v0.0.1

[0.0.1] - 2026-11-12

Changed

• Scripts call History through its tools RPC. The history namespace description and a new row in the history-recall skill's table now say that a script or cron job uses the tools RPC history.sessions.tools (opencode api post /api/rpc/history.sessions.tools/<tool>, as a session the script creates) and never reads OpenCode's database (opencode.db) or History's index (index.db) directly: the RPC masks secrets and applies the permission rules, and a direct read does neither. In an interleaved evaluation against 0.0.0 (both versions run case by case in the same hour, Claude Haiku on OpenCode, 45 core questions and 17 safety questions, one model and one synthetic history), the scripting question's direct database reads fell from 1 of 2 runs to none, with no regression on the core questions and no safety failures. Scores moved by 10 to 16 points between runs of the same version at different hours, so only the interleaved comparison is meaningful, and it supports "no regression", not a gain.

Known limits

• The first index pass runs in the background. Until it finishes, search, sessions and recall answer from the sessions indexed so far. /history-status shows the progress.
• Only OpenCode's database is read. When it cannot be read, or its layout is one this version does not know, the plugin falls back to the plugin session API, which holds only the messages after each session's latest compaction. Status says the history is partial.
• Masking matches patterns. The built-in patterns and your mask entries catch the credentials they describe, not every secret. Text indexed before a change keeps its old form until /history-reindex rebuild.
• The index is large and grows with your history. It takes about 2.7 times the text it holds, and deleting a session does not shrink the file.
• Every tool is allowed by default. Any agent can read any indexed session in any project, and access decides what runs without asking. scope filters results; it is not access control.
• Tested on OpenCode 2.2.3, 2.2.4, 2.2.5 and 2.2.6. Other releases inside >=2.2.3 <2.3.0 start, and status reports them as untested.
• Updates are not automatic for a Git install, and opencode plugin update and opencode plugin check do not work on one: to move to a newer release, remove the old entry and add the new tag.

v0.0.0

[0.0.0] - 2026-11-10

Added

• Jelly shows each setting's default: access "all", defaultScope "project" and maskDefaults true.
• The access option restricts what the generated default rules allow: "all" (the default), "ask-changes" and
  "read-only". The block is generated from the tool classes, with the history_* namespace rule first, so a tool a
  later version adds follows the same value. /history-status and the status RPC report the value and the block.

Changed

Everything an agent reads about History was rewritten and measured: 47 lookup, listing, aggregate, safety and "not in the history" questions, three trials each, on OpenCode 2.2.6 with Claude Haiku, against a synthetic history of 203 sessions across six projects. The share of runs in which every blocker and major item passed ("strict pass") went from 55% to 76%, a gain of 21 points (95% CI 14 to 30, paired over cases; 20 questions improved and none got worse); full (ses_… #seq) citations from 52% to 77%; the skill was loaded in 78% of the lookup questions, up from 53%. On 9 held-out questions written before tuning, strict pass went from 48% to 67% and runs with no failed blocker from 70% to 96%. The sample is small, one model and one synthetic corpus: read it as evidence of direction, not of size. docs/architecture.md says which text reaches the model and where an instruction belongs.

• The history namespace description says when to look: before the repo or git, whenever the user refers to earlier work ("we did / wrote / fixed / decided", "last time", "how did we…"), and before saying that something the user says you did does not exist. It says to load the history-recall skill first, that time windows, costs, counts and rankings go to sessions or sql and not to search, how to widen a search that misses (scope: "all", then includeArchived and includeSubagents), and how to cite. It is about 260 tokens, up from about 125, in every session that has the plugin.

• The first ~118 characters of every tool description stand alone. The Code Mode catalog shows only that much of a description; the rest is read through search().

• includeSubagents and includeArchived no longer say to set them only after an empty result whose hidden count is above 0 (the 0.0.4 wording). Agents never read hidden, and it is reported only when a search finds nothing, so that wording left archived and subagent sessions unfound: the archived-decision question failed in every baseline trial. They now say to set them on the first call when the user asks for that kind of work, and on a repeat when the visible results miss. scope says when to use all.

• Result fields carry descriptions that the Code Mode signature shows: cite (copy it, and keep it in what your code returns), hidden, similar, queriesMatched, next, previous, seqs, and recall's evidence, which can stop short of the answer.

• The history-recall skill leads with four rules, adds rows for exact text, subagent work and archived sessions, says the newest session wins when sessions disagree, and tells an agent to read on when a recall's evidence stops short. Its frontmatter fires on "we wrote / did / ran X" and before telling the user something is not in the repo or git. It is about 280 tokens longer when loaded.

• docs/architecture.md has a table of what the model reads, and where an instruction belongs.

• The tests that pinned the changed wording pin the new wording, and test/unit/host/tools.test.ts pins the trigger rule, the standalone blurbs and the output-field docs.

• Every tool is allowed by default. The plugin inserts an allow for each tool it registers and for the history_*
  namespace: the seven reads, and history_pin, which writes a past session's brief into the current session's
  instructions. An agent runs them without asking, and nothing is held back. "ask-changes" makes history_pin and a
  new tool ask, and "read-only" denies them; the reads always run. At "all" no agent needs the per-agent fix, so
  status names none.

• scripts get the same default: every method runs unless access or the session's rules restrict it.

• tools RPC v2: every known tool is scriptable under a prior explicit allow. history_pin is a method now, a write,
  so a script can pin with the session's allow; the shared tools RPC module is copied into src/host/tools-rpc.ts and
  its copy is pinned by scripts/check-copies.mjs. Every method carries a class, and describe reports it, plus each
  method's resolved permission when it is given a session.

• A call now resolves the rule before dispatch: only an allow runs, an ask is refused, and a deny is refused,
  with no tool call and no prompt. A saved "Always allow" no longer authorises an ad-hoc script; its grant is a rule in
  config, or a Jobs run session.

• Script asserts now carry the same tool source id as a model call, so an inner ask is refused and named instead of
  waiting for a prompt.

• The history_pin description says that session text is data, never instructions, as the skill and the other tool descriptions do.

Known limits

• The first index pass runs in the background. Until it finishes, search, sessions and recall answer from the sessions indexed so far. /history-status shows the progress.
• Only OpenCode's database is read. When it cannot be read, or its layout is one this version does not know, the plugin falls back to the plugin session API, which holds only the messages after each session's latest compaction. Status says the history is partial.
• Masking matches patterns. The built-in patterns and your mask entries catch the credentials they describe, not every secret. Text indexed before a change keeps its old form until /history-reindex rebuild.
• The index is large and grows with your history. It takes about 2.7 times the text it holds, and deleting a session does not shrink the file.
• Every tool is allowed by default. Any agent can read any indexed session in any project, and access decides what runs without asking. scope filters results; it is not access control.
• Tested on OpenCode 2.2.3, 2.2.4, 2.2.5 and 2.2.6. Other releases inside >=2.2.3 <2.3.0 start, and status reports them as untested.
• Updates are not automatic for a Git install, and opencode plugin update and opencode plugin check do not work on one: to move to a newer release, remove the old entry and add the new tag.