[WhiteZeek]

What this PR does

Before this PR: Ordinary Assistants cannot use the shared user-memory tier introduced for Agents in #22068.

After this PR: Assistants can opt in through settings.userMemoryEnabled (default false, stored in the existing settings JSON). Persistent desktop chat injects fresh shared facts and exposes a built-in user_memory tool for read, revision-checked update, append, and journal search. Updates and appends use the existing approval flow; storage reuses #22068's mutex, revision checks, and atomic writes.

Only the persistent, non-headless chat dispatcher supplies the main-only access context. Loading and tool execution validate the live Assistant setting and topic ownership. Temporary/auxiliary requests, caller-owned context, and Agent/channel dispatch receive no access. Non-tool models and tool-disabled requests can receive facts but cannot write. Agent-local files are never exposed.

Related to #15669; stacked on #22068. This is the ordinary-Assistant extension, not completion of the original issue.

Why we need it and why it was done in this way

The following tradeoffs were made: Assistant memory is opt-in to preserve existing chat behavior. The UI switch belongs to the next layer. Clearing facts changes future snapshots, not prior conversations or an in-flight request.

The following alternatives were considered: Reuse the shared file store instead of adding database tables or Assistant-local USER.md files. Use a built-in tool instead of asking users to configure filesystem MCP. A main-only dispatch grant prevents auxiliary calls from gaining access merely by supplying an Assistant ID.

Links to places where the discussion took place: #22068 and #15669.

Agent Note / Spec

Agent Note: N/A — the author explicitly requested no Agent Note files; rationale is recorded here.

Spec PR: N/A — the author approved implementation of this first layer in the task conversation.

Acceptance criteria: Opt-in defaults/partial updates; Assistant-to-Agent shared facts; fresh, single-section recall; no Agent-local file exposure; no temporary/headless/caller-owned access; live opt-out/ownership checks; stale-write rejection and approval-gated mutations.

Verification

• Main Vitest, Electron Node mode (--project main --maxWorkers=2), 279 passed across identity.test.ts, buildAgentParams.test.ts, dispatch tests, builtin registration tests, and AssistantService.test.ts. Real temporary SQLite and memory files cover interop, concurrency, ownership, and opt-out. Provider setup is stubbed for request-assembly checks; no live model call is claimed.
• pnpm exec vitest run --project shared src/shared/data/api/schemas/__tests__/assistants.test.ts: 5 passed.
• pnpm typecheck:node, pnpm typecheck:web, scoped Oxfmt/ESLint/Oxlint, pnpm docs:check, and git diff --check passed.
• pnpm change:scope --base codex/user-shared-memory and pnpm docs:affected --base codex/user-shared-memory inspected. Docs cover the access boundary, tool, and pending UI.

Breaking changes

None. Missing or false settings.userMemoryEnabled keeps existing Assistant behavior; no database migration, new table, or dependency is required. Agent memory behavior is unchanged.

Special notes for your reviewer

Review against codex/user-shared-memory, not main. This PR intentionally contains only the runtime/configuration/tool layer; the settings form control is deferred. No new Agent Note artifacts. Tests ran on Windows with Electron Node mode to match SQLite ABI. Real-provider behavior, native macOS/Linux execution, and interactive approval UI were not exercised in this layer.

Checklist

This checklist is not enforcing, but it's a reminder of items that could be relevant to every PR.
Approvers are expected to review this list.

• Branch: This PR targets main (stacked layer: targets codex/user-shared-memory until feat(agents): add desktop shared user memory #22068 merges)
• PR: The PR description is expressive enough and will help future contributors
• Code: Write code that humans can understand and Keep it simple
• Refactor: You have left the code cleaner than you found it (Boy Scout Rule)
• Upgrade: Impact of this change on upgrade flows was considered and addressed if required
• Documentation: A user-guide update was considered and is present (link) or not required. Check this only when the PR introduces or changes a user-facing feature or behavior.
• Self-review: I have reviewed my own code (e.g., via /gh-pr-review, gh pr diff, or GitHub UI) before requesting review from others

Release note

Ordinary Assistants can opt in to shared user memory through their configuration, reusing Agent shared facts and requiring approval for memory writes. A dedicated Assistant settings switch will follow separately.