vault-go 0.20.0 → 0.21.0

package/README.md

@@ -181,7 +181,7 @@ limitados.
 
 O seletor oferece Codex (Terra, Luna ou Sol pela assinatura ChatGPT), Claude (CLI da assinatura), OpenRouter (chave), Gemini (chave) ou o Vault AI Resume da conta, quando disponível no servidor. Grave chaves com `vault-go engine key openrouter|gemini` ou no painel local; as ferramentas MCP não aceitam segredos.
 
-Na instalação, o Vault Go registra hooks no Claude Code, no Codex, no Grok e no Agy. Eles injetam contexto no início da sessão, capturam prompts e ferramentas, e o serviço local (`http://localhost:38850`) gera memórias com o motor escolhido — o mesmo ciclo do claude-mem, persistindo no Vault.
+Na instalação, o Vault Go registra hooks no Claude Code, no Codex, no Grok, no Agy e no Gemini CLI. Eles carregam contexto e capturam os eventos oferecidos pelo cliente; o serviço local (`http://localhost:38850`) gera memórias com o motor escolhido, persistindo no Vault. No OpenCode 1.x, um plugin acrescenta contexto ao sistema antes das chamadas do modelo; esse adaptador não adiciona captura automática.
 
 O recurso `vault-go://status` fornece o resumo sanitizado em JSON.
 
@@ -278,6 +278,10 @@ O runtime fica em `~/.memvault/local-runtime`, independente do cache bunx.
 `local stop` para o processo; `local uninstall` remove o início automático e
 preserva autenticação, cache e atividade. A atualização automática mantém o
 serviço e os hooks atualizados; clientes MCP abertos precisam reconectar.
+Após validar a nova versão do serviço, a atualização também repara os hooks do
+Gemini e o plugin do OpenCode quando esses clientes já têm o MCP Vault configurado.
+Plugins de terceiros são preservados. Reinicie clientes abertos para carregar
+novos hooks ou o módulo atualizado do plugin.
 
 A atividade registra método, rota, duração e resultado das chamadas feitas
 pelo MCP Vault, sem argumentos, consultas ou credenciais. Não captura toda a
@@ -322,6 +326,21 @@ conforme os eventos oferecidos pelo cliente. O hook anterior à leitura de arqui
 é síncrono para conseguir inserir o contexto. `vault_go_session_start_context`
 executa o mesmo leitor, respeitando `contextItems` e `contextMaxChars` da conta.
 
+Claude, Codex e Gemini mostram uma confirmação quando o contexto é carregado,
+sem exibir conteúdo da memória nessa confirmação. Worktrees Git reutilizam o
+projeto do repositório principal; se ele ainda não estiver cadastrado, um projeto
+existente do próprio worktree continua legível. Submódulos mantêm seu projeto.
+
+O Gemini usa `SessionStart`, `BeforeAgent`, `AfterTool` e `AfterAgent`, conforme
+seu [contrato de hooks](https://geminicli.com/docs/hooks/reference/). Não há
+injeção de histórico de arquivo em `BeforeTool`, pois esse evento não oferece
+esse contrato. O plugin OpenCode usa `experimental.chat.system.transform`
+do [contrato 1.x](https://github.com/anomalyco/opencode/blob/v1.18.31/packages/plugin/src/index.ts),
+com prazo de três segundos e continuação normal em caso de falha. Consultas
+simultâneas da mesma sessão são compartilhadas; respostas de uma credencial
+substituída não são injetadas. Clientes sem esses adaptadores acessam memória
+pelas ferramentas MCP, sem promessa de contexto automático.
+
 A captura respeita `automaticCapture`, `captureMode` e a opção de incluir resultados
 de ferramentas. Uma falha ao consultar preferências desativa aquela captura.
 Eventos privados não são enviados; campos sensíveis e marcadores privados são

