adapters — when adding or changing a tool, change `ops.ts` once and both hosts pick it up.
 
@@ -126,6 +126,7 @@ Layout: `memories/<scope_key>/<id>.md` (YAML frontmatter + body) + `index.db` (S
 
 - `personal` scope key is literal `"personal"` (v1 called this `user`; renamed in v2, design §19).
 - `project` scope key: `project__<sanitized-name>__<12-hex-sha256>`, seeded from normalized git origin URL, else lowercased cwd. See `src/scope.ts`. Same repo across machines → same key (intentional; enables future git-commit of memories).
+- The root a host adapter seeds on matters: OpenCode v1 reports the **filesystem root** as `worktree` for non-git folders, so the v1 adapter goes through `pickScopeRoot` (src/scope.ts) — `worktree` only when it is a real directory below the filesystem root, else the opened `directory` (D71). Seeding on a filesystem root merges every non-git folder on a drive into one `project__workspace__…` bucket.
 - `org`, `team`, `public` are reserved — the schema rejects writes. See `docs/SCOPES.md`.
 - The scope key **changes** when a repo gains/loses a git origin. `src/index.ts` logs a one-shot warning on load if it finds files under the legacy cwd-only key (`resolveCwdScope`). Use `cli scopes` to enumerate all scope dirs and `cli migrate --from <old>` to reconcile — see `src/store/migrate.ts`. No auto-migration; two unrelated repos at the same cwd would silently merge.
 - Read-only callers must use `memoriesDirPath` (in `src/paths.ts`), never `memoriesDirFor`. The latter `mkdir -p`s the directory as a side effect and will pollute storage with empty scope dirs.
@@ -161,15 +162,17 @@ AGENTS.md hygiene footer, the MCP handshake, and the tool descriptions.
 
 Keyword capture fires from `chat.message` on the user's message parts (`UserMessage`). Patterns live in `src/capture/keywords.ts` / config `keywordPatterns`; regex group 1 is the memory body. Scope routing: personal patterns (`cfg.keywordPersonalPatterns`) force the personal scope — the rule is 我 → personal (记住我/替我记/帮我记/我觉得/我喜欢/remember for me/help me remember), 我们 → current scope (我们认为/我们决定/帮我们记住); personal patterns run first and claim their line so a generic trigger can't double-fire (a rejected personal match keeps the claim — see D67).
 
+D73 — one user statement, one memory. The hook and the agent are two writers for one turn, and only the hook knows the sentence is stored. Both hooks therefore take the session id (`chat.message` on v1, `prompt` on v2), `captureFromText` records each capture in `PluginState.captures`, and the system/context hook pushes the hand-off note (`captureHandoff` → `formatHandoffBlock`, `src/capture/handoff.ts`) once per capture. `memory_add` additionally refuses a write overlapping a `source: keyword`/`user` memory created in the same scope within `TURN_ECHO_WINDOW_MS` (`findTurnEcho`, threshold `TURN_ECHO_THRESHOLD` = 0.28) and returns the stored id plus the supersede route. Keep the note, the refusal text, `TOOL_DESCRIPTIONS.memory_add`, the skill, and this paragraph saying the same thing — an agent that reads only one of them still has to behave. Never lower `TURN_ECHO_THRESHOLD` to catch more: the measured reason it is high is that an agent's gloss (0.211) and a genuinely new fact from the same sentence (0.214) are lexically indistinguishable.
+
 D67 rules for any new pattern: a trigger must be a **statement to the store**, not narration — 记得… / `remind me to…` are deliberately out, and the ambiguous forms require an explicit marker (`别忘了：…`, `don't forget: …`, `don't forget that …`). The 帮/替/我们 family takes the full verb phrase (`记` + optional `住|录`, never followed by a verb continuation) + optional `一下`; the separator boundary applies to the **bare** verb only, so `帮我记一下这个配置` captures while `帮我记得带伞` cannot produce mid-word garbage. Bodies under `MIN_CAPTURE_CHARS` (3) are rejected as fragments — never lower the floor silently; `scanKeywords` returns the drop so `capture --dry-run` and the debug log can report it.
 
 Context injection happens exactly once per session in `experimental.chat.system.transform`, guarded by an in-memory `Set<sessionID>` in `src/index.ts`. It is not persisted — restarting opencode re-injects on the next first turn.
 
 ## Design constraints — read the frozen design first
 
-`docs/V2-DESIGN.md` is the frozen protocol v0.2 (decisions settled through D69; open questions tracked at the end of the doc). Per its §12:
+`docs/V2-DESIGN.md` is the frozen protocol v0.2 (decisions settled through D73; open questions tracked at the end of the doc). Per its §12:
 AGENTS.md answers "how should AI work here"; the design doc answers "why is it
-built this way" (principles, iron rules, the append-only decision log, currently D1–D70). Before changing
+built this way" (principles, iron rules, the append-only decision log, currently D1–D73). Before changing
 architecture, scope semantics, lifecycle, or the protocol surface (frontmatter
 schema, MCP tools, CLI contract), read the relevant design section — the decision
 log records what was already considered and rejected.

package/CHANGELOG.md

@@ -9,6 +9,22 @@ the `@alpha` tag are development snapshots and are not listed individually.
 
