Old versions of TWRP would prompt for the password to decrypt the phone prior to performing an ota, however new versions are able to apply otas without requiring decryption. This is great in practise but does mean that magisk is removed by the ota (when decrypted it would run some scripts after the ota installed, this doesn't happen when the phone is still encrypted) Is there anyway to tell TWRP I want it to always decrypt the phone?
Edit: the feature was added in twrp 3.2.2)
Running Lineage 15.1 and magisk v18.0 on a op3t
decrypt password :
decrypt /data with provided password. Password could be numeric, alphanumeric. Pattern: Use the table bellow to determine what your password will be: 1 2 3 4 5 6 7 8 9 1 2 3 4 5 6 7 8 9 : ; < = > ? @ 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I Example: if your pattern is a "U" shape in the middle of the 5x5, enter twrp decrypt '7<ABC>9' in the terminal or ADB shell. Note that characters ;<>? are special to the shell and require backslash escaping or single quotes around the string