package/dist/capabilities.js

@@ -6,7 +6,7 @@ export const CAPABILITIES = {
         { upstream: ['important_workflow'], status: 'available', tools: ['vault_go_workflow'] },
         { upstream: ['search', 'get_observations', 'timeline'], status: 'partial', tools: ['vault_go_search_index', 'vault_go_observations', 'vault_go_timeline', 'vault_go_feed'], difference: 'UUID identifiers; search requires query; feed provides cursor pagination. No offset/orderBy or automatic timeline anchor.' },
         { upstream: ['get_tool_uses'], status: 'available', tools: ['vault_go_tool_uses'], requires: 'Engine with POST /v1/events/batch. Historical output is unavailable unless it was captured. Private data is redacted.' },
-        { upstream: ['session_start_context'], status: 'partial', tools: ['vault_go_session_start_context', 'vault_go_context', 'vault_go_file_context'], difference: 'Exact Vault SessionStart hook output and configured context budget. No upstream multi-project chain renderer.' },
+        { upstream: ['session_start_context'], status: 'partial', tools: ['vault_go_session_start_context', 'vault_go_context', 'vault_go_file_context'], difference: 'Vault SessionStart output and configured budget; canonical Git worktree projects. Native hooks for Claude/Codex/Grok/Agy/Gemini; context-only OpenCode 1.x system plugin. No upstream multi-project chain renderer.' },
         { upstream: ['smart_search', 'smart_outline', 'smart_unfold'], status: 'partial', tools: ['vault_go_smart_search', 'vault_go_smart_outline', 'vault_go_smart_unfold'], difference: 'Local AST with bounded workspace reads; supported languages are returned by the tools, not all upstream grammars.' },
         { upstream: ['observation_add', 'observation_record_event', 'observation_search', 'observation_context'], status: 'available', tools: ['vault_go_remember', 'vault_go_event', 'vault_go_search', 'vault_go_context'], requires: 'generate:false requires updated engine and prevents duplicate server processing. summaryMode=off preserves raw memory without invoking a model.' },
         { upstream: ['automatic updates'], status: 'available', tools: ['vault_go_update_status', 'vault_go_update_check', 'vault_go_update_install', 'vault_go_update_configure'], requires: 'Local worker running, npm installed and official registry reachable. Daily stable-release check; idle activation and runtime rollback. Reconnect MCP clients to use new tool definitions.' },
@@ -16,7 +16,7 @@ export const CAPABILITIES = {
         { upstream: ['provider selection', 'automatic observation processing'], status: 'available', tools: ['vault_go_engines', 'vault_go_engine_select', 'vault_go_generate_context', 'vault_go_processing_status'], requires: 'Local worker running and selected provider authenticated. Codex Terra/Luna/Sol use ChatGPT subscription CLI. Retried persistence is idempotent.' },
         { upstream: ['privacy', 'capture modes', 'context settings'], status: 'partial', tools: ['vault_go_preferences', 'vault_go_preferences_update'], difference: 'Built-in capture modes and private-tag redaction; no custom mode inheritance/taxonomy. Preference update requires session authentication.' },
         { upstream: ['import', 'export', 'cloud sync'], status: 'partial', tools: ['vault_go_import', 'vault_go_export'], difference: 'Vault PostgreSQL persistence; upstream SQLite exports are a different format. Export is a bounded batch, not a complete backup. No offline replicated memory store.' },
-        { upstream: ['Telegram', 'Grok awareness push', 'CCS Align', 'transcript watchers'], status: 'unsupported', tools: [], difference: 'Not ported. Native capture hooks currently target Claude, Codex, Grok and Agy; other clients use MCP.' },
+        { upstream: ['Telegram', 'Grok awareness push', 'CCS Align', 'transcript watchers'], status: 'unsupported', tools: [], difference: 'Not ported. Native capture hooks target Claude, Codex, Grok, Agy and Gemini. OpenCode has context-only integration; remaining clients use MCP.' },
         { upstream: ['development/report/presentation skills', 'babysit'], status: 'partial', tools: ['vault_go_modes', 'vault_go_mode'], difference: '20 original Vault workflow prompts, also exposed as tools for clients without prompt support. Requirements and missing runtimes are explicit. Loading a mode does not start background agents or execute external actions.' },
     ],
 };