 ## [Unreleased]
 
+## One thing you said is one memory (D73)
+
+Saying "remember ." used to save the same statement up to three times: the keyword hook stored your sentence verbatim with no agent in the loop, then the agent - which could see the chat but not the store - saved its own paraphrase beside it, and `memory_add`'s near-duplicate check scored the two too far apart (0.21-0.38 against a 0.80 bar) to notice. `open-memex audit` reported zero near-duplicates while three copies sat in the folder, and search returned all of them.
+
+- **The agent is told what was already stored.** When the keyword hook captures a sentence, the plugin records it against the session and the next system context carries a short note naming the stored memory. Do not save that text again in any rewording; save only what it does not contain, or `memory_supersede` it. Delivered once per capture, in memory only (nothing new is written to disk).
+- **`memory_add` refuses the echo anyway.** A write that overlaps a memory captured from your own words in the same scope within the last 10 minutes is refused with the stored id, as a deterministic backstop for when the note is not enough. The bar is deliberately high (0.28 token overlap) and never applies to the agent's own inferences - a distinct fact the same sentence carried still saves normally. A refusal is recoverable: supersede the stored one, or re-save with only the new information.
+- Reports nothing and changes no data: existing memories are not merged or rewritten, and the near-duplicate notice for ordinary agent saves is unchanged.
+
+## Node 24 CLI aborts: SQLite driver moves to the N-API line (D72)
+
+- **Fixed: CLI processes intermittently aborted on Node 24.19+.** `better-sqlite3` 11 could finalize a prepared statement from a garbage-collection callback after Node's environment was gone (`RemoveEnvironmentCleanupHook ... Assertion failed`), killing the process with `SIGABRT` and losing its output even though the memory work had already landed. The driver is now `better-sqlite3` 13 (the N-API rewrite; Node �22 unchanged) - same API surface, no protocol or data change. If you build from source on Node 24.19+, reinstall dependencies so the new driver is picked up.
+
+## Non-git folders shared one scope bucket (D71)
+
+- **Fixed: every non-git folder on a drive shared a single project scope.** OpenCode v1 reports the filesystem root (`C:\`, `/`) as the project `worktree` when the opened folder is not a git repo, and the plugin seeded its scope on that root — so unrelated folders like `C:\temp` and `C:\scratch` all wrote to one `project__workspace__…` bucket. The scope now seeds on the folder actually opened (`pickScopeRoot` in `src/scope.ts`); real repo worktrees are unchanged. Memories already saved under the shared bucket are not moved automatically: run `open-memex scopes` to spot it, then `open-memex migrate --from <old-key>`.
+
 ## Visibility follow-ups: one number, one guard, one truth (D70)
 
 Review of the D68/D69 inventory surfaces — each was honest on its own, and they disagreed with each other:
@@ -29,7 +45,7 @@ Review of the D68/D69 inventory surfaces — each was honest on its own, and the
 Group 3-C — the surface a user reads to learn what the store actually remembers:
 
 - **`memory_list` is now a numbered inventory.** Lines are structured (`[type] id=… created=… source=…`), keep the raw provenance, and every listing states its true total — a truncated list says how many entries it is not showing instead of quietly looking complete. New input `include: "active" | "all"` (default `active`): **behavior change** — superseded versions, retracted and archived memories no longer appear unless you pass `include=all` (the audit view). The CLI gains the matching `list --include` flag.
-- **`open-memex inventory`** renders the same data as readable text (default) or JSON (`--format json`, format `open-memex-inventory/2` — bumped from `/1` in D70, which dropped the absolute file path) — personal plus the current project, outbox drafts in their own section, hidden history counted rather than silently dropped. A report containing personal memories refuses to be written inside a git working tree without `--allow-personal`.
+- **`open-memex inventory`** renders the same data as readable text (default) or JSON (`--format json`, format `open-memex-inventory/1`) — personal plus the current project, outbox drafts in their own section, hidden history counted rather than silently dropped. A report containing personal memories refuses to be written inside a git working tree without `--allow-personal`.
 - **Hide instead of delete:** `memory_forget` gains `soft=true` (CLI: `forget --soft`) — the memory is retracted: out of lists and search, file kept. Still one-way (D64): bringing the fact back means saving it again.
 - **Guidance kept in one voice:** the tool descriptions, the MCP session-start instructions, SKILL.md and the `distill-agents` AGENTS.md snippet all teach the same flow — answer "what do you remember?" conversationally from the inventory, re-list before acting on a number, read an entry back before deleting it.
 

