feat(claude-code): EverOS memory plugin for Claude Code

[gloryfromca]

Adds claude-code/, a sibling of the OpenClaw / Hermes / DSH plugins: same
local-EverOS contract (/api/v2/memory/*), same recall → capture → seal
lifecycle, same fail-open promise. Nothing existed for Claude Code against a
self-hosted EverOS — evermem-claude-code targets the cloud gateway and
EverMe/plugins/claude-code targets the EverMe gateway.

What it does

Four hooks, no tools for the model to call:

Event	Behaviour
SessionStart	Detect EverOS, start one if it is down and loopback, seal any session a previous run left unsealed
UserPromptSubmit	Search the user and agent tracks in parallel, inject a fenced <everos_memory> block
Stop	Map the finished turn — text plus the full tool-call trajectory — and POST it
SessionEnd, PreCompact	Seal the session buffer

Two skills: /everos:status and /everos:search.

What this change is, and is not

It is an integration: that recall leaves, that what came back reaches the
prompt, that a finished turn is stored with its trajectory, that the session is
sealed, and that none of it can break the editor. Every case below asserts on
backend receipt — markdown on disk, a real search, the context read back out of
the transcript — never on whether a reply sounded like it remembered.

It is not an evaluation of EverOS's retrieval or extraction quality. Whether
the memories that come back are the right ones is EverOS's question, not this
plugin's, and nothing here measures it.

Verification

• 169 unit tests across 15 files, node:test, zero dependencies, no skips.
• scripts/hooks-contract.sh feeds the four hooks synthetic stdin against a
  real EverOS 1.3.1: the wire contract and what an algorithm decides
  deterministically, including that a trajectory with a detour produces an agent
  case.
• scripts/e2e-claude-code.sh starts real Claude Code sessions — headless
  and in a real terminal under tmux — and judges by backend receipt.
  All ten cases pass against a live EverOS 1.3.1: 32 checks, 0 failures,
  at 89cd6f2. It starts its own EverOS on its own port under its own root and
  never touches a server you are already running.
• Every fix in this PR carries a symptom-level reproduction and a mutation
  check: the defect is reintroduced and the test has to go red, or the test is
  not holding anything.

The ten cases: cross-session recall · another repository cannot see it · a
worktree can · the trajectory a tool-using session sends · fail-open · the sweep
· host noise never becomes memory · an interactive terminal · a session that is
cleared and compacted under itself · a whole conversation with memory down.

Running it for real is what found the defects that mattered. These could not
have been caught by unit tests:

• Stop read the transcript as soon as the prompt id appeared, but the closing
  assistant entry lands a fraction of a second later — every assistant reply
  was silently dropped.
• The 3s recall budget lost the opening recall in two of the first three live
  sessions.
• The turn slice ran to end of file, so a prompt queued mid-turn was captured
  under the wrong turn.
• Claude Code cancels SessionEnd when the host exits in a hurry, stranding the
  session tail.
• An agent case injected its entire numbered approach, over 1500 characters on
  every prompt.
• A quarter of what was stored as "the user's words" was the host's own wrapper
  text, not the user's.
• The developer profile is fetched by owner id alone, so it came back identical
  whatever the question was — and it was being asked for on every single turn.

Security

A dedicated review found one critical issue, since fixed. The host renders hook
additionalContext inside its own system-reminder tag; a recalled memory
carrying a closing one escaped that wrapper, and everything after it read to the
model as host-authored instruction. Recalled memory is untrusted by construction
— an earlier session's LLM wrote it from whatever that session contained — so
every tag in it is now inert, not just our own fence.

project_id also carries host and owner now. The bare repository name is not a
namespace: two api repositories from different owners would otherwise share
one memory partition.

Known limits

Version 0.1.0 in both manifests. Stability is not claimed, and this is what
that means concretely.

Six known silent degradations, none of them data loss or disclosure, all with
narrow triggers: one boolean covers three different warning kinds, so a user who
saw "could not start" is not told about a later half-failure; corrupt stdin is
logged only to the debug log; a 200 carrying data: null is reported as
unreachable; the sweep sends a raw session id where flush.js sanitises;
stdin is not paused on the early-return paths; the hook timeout window is not
enforced end to end.

The verification surface is narrow: one macOS machine, one EverOS (1.3.1), and
Haiku driving the end-to-end sessions. Node 20 and 22 are covered by unit tests
only. The end-to-end suite runs at a 7 s recall budget, so it no longer
exercises the 5 s default.

Notes for review

• The spawned EverOS is deliberately an orphan. A hook is a two-second process,
  so there is no resident parent to own the server; EverOS's single-instance
  lock makes concurrent spawns from several windows harmless.
• The full tool trajectory is sent on purpose. everalgo's case extractor rejects
  trajectories without enough tool rounds, so sending less would mean no agent
  memory at all.
• docs/DESIGN_DOC.md records the decisions, including the ones the live runs
  overturned and the evidence that overturned them.

🤖 Generated with Claude Code