opencode-codex-memory 0.1.9 → 0.2.0

package/README.md

@@ -61,7 +61,12 @@ is enabled. To choose which models
 they use, set the `extract_model` / `consolidation_model` plugin options (see
 [Configuration](#configuration)) — don't override the agents for that. Defining
 an agent with the same name in your own config is only for advanced tweaks
-(e.g. permissions); your definition then replaces the shipped one.
+(e.g. permissions); your definition then replaces the shipped one. If you
+override `memorize`, keep an `external_directory` allow for
+`~/.local/share/opencode/memories/*` (e.g.
+`"external_directory": { "$HOME/.local/share/opencode/memories/*": "allow" }`
+after the wildcard deny) — the memory folder lives outside your project, and
+without that grant opencode blocks the consolidator's file access.
 
 ## Try it
 
@@ -176,12 +181,17 @@ explicitly, so they win over an agent-level `model`.
 > This is the one intentional default difference — the tools are a core part of a
 > standalone memory plugin. Everything else matches codex's defaults.
 >
-> Turning `dedicated_tools` off doesn't break anything: background learning,
-> summary injection, and citation tracking all keep working. The injected
-> guidance switches to codex's file-based mode — the agent reads the memory
-> files with its normal file tools and writes "remember this" notes directly
-> into `extensions/ad_hoc/notes/`. The maintenance tools (`memory_reset`,
-> `memory_inspect`, `memory_mode`) stay available either way.
+> Turning `dedicated_tools` off keeps background learning, summary injection,
+> and citation tracking working. The injected guidance switches to codex's
+> file-based mode — the agent reads the memory files with its normal file
+> tools and writes "remember this" notes directly into
+> `extensions/ad_hoc/notes/`. Caveat: the memory folder lives outside your
+> project, so opencode raises an `external_directory` permission prompt the
+> first time an agent touches it (allow-always covers later access); agents
+> whose permissions deny that ask cannot use file-based mode. The dedicated
+> tools have no such friction — that's why they are the default. The
+> maintenance tools (`memory_reset`, `memory_inspect`, `memory_mode`) stay
+> available either way.
 
 ## Under the hood
 

package/dist/opencode.json

@@ -20,7 +20,7 @@
     },
     "memorize-extract": {
       "mode": "subagent",
-      "prompt": "You are a memory extraction agent. Read the session transcript and extract raw_memory, rollout_summary, and rollout_slug as JSON. Exclude AGENTS.md/instruction content. Redact secrets.",
+      "prompt": "You are a memory extraction agent. The session transcript is provided inline in the prompt. Extract raw_memory, rollout_summary, and rollout_slug as JSON. Exclude AGENTS.md/instruction content. Redact secrets.",
       "permission": {
         "*": "deny",
         "bash": "deny",
@@ -28,11 +28,11 @@
         "websearch": "deny",
         "task": "deny",
         "todowrite": "deny",
-        "read": "allow",
+        "read": "deny",
         "write": "deny",
         "edit": "deny",
-        "glob": "allow",
-        "grep": "allow"
+        "glob": "deny",
+        "grep": "deny"
       }
     }
   }