package/README.md

@@ -375,7 +375,11 @@ Three ways memories get in:
   `don't forget the wifi password` never fire (add a separator — `别忘了：…`,
   `don't forget: …` — or `that` to make it an instruction); and a captured body
   under 3 characters is rejected as a fragment rather than saved — `capture
-  --dry-run` says so instead of dropping it silently.
+  --dry-run` says so instead of dropping it silently. A trigger also owns its
+  own sentence: the plugin tells the agent what it just stored, and a
+  `memory_add` that re-saves the same words within the next few minutes is
+  refused with the stored id (D73) — one thing you said is one memory, not
+  three copies of it.
 - **The agent saves it**: in any editor, ask your agent to remember something
   (or it saves on its own when you state a fact worth keeping) — it calls
   `memory_add`. The routing above is a heuristic; you can always say "save this

package/README.zh-CN.md

@@ -252,7 +252,7 @@ open-memex uninstall --yes
 
 三种存入方式：
 
-- **关键词触发**（仅 opencode 原生插件）：说 `remember …`、`note that …`、`don't forget: …`、`TIL …`、`save this …`——中文 `记住…` / `记一下…` / `记录一下…` / `别忘了：…`——这句话就被存下来，不需要任何工具调用。捕获默认进当前 **project**；`remember for me …`、`help me remember: …`、`记住我…`、`替我记…`、`帮我记…`、`我觉得…`、`我喜欢…` 这类"这是关于我"的信号会改为进 **personal**；`我们决定…`、`帮我们记住…` 等团队语境仍留在项目里。两条降噪规则（D67）：触发词必须是**对存储说的话**，所以叙述型的 `记得…` / `remind me to…` / `别忘了带伞` / `don't forget the wifi password` 一律不触发（加一个分隔符——`别忘了：…`、`don't forget: …`——或用 `that`，才算指令）；捕获内容不足 3 个字符按碎片丢弃，不会存下来——`capture --dry-run` 会明确说明，不再悄悄吞掉。
+- **关键词触发**（仅 opencode 原生插件）：说 `remember …`、`note that …`、`don't forget: …`、`TIL …`、`save this …`——中文 `记住…` / `记一下…` / `记录一下…` / `别忘了：…`——这句话就被存下来，不需要任何工具调用。捕获默认进当前 **project**；`remember for me …`、`help me remember: …`、`记住我…`、`替我记…`、`帮我记…`、`我觉得…`、`我喜欢…` 这类"这是关于我"的信号会改为进 **personal**；`我们决定…`、`帮我们记住…` 等团队语境仍留在项目里。两条降噪规则（D67）：触发词必须是**对存储说的话**，所以叙述型的 `记得…` / `remind me to…` / `别忘了带伞` / `don't forget the wifi password` 一律不触发（加一个分隔符——`别忘了：…`、`don't forget: …`——或用 `that`，才算指令）；捕获内容不足 3 个字符按碎片丢弃，不会存下来——`capture --dry-run` 会明确说明，不再悄悄吞掉。另外，一句触发捕获的话只归一条记忆：插件会把它刚存下的内容告诉助手，几分钟内再用 `memory_add` 重复存同样的字眼会被拒绝（并给出已存的 id，D73）——你说的一件事就是一条记忆，不是它的三个副本。
 - **助手主动保存**：在任何编辑器里，你让助手记住某件事（或者你陈述了一个值得记的事实、它自己判断该保存），它会调用 `memory_add`。上面的路由是启发式规则；你可以明说"存到我的个人记忆"，或用 CLI 加 `--scope` 明确指定。
 - **检查点提议**：一个任务收尾时，助手会提议 1–3 条从这轮工作里提炼的候选记忆——决定及其理由、约定、踩过的坑、走过又放弃的路——只有你点头的那几条才存。不会有任何东西在你不知情时被写下来。
 - **CLI**：`open-memex add "…"`，可选 `--scope` / `--tag` / `--type` / `--aliases`。

package/dist/.build-stamp

@@ -1 +1 @@
-2800e45cb31d71e3355d41c293cc51de833adec76995ac95b42d10707d04bb92
+c84b05d4afadebb4346f31a95ca00c4075a700269fc5019453799d0eeeb8b09e

