opencode-episodic-memory 0.1.1 → 0.1.2

package/README.md

@@ -35,6 +35,17 @@ bun install   # first embed downloads the model (~100 MB, cached afterwards)
 }
 ```
 
+Or from npm — pin the version. OpenCode caches npm plugins and never
+re-resolves a bare name / `@latest`
+([anomalyco/opencode#25293](https://github.com/anomalyco/opencode/issues/25293)),
+so to update later you bump the pin:
+
+```jsonc
+{
+  "plugin": ["opencode-episodic-memory@0.1.1"]
+}
+```
+
 Copy the skill so the agent knows when to search:
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-episodic-memory",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Semantic search over past OpenCode conversations. Port of obra/episodic-memory to OpenCode primitives.",
   "type": "module",
   "license": "MIT",
@@ -17,6 +17,7 @@
     "embeddings",
     "transformersjs"
   ],
+  "main": "./plugin/episodic-memory.ts",
   "exports": {
     ".": "./plugin/episodic-memory.ts",
     "./cli": "./src/cli.ts"
@@ -33,7 +34,8 @@
     "spike": "bun run spikes/spike.ts",
     "test": "bun test",
     "typecheck": "tsc --noEmit",
-    "prepublishOnly": "bun run typecheck && bun test"
+    "verify:entrypoint": "bun run spikes/verify-opencode-entrypoint.ts",
+    "prepublishOnly": "bun run typecheck && bun test && bun run verify:entrypoint"
   },
   "dependencies": {
     "@huggingface/transformers": "^4.2.0",

package/plugin/episodic-memory.ts

@@ -2,11 +2,10 @@
 // - Native tools: episodic_search, episodic_read
 // - Incremental reindex on session.idle (fire-and-forget, debounced)
 import { type Plugin, tool } from "@opencode-ai/plugin";
-import { openSource, getSession, getTranscript } from "../src/reader";
+import { openSource, getSession, getTranscript, transcriptHasMarker } from "../src/reader";
 import { openIndex, search, textSearch } from "../src/store";
 import { syncSession, syncAll, pruneOrphans } from "../src/indexer";
 import { embedQuery } from "../src/embed";
-import { hasExcludeMarker } from "../src/parser";
 
 // Discriminated result so callers handle the parse error explicitly (no cast to
 // strip the error arm off a union). `ms` is undefined when no date was given.
@@ -124,10 +123,12 @@ export const EpisodicMemory: Plugin = async ({ client }) => {
               const source = openSource();
               const s = getSession(source, args.session_id);
               if (s) {
-                const transcript = getTranscript(source, args.session_id);
-                if (hasExcludeMarker(transcript)) {
+                // Authoritative gate: raw part blobs (a marker in an
+                // unparseable blob would be invisible to the parsed-text scan).
+                if (transcriptHasMarker(source, args.session_id)) {
                   return "Session is marked private (exclusion marker present); transcript withheld.";
                 }
+                const transcript = getTranscript(source, args.session_id);
                 const lines: string[] = [`# ${s.title}`, `${fmtDate(s.time_created)} — ${s.directory} — ${s.id}`, ""];
                 for (const m of transcript) {
                   const text = m.parts

package/src/cli.ts

@@ -10,11 +10,10 @@
 //   stats                          Index statistics
 //   doctor                         Diagnose setup
 import { existsSync } from "node:fs";
-import { openSource, sourceDbPath, getSession, getTranscript } from "./reader";
+import { openSource, sourceDbPath, getSession, getTranscript, transcriptHasMarker } from "./reader";
 import { openIndex, indexDbPath, search, textSearch, stats, type SearchHit } from "./store";
 import { syncAll } from "./indexer";
 import { embed, embedQuery } from "./embed";
-import { hasExcludeMarker } from "./parser";
 
 const [, , command, ...rest] = process.argv;
 
@@ -126,11 +125,13 @@ async function main() {
       const source = openSource();
       const s = getSession(source, id);
       if (!s) { console.error("session not found:", id); process.exit(1); }
-      const transcript = getTranscript(source, id);
-      if (hasExcludeMarker(transcript)) {
+      // Authoritative gate: raw part blobs (a marker in an unparseable blob
+      // would be invisible to the parsed-text scan).