package/dist/src/capture.d.ts

@@ -1,19 +1,44 @@
-import { MemoryStore } from "./store.js";
+import type { MemoryStore } from "./store.js";
 export interface SessionRow {
     id: string;
     updated_at: number;
     directory: string | null;
 }
-export declare function listRecentSessions(limit?: number): SessionRow[];
+/**
+ * Global session discovery through the official API: opencode's session.list
+ * is project-scoped, so enumerate projects (project.list) and list each one
+ * with scope=project (routes the request to that project's instance AND
+ * widens the filter from the session directory to the whole project).
+ * Instance contexts created this way are cached by the host for the process
+ * lifetime, and the whole pass is rate-limited (30s min interval).
+ *
+ * Fail-safe at two levels: a failed project.list skips the pass ([]), a
+ * failed per-project session.list skips that project — neither claims or
+ * finalizes any job. Transcript loading must NOT be fail-safe — see
+ * loadTranscript.
+ */
+export declare function listRecentSessions(limit?: number): Promise<SessionRow[]>;
 export interface TranscriptMessage {
     type: string;
     role?: string;
     text?: string;
 }
-export declare function loadTranscript(sessionId: string): TranscriptMessage[];
+/**
+ * Transcript loading uses the official API — the same surface opencode's own
+ * UI renders history from; the session-scoped route resolves the right
+ * instance even for sessions from other projects.
+ *
+ * Errors PROPAGATE. An empty result must mean "session has no extractable
+ * content" — a swallowed error here used to surface as a successful
+ * no-output extraction, which deletes any previous extraction for the
+ * session (codex: load_rollout_items errors fail the job, which retries
+ * under its lease/backoff). A claimed session normally has messages, so a
+ * legitimately empty result is logged for observability.
+ */
+export declare function loadTranscript(sessionId: string): Promise<TranscriptMessage[]>;
 export interface EligibilityOptions {
     maxAgeDays: number;
     minIdleHours: number;
     excludeSession?: string;
 }
-export declare function selectEligibleSessions(store: MemoryStore, opts: EligibilityOptions): SessionRow[];
+export declare function selectEligibleSessions(store: MemoryStore, opts: EligibilityOptions): Promise<SessionRow[]>;

