v2.23.2

Changed

• Prepared-statement caching is shared, and plugin.ts re-exports OpenCodeMemPlugin directly.
• better-sqlite3 is an optional dependency — installs no longer hard-fail on platforms where its native build breaks (bun:sqlite / node:sqlite users unaffected).
• Dashboard route handlers are imported directly — the api-handlers.ts re-export layer is gone.
• Config types are now derived from the zod schema (z.infer) instead of a hand-maintained duplicate interface.
• Startup no longer blocks on embedding warmup or score recalculation — the plugin loads immediately and warms up in the background.

Fixed

• Auto-capture no longer strands prompts in captured=2 state when capture is skipped after claiming — early returns now release the claim for the next idle cycle.
• Plugin now implements the opencode dispose hook — all timers, jobs, the web server, and sqlite connections are cleaned up when the host disposes or reloads the plugin.
• Warmup timeout race no longer triggers an unhandled promise rejection.
• Auto-capture and profile learning now wait for opencode provider state instead of racing it at startup.
• The forget tool now reports actual deletion failures instead of always claiming success.
• Re-embed migrations now update vectors in place, and migration operations report success only when every shard succeeded — failures propagate to the admin UI instead of being logged away.
• Exact-duplicate cleanup is now transactional (no partial purges on crash) and no longer writes memory content into host logs.
• Memory archival now commits its sqlite transaction before touching the vector index — no more async work inside BEGIN IMMEDIATE, and archived ids are reliably deleted from the index.
• Batched writes are no longer dropped when their connection was evicted before flush.
• SQL connection pool no longer evicts (and mid-checkpoint-closes) connections with an open transaction.
• SQLite write transactions are no longer held open across async vector-index updates — eliminating nested-transaction/SQLITE_BUSY risks under concurrent captures, decay, and admin operations.
• Keyword search and FTS boost now work: the memories_fts FTS5 virtual table (absent since shards were created without it) is created on new and existing shards — keyword search no longer silently degrades to a full-table LIKE scan.
• Decay cycle now rotates through all decayable memories (ordered by last_decay_at) instead of repeatedly processing only the first batch; rows past the batch cap now decay and archive.
• CI and SonarCloud workflows pin Bun to 1.4.0 and install with --frozen-lockfile for reproducible gates.

Security

• Dashboard requests are now rejected unless the Host header is loopback or explicitly configured — closes a DNS-rebinding route to the unauthenticated local API.
• Bun.serve now applies the same 256 KiB request body cap as the Node adapter, preventing memory-exhaustion via oversized dashboard payloads.
• Web dashboard loads app.js after DOMPurify and sanitizes fail-closed when the sanitizer is unavailable.
• Transcript keyword search now sanitizes FTS5 operator syntax from user queries, matching the memory search path.
• API key comparison is now constant-time without a length short-circuit.

Contributors

@ZeR020