package/dist/capture/handoff.js

@@ -0,0 +1,59 @@
+/**
+ * Turn hand-off between keyword capture and the agent (D73).
+ *
+ * The keyword hook and the agent are two writers for one user turn. The hook
+ * stores the user's sentence verbatim, with no agent in the loop; the agent
+ * then sees only the chat transcript and cannot tell the sentence is already
+ * stored, so it saves its own paraphrase — the same statement lands two or
+ * three times (observed 2026-10-04: one `remember …` sentence → one
+ * `source: keyword` file plus two `source: tool` files).
+ *
+ * Two mechanisms, in this order:
+ *   (a) the hand-off note — this module's `formatHandoffBlock`, pushed into the
+ *       turn's system context so the agent knows what is already stored;
+ *   (b) the turn-echo guard — `TURN_ECHO_THRESHOLD` below, enforced in
+ *       `addMemory` (src/tools/ops.ts) over what the hook just wrote.
+ *
+ * Pure module: no db, no fs, no config, so the threshold behavior is testable
+ * in scripts/smoke-pure.ts.
+ */
+/**
+ * Overlap bar for refusing a re-save of a just-captured user statement.
+ *
+ * Deliberately high, and only ever applied to memories the *hook* wrote
+ * (`source: keyword` / `user`) inside `TURN_ECHO_WINDOW_MS`. Measured on the
+ * reported case and its near neighbours (token Jaccard, see
+ * `similarity` in src/store/lifecycle.ts): a wholesale re-save of the captured
+ * sentence scores 0.29–0.36, while a genuinely distinct fact the same
+ * sentence also contained scores 0.21 and below. Lexical overlap cannot
+ * separate an agent's gloss from a new fact — those two measured 0.211 and
+ * 0.214 — so the guard sits at the high-confidence end and everything under
+ * the bar is left to (a) and the agent's judgment. A refusal is always
+ * reported with the stored id, so the caller can supersede or rephrase.
+ */
+export const TURN_ECHO_THRESHOLD = 0.28;
+/** How long a hook capture counts as "this turn" (10 minutes). */
+export const TURN_ECHO_WINDOW_MS = 10 * 60 * 1000;
+export function isTurnEcho(score) {
+    return score >= TURN_ECHO_THRESHOLD;
+}
+/** Records still inside the window. */
+export function freshCaptures(records, now) {
+    return records.filter((r) => now - r.at <= TURN_ECHO_WINDOW_MS);
+}
+function preview(content) {
+    const one = content.replace(/\s+/g, " ").trim();
+    return one.length > 160 ? `${one.slice(0, 160)}…` : one;
+}
+/** The hand-off note (a). Empty string when there is nothing to hand off. */
+export function formatHandoffBlock(records) {
+    if (records.length === 0)
+        return "";
+    const lines = records.map((r) => `- id=${r.id} (${r.scopeKey}) — "${preview(r.content)}"`);
+    return [
+        "[open-memex] The user's own wording in this turn was ALREADY stored verbatim, before you saw it. It is not unsaved.",
+        ...lines,
+        "Do not call memory_add to save that text again in any rewording — one statement is already one memory, and a rewording only adds a second copy that retrieval will return alongside the first.",
+        "Save a memory only for information those lines do NOT contain, as its own self-contained statement. If your version is meant to replace one of them, call memory_supersede with that id instead of memory_add.",
+    ].join("\n");
+}

package/dist/index.js

@@ -1,4 +1,5 @@
-import { PLUGIN_ID, bootstrapPlugin, captureFromText, injectOnce, } from "./plugin-core.js";
+import { PLUGIN_ID, bootstrapPlugin, captureFromText, captureHandoff, injectOnce, } from "./plugin-core.js";
+import { pickScopeRoot } from "./scope.js";
 import { makeTools } from "./tools/memory.js";
 import { v2Plugin } from "./opencode-v2.js";
 /**
@@ -12,23 +13,30 @@ import { v2Plugin } from "./opencode-v2.js";
  * type-only (D58), and v2's decode is structural.
  */
 const server = async ({ worktree, directory }) => {
-    const roots = worktree || directory || process.cwd();
-    const state = bootstrapPlugin(roots);
+    // v1's `worktree` is the filesystem root for non-git folders — never seed a
+    // scope on it (D71). `pickScopeRoot` falls back to the opened `directory`.
+    const state = bootstrapPlugin(pickScopeRoot(worktree, directory));
     const tools = makeTools(() => state.scope, state.cfg);
     return {
         tool: tools,
-        async "chat.message"(_input, output) {
+        async "chat.message"(input, output) {
             const parts = (output.parts ?? []);
             const text = parts
                 .map((p) => (p?.type === "text" ? p.text ?? "" : ""))
                 .filter(Boolean)
                 .join("\n");
-            captureFromText(text, state);
+            captureFromText(text, state, input.sessionID ?? "");
         },
         async "experimental.chat.system.transform"(input, output) {
-            injectOnce(input.sessionID ?? "", state, (block) => {
+            const sessionID = input.sessionID ?? "";
+            injectOnce(sessionID, state, (block) => {
                 output.system.push(block);
             });
+            // D73: runs on every request, so the note lands on the very turn whose
+            // message the hook just captured. Delivered once per capture.
+            const handoff = captureHandoff(sessionID, state);
+            if (handoff)
+                output.system.push(handoff);
         },
     };
 };

package/dist/opencode-v2.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { PLUGIN_ID, bootstrapPlugin, captureFromText, injectOnce, } from "./plugin-core.js";
+import { PLUGIN_ID, bootstrapPlugin, captureFromText, captureHandoff, injectOnce, } from "./plugin-core.js";
 import { makeTools } from "./tools/memory.js";
 /** Register the five memory tools on a v2 host. */
 async function registerTools(ctx, state) {
@@ -28,12 +28,17 @@ export const v2Plugin = {
         const registrations = [];
         await registerTools(ctx, state);
         registrations.push(await ctx.session.hook("prompt", (ev) => {
-            captureFromText(ev.prompt?.text ?? "", state);
+            captureFromText(ev.prompt?.text ?? "", state, ev.sessionID ?? "");
         }));
         registrations.push(await ctx.session.hook("context", (ev) => {
-            injectOnce(ev.sessionID ?? "", state, (block) => {
+            const sessionID = ev.sessionID ?? "";
+            injectOnce(sessionID, state, (block) => {
                 ev.system.push({ type: "text", text: block });
             });
+            // D73: tell the agent what the keyword hook already stored this turn.
+            const handoff = captureHandoff(sessionID, state);
+            if (handoff)
+                ev.system.push({ type: "text", text: handoff });
         }));
         return () => {
             for (const r of registrations)