package/dist/src/capture.js

@@ -1,72 +1,121 @@
-import { Database } from "bun:sqlite";
-import { opencodeDbPath } from "./paths.js";
 import { SCAN_LIMIT } from "./store.js";
-let opencodeDb = null;
-function openOpencodeDb() {
-    if (opencodeDb)
-        return opencodeDb;
-    const p = opencodeDbPath();
+import { getPluginInput } from "./llm.js";
+const API_TIMEOUT_MS = 60_000;
+async function withTimeout(promise, ms, label) {
+    let timer;
     try {
-        opencodeDb = new Database(p, { readonly: true });
+        return await Promise.race([
+            promise,
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error(`${label} timed out after ${ms}ms`)), ms);
+            }),
+        ]);
     }
-    catch {
-        opencodeDb = null;
+    finally {
+        clearTimeout(timer);
     }
-    return opencodeDb;
 }
-export function listRecentSessions(limit = SCAN_LIMIT) {
-    const db = openOpencodeDb();
-    if (!db)
+/**
+ * Global session discovery through the official API: opencode's session.list
+ * is project-scoped, so enumerate projects (project.list) and list each one
+ * with scope=project (routes the request to that project's instance AND
+ * widens the filter from the session directory to the whole project).
+ * Instance contexts created this way are cached by the host for the process
+ * lifetime, and the whole pass is rate-limited (30s min interval).
+ *
+ * Fail-safe at two levels: a failed project.list skips the pass ([]), a
+ * failed per-project session.list skips that project — neither claims or
+ * finalizes any job. Transcript loading must NOT be fail-safe — see
+ * loadTranscript.
+ */
+export async function listRecentSessions(limit = SCAN_LIMIT) {
+    const client = getPluginInput()?.client;
+    if (!client?.project?.list || !client?.session?.list)
         return [];
+    let projects;
     try {
-        // Top-level sessions only: task-tool children are summarized into their
-        // parent, and the plugin's own sub-sessions must never be memorized.
-        return db
-            .prepare(`SELECT id, time_updated AS updated_at, directory FROM session
-         WHERE parent_id IS NULL AND title NOT LIKE 'codex-memory-%'
-         ORDER BY time_updated DESC LIMIT ?`)
-            .all(limit);
+        const res = await withTimeout(client.project.list(), API_TIMEOUT_MS, "project.list");
+        if (!res || res.error || !Array.isArray(res.data))
+            throw new Error(`project.list failed: ${JSON.stringify(res?.error ?? {})}`);
+        projects = res.data;
     }
-    catch {
+    catch (err) {
+        console.warn("[opencode-codex-memory] project discovery failed; skipping pass:", err);
         return [];
     }
-}
-export function loadTranscript(sessionId) {
-    const db = openOpencodeDb();
-    if (!db)
-        return [];
-    try {
-        const rows = db
-            .prepare(`SELECT p.data, m.data AS msg_data
-         FROM part p
-         JOIN message m ON p.message_id = m.id
-         WHERE p.session_id = ?
-         ORDER BY p.time_created ASC`)
-            .all(sessionId);
-        return rows.map((r) => {
-            let parsed = {};
-            try {
-                parsed = JSON.parse(r.data);
-            }
-            catch {
+    const all = [];
+    for (const project of projects) {
+        if (!project?.worktree)
+            continue;
+        try {
+            const res = await withTimeout(client.session.list({
+                // scope/roots/limit are in the server's ListQuery since 1.17; the
+                // pinned SDK types lag behind, hence the cast at the call site.
+                query: { directory: project.worktree, scope: "project", roots: true, limit },
+            }), API_TIMEOUT_MS, "session.list");
+            if (!res || res.error || !Array.isArray(res.data))
+                throw new Error(JSON.stringify(res?.error ?? {}));
+            for (const s of res.data) {
+                // Top-level sessions only: task-tool children are summarized into
+                // their parent, and the plugin's own sub-sessions must never be
+                // memorized (roots=true drops children server-side; keep both belts).
+                if (!s?.id || s.parentID)
+                    continue;
+                if (s.title && s.title.startsWith("codex-memory-"))
+                    continue;
+                all.push({ id: s.id, updated_at: s.time?.updated ?? 0, directory: s.directory ?? null });
             }
-            let role;
-            try {
-                const msg = JSON.parse(r.msg_data);
-                role = msg.role;
-            }
-            catch {
-            }
-            return {
-                type: parsed.type ?? "unknown",
-                role,
-                text: extractText(parsed),
-            };
-        });
+        }
+        catch (err) {
+            console.warn(`[opencode-codex-memory] session.list failed for ${project.worktree}; skipping project:`, err);
+        }
     }
-    catch {
+    all.sort((a, b) => b.updated_at - a.updated_at);
+    return all.slice(0, limit);
+}
+/** Official transcript surface: GET /session/{id}/message via the plugin's authenticated client. */
+async function fetchMessagesViaApi(sessionId) {
+    const client = getPluginInput()?.client;
+    if (typeof client?.session?.messages !== "function") {
+        throw new Error("plugin client unavailable; cannot load transcript");
+    }
+    const res = await withTimeout(client.session.messages({ path: { id: sessionId } }), API_TIMEOUT_MS, "session.messages");
+    if (!res || res.error || !Array.isArray(res.data)) {
+        throw new Error(`session.messages failed: ${JSON.stringify(res?.error ?? {})}`);
+    }
+    return res.data;
+}
+/**
+ * Transcript loading uses the official API — the same surface opencode's own
+ * UI renders history from; the session-scoped route resolves the right
+ * instance even for sessions from other projects.
+ *
+ * Errors PROPAGATE. An empty result must mean "session has no extractable
+ * content" — a swallowed error here used to surface as a successful
+ * no-output extraction, which deletes any previous extraction for the
+ * session (codex: load_rollout_items errors fail the job, which retries
+ * under its lease/backoff). A claimed session normally has messages, so a
+ * legitimately empty result is logged for observability.
+ */
+export async function loadTranscript(sessionId) {
+    const rows = await fetchMessagesViaApi(sessionId);
+    if (rows.length === 0) {
+        console.warn(`[opencode-codex-memory] session.messages returned no messages for claimed session ${sessionId}`);
         return [];
     }
+    // One entry per part — the granularity extraction expects.
+    const out = [];
+    for (const row of rows) {
+        const role = row?.info?.role;
+        for (const part of row?.parts ?? []) {
+            out.push({
+                type: part?.type ?? "unknown",
+                role,
+                text: extractText(part),
+            });
+        }
+    }
+    return out;
 }
 function extractText(msg) {
     if (!msg)
@@ -103,11 +152,11 @@ function extractText(msg) {
     }
     return undefined;
 }
-export function selectEligibleSessions(store, opts) {
+export async function selectEligibleSessions(store, opts) {
     const now = Date.now();
     const minUpdated = now - opts.maxAgeDays * 24 * 60 * 60 * 1000;
     const maxUpdated = now - opts.minIdleHours * 60 * 60 * 1000;
-    const sessions = listRecentSessions();
+    const sessions = await listRecentSessions();
     return sessions.filter((s) => {
         if (opts.excludeSession && s.id === opts.excludeSession)
             return false;

