Add persistent Supermemory status to OpenCode

[ishaanxgupta]

Adds a persistent Supermemory footer using OpenCode's native TUI plugin slots.\n\nIt turns blue while a turn is running and keeps the latest recall or save activity visible.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​opencode-ai/​plugin@​1.0.191 ⏵ 1.18.23			+3
	@​opentui/​core@​0.5.8
	solid-js@​1.9.12
	@​opentui/​keymap@​0.5.8
	@​opentui/​solid@​0.5.8

View full report

[ishaanxgupta]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• Align OpenCode with hosted MCP architecture #82
• Add persistent Supermemory status to OpenCode #81 👈 (View in Graphite)
• Show Supermemory activity in OpenCode #80
• Harden recall and capture reliability #78
• Capture durable human memory #77
• Recall memories directly on substantive prompts #76
• Improve recall result quality #75
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm json-schema is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/@opencode-ai/plugin@1.18.23 → npm/json-schema@0.4.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/json-schema@0.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[vorflux]

Found one material installer consistency issue.

---

Review with Vorflux

[vorflux]

P2 — Only install the TUI plugin after server-plugin registration succeeds. The interactive flow can decline creating/updating the main OpenCode config, and addPluginToConfig() can also return false, but this call still writes the package to tui.json[c]. OpenCode loads that TUI entry independently, leaving a Supermemory footer installed even though the server plugin that provides recall/save behavior is absent. Please track the main registration result and skip or separately confirm TUI installation when it did not succeed.