package/dist/plugin-core.js

@@ -6,6 +6,7 @@ import { scopeHasFiles } from "./store/migrate.js";
 import { writeMemoryFile, readMemoryFile, ulid, msToRfc3339, } from "./store/markdown.js";
 import { buildContextBlock } from "./retrieve/inject.js";
 import { detectKeywords } from "./capture/keywords.js";
+import { formatHandoffBlock, freshCaptures, } from "./capture/handoff.js";
 import { findDuplicates } from "./store/lifecycle.js";
 import { redact } from "./redact.js";
 /**
@@ -44,14 +45,16 @@ export function bootstrapPlugin(root) {
     catch (err) {
         console.error("[open-memex] init failed:", err);
     }
-    return { cfg, scope, injectedSessions: new Set() };
+    return { cfg, scope, injectedSessions: new Set(), captures: new Map() };
 }
 /**
  * Keyword capture (§ capture): scan one user message for "remember …"
  * triggers and save each hit. Shared by the v1 `chat.message` hook and
- * the v2 session `prompt` hook — both hand us the message text.
+ * the v2 session `prompt` hook — both hand us the message text and the
+ * session id. The session id is what makes the D73 hand-off possible: without
+ * it the agent never learns the sentence is already stored.
  */
-export function captureFromText(text, state) {
+export function captureFromText(text, state, sessionID) {
     const { cfg, scope } = state;
     if (!cfg.keywordCaptureEnabled || !text)
         return;
@@ -106,12 +109,54 @@ export function captureFromText(text, state) {
             // offers no toast channel, so the plugin log is the feedback surface.
             const preview = content.length > 60 ? content.slice(0, 60) + "…" : content;
             console.log(`[open-memex] remembered → ${target.kind} scope: "${preview}"`);
+            // D73 hand-off: the agent gets told about this capture in the turn's
+            // system context, so it does not save the same statement again.
+            recordCapture(state, sessionID, { id: fm.id, scopeKey: target.key, content, at: now });
         }
         catch (err) {
             console.error("[open-memex] keyword capture failed:", err);
         }
     }
 }
+/** Note one hook capture against its session (D73). No-op without a session. */
+function recordCapture(state, sessionID, record) {
+    if (!sessionID)
+        return;
+    const list = state.captures.get(sessionID) ?? [];
+    list.push(record);
+    state.captures.set(sessionID, list);
+}
+/**
+ * D73 hand-off note (a): what the keyword hook already stored for this
+ * session, delivered once per capture into the turn's system context. The
+ * agent cannot avoid re-saving a statement it cannot see is stored, so the
+ * store tells it. Returns "" when there is nothing new to hand off; stale
+ * records are pruned (in-memory only, like `injectedSessions`).
+ *
+ * Both host adapters push this from their system/context hook — the one that
+ * runs before the model request, i.e. after `chat.message` / `prompt`.
+ */
+export function captureHandoff(sessionID, state) {
+    if (!sessionID)
+        return "";
+    const list = state.captures.get(sessionID);
+    if (!list || list.length === 0)
+        return "";
+    const now = Date.now();
+    const fresh = freshCaptures(list, now);
+    if (fresh.length !== list.length) {
+        if (fresh.length === 0)
+            state.captures.delete(sessionID);
+        else
+            state.captures.set(sessionID, fresh);
+    }
+    const pending = fresh.filter((r) => !r.delivered);
+    if (pending.length === 0)
+        return "";
+    for (const r of pending)
+        r.delivered = true;
+    return formatHandoffBlock(pending);
+}
 /**
  * First-turn context injection: exactly once per session. The host adapter
  * supplies `push` (v1: output.system.push; v2: the session context hook's

package/dist/scope.js

@@ -57,6 +57,23 @@ export function resolveCwdScope(worktree) {
         projectName = "workspace";
     return scopeFromSeed(seed, projectName);
 }
+/** Pick the directory that seeds scope resolution from a host's candidate
+ *  roots. OpenCode v1 hands the plugin both `worktree` (the repo root — but
+ *  the filesystem root, e.g. `C:\` or `/`, when the opened folder is not a
+ *  git repo) and `directory` (the folder actually opened). Seeding on a
+ *  filesystem root collapses every non-git folder on a drive into one shared
+ *  `project__workspace__…` scope (D71), so prefer `worktree` only when it is
+ *  a real directory below the filesystem root. */
+export function pickScopeRoot(worktree, directory) {
+    const isFsRoot = (p) => path.parse(p).root === p;
+    if (worktree && !isFsRoot(worktree))
+        return worktree;
+    if (directory)
+        return directory;
+    if (worktree)
+        return worktree;
+    return process.cwd();
+}
 export function resolveProjectScope(worktree) {
     const target = worktree && worktree.length > 0 ? worktree : ".";
     const remote = tryGitRemote(target);