+      if (transcriptHasMarker(source, id)) {
         console.error("session is marked private (exclusion marker present); transcript withheld");
         process.exit(1);
       }
+      const transcript = getTranscript(source, id);
       console.log(`# ${s.title}\n${fmtDate(s.time_created)} — ${s.directory} — ${s.id}\n`);
       for (const m of transcript) {
         const text = m.parts.filter((p) => p.type === "text" && p.text).map((p) => p.text).join("\n");

package/src/indexer.ts

@@ -1,7 +1,7 @@
 // Incremental, idempotent indexer. Watermark = session.time_updated; a session
 // is re-embedded only when the source changed since we last indexed it.
 import type { Database } from "bun:sqlite";
-import { getTranscript, listSessions, type SourceSession } from "./reader";
+import { getTranscript, listSessions, transcriptHasMarker, type SourceSession } from "./reader";
 import { parseTranscript, exchangeText } from "./parser";
 import { embed } from "./embed";
 import { getIndexedSession, replaceSessionChunks } from "./store";
@@ -24,7 +24,12 @@ export async function syncSession(
   const prior = getIndexedSession(index, s.id);
   if (!force && prior && prior.source_time_updated >= s.time_updated) return "fresh";
 
-  const { exchanges, excluded } = parseTranscript(getTranscript(source, s.id));
+  // Authoritative opt-out gate: raw part blobs. The parsed-text scan inside
+  // parseTranscript would miss a marker in an unparseable blob.
+  const excludedRaw = transcriptHasMarker(source, s.id);
+  const { exchanges, excluded } = excludedRaw
+    ? { exchanges: [], excluded: true }
+    : parseTranscript(getTranscript(source, s.id));
   const meta = {
     id: s.id, project_id: s.project_id, parent_id: s.parent_id,
     title: s.title, directory: s.directory,

package/src/parser.ts

@@ -1,13 +1,18 @@
 // Turn a raw transcript into condensed exchanges suitable for embedding.
 // Keeps user text, assistant text, and tool *names* (not tool output, which is
 // bulky and low-signal). Skips reasoning blobs and step markers.
-import type { SourceMessage, SourcePart } from "./reader";
+import { EXCLUDE_MARKER, type SourceMessage, type SourcePart } from "./reader";
 
-export const EXCLUDE_MARKER = "DO NOT INDEX THIS CHAT";
+// Defined in reader.ts (single source of truth); re-exported for existing
+// consumers of this module.
+export { EXCLUDE_MARKER };
 
-// True if any text part in the conversation contains the opt-out marker.
-// Used both at index time (skip embedding) and at read time (refuse to return
-// the transcript), so a markered chat is never surfaced verbatim.
+// Fast-path check over PARSED part text. Cheaper than the raw scan, but can
+// miss the marker when a part blob fails to parse and degrades to
+// text: undefined — the AUTHORITATIVE check is transcriptHasMarker() in
+// reader.ts, which substring-matches the raw `data` column. Callers that gate
+// privacy-sensitive paths should use the raw check; this remains useful for
+// parseTranscript's in-memory flow and tests.
 export function hasExcludeMarker(messages: SourceMessage[]): boolean {
   for (const m of messages) {
     for (const p of m.parts) {

package/src/reader.test.ts

@@ -1,6 +1,6 @@
 import { describe, test, expect } from "bun:test";
 import { Database } from "bun:sqlite";
-import { listSessions, getSession, getTranscript } from "./reader";
+import { listSessions, getSession, getTranscript, transcriptHasMarker, EXCLUDE_MARKER } from "./reader";
 
 // A minimal opencode.db mirroring only the columns reader.ts SELECTs. Writable
 // here so we can seed rows; the reader functions take a Database and never write.
@@ -137,3 +137,69 @@ describe("getTranscript (JSON blob degradation)", () => {
     expect(() => getTranscript(db, "ses_a")).toThrow();
   });
 });
+
+describe("transcriptHasMarker (raw blob scan)", () => {
+  test("detects the marker in a well-formed text part", () => {
+    const db = makeSource();
+    addSession(db, { id: "ses_a" });
+    addMessage(db, "m1", "ses_a", 1, `{"role":"user"}`);
+    addPart(db, "p1", "m1", "ses_a", 1, `{"type":"text","text":"note: ${EXCLUDE_MARKER}"}`);
+    expect(transcriptHasMarker(db, "ses_a")).toBe(true);
+  });
+
+  // Regression for issue #10: the parsed-text scan degrades this blob to
+  // text: undefined, so the marker is invisible to hasExcludeMarker — but the
+  // raw scan must still see it. The privacy kill-switch must not depend on
+  // blob parseability.
+  test("detects the marker inside a malformed/unparseable part blob", () => {
+    const db = makeSource();
+    addSession(db, { id: "ses_a" });
+    addMessage(db, "m1", "ses_a", 1, `{"role":"user"}`);
+    addPart(db, "p1", "m1", "ses_a", 1, `{oops not json ${EXCLUDE_MARKER}`);
+
+    // Sanity: the parsed view really does lose the marker text.