package/dist/src/index.d.ts

@@ -1,6 +1,8 @@
 import { MemoryStore } from "./store.js";
 import type { PluginInput, PluginOptions } from "@opencode-ai/plugin";
 export declare function takeNewCitations(partKey: string, ids: string[]): string[];
+export declare function markTurnSeen(sessionId: string): boolean;
+export declare function shouldHandleIdle(sessionId: string, now?: number): boolean;
 export declare function handleSessionDeleted(sessionId: string, store?: Pick<MemoryStore, "deleteSessionMemory">, schedulePhase2?: () => void): void;
 declare const _default: {
     id: string;
@@ -22,16 +24,32 @@ declare const _default: {
             memory_search: {
                 description: string;
                 args: {
-                    query: import("zod").ZodOptional<import("zod").ZodString>;
+                    queries: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                    match_mode: import("zod").ZodDefault<import("zod").ZodEnum<{
+                        any: "any";
+                        all_on_same_line: "all_on_same_line";
+                        all_within_lines: "all_within_lines";
+                    }>>;
+                    line_count: import("zod").ZodOptional<import("zod").ZodNumber>;
+                    path: import("zod").ZodOptional<import("zod").ZodString>;
+                    cursor: import("zod").ZodOptional<import("zod").ZodString>;
+                    context_lines: import("zod").ZodDefault<import("zod").ZodNumber>;
                     case_sensitive: import("zod").ZodDefault<import("zod").ZodBoolean>;
+                    normalized: import("zod").ZodDefault<import("zod").ZodBoolean>;
                     since: import("zod").ZodOptional<import("zod").ZodString>;
                     until: import("zod").ZodOptional<import("zod").ZodString>;
-                    limit: import("zod").ZodDefault<import("zod").ZodNumber>;
+                    max_results: import("zod").ZodDefault<import("zod").ZodNumber>;
                 };
                 execute(args: {
+                    match_mode: "any" | "all_on_same_line" | "all_within_lines";
+                    context_lines: number;
                     case_sensitive: boolean;
-                    limit: number;
-                    query?: string | undefined;
+                    normalized: boolean;
+                    max_results: number;
+                    queries?: string[] | undefined;
+                    line_count?: number | undefined;
+                    path?: string | undefined;
+                    cursor?: string | undefined;
                     since?: string | undefined;
                     until?: string | undefined;
                 }, context: import("@opencode-ai/plugin").ToolContext): Promise<import("@opencode-ai/plugin").ToolResult>;
@@ -131,6 +149,22 @@ declare const _default: {
         }, output: {
             system: string[];
         }): Promise<void>;
+        /**
+         * Fires at text-end, before opencode persists the final part text
+         * (session/processor.ts): the returned text replaces the stored one.
+         * Primary citation seam — records usage and strips the block so neither
+         * the UI nor history ever shows citation markup (matches codex, which
+         * strips from the displayed/persisted message). The event and
+         * messages.transform paths below stay as fallbacks for older opencode
+         * hosts and for history persisted before this hook existed.
+         */
+        "experimental.text.complete"(input: {
+            sessionID: string;
+            messageID: string;
+            partID: string;
+        }, output: {
+            text: string;
+        }): Promise<void>;
         "experimental.chat.messages.transform"(_input: unknown, output: {
             messages: {
                 info: {
@@ -142,6 +176,19 @@ declare const _default: {
                 }[];
             }[];
         }): Promise<void>;
+        /**
+         * Turn start. codex stamps memory_mode at thread creation (session.rs) and
+         * schedules memory work per startup/turn; the first user message is the
+         * closest plugin-visible moment. Stamping here (instead of waiting for the
+         * first idle) means a session created while generate_memories=false keeps
+         * its 'disabled' stamp even if the option flips mid-session, and the
+         * phase-1 pump no longer depends on idle events at all. The idle path
+         * below stays as a second pump trigger; both are cheap (stamp is INSERT OR
+         * IGNORE, the pump is gated by in-flight/rate/claim guards).
+         */
+        "chat.message"(input: {
+            sessionID?: string;
+        }): Promise<void>;
         "tool.execute.after"(input: {
             tool: string;
             sessionID: string;