package/dist/hook-install.d.ts

@@ -9,6 +9,11 @@ export declare const HOOK_EVENTS: {
 export declare function quoteShell(value: string): string;
 export declare function hookEntryPath(configHome?: string): string;
 export declare function hookCommand(adapter: string, event: string, configHome?: string): string;
-export type HookClient = "claude" | "codex" | "grok" | "agy";
+export type HookClient = "claude" | "codex" | "grok" | "agy" | "gemini";
 export declare function installClientHooks(client: HookClient, userHome?: string, configHome?: string): void;
-export declare function repairClientHooks(userHome?: string, configHome?: string): void;
+export declare function installOpenCodePlugin(userHome?: string, configHome?: string): void;
+/** Repairs only clients explicitly connected to Vault; never installs a CLI. */
+export declare function repairAdditionalClientHooks(userHome?: string, configHome?: string, report?: typeof reportRepairWarning): void;
+declare function reportRepairWarning(message: string): void;
+export declare function repairClientHooks(userHome?: string, configHome?: string, report?: typeof reportRepairWarning): void;
+export {};

package/dist/hook-install.js

@@ -1,7 +1,7 @@
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { vaultHome } from "./config.js";
 function readJsonObject(path) {
     if (!existsSync(path))
@@ -21,9 +21,12 @@ function readJsonObject(path) {
     return parsed;
 }
 function atomicWriteJson(path, value) {
+    atomicWriteText(path, `${JSON.stringify(value, null, 2)}\n`);
+}
+function atomicWriteText(path, text) {
     mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
     const temporary = join(dirname(path), `.${process.pid}.${Date.now()}.tmp`);
-    writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, {
+    writeFileSync(temporary, text, {
         mode: 0o600,
     });
     renameSync(temporary, path);
@@ -37,6 +40,12 @@ export const HOOK_EVENTS = {
     PostToolUse: "observation",
     Stop: "summarize",
 };
+const GEMINI_EVENTS = {
+    SessionStart: "context",
+    BeforeAgent: "session-init",
+    AfterTool: "observation",
+    AfterAgent: "summarize",
+};
 export function quoteShell(value) {
     return "'" + value.replaceAll("'", "'\\''") + "'";
 }
@@ -51,7 +60,7 @@ export function hookCommand(adapter, event, configHome = vaultHome()) {
 }
 function hookManifest(adapter, configHome = vaultHome()) {
     return {
-        hooks: Object.fromEntries(Object.entries(HOOK_EVENTS).map(([name, event]) => [
+        hooks: Object.fromEntries(Object.entries(adapter === "gemini" ? GEMINI_EVENTS : HOOK_EVENTS).map(([name, event]) => [
             name,
             [
                 {
@@ -59,10 +68,15 @@ function hookManifest(adapter, configHome = vaultHome()) {
                         {
                             type: "command",
                             command: hookCommand(adapter, event, configHome),
-                            timeout: event === "context" ? 60 : 20,
-                            statusMessage: HOOK_OWNER,
-                            ...(event === "observation" ||
-                                event === "summarize"
+                            ...(adapter === "gemini" ? {
+                                timeout: event === "context" ? 60000 : 20000,
+                                name: `vault-go:${event}`,
+                                description: HOOK_OWNER,
+                            } : {
+                                timeout: event === "context" ? 60 : 20,
+                                statusMessage: HOOK_OWNER,
+                            }),
+                            ...(adapter !== "gemini" && (event === "observation" || event === "summarize")
                                 ? { async: true }
                                 : {}),
                         },
@@ -100,7 +114,7 @@ export function installClientHooks(client, userHome = homedir(), configHome = va
         atomicWriteJson(path, { ...config, "vault-go": agyHookManifest(configHome) });
         return;
     }
-    const path = join(userHome, client === "claude" ? ".claude/settings.json" : ".codex/hooks.json");
+    const path = join(userHome, client === "claude" ? ".claude/settings.json" : client === "gemini" ? ".gemini/settings.json" : ".codex/hooks.json");
     const config = readJsonObject(path);
     const hooks = {
         ...(config.hooks &&
