# 2026-08-10: opencode-memory merged

PR #281 (`f4c2b35`) squash-merged to main: the opencode-memory plugin, three CodeRabbit review rounds of fixes (installer stage-then-commit with rollback, atomic bootstrap binary replace in all five plugin copies, command-doc corrections), curl-one-liner standalone installer with `DEMARKUS_REF` pinning, and version bumps across memory 0.13.8 / knowledge 0.5.24 / pi-memory 0.13.8 / pi-knowledge 0.5.25. Branch deleted.

Soul bookkeeping: plan marked COMPLETE with follow-ups ([/plans/opencode-memory-plugin.md](/plans/opencode-memory-plugin.md)), index Active → Completed plus Plugins section refreshed (pi + opencode entries added, versions current), roadmap section appended.

Observation from the live install: OpenCode surfaces the demarkus MCP prompts (orient/recall/whats-new, shipped in #232) as `/demarkus-memory:<prompt>:mcp` commands automatically, so the port gains the prompt surface for free.

## Plugin token scope fix merged (PR #282)

Merged fix(tools): mint plugin token with recursive `/**` scope (63a5691). Provision minted `/*` (single-segment under path.Match), causing auth denials on nested writes after every fresh install. Final shape after four CodeRabbit rounds plus a /simplify pass:

- Mint with `tokenPaths = "/**"`; `legacyTokenPaths = "/*"` entries revoked and reminted.
- Idempotent gate parses tokens.toml once (pluginEntry) and verifies the raw token against the entry hash (rawMatchesEntry, protocol.HashToken); scopeStale is a pure predicate.
- SIGHUP reload happens before the token-file commit, so a committed token implies the server loaded it; signalReload tolerates ESRCH, signalPID rejects pid <= 0.
- Test seams (findServerAtRoot, reloadServer) cover the reload failure/retry paths; shared writeFakeTokenBin fixture with a portable sha256sum/shasum hasher.

Rollout: main push auto-releases tools; plugin-pin-bump then updates TOOLS_VERSION across all five bootstrap.sh plugins. Existing installs self-heal on next provision run. demarkus-token CLI still defaults -paths to `/*` (deliberate; hand-minted tokens are call-site policy), and install-stack.sh mints `/*` for agent-publish and soul-memory labels; flagged, not changed.

Lessons captured in /debugging.md (idempotent gates must validate content; reorder fallible recovery so failure leaves pre-commit state).