package/dist/src/index.js

@@ -1,4 +1,5 @@
 import { ensureMemoryLayout, buildMemorySystemPrompt, invalidateCache } from "./source.js";
+import { memoryRoot } from "./paths.js";
 import { stripCitations, extractCitedSessionIds } from "./citation.js";
 import { memory_read, memory_search, memory_list, memory_add_note } from "../tools/memory.js";
 import { memory_reset, memory_inspect, memory_mode } from "../tools/control.js";
@@ -31,9 +32,10 @@ let pluginOptions = {
 function getStore() {
     return new MemoryStore();
 }
-// Citation blocks arrive via message.part.updated once per streaming delta,
-// so the same completed block is seen many times. Track which session ids
-// were already recorded per part to count each citation once.
+// Citation blocks are seen by both the text.complete hook (once, at
+// completion) and message.part.updated (once per streaming delta), so the
+// same block surfaces many times. Track which session ids were already
+// recorded per part to count each citation exactly once across both paths.
 const recordedCitations = new Map();
 const MAX_TRACKED_PARTS = 500;
 export function takeNewCitations(partKey, ids) {
@@ -52,6 +54,40 @@ export function takeNewCitations(partKey, ids) {
         seen.add(id);
     return fresh;
 }
+// One stamp+pump per session per process from the chat.message hook; later
+// messages in the same session add nothing (stamp is idempotent, the pump
+// re-fires on idle anyway).
+const seenTurnSessions = new Set();
+const MAX_TRACKED_TURN_SESSIONS = 1000;
+export function markTurnSeen(sessionId) {
+    if (seenTurnSessions.has(sessionId))
+        return false;
+    seenTurnSessions.add(sessionId);
+    if (seenTurnSessions.size > MAX_TRACKED_TURN_SESSIONS) {
+        const oldest = seenTurnSessions.keys().next().value;
+        if (oldest !== undefined)
+            seenTurnSessions.delete(oldest);
+    }
+    return true;
+}
+// opencode 1.17 publishes BOTH session.status {type:"idle"} and the
+// deprecated session.idle for the same transition, back to back. Handle
+// whichever arrives first and swallow the twin within a short window.
+const recentIdle = new Map();
+const IDLE_DEDUP_MS = 5000;
+const MAX_TRACKED_IDLE = 500;
+export function shouldHandleIdle(sessionId, now = Date.now()) {
+    const last = recentIdle.get(sessionId);
+    if (last !== undefined && now - last < IDLE_DEDUP_MS)
+        return false;
+    recentIdle.set(sessionId, now);
+    if (recentIdle.size > MAX_TRACKED_IDLE) {
+        const oldest = recentIdle.keys().next().value;
+        if (oldest !== undefined)
+            recentIdle.delete(oldest);
+    }
+    return true;
+}
 export function handleSessionDeleted(sessionId, store = getStore(), 
 // With generation off the memorize agent is not injected, so a consolidation
 // attempt could only fail; the row deletion above still happens, and the
@@ -172,6 +208,18 @@ export function injectAgentDefinitions(config) {
         console.warn("[opencode-codex-memory] could not load bundled agent definitions:", err);
         return;
     }
+    // opencode gates file tools outside the session's project behind the
+    // `external_directory` permission, and the memory workspace is global —
+    // outside every project — so the consolidator's reads/writes there always
+    // trigger that ask. The bundled `"*": "deny"` matches it (permission rules
+    // are wildcard-on-name, last match wins), which would block consolidation
+    // entirely. Grant the memory root here rather than in opencode.json: the
+    // path is homedir/env-dependent (src/paths.ts is its single source of
+    // truth). Appended last so it out-ranks the wildcard deny.
+    const memorize = defs["memorize"];
+    if (memorize?.permission && !("external_directory" in memorize.permission)) {
+        memorize.permission["external_directory"] = { [path.join(memoryRoot(), "*")]: "allow" };
+    }
     config.agent ??= {};
     for (const [name, def] of Object.entries(defs)) {
         if (!config.agent[name])
@@ -208,6 +256,41 @@ function buildHooks() {
                 console.error("[opencode-codex-memory] system.transform error:", err);
             }
         },
+        /**
+         * Fires at text-end, before opencode persists the final part text
+         * (session/processor.ts): the returned text replaces the stored one.
+         * Primary citation seam — records usage and strips the block so neither
+         * the UI nor history ever shows citation markup (matches codex, which
+         * strips from the displayed/persisted message). The event and
+         * messages.transform paths below stay as fallbacks for older opencode
+         * hosts and for history persisted before this hook existed.
+         */
+        async "experimental.text.complete"(input, output) {
+            try {
+                if (isMemorySubSession(input.sessionID))
+                    return;
+                if (!output.text.includes("<memory-citation>"))
+                    return;
+                try {
+                    const ids = extractCitedSessionIds(output.text);
+                    // Same part key as the event path: whichever hook sees the ids first
+                    // records them; the other becomes a no-op.
+                    const fresh = takeNewCitations(`${input.sessionID}:${input.partID}`, ids);
+                    if (fresh.length > 0)