@@ -110,7 +124,7 @@ export function installClientHooks(client, userHome = homedir(), configHome = va
             : {}),
     };
     const desired = hookManifest(client, configHome).hooks;
-    for (const event of Object.keys(HOOK_EVENTS)) {
+    for (const event of Object.keys(desired)) {
         const current = hooks[event];
         const retained = Array.isArray(current)
             ? current
@@ -121,7 +135,8 @@ export function installClientHooks(client, userHome = homedir(), configHome = va
                     return group;
                 const filtered = group.hooks.filter((hook) => !hook ||
                     typeof hook !== "object" ||
-                    hook.statusMessage !== HOOK_OWNER);
+                    (hook.statusMessage !== HOOK_OWNER &&
+                        !(client === "gemini" && hook.name === `vault-go:${GEMINI_EVENTS[event]}`)));
                 return { ...group, hooks: filtered };
             })
                 .filter((group) => !group ||
@@ -133,15 +148,56 @@ export function installClientHooks(client, userHome = homedir(), configHome = va
     }
     atomicWriteJson(path, { ...config, hooks });
 }
-export function repairClientHooks(userHome = homedir(), configHome = vaultHome()) {
-    installClientHooks("claude", userHome, configHome);
-    installClientHooks("codex", userHome, configHome);
+const OPENCODE_OWNER = "// Managed by vault-go: automatic memory context";
+export function installOpenCodePlugin(userHome = homedir(), configHome = vaultHome()) {
+    const path = join(userHome, ".config", "opencode", "plugins", "vault-go-memory.js");
+    if (existsSync(path) && !readFileSync(path, "utf8").startsWith(OPENCODE_OWNER + "\n")) {
+        throw new Error(`Refusing to replace an unowned plugin: ${path}`);
+    }
+    const runtime = pathToFileURL(join(configHome, "local-runtime", "dist", "opencode-plugin.js")).href;
+    atomicWriteText(path, `${OPENCODE_OWNER}\nexport default async function(input) {\n  try {\n    const runtime = await import(${JSON.stringify(runtime)});\n    return runtime.createOpenCodePlugin(input, { home: ${JSON.stringify(configHome)} });\n  } catch { return {}; }\n}\n`);
+}
+/** Repairs only clients explicitly connected to Vault; never installs a CLI. */
+export function repairAdditionalClientHooks(userHome = homedir(), configHome = vaultHome(), report = reportRepairWarning) {
+    repairClient("gemini", () => {
+        const gemini = readJsonObject(join(userHome, ".gemini", "settings.json"));
+        const server = gemini.mcpServers?.["vault-go"];
+        if (server && server.enabled !== false && server.disabled !== true) {
+            installClientHooks("gemini", userHome, configHome);
+        }
+    }, report);
+    repairClient("opencode", () => {
+        const opencode = readJsonObject(join(userHome, ".config", "opencode", "opencode.json"));
+        const server = opencode.mcp?.["vault-go"];
+        if (server && server.enabled !== false)
+            installOpenCodePlugin(userHome, configHome);
+    }, report);
+}
+function reportRepairWarning(message) {
+    process.stderr.write(message + "\n");
+}
+function repairClient(client, repair, report) {
+    try {
+        repair();
+    }
+    catch {
+        // Client configuration failures must not stop another client's repair or reveal its contents.
+        try {
+            report(`Vault Go: reparo de ${client} pendente; configuração existente preservada.`);
+        }
+        catch { }
+    }
+}
+export function repairClientHooks(userHome = homedir(), configHome = vaultHome(), report = reportRepairWarning) {
+    repairAdditionalClientHooks(userHome, configHome, report);
+    repairClient("claude", () => installClientHooks("claude", userHome, configHome), report);
+    repairClient("codex", () => installClientHooks("codex", userHome, configHome), report);
     if (existsSync(join(userHome, ".grok"))) {
-        installClientHooks("grok", userHome, configHome);
+        repairClient("grok", () => installClientHooks("grok", userHome, configHome), report);
     }
     if (existsSync(join(userHome, ".gemini", "config")) ||
         existsSync(join(userHome, ".gemini", "antigravity")) ||
         existsSync(join(userHome, ".gemini", "antigravity-cli"))) {
-        installClientHooks("agy", userHome, configHome);
+        repairClient("agy", () => installClientHooks("agy", userHome, configHome), report);
     }
 }