package/dist/store/lifecycle.js

@@ -5,6 +5,7 @@ import { db } from "./db.js";
 import { paths, projectRoot, inRepoMemoriesDirPath, } from "../paths.js";
 import { loadConfig } from "../config.js";
 import { cjkIndexText } from "../retrieve/cjk.js";
+import { isTurnEcho } from "../capture/handoff.js";
 import { parse, serialize, atomicWriteTextSync, ulid, msToRfc3339, } from "./markdown.js";
 /**
  * Dedup + lifecycle (V2-DESIGN §3.3, §3.4).
@@ -40,6 +41,10 @@ export function similarity(a, b) {
     return union === 0 ? 0 : inter / union;
 }
 export const NEAR_DUP_THRESHOLD = 0.8;
+/** `source` values the keyword hook (or an agent marking a user statement) writes.
+ *  Only these are turn-echo candidates — a `tool` memory is the agent's own
+ *  inference and keeps the 0.8 near-dup notice instead of a refusal. */
+const ECHO_SOURCES = "('keyword','user')";
 /** Find exact + near duplicates of `body` among ACTIVE memories in scope. */
 export function findDuplicates(scopeKey, body, excludeId) {
     const hash = contentHash(body);
@@ -64,6 +69,43 @@ export function findDuplicates(scopeKey, body, excludeId) {
     near.sort((x, y) => y.score - x.score);
     return { exact, near: near.slice(0, 3) };
 }
+/**
+ * D73: memories written from the user's own words moments ago — the keyword
+ * hook's captures, plus agent saves marked `source: user`. `memory_add` uses
+ * this to refuse a re-save of a statement the store already holds verbatim
+ * (see TURN_ECHO_THRESHOLD in src/capture/handoff.ts for why the bar is high).
+ * `created_at` is epoch ms in the index, so the window is a numeric compare.
+ */
+export function findTurnEcho(scopeKey, body, windowMs) {
+    const cutoff = Date.now() - windowMs;
+    let rows;
+    try {
+        rows = db()
+            .prepare(`SELECT id, content, source, created_at FROM memories
+         WHERE scope_key = ? AND status = 'active'
+           AND source IN ${ECHO_SOURCES} AND created_at >= ?`)
+            .all(scopeKey, cutoff);
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const r of rows) {
+        if (typeof r.created_at !== "number" || r.created_at < cutoff)
+            continue;
+        const score = similarity(body, r.content);
+        if (isTurnEcho(score)) {
+            out.push({
+                id: r.id,
+                score,
+                source: r.source,
+                snippet: r.content.replace(/\s+/g, " ").trim().slice(0, 120),
+            });
+        }
+    }
+    out.sort((x, y) => y.score - x.score);
+    return out.slice(0, 3);
+}
 /** Locate a memory file by id: index file_path first, then dir-scan fallback. */
 export function findMemoryFile(id) {
     const { memories } = paths();

package/dist/tools/ops.js

@@ -13,7 +13,8 @@ import { search, list, countList, hitStateLabel } from "../retrieve/search.js";
 import { formatInventoryLine, truncationNote } from "../retrieve/display.js";
 import { writeMemoryFile, readMemoryFile, ulid, msToRfc3339, MEMORY_TYPE_TAXONOMY, normalizeAliases, } from "../store/markdown.js";
 import { upsertFromFile, deleteFromIndex } from "../store/sync.js";
-import { findDuplicates, supersede, setStatus } from "../store/lifecycle.js";
+import { findDuplicates, findTurnEcho, supersede, setStatus } from "../store/lifecycle.js";
+import { TURN_ECHO_WINDOW_MS } from "../capture/handoff.js";
 import { db } from "../store/db.js";
 import { redact } from "../redact.js";
 import { getSyncStatus, formatSyncStatus, submitMemories, outboxDraftCount } from "../submit.js";
@@ -37,7 +38,7 @@ export async function withOutboxNote(scopeKey, p, reviewHint) {
 }
 /** LLM-facing tool descriptions, shared by the opencode plugin and the MCP server. */
 export const TOOL_DESCRIPTIONS = {
-    memory_add: "Save a fact, preference, decision, or note to persistent local memory. Call this PROACTIVELY whenever the user shares something worth remembering across sessions — project conventions, tool choices, personal preferences, decisions made, error fixes and their causes. Worth saving: decisions and their reasons, preferences, conventions, gotchas, approaches tried and abandoned. Not worth saving: one-off task details or anything re-derivable from the code. Do not wait to be asked. For facts you infer yourself rather than the user stating, propose them first and save only on approval. Keep each memory to one self-contained statement; attach aliases when the parameter is available. Default scope is the current project; use the personal scope for facts about the user that apply across all projects.",