+                        getStore().recordUsage(fresh);
+                }
+                catch (e) {
+                    console.error("[opencode-codex-memory] citation recording failed:", e);
+                }
+                output.text = stripCitations(output.text);
+            }
+            catch (err) {
+                console.error("[opencode-codex-memory] text.complete error:", err);
+            }
+        },
+        // Fallback strip for history that still carries citation blocks (messages
+        // persisted by plugin versions before the text.complete seam, or hosts
+        // without it). Keeps citation markup out of the model-facing transcript.
         async "experimental.chat.messages.transform"(_input, output) {
             try {
                 for (const msg of output.messages) {
@@ -228,6 +311,35 @@ function buildHooks() {
                 console.error("[opencode-codex-memory] messages.transform error:", err);
             }
         },
+        /**
+         * Turn start. codex stamps memory_mode at thread creation (session.rs) and
+         * schedules memory work per startup/turn; the first user message is the
+         * closest plugin-visible moment. Stamping here (instead of waiting for the
+         * first idle) means a session created while generate_memories=false keeps
+         * its 'disabled' stamp even if the option flips mid-session, and the
+         * phase-1 pump no longer depends on idle events at all. The idle path
+         * below stays as a second pump trigger; both are cheap (stamp is INSERT OR
+         * IGNORE, the pump is gated by in-flight/rate/claim guards).
+         */
+        async "chat.message"(input) {
+            try {
+                const sid = input?.sessionID;
+                if (!sid || isMemorySubSession(sid))
+                    return;
+                if (!markTurnSeen(sid))
+                    return;
+                try {
+                    getStore().stampMemoryModeIfAbsent(sid, pluginOptions.generate_memories ? "enabled" : "disabled");
+                }
+                catch (e) {
+                    console.error("[opencode-codex-memory] stampMemoryModeIfAbsent failed:", e);
+                }
+                void triggerPhase1(sid);
+            }
+            catch (err) {
+                console.error("[opencode-codex-memory] chat.message error:", err);
+            }
+        },
         // Dedicated plugin hook (NOT an event-bus type): fires after every tool
         // call. Mirrors codex: external context (web search or any MCP tool) only
         // pollutes the session's memory when disable_on_external_context is
@@ -289,21 +401,19 @@ function buildHooks() {
                     }
                     return;
                 }
+                // session.idle is deprecated in opencode 1.17 in favor of
+                // session.status {type:"idle"}; both are still emitted. Support both so
+                // the pipeline keeps triggering when the legacy event disappears.
+                if (ev.type === "session.status") {
+                    const props = ev.properties;
+                    if (props?.status?.type === "idle" && props.sessionID)
+                        handleSessionIdle(props.sessionID);
+                    return;
+                }
                 if (ev.type === "session.idle") {
                     const props = ev.properties;
-                    const sid = props?.sessionID;
-                    if (!sid || isMemorySubSession(sid))
-                        return;
-                    // codex stamps memory_mode at thread creation from generate_memories:
-                    // sessions first seen while generation is off keep that stamp when the
-                    // option is re-enabled (manual override: the memory_mode tool).
-                    try {
-                        getStore().stampMemoryModeIfAbsent(sid, pluginOptions.generate_memories ? "enabled" : "disabled");
-                    }
-                    catch (e) {
-                        console.error("[opencode-codex-memory] stampMemoryModeIfAbsent failed:", e);
-                    }
-                    void triggerPhase1(sid);
+                    if (props?.sessionID)
+                        handleSessionIdle(props.sessionID);
                     return;
                 }
             }
@@ -315,6 +425,22 @@ function buildHooks() {
             invalidateCache();
         },
     };
+    function handleSessionIdle(sid) {
+        if (isMemorySubSession(sid))
+            return;
+        if (!shouldHandleIdle(sid))
+            return;
+        // codex stamps memory_mode at thread creation from generate_memories:
+        // sessions first seen while generation is off keep that stamp when the
+        // option is re-enabled (manual override: the memory_mode tool).
+        try {
+            getStore().stampMemoryModeIfAbsent(sid, pluginOptions.generate_memories ? "enabled" : "disabled");
+        }
+        catch (e) {
+            console.error("[opencode-codex-memory] stampMemoryModeIfAbsent failed:", e);
+        }
+        void triggerPhase1(sid);
+    }
     // Control tools (reset/inspect/mode) are always available. The memory
     // read/search/list/add-note tools require BOTH use_memories and
     // dedicated_tools, mirroring codex's MemoriesExtension: use_memories=false