+    const t = getTranscript(db, "ses_a");
+    expect(t[0].parts).toEqual([{ type: "unknown" }]);
+
+    expect(transcriptHasMarker(db, "ses_a")).toBe(true);
+  });
+
+  test("detects the marker in a blob whose fields all fail validation", () => {
+    const db = makeSource();
+    addSession(db, { id: "ses_a" });
+    addMessage(db, "m1", "ses_a", 1, `{"role":"user"}`);
+    // Valid JSON, but type is non-string → degrades to {type:"unknown"}.
+    addPart(db, "p1", "m1", "ses_a", 1, `{"type":123,"note":"${EXCLUDE_MARKER}"}`);
+
+    const t = getTranscript(db, "ses_a");
+    expect(t[0].parts).toEqual([{ type: "unknown" }]);
+    expect(transcriptHasMarker(db, "ses_a")).toBe(true);
+  });
+
+  test("returns false when no part contains the marker", () => {
+    const db = makeSource();
+    addSession(db, { id: "ses_a" });
+    addMessage(db, "m1", "ses_a", 1, `{"role":"user"}`);
+    addPart(db, "p1", "m1", "ses_a", 1, `{"type":"text","text":"hello"}`);
+    expect(transcriptHasMarker(db, "ses_a")).toBe(false);
+  });
+
+  test("is scoped to the requested session", () => {
+    const db = makeSource();
+    addSession(db, { id: "ses_a" });
+    addSession(db, { id: "ses_b" });
+    addMessage(db, "m1", "ses_b", 1, `{"role":"user"}`);
+    addPart(db, "p1", "m1", "ses_b", 1, `{"type":"text","text":"${EXCLUDE_MARKER}"}`);
+    expect(transcriptHasMarker(db, "ses_a")).toBe(false);
+    expect(transcriptHasMarker(db, "ses_b")).toBe(true);
+  });
+
+  test("does not match case variants or partial markers (exact substring)", () => {
+    const db = makeSource();
+    addSession(db, { id: "ses_a" });
+    addMessage(db, "m1", "ses_a", 1, `{"role":"user"}`);
+    addPart(db, "p1", "m1", "ses_a", 1, `{"type":"text","text":"do not index this chat"}`);
+    addPart(db, "p2", "m1", "ses_a", 2, `{"type":"text","text":"DO NOT INDEX THIS"}`);
+    expect(transcriptHasMarker(db, "ses_a")).toBe(false);
+  });
+});

package/src/reader.ts

@@ -7,6 +7,11 @@ import { z } from "zod";
 
 export const DEFAULT_SOURCE_DB = join(homedir(), ".local/share/opencode/opencode.db");
 
+// Opt-out marker. Matched as a BARE SUBSTRING anywhere in any message part —
+// broader than upstream's full instruction-tag match, so it also fires on
+// conversations that merely quote the phrase. Re-exported by parser.ts.
+export const EXCLUDE_MARKER = "DO NOT INDEX THIS CHAT";
+
 // --- Validation strategy ----------------------------------------------------
 // Two surfaces, two failure modes (see AGENTS.md):
 //   1. Structural rows we SELECT from opencode.db (columns: id, time_created,
@@ -43,6 +48,9 @@ const PartRowSchema = z.object({
   data: z.string(),
 });
 
+// Aggregate row for the raw marker scan (structural: throw on drift).
+const MarkerCountSchema = z.object({ n: z.number() });
+
 // --- JSON blob schemas (degrade to "unknown" on mismatch) -------------------
 const PartDataSchema = z
   .object({
@@ -102,6 +110,24 @@ export function getSession(db: Database, sessionId: string): SourceSession | nul
   return row === null || row === undefined ? null : SessionRowSchema.parse(row);
 }
 
+// AUTHORITATIVE exclusion check: bare-substring match over the RAW `data`
+// column of the session's part rows, with no JSON parsing. The parsed-text
+// scan (parser.ts hasExcludeMarker) can miss the marker when a part blob fails
+// to parse and degrades to text: undefined — the privacy kill-switch must not
+// depend on blob parseability. `instr` is an exact, case-sensitive substring
+// match (unlike LIKE, which is case-insensitive and has wildcard chars).
+export function transcriptHasMarker(db: Database, sessionId: string): boolean {
+  const row = MarkerCountSchema.parse(
+    db
+      .prepare(
+        `SELECT COUNT(*) AS n FROM part
+         WHERE session_id = ? AND instr(data, ?) > 0`
+      )
+      .get(sessionId, EXCLUDE_MARKER)
+  );
+  return row.n > 0;
+}
+
 export function getTranscript(db: Database, sessionId: string): SourceMessage[] {
   const messages = MessageRowSchema.array().parse(
     db