vshulcz/deja-vu v0.21.2 on GitHub

recall stops answering with the session that is asking. An agent's own
transcript is in the index while it is still being written, so a question put
mid-session could come back as its own best match, with the session that held
the answer off the page. deja secrets --scrub rewrites the transcripts that
still carry a credential, and fix hands over what a session said about an
error when nothing was run after it.

Added

deja secrets --scrub rewrites the transcripts that still hold a credential: the same [redacted:kind] marker the index uses goes where the value was, the original stays at <file>.deja-backup-<stamp>, and deja index afterwards drops the finding. It replaces only the kinds the report names, refuses a transcript an agent is in or one written in the last two minutes, and prints how many findings it could not reach — a store with no per-session file cannot be rewritten at all, which on one machine was 36 of 88 findings. --dry-run says what it would do (#3823).
deja forget --list marks a tombstone whose session is gone everywhere — in neither the index nor any store — as suppressing nothing. A leftover from a session deleted on disk printed exactly like one somebody forgot yesterday. The row still starts with its id and the list is still one line per tombstone; a machine with no leftovers sees no change.
deja sources says when a store holds transcripts the index has never read, in the words deja doctor has used since #3747: (2 transcripts never read — `deja index`). It is the command people run first, and its session count read as "nothing written yet" rather than "files never opened". A store with none says nothing.
The line before an edit hands over the command those sessions ran, when the transcript saw it pass: store_test.go has been worked on in 2 sessions — ran here and passed: and the command. A file two sessions agree on clears the same bar a decision does.
opencode gets the point-of-action line at all. Both plugin shapes wired their tool seams to a tool name, so a read produced nothing there; the file action now goes out from tool.execute.after, which is the only seam opencode has that reaches the model. Measured on a 325-file fixture: the same task cost 40k tokens against 70k with deja and no line, and 136k with no memory.

Fixed

Tab completion offers deja recap and deja tests, which shipped in 0.21.0 and were in neither the bash nor the fish script. The command list is substituted from one place now, the way the harness and role lists already were — bash and fish each carried it twice and PowerShell three times, and each copy drifted on its own (#3976).
recall no longer answers with the session that is asking. An agent's transcript is indexed while it is still being written, so the best match for a question asked mid-session could be the question itself, with the session holding the answer pushed off the page (#3945, #3965). Every hook that carries a session id now stamps it beside the index, and the MCP surfaces keep those sessions out of the search for twenty minutes. Nothing changes on the CLI, or on a machine with no hooks wired.
fix answers with what the sessions said when nothing was run. A session that wrote the remedy out in words holds no error/command pair, so the mode reported "no session on this machine ran a command after that error" over an index that held the answer; it now falls back to a recall over the error text and says which of the two answers it is. In a 12-run A/B the one deja run that failed the task failed here.
deja install codex no longer refuses a stock Codex config. Codex writes hook trust tables as [hooks.state."browser@openai-bundled:plugin.json#hooks[0]:subagent_stop:0:0"], and the header check cut the line at that # as if it began a comment, so the header read as never closed and nothing was written (#3969). Reported and fixed by @h4ckm1n-dev.
The .mcpb bundle describes all seven modes of the deja tool. Its manifest enumerated six and stopped before orient, so a Claude Desktop install was never told about the mode that answers what a project's past sessions ran and which files they worked in. docs/INTEGRATING.md, which another project reads to wire deja in, had the same six (#3985).
The getting-started page lists every package under extensions/. It said "three more" and named opencode, dsh and Zed while the directory grew to seven, and README.md's table stopped at six; OpenClaw, pi, Grok and Kimi Code are now on both, in the install lines extensions/README.md already gives, and neither page counts its lists in prose any more. A test fails the next time a package lands without them.

Changelog

Features

feat(forget): mark a tombstone whose session exists nowhere (#3963) (@vaibhav8a)
feat(hook): the file an agent opens names the command that passed there (#3956)
feat(mcp): the best recall hit says what the session ran and how it ended (#3953)
feat(recall): the evidence line says what was tried as well as what worked, and a red check is said before an edit (#3959)
feat(secrets): --scrub rewrites the transcripts that still hold a credential (#3975)
feat(sources): say when a store holds transcripts the index never read (#3962) (@vaibhav8a)

Fixes

fix(completion): every shell offers deja recap and deja tests (#3977)
fix(mcp): fix mode answers with what a session said when it ran nothing (#3972)
fix(opencode): write MCP servers in the v2 nested layout (#3943) (@Oscar-Williams)
fix(recall): a harness the reader excluded stops answering, not just stops being indexed (#3968)
fix(recall): the session an agent is inside stops answering its own questions (#3973)
fix: stop refusing valid codex configs whose quoted hook keys contain a # (#3970) (@h4ckm1n-dev)

Performance

perf(mcp): the tool costs 450 tokens a turn instead of 828, and the session starts knowing where the work is (#3950)

Documentation

docs(opencode): say that the point-of-action line arrives after the action (#3974)
docs: add the Chinese guide for when the agent loses context (#3971) (@rainhuang0220)
docs: cut 0.21.2 (#3978)
docs: day zero says what finishing a task costs, not only what a tool can answer (#3967)
docs: list every extension where it is installed from, and test it (#1579) (#3964) (@vaibhav8a)
docs: the comparison says what those projects ship today (#3990)
docs: the day-zero deja row is re-measured on 0.21.1, same figures (#3944)
docs: the day-zero table says what each tool costs in context every turn (#3961)
docs: what the repo says about itself matches what 0.21.2 ships (#3987)

Other

chore: the manifests and plugin versions say 0.21.1 (#3942)
ci: a stale generated file fails instead of staying green (#3988)

Install

curl -fsSL https://raw.githubusercontent.com/vshulcz/deja-vu/main/install.sh | sh
go install github.com/vshulcz/deja-vu/cmd/deja@v0.21.2
brew install deja-vu