+    memory_add: "Save a fact, preference, decision, or note to persistent local memory. Call this PROACTIVELY whenever the user shares something worth remembering across sessions — project conventions, tool choices, personal preferences, decisions made, error fixes and their causes. Worth saving: decisions and their reasons, preferences, conventions, gotchas, approaches tried and abandoned. Not worth saving: one-off task details or anything re-derivable from the code. Do not wait to be asked. For facts you infer yourself rather than the user stating, propose them first and save only on approval. Keep each memory to one self-contained statement; attach aliases when the parameter is available. If a note tells you the user's own wording was already stored verbatim this turn, that statement is already saved: do not retry it in a rewording — save only what that text does not contain, or use memory_supersede on the given id. Default scope is the current project; use the personal scope for facts about the user that apply across all projects.",
     memory_search: "Search persistent memory by keyword (BM25 full-text). Returns matching memories from the current project and/or personal scope. Call before asking the user about past decisions, conventions, or preferences they may have told you before. Search well: break the question into its concepts and try 2–3 phrasings per concept — synonyms, the user's other language, shorter keyword forms — and check the other scope too, before concluding nothing is stored.",
     memory_list: "List memories in a scope, newest first, as a numbered inventory. Each line keeps the raw fields — [type] id=… created=… source=… — say them back to the user in plain words (source=user → 'you told me this'; inference → 'I inferred this, check me'; keyword → 'caught from your own wording'), never read the raw id aloud unless they ask. When the user asks 'what do you remember about me?', use scope=both and present the inventory conversationally. The user may point at an entry by its number ('delete #3'): numbers are only valid for the listing you just produced — re-run memory_list, read the candidate back in full, and get a confirmation before calling memory_forget (deletion is permanent). include=all is the audit view (superseded versions, retracted, archived also shown).",
     memory_supersede: "Replace an existing memory with a newer version. The old memory is kept as history (status: superseded) and retrieval returns the new one. Use when a saved fact becomes outdated and should be replaced rather than duplicated.",
@@ -197,6 +198,26 @@ export async function addMemory(getScope, cfg, args) {
             output: `Identical memory already exists: id=${dups.exact.id}. Not duplicated.`,
         };
     }
+    // D73: one user statement, one memory. The keyword hook stores the user's
+    // sentence verbatim with no agent in the loop; a paraphrase of that same
+    // sentence is refused instead of written beside it. The stored id comes back
+    // so the caller can supersede it or save only the genuinely new part.
+    const echo = findTurnEcho(s.key, redacted, TURN_ECHO_WINDOW_MS);
+    if (echo.length > 0) {
+        const top = echo[0];
+        const others = echo
+            .slice(1)
+            .map((e) => `id=${e.id} (${e.source}, overlap ${e.score.toFixed(2)})`)
+            .join(", ");
+        return {
+            title: "memory: already captured verbatim",
+            output: `Not saved — the user's own words were already stored moments ago (source: ${top.source}, overlap ${top.score.toFixed(2)}): ` +
+                `id=${top.id} — ${top.snippet}` +
+                (others ? `\nAlso matching: ${others}` : "") +
+                `\nDo not retry with a rewording: that only adds a second copy of one statement. ` +
+                `Save a separate memory only for information that stored text does not contain, or call memory_supersede on that id if this replaces it.`,
+        };
+    }
     const fm = buildFrontmatter(s, {
         type: args.type ?? "fact",
         tags: args.tags ?? [],