package/dist/hooks.js

@@ -1,6 +1,6 @@
 import { createHash, randomUUID } from "node:crypto";
-import { basename, dirname, resolve } from "node:path";
-import { existsSync } from "node:fs";
+import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { VaultCloudClient } from "./cloud.js";
 import { vaultHome } from "./config.js";
 import { enqueueGeneration } from "./hook-queue.js";
@@ -16,6 +16,14 @@ const record = (value) => value && typeof value === "object" && !Array.isArray(v
     : {};
 const string = (...values) => values.find((value) => typeof value === "string" && value.trim()) ||
     "";
+function resolvedPath(path) {
+    try {
+        return realpathSync(resolve(path));
+    }
+    catch {
+        return resolve(path);
+    }
+}
 function root(cwd) {
     const initial = resolve(cwd);
     let dir = initial;
@@ -26,6 +34,43 @@ function root(cwd) {
     }
     return initial;
 }
+function gitMetadata(path) {
+    const file = statSync(path);
+    if (!file.isFile() || file.size > 4096)
+        return "";
+    return readFileSync(path, "utf8").trim();
+}
+function projectRoots(workspace) {
+    const fallback = [resolvedPath(workspace)];
+    try {
+        const marker = /^gitdir:\s*(.+)$/.exec(gitMetadata(resolve(workspace, ".git")));
+        if (!marker)
+            return fallback;
+        const gitdir = resolve(workspace, marker[1]);
+        const common = gitMetadata(resolve(gitdir, "commondir"));
+        // A submodule or separate git directory has no shared worktree metadata.
+        if (!common)
+            return fallback;
+        const shared = resolvedPath(resolve(gitdir, common));
+        if (basename(shared) !== ".git" || !statSync(shared).isDirectory())
+            return fallback;
+        return [...new Set([dirname(shared), ...fallback])];
+    }
+    catch {
+        // Keep existing projects usable if Git metadata is absent or unreadable.
+        return fallback;
+    }
+}
+function canonicalFile(file, workspace, project) {
+    const absolute = resolve(workspace, file);
+    for (const directory of [workspace, resolvedPath(workspace)]) {
+        const path = relative(directory, absolute);
+        if (path !== ".." && !path.startsWith("../") && !path.startsWith("..\\") && !isAbsolute(path)) {
+            return resolve(project, path);
+        }
+    }
+    return absolute;
+}
 export function redact(value) {
     if (typeof value === "string") {
         return value
@@ -58,7 +103,7 @@ export function normalizeHookInput(adapter, value) {
         cwd: string(input.cwd, input.workspace, input.workspaceRoot, workspace),
         tool_name: string(input.tool_name, input.toolName, toolCall.name),
         tool_input: record(input.tool_input ?? input.toolInput ?? toolCall.args),
-        last_assistant_message: string(input.last_assistant_message, input.lastAssistantMessage, input.response, input.summary),
+        last_assistant_message: string(input.last_assistant_message, input.lastAssistantMessage, input.prompt_response, input.response, input.summary),
         prompt: string(input.prompt, input.user_prompt, input.userPrompt),
     };
 }
@@ -73,19 +118,24 @@ export function hookOutput(event, context = "", adapter = "claude") {
             return { decision: "allow" };
         return {};
     }
-    const result = { continue: true, suppressOutput: true };
+    const result = adapter === "codex"
+        ? {}
+        : { continue: true, suppressOutput: true };
     const name = event === "context"
         ? "SessionStart"
         : event === "file-context"
             ? "PreToolUse"
             : event === "session-init"
-                ? "UserPromptSubmit"