package/dist/src/llm.d.ts

@@ -5,6 +5,7 @@ export interface ExtractionResult {
     rollout_slug: string | null;
 }
 export declare function setPluginInput(input: PluginInput): void;
+export declare function getPluginInput(): PluginInput | null;
 export declare function isMemorySubSession(sessionId: string): boolean;
 export interface ExtractOptions {
     cwd?: string;

package/dist/src/llm.js

@@ -4,7 +4,7 @@ let inputRef = null;
 export function setPluginInput(input) {
     inputRef = input;
 }
-function getPluginInput() {
+export function getPluginInput() {
     return inputRef;
 }
 // Sessions this plugin spawned for extraction/consolidation. The main

package/dist/src/path-guard.d.ts

@@ -7,4 +7,13 @@
  * - every existing component is lstat-checked: symlinks are rejected, so a
  *   link placed inside the workspace cannot lead reads outside it
  */
+/**
+ * The memory root itself must not be a symlink: every scoped resolution and
+ * every workspace walk starts there, so a symlinked root would redirect ALL
+ * memory reads/writes elsewhere on disk. codex rejects a symlinked root when
+ * clearing (control.rs clear_memory_root_contents); the model-facing tools
+ * here extend that check to every memory operation. Returns the root path.
+ * A missing root is fine — callers create it as a real directory.
+ */
+export declare function assertMemoryRootSafe(): string;
 export declare function safeResolveMemoryPath(rel: string): string;