opencode-claude-memory 2.1.0 → 2.1.1

package/dist/host/v2/agents.d.ts

@@ -3,6 +3,13 @@ import type { MemoryAgents } from "../../config.js";
 import type { PermissionRule } from "./fork.js";
 export type { PermissionRule };
 export declare const BASELINE_PROBE_AGENT = "opencode-memory-baseline-probe";
+export declare const PERMISSIONS_PROBE_AGENT = "opencode-memory-permissions-probe";
 export declare function sandboxRules(allowedTools: readonly string[]): PermissionRule[];
+export declare const PROBE_RULES: readonly PermissionRule[];
 export declare function userRules(rules: readonly PermissionRule[], baseline: readonly PermissionRule[]): PermissionRule[];
 export declare function applyMemoryAgents(editor: AgentEditor, agents: MemoryAgents): void;
+export declare function ownAgentRules(resolved: readonly PermissionRule[], sandbox: readonly PermissionRule[], probe: readonly PermissionRule[]): PermissionRule[] | undefined;
+export declare function forkSessionRules(sandbox: readonly PermissionRule[], resolved: readonly PermissionRule[] | undefined, probe: readonly PermissionRule[] | undefined): {
+    rules: PermissionRule[];
+    own: boolean;
+};

package/dist/host/v2/agents.js

@@ -1,19 +1,26 @@
 import { memoryAgentDefaults } from "../../agents.js";
 // A throwaway id used to read the host's default ruleset inside the same draft.
 export const BASELINE_PROBE_AGENT = "opencode-memory-baseline-probe";
+// A hidden, deny-all agent that is kept: every rule after its own PROBE_RULES was appended to all
+// agents by a later transform (the global `permissions`, the browser plugin's `browser` deny). It
+// tells the fork which part of a memory agent's resolved ruleset is global and which is its own.
+export const PERMISSIONS_PROBE_AGENT = "opencode-memory-permissions-probe";
 export function sandboxRules(allowedTools) {
     return [
         { action: "*", resource: "*", effect: "deny" },
         ...allowedTools.map((tool) => ({ action: tool, resource: "*", effect: "allow" })),
     ];
 }
+export const PROBE_RULES = sandboxRules([]);
 function ruleKey(rule) {
     return `${rule.action}\u0000${rule.resource}\u0000${rule.effect}`;
 }
+function startsWith(rules, prefix) {
+    return prefix.every((rule, index) => rules[index] !== undefined && ruleKey(rules[index]) === ruleKey(rule));
+}
 // The user's own rules: the agent's ruleset minus the host defaults every agent starts with.
 export function userRules(rules, baseline) {
-    const prefix = baseline.every((rule, index) => rules[index] && ruleKey(rules[index]) === ruleKey(rule));
-    if (prefix)
+    if (startsWith(rules, baseline))
         return rules.slice(baseline.length).map((rule) => ({ ...rule }));
     const base = new Set(baseline.map(ruleKey));
     return rules.filter((rule) => !base.has(ruleKey(rule))).map((rule) => ({ ...rule }));
@@ -22,6 +29,12 @@ export function applyMemoryAgents(editor, agents) {
     editor.update(BASELINE_PROBE_AGENT, () => { });
     const baseline = (editor.get(BASELINE_PROBE_AGENT)?.permissions ?? []).map((rule) => ({ ...rule }));
     editor.remove(BASELINE_PROBE_AGENT);
+    editor.update(PERMISSIONS_PROBE_AGENT, (agent) => {
+        agent.mode = "subagent";
+        agent.hidden = true;
+        agent.description = "opencode-claude-memory internal: permission probe, never runs";
+        agent.permissions = PROBE_RULES.map((rule) => ({ ...rule }));
+    });
     for (const [name, defaults] of Object.entries(memoryAgentDefaults(agents))) {
         applyAgent(editor, name, defaults, baseline);
     }
@@ -39,3 +52,32 @@ function applyAgent(editor, name, defaults, baseline) {
         agent.permissions = [...sandboxRules(defaults.allowedTools), ...configured];
     });
 }
+// The memory agent's own rules: what follows the sandbox in its resolved ruleset, minus the rules
+// appended to every agent (the probe's tail, removed as an ordered subsequence). These are the
+// user's `agents.<name>.permissions` (and rules of a plugin that configured the agent first).
+// undefined when either ruleset does not have the layout this plugin wrote.
+export function ownAgentRules(resolved, sandbox, probe) {
+    if (!startsWith(resolved, sandbox) || !startsWith(probe, PROBE_RULES))
+        return undefined;
+    const shared = probe.slice(PROBE_RULES.length);
+    const own = [];
+    let next = 0;
+    for (const rule of resolved.slice(sandbox.length)) {
+        const expected = shared[next];
+        if (expected && ruleKey(expected) === ruleKey(rule))
+            next += 1;
+        else
+            own.push({ ...rule });
+    }
+    return next === shared.length ? own : undefined;
+}
+// The fork's session ruleset. The host evaluates `[...agent rules, ...session rules]` last match
+// wins, and checks deny before any saved "always" approval, so a session ruleset that starts with the
+// sandbox overrides every global rule (allow, ask, or a rule for `shell`, `read`,
+// `external_directory`, ...). The agent's own rules follow it, so a user override in
+// `agents.<name>.permissions` still widens or narrows the sandbox. Global rules no longer reach the
+// fork; without a recoverable layout the fork runs under the bare sandbox.
+export function forkSessionRules(sandbox, resolved, probe) {
+    const own = resolved && probe ? ownAgentRules(resolved, sandbox, probe) : undefined;
+    return { rules: [...sandbox.map((rule) => ({ ...rule })), ...(own ?? [])], own: own !== undefined };
+}

