- Updated OpenCode autosave implementation in
.opencode/plugins/mempalace-autosave.js,mempalace-autosave-sync.py,mempalace-autosave-mine.sh,.gitignore, andREADME.md - Focused on the previously identified security and performance issues in autosave persistence and sync behavior
- safe to merge
- No unresolved material security or performance issues were found in the current autosave implementation.
- Existing coverage now includes a Node plugin regression test for sanitized transcript persistence and no-op idle flushes, plus a Python unittest for sync idempotency and stale chunk deletion.
- Add a permission-focused test for the autosave directory and transcript files where the platform supports
chmodsemantics. - Add a long-session benchmark or regression test to quantify idle flush cost on large transcripts.
- Raw tool output is no longer persisted; assistant fallback content is reduced to bounded structural markers such as tool status and patch file names.
- Autosave directories and transcript files are created with restrictive modes (
0700/0600) on platforms that honor them. - The plugin now maintains an incremental in-memory session cache from OpenCode events and only hydrates from the server when needed after startup.
- The sync script skips unchanged chunks and deletes stale chunk IDs, substantially reducing ChromaDB churn versus blind full upserts.
.mempalace-autosave/is ignored by git to reduce accidental publication of local transcript spools.
- End-to-end plugin behavior against a live OpenCode runtime was not exercised here; validation was limited to code inspection plus syntax checks.
- Very large or very long-lived sessions may still merit profiling because transcript rendering and chunk comparison remain proportional to changed session size at flush time.
- Filesystem permission hardening is best-effort and may not be enforced uniformly on all platforms or mounts.