* security: bump vite across integrations to patched versions Fixes Dependabot alerts for vite transitive dev dependency: - GHSA-v2wj-q39q-566r (high): server.fs.deny bypass with queries - GHSA-p9ff-h696-f583 (high): related vite server vulnerability Adds a `vite` entry to the npm `overrides` in each integration's package.json to force the patched version (>=8.0.5). To make this possible in ai-sdk, chat, and openclaw — which pinned vitest ^4.0.18 whose vite peer is `^6.0.0 || ^7.0.0` — the minor-compatible bump vitest ^4.0.18 -> ^4.1.2 is also included. vitest 4.1.x supports vite 8.x (peer: ^6 || ^7 || ^8), so all six integrations converge on vite 8.x consistently. paperclip had no overrides block; one was added. Verified locally: `npm ci && npx vitest run` passes in all six integrations (ai-sdk 23, chat 28, openclaw 66, opencode 89, paperclip 27, nemoclaw 36 tests). * chore: regenerate hindsight-docs skill Picks up FAQ and best-practice sections added in #905 that were not regenerated at merge time, so that `verify-generated-files` passes for this branch. |
||
|---|---|---|
| .. | ||
| src | ||
| package-lock.json | ||
| package.json | ||
| README.md | ||
| tsconfig.json | ||
| tsup.config.ts | ||
| vitest.config.ts | ||
@vectorize-io/opencode-hindsight
Hindsight memory plugin for OpenCode — give your AI coding agent persistent long-term memory across sessions.
Features
- Custom tools:
hindsight_retain,hindsight_recall,hindsight_reflect— the agent calls these explicitly - Auto-retain: Captures conversation on
session.idleand stores to Hindsight - Memory injection: Recalls relevant memories when a new session starts
- Compaction hook: Injects memories during context compaction so they survive window trimming
Quick Start
1. Install
npm install @vectorize-io/opencode-hindsight
2. Configure
Add to your opencode.json:
{
"plugin": ["@vectorize-io/opencode-hindsight"]
}
3. Set Environment Variables
# Required: Hindsight API URL
export HINDSIGHT_API_URL="http://localhost:8888"
# Optional: API key for Hindsight Cloud
export HINDSIGHT_API_TOKEN="your-api-key"
# Optional: Override the memory bank ID
export HINDSIGHT_BANK_ID="my-project"
Configuration
Plugin Options
Pass options directly in opencode.json:
{
"plugin": [
["@vectorize-io/opencode-hindsight", {
"hindsightApiUrl": "http://localhost:8888",
"bankId": "my-project",
"autoRecall": true,
"autoRetain": true,
"recallBudget": "mid"
}]
]
}
Config File
Create ~/.hindsight/opencode.json for persistent configuration:
{
"hindsightApiUrl": "http://localhost:8888",
"hindsightApiToken": "your-api-key",
"recallBudget": "mid",
"retainEveryNTurns": 10,
"debug": false
}
Environment Variables
| Variable | Description | Default |
|---|---|---|
HINDSIGHT_API_URL |
Hindsight API base URL | (required) |
HINDSIGHT_API_TOKEN |
API key for authentication | (none) |
HINDSIGHT_BANK_ID |
Static memory bank ID | opencode |
HINDSIGHT_AGENT_NAME |
Agent name for dynamic bank IDs | opencode |
HINDSIGHT_AUTO_RECALL |
Auto-recall on session start | true |
HINDSIGHT_AUTO_RETAIN |
Auto-retain on session idle | true |
HINDSIGHT_RETAIN_MODE |
full-session or last-turn |
full-session |
HINDSIGHT_RECALL_BUDGET |
Recall budget: low, mid, high |
mid |
HINDSIGHT_RECALL_MAX_TOKENS |
Max tokens for recall results | 1024 |
HINDSIGHT_DYNAMIC_BANK_ID |
Enable dynamic bank ID derivation | false |
HINDSIGHT_BANK_MISSION |
Bank mission/context | (none) |
HINDSIGHT_DEBUG |
Enable debug logging | false |
Configuration Priority
Settings are loaded in this order (later wins):
- Built-in defaults
~/.hindsight/opencode.json- Plugin options from
opencode.json - Environment variables
Tools
hindsight_retain
Store information in long-term memory. The agent uses this to save important facts, user preferences, project context, and decisions.
hindsight_recall
Search long-term memory. The agent uses this proactively before answering questions where prior context would help.
hindsight_reflect
Generate a synthesized answer from long-term memory. Unlike recall (raw memories), reflect produces a coherent summary.
Dynamic Bank IDs
For multi-project setups, enable dynamic bank ID derivation:
export HINDSIGHT_DYNAMIC_BANK_ID=true
The bank ID is composed from granularity fields (default: agent::project). Supported fields: agent, project, channel, user.
Note: The bank ID is derived once when the plugin loads, from environment variables set before OpenCode starts. These dimensions are process-scoped — they don't change per session within a running OpenCode process. For per-user isolation, set the env vars before launching each user's OpenCode instance:
export HINDSIGHT_CHANNEL_ID="slack-general"
export HINDSIGHT_USER_ID="user123"
Development
npm install
npm test # Run tests
npm run build # Build to dist/
License
MIT