package/dist/host/v2/host.d.ts

@@ -1,3 +1,4 @@
+import type { Logger } from "../../util/log.js";
 import { type GenerateInput, type MemoryHost } from "../types.js";
 import { type ModelRef, type PermissionRule, type V2SessionApi } from "./fork.js";
 export type V2AgentInfo = {
@@ -14,6 +15,7 @@ export type V2HostOptions = {
     }>;
     getAgent: (name: string) => Promise<V2AgentInfo | undefined>;
     sandboxFor: (name: string) => PermissionRule[];
+    log?: Logger;
 };
 export declare function buildGeneratePrompt(input: Pick<GenerateInput, "system" | "text" | "schema">): string;
 export declare class V2Host implements MemoryHost {

package/dist/host/v2/host.js

@@ -1,13 +1,6 @@
-// MemoryHost over the V2 plugin context (`setup` entry).
-//
-// Differences from V1 that the coordinators see through the interface:
-// - readTranscript only has the messages after the last compaction (`session.context`), so a
-//   watermark message that was compacted away yields `truncated: true`;
-// - listSessions is unavailable (the plugin API cannot list sessions);
-// - generate is a one-shot `generate.text` call: no system prompt, no structured output, so both
-//   are folded into the prompt and the caller parses the text.
 import { withDeadline } from "../../util/timeout.js";
 import { SDK_READ_TIMEOUT_MS } from "../types.js";
+import { forkSessionRules, PERMISSIONS_PROBE_AGENT } from "./agents.js";
 import { runV2Fork } from "./fork.js";
 import { toTranscript } from "./transcript.js";
 // The V2 plugin calls take no AbortSignal; withDeadline only bounds the wait.
@@ -63,12 +56,18 @@ export class V2Host {
         }
     }
     async fork(input) {
-        // The resolved agent's ruleset (sandbox + the user's overrides) is also passed as the session
-        // ruleset; without one the child would inherit its parent's session permissions.
-        const agent = await this.agent(input.agent);
-        const permissions = agent?.permissions?.length
-            ? agent.permissions.map((rule) => ({ ...rule }))
-            : this.options.sandboxFor(input.agent);
+        // The resolved agent ruleset carries the global `permissions` after the sandbox (see agents.ts),
+        // so it is never passed through: the session ruleset is the sandbox followed by the agent's own
+        // rules only. Without an explicit one the child would also inherit its parent's session rules.
+        const sandbox = this.options.sandboxFor(input.agent);
+        const [agent, probe] = await Promise.all([this.agent(input.agent), this.agent(PERMISSIONS_PROBE_AGENT)]);
+        const { rules: permissions, own } = forkSessionRules(sandbox, agent?.permissions, probe?.permissions);
+        if (!own && agent?.permissions) {
+            this.options.log?.("warn", "Memory agent overrides could not be told apart from global rules; forking with the bare sandbox", {
+                agent: input.agent,
+            });
+        }
+        this.options.log?.("debug", "Memory fork session permissions", { agent: input.agent, permissions });
         return runV2Fork(this.options.session, {
             ...input,
             permissions,

package/dist/host/v2/plugin.js

@@ -52,6 +52,7 @@ export const createV2Setup = (env, homeDir) => async (ctx) => {
             return agent?.data;
         },
         sandboxFor: (name) => sandboxRules(defaults[name]?.allowedTools ?? []),
+        log,
     });
     const deps = { store, config, host, owned, log };
     const recall = new RecallCoordinator(deps);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-claude-memory",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "type": "module",
   "description": "OpenCode plugin for Claude Code memory: persistent, local-first shared memory with Claude Code-compatible Markdown files, LLM recall, in-process auto extraction, and auto-dream consolidation",
   "main": "dist/index.js",