+                ? adapter === "gemini" ? "BeforeAgent" : "UserPromptSubmit"
                 : "";
     if (name && context) {
         result.hookSpecificOutput = {
             hookEventName: name,
             additionalContext: context,
         };
+        if (event === "context" && ["claude", "codex", "gemini"].includes(adapter)) {
+            result.systemMessage = "Vault Memory: contexto do projeto carregado.";
+        }
     }
     return result;
 }
@@ -130,15 +180,17 @@ export async function executeHook(adapter, event, value, cloud = new VaultCloudC
     const sessionId = string(input.session_id);
     if (!reading && !sessionId)
         return hookOutput(event, "", adapter);
-    const cwd = root(string(input.cwd, input.workspace) || process.cwd());
+    const workspace = root(string(input.cwd, input.workspace) || process.cwd());
+    const roots = projectRoots(workspace);
     const projects = await cloud.projects();
     if (!Array.isArray(projects))
         throw new Error("Resposta de projetos inválida");
-    let project = projects.find((item) => item &&
+    let project = roots.map((cwd) => projects.find((item) => item &&
         typeof item === "object" &&
         typeof item.rootPath === "string" &&
         Boolean(String(item.rootPath).trim()) &&
-        resolve(String(item.rootPath)) === cwd);
+        resolvedPath(String(item.rootPath)) === cwd)).find(Boolean);
+    const cwd = project ? resolvedPath(String(project.rootPath)) : roots[0];
     if (!project && reading)
         return hookOutput(event, "", adapter);
     if (!project) {
@@ -154,11 +206,15 @@ export async function executeHook(adapter, event, value, cloud = new VaultCloudC
         limit: boundedPreference(prefs.contextItems, 20, 1, 100),
         maxChars: boundedPreference(prefs.contextMaxChars, 24_000, 1_000, 100_000),
     };
+    const projectFile = file ? canonicalFile(file, workspace, cwd) : "";
+    const files = file
+        ? [...new Set([file, ...(resolvedPath(workspace) !== cwd ? [projectFile] : [])])]
+        : [];
     if (reading) {
         const result = record(event === "file-context"
             ? await cloud.fileContext({
                 ...limits,
-                paths: [...new Set([file, resolve(cwd, file)])],
+                paths: [...new Set([file, resolve(workspace, file), projectFile])],
             })
             : await cloud.context(limits));
         return hookOutput(event, string(result.context).slice(0, limits.maxChars), adapter);
@@ -218,8 +274,8 @@ export async function executeHook(adapter, event, value, cloud = new VaultCloudC
                 title: toolName ||
                     (event === "summarize" ? "Resumo da sessão" : "Solicitação do usuário"),
                 content,
-                filesRead: !modifies && file ? [file] : [],
-                filesModified: modifies && file ? [file] : [],
+                filesRead: !modifies ? files : [],
+                filesModified: modifies ? files : [],
             },
             occurredAtEpoch: Date.now(),
         });
@@ -233,8 +289,8 @@ export async function executeHook(adapter, event, value, cloud = new VaultCloudC
                 (event === "summarize" ? "Resumo da sessão" : "Solicitação do usuário"),
             kind: event === "summarize" ? "summary" : event === "session-init" ? "prompt" : "observation",
             maxChars: boundedPreference(prefs.summaryMaxChars, 4_000, 256, 16_000),
-            filesRead: !modifies && file ? [file] : [],
-            filesModified: modifies && file ? [file] : [],
+            filesRead: !modifies ? files : [],
+            filesModified: modifies ? files : [],
         });
     }
     if (event === "summarize")

