Tell TWRP to decrypt for ota Old versions of TWRP would prompt for the password to decrypt the phone prior to performing an ota, however new versions are able to apply otas without requiring decryption. This is great in practise but does mean that magisk is removed by the ota (when decrypted it would run some scripts after the ota installed, this doesn't happen when the phone is still encrypted) Is there anyway to tell TWRP I want it to always decrypt the phone?

Edit: the feature was added in twrp 3.2.2)

Running Lineage 15.1 and magisk v18.0 on a op3t
There doesn't currently seem to be a way to tell TWRP to decrypt /data before an OTA. As you've said, this prevents the Magisk addon.d script to work, since the main part of that script itself resides in the /data partition. (But it also seems to require other things from the /data partition, so we can't just move it).

Here's a workaround:

Since you're on LineageOS, you can install your OTA update manually in TWRP, after decrypting. First download (not install) the OTA in the LineageOS updater. Then reboot to recovery manually and select the OTA zip from /data/lineageos_updates.

It's a bit more cumbersome than automatic-recovery-OTA, but at least it doesn't require adb or manually downloading the zip to your internal storage, where it is writable by any app with Storage permission...