package/docs/TEST-PLAN.md

@@ -73,7 +73,7 @@
 
 ## H. 已知问题观察
 
-- [ ] better-sqlite3 在 Node 24 退出时偶发 crash（exit 134）：注意是否丢数据（预期：不丢，只影响退出码）
+- [x] better-sqlite3 在 Node 24 退出时偶发 crash（exit 134）：D72 已把驱动升到 13（N-API 线）；Linux Node 24.20 连续 3 次 `test-full` 114/114。Windows 真机仍需确认同一版本下无 `SIGABRT` / exit 134，且不丢数据。
 - [ ] `memory_list` 默认只列 project scope 是否符合预期（Stone 已定保持现状）
 
 ---

package/docs/V2-DESIGN.md

@@ -1,6 +1,6 @@
 # OpenMemex — Design Document (protocol v0.2)
 
-**Status:** FROZEN — protocol v0.2 (2026-09-26). Decisions D1–D70 are settled; open questions are tracked at the end of this document.
+**Status:** FROZEN — protocol v0.2 (2026-09-26). Decisions D1–D73 are settled; open questions are tracked at the end of this document.
 **Author:** Stone, with 小沐
 **Changelog vs v1:** incorporates round-3 review from Perplexity, Grok, Gemini, ChatGPT, DeepSeek.
 Key changes: Design Principles section; `role` separated from `type`; two iron rules;
@@ -1469,18 +1469,63 @@ requirement: personal data never touches third-party services). Benchmarks to tr
   entry back before deleting. The HTML rendering of the same data layer
   follows as a separate change; auto-draft stays gated on the unlock
   conditions in the design doc.
-
-- **D69 — inventory HTML rendering lands (3-C complete on the visibility side).**
-  `open-memex inventory --format html` renders the D68 data layer into a
-  single local page: scopes grouped, outbox drafts in their own section,
-  replaced/hidden history folded with supersede-chain pointers, all
-  content escaped, filter box is local show/hide (no innerHTML, no
-  network). Default output is the data dir's `inventory.html`; the D68
-  worktree refusal applies unchanged. Sections fold above 50 current
-  entries. With this, the 3-C visibility surfaces are complete (agent
-  inventory in chat, text/JSON reports, HTML page; hide + confirmed
-  delete as the correction actions). Auto-draft remains gated on the
-  unlock conditions in `docs/memory-visibility-design.md`.
+- **D73 — one user statement, one memory: the keyword hook hands off to the
+  agent.** The keyword hook and the agent are two writers for one user turn,
+  and only one of them knows the sentence is already stored. Observed
+  2026-10-04: a single `remember this folder is for my spark tank ideas …
+  shared memory across agents and employees` produced **three** memories — one
+  `source: keyword` verbatim capture plus two `source: tool` paraphrases the
+  agent wrote because it could see the chat transcript but not the store. The
+  existing §3.4 guard could not catch it: token Jaccard scored those
+  paraphrases 0.21–0.38 against the capture, below the 0.8 near-dup bar, and
+  `open-memex audit` reported zero near-dup pairs, so the store looked healthy
+  while holding three copies of one statement (retrieval then returns all
+  three). Two mechanisms, deliberately layered:
+  **(a) hand-off note** — `captureFromText` records each capture against the
+  host session id (`chat.message` / v2 `prompt`, both of which carry one), and
+  the system-context hook (`experimental.chat.system.transform` / v2
+  `context`) pushes a short block naming what was already stored, delivered
+  once per capture and pruned after the turn window. The agent can now avoid
+  the duplicate write it had no way to see. In-memory only, like
+  `injectedSessions`: never persisted, gone on restart.
+  **(b) turn-echo guard** — `memory_add` additionally refuses a write that
+  overlaps a `source: keyword`/`user` memory created in the same scope within
+  the last 10 minutes, returning the stored id and pointing at
+  `memory_supersede`. This is the deterministic backstop for the case where
+  (a) is ignored. It is deliberately scoped and high-barred, because lexical
+  overlap **cannot** separate an agent's gloss from a genuinely new fact: in
+  the same measured set, the agent's gloss scored 0.211 and a distinct fact
+  the same sentence happened to contain scored 0.214. So the bar sits at
+  0.28 — wholesale re-saves of the captured sentence measure 0.29–0.36 and are
+  refused; anything below is left to (a) and the agent's judgment, and a
+  refusal always names the stored id so the caller can rephrase to the new
+  part or supersede. Agent-authored `source: tool` saves keep the old 0.8
+  near-dup *notice* and are never refused. The refused case is recoverable by
+  construction (supersede, or a follow-up add carrying only the new
+  information), and no D14-style masking, dedup, or lifecycle rule changes.
+  What is deliberately NOT done: no fuzzy-matching upgrade (D73 measures why a
+  better metric still cannot decide "new information"), no auto-merging of the
+  agent's gloss into the capture, and no transcript store (the replay-distillation
+  open question owns that).
+
+- **D72 — the Node SQLite driver moves to the N-API line.** The D70 suite was stable on Windows and failed in shifting clusters on Linux under Node 24.20: individual CLI processes intermittently died with `SIGABRT` in `Statement::~Statement()` (`RemoveEnvironmentCleanupHook ... Assertion failed: (env) != nullptr`) and lost their stdout, so unrelated supersede / submit / inventory checks failed depending on which process the GC reaped. The work itself had always landed; only the exit path was broken. Root cause is upstream: Node 24.19 changed `node::ObjectWrap` cleanup-hook registration, and `better-sqlite3` <13 (raw `node::ObjectWrap`) can finalize a prepared statement from a GC callback with no Environment entered. `better-sqlite3` 13 is the N-API rewrite and removes that path; it still supports Node ≥22, and every API this repo uses (`Database`, `prepare`, `exec`, `pragma`-style PRAGMAs, `close`) is unchanged. The suite's crash-retry shim stays as belt-and-braces for older installs, but the shipped driver no longer needs it on current Node. Verified: three consecutive Linux `test-full` runs at 114/114 plus a 40-command add/list/search loop with zero aborts (was ~50% per process).
+
+- **D71 — the scope seed is the folder opened, never a filesystem root.**
+  OpenCode v1 hands the plugin two roots: `worktree` (the repo root — but
+  the filesystem root itself, `C:\` or `/`, when the opened folder is not a
+  git repo) and `directory` (the folder actually opened). The v1 adapter
+  preferred `worktree`, so every non-git folder on a drive seeded its scope
+  on the drive root and collapsed into one shared
+  `project__workspace__<hash of the root>` bucket — a `c:\temp` project
+  landing in `project__workspace__3dc8472eaebe` (seed `c:\`) is what
+  surfaced it. `pickScopeRoot` (src/scope.ts) now takes `worktree` only when
+  it is a real directory below the filesystem root, else `directory`. The
+  repo-root behavior is unchanged: a real worktree still wins, so opening a
+  repo subfolder keeps the repo's scope. Memories already written under a
+  root-seeded key stay where they are (no auto-migration, per the existing
+  rule); `open-memex scopes` shows the stray bucket and
+  `open-memex migrate --from <old-key>` moves them. The v2 adapter already
+  seeded on the opened directory and is unaffected.
 
 - **D70 — visibility follow-ups: one number, one guard, one truth.** The
   3-C review of D68/D69 found the surfaces honest individually and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "open-memex",
-  "version": "0.7.0-alpha.11",
+  "version": "0.7.0-alpha.15",
   "description": "Local-first memory layer and protocol for AI coding agents. Markdown source of truth, SQLite FTS5 index, zero cloud.",
   "type": "module",
   "license": "Apache-2.0",
@@ -23,7 +23,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.1",
-    "better-sqlite3": "^11.7.0",
+    "better-sqlite3": "^13.0.3",
     "js-yaml": "^4.1.0",
     "zod": "^4.1.8"
   },