package/dist/installer.js

@@ -4,7 +4,7 @@ import { dirname, join, resolve } from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { vaultHome } from './config.js';
 import { stageLocalRuntime } from './local-install.js';
-import { installClientHooks } from './hook-install.js';
+import { installClientHooks, installOpenCodePlugin } from './hook-install.js';
 export const MCP_SERVER_NAME = 'vault-go';
 export const MCP_SERVER_COMMAND = ['bunx', '--bun', 'vault-go@latest', 'serve'];
 export const MCP_CLIENTS = [
@@ -199,6 +199,11 @@ export function installMcpClient(client, options = {}) {
     if (client === 'gemini') {
         const path = join(home, '.gemini', 'settings.json');
         mergeServer(path);
+        try {
+            stageLocalRuntime(vaultHome());
+        }
+        catch { /* incomplete installs still write hooks */ }
+        installClientHooks('gemini', home);
         return { client, status: 'installed', destination: path };
     }
     if (client === 'vault-desktop') {
@@ -221,6 +226,11 @@ export function installMcpClient(client, options = {}) {
     else
         path = join(home, '.config', 'opencode', 'opencode.json');
     if (client === 'opencode') {
+        try {
+            stageLocalRuntime(vaultHome());
+        }
+        catch { /* plugin becomes active when runtime is available */ }
+        installOpenCodePlugin(home);
         mergeServer(path, 'mcp', {
             type: 'local',
             command: [...MCP_SERVER_COMMAND],

package/dist/opencode-plugin.d.ts

@@ -0,0 +1,16 @@
+type Options = {
+    home?: string;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+};
+/** OpenCode 1.x plugin contract: context only; capture stays with the user's existing integrations. */
+export declare function createOpenCodePlugin(input: {
+    directory: string;
+}, options?: Options): {
+    'experimental.chat.system.transform': (request: {
+        sessionID?: string;
+    }, output: {
+        system: string[];
+    }) => Promise<void>;
+};
+export {};

package/dist/opencode-plugin.js

@@ -0,0 +1,73 @@
+import { createHash } from 'node:crypto';
+import { loadConfig, loadTokens, vaultHome } from './config.js';
+import { VaultCloudClient } from './cloud.js';
+import { executeHook } from './hooks.js';
+function owner(home) {
+    return createHash('sha256').update(JSON.stringify([
+        loadConfig(home).apiUrl,
+        process.env.VAULT_GO_TOKEN || loadTokens(home)?.accessToken || '',
+    ])).digest('hex');
+}
+/** OpenCode 1.x plugin contract: context only; capture stays with the user's existing integrations. */
+export function createOpenCodePlugin(input, options = {}) {
+    const home = options.home ?? vaultHome();
+    const pending = new Map();
+    const empty = () => ({ context: '', owner: '' });
+    async function readContext(sessionID) {
+        const controller = new AbortController();
+        const fetcher = options.fetch ?? globalThis.fetch;
+        const boundedFetch = (async (url, init) => {
+            controller.signal.throwIfAborted();
+            return fetcher(url, {
+                ...init,
+                signal: init?.signal ? AbortSignal.any([controller.signal, init.signal]) : controller.signal,
+            });
+        });
+        const cloud = new VaultCloudClient(home, boundedFetch, false);
+        let timer;
+        const load = async () => {
+            // Authenticate/refresh before taking the ownership snapshot. No model or capture writes run here.
+            const preferences = await cloud.preferences();
+            controller.signal.throwIfAborted();
+            const requestOwner = owner(home);
+            cloud.preferences = async () => preferences;
+            const output = await executeHook('opencode', 'context', { cwd: input.directory, session_id: sessionID }, cloud, home);
+            const context = output.hookSpecificOutput?.additionalContext;
+            if (controller.signal.aborted || requestOwner !== owner(home) || typeof context !== 'string')
+                return empty();
+            return { context, owner: requestOwner };
+        };
+        try {
+            return await Promise.race([
+                load(),
+                new Promise(resolve => {
+                    timer = setTimeout(() => { controller.abort(); resolve(empty()); }, options.timeoutMs ?? 3000);
+                }),
+            ]);
+        }
+        catch {
+            return empty();
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+            controller.abort();
+        }
+    }
+    return {
+        'experimental.chat.system.transform': async (request, output) => {
+            if (!request.sessionID || !input.directory)
+                return;
+            const key = JSON.stringify([request.sessionID, owner(home)]);
+            let loading = pending.get(key);
+            if (!loading) {
+                loading = readContext(request.sessionID).finally(() => pending.delete(key));
+                pending.set(key, loading);
+            }
+            const result = await loading;
+            if (result.context && result.owner === owner(home) && !output.system.includes(result.context)) {
+                output.system.push(result.context);
+            }
+        },
+    };
+}

package/dist/update-control.d.ts

@@ -3,6 +3,8 @@ import { type UpdateState } from './updater.js';
 export declare function activatePreparedUpdate(home: string, state: UpdateState, operations?: {
     stop: (home: string) => Promise<boolean>;
     start: (home: string) => Promise<LocalHealth>;
+    repair?: (home: string) => void;
+    warn?: (message: string) => void;
 }, options?: {
     automatic?: boolean;
 }): Promise<LocalHealth>;

package/dist/update-control.js

@@ -2,10 +2,12 @@ import { spawn } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
 import { existsSync, openSync, closeSync, readFileSync, realpathSync, renameSync, rmSync, lstatSync, unlinkSync, writeFileSync } from 'node:fs';
 import { join, relative, isAbsolute } from 'node:path';
+import { homedir } from 'node:os';
 import { stageLocalRuntime, startLocal, stopLocal } from './local-install.js';
 import { installUpdate, updateStatus } from './updater.js';
 import { vaultHome } from './config.js';
 import { generationQueueStatus } from './hook-queue.js';
+import { repairAdditionalClientHooks } from './hook-install.js';
 function preparedPackage(home, state) {
     if (state.status !== 'ready' || !state.packageRoot || !state.latest)
         throw new Error('No validated update is ready.');
@@ -18,8 +20,20 @@ function preparedPackage(home, state) {
         throw new Error('Invalid prepared update.');
     return root;
 }
-export async function activatePreparedUpdate(home, state, operations = { stop: stopLocal, start: startLocal }, options = {}) {
+export async function activatePreparedUpdate(home, state, operations = { stop: stopLocal, start: startLocal, repair: home => repairAdditionalClientHooks(homedir(), home) }, options = {}) {
     const release = await acquireActivationLock(home);
+    const repair = () => {
+        try {
+            operations.repair?.(home);
+        }
+        catch {
+            const message = 'Vault Go: runtime atualizado; reparo dos hooks dos clientes pendente.';
+            try {
+                (operations.warn ?? (warning => { process.stderr.write(warning + '\n'); }))(message);
+            }
+            catch { }
+        }
+    };
     try {
         if (options.automatic && !updateStatus(home).enabled)
             throw new Error('Automatic updates are disabled.');
@@ -29,11 +43,14 @@ export async function activatePreparedUpdate(home, state, operations = { stop: s
             const health = await operations.start(home);
             if (health.version !== state.latest)
                 throw new Error('Active worker version mismatch.');
+            repair();
             return health;
         }
         if (active && compareVersions(active, state.latest) > 0)
             throw new Error('Refusing to activate an older runtime.');
-        return await replaceRuntime(home, state, source, operations);
+        const health = await replaceRuntime(home, state, source, operations);
+        repair();
+        return health;
     }
     finally {
         release();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vault-go",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "Servidor MCP universal com autenticação e instalação multi-cliente para a plataforma Vault.",
   "type": "module",
   "bin": {
@@ -20,6 +20,8 @@
     }
   },
   "files": [
+    "dist/opencode-plugin.js",
+    "dist/opencode-plugin.d.ts",
     "dist/activity.js",
     "dist/activity.d.ts",
     "dist/auth.js",