@cortexkit/magic-context 0.21.2 → 0.21.5

package/dist/index.js

@@ -27303,7 +27303,6 @@ var init_magic_context = __esm(() => {
       enabled: exports_external.boolean().default(true),
       min_clusters: exports_external.number().min(1).default(3)
     }).default({ enabled: true, min_clusters: 3 }),
-    compaction_markers: exports_external.boolean().default(true),
     system_prompt_injection: exports_external.object({
       enabled: exports_external.boolean().default(true),
       skip_signatures: exports_external.array(exports_external.string()).default(["<!-- magic-context: skip -->"])
@@ -27379,6 +27378,21 @@ import { dirname as dirname7, isAbsolute, resolve as resolve2 } from "node:path"
 function substituteConfigVariables(input) {
   const warnings = [];
   let text2 = input.text;
+  if (input.isProjectConfig) {
+    const hasEnvTokens = ENV_PATTERN.test(text2);
+    const hasFileTokens = FILE_PATTERN.test(text2);
+    ENV_PATTERN.lastIndex = 0;
+    FILE_PATTERN.lastIndex = 0;
+    if (hasEnvTokens || hasFileTokens) {
+      const tokenTypes = [
+        hasEnvTokens ? "{env:}" : undefined,
+        hasFileTokens ? "{file:}" : undefined
+      ].filter(Boolean).join(" and ");
+      warnings.push(`Project-level config no longer supports ${tokenTypes} tokens for security reasons; leaving tokens literal. Move secret expansion to user-level config.`);
+    }
+    return { text: text2, warnings };
+  }
+  text2 = stripJsonComments(text2);
   text2 = text2.replace(ENV_PATTERN, (_, rawName) => {
     const varName = rawName.trim();
     const value = varName ? process.env[varName] : undefined;
@@ -27386,7 +27400,7 @@ function substituteConfigVariables(input) {
       warnings.push(`Environment variable ${varName} is not set (referenced via {env:${varName}}); using empty string`);
       return "";
     }
-    return value;
+    return JSON.stringify(value).slice(1, -1);
   });
   const fileMatches = Array.from(text2.matchAll(FILE_PATTERN));
   if (fileMatches.length === 0) {
@@ -27433,6 +27447,7 @@ function substituteConfigVariables(input) {
 }
 var ENV_PATTERN, FILE_PATTERN;
 var init_variable = __esm(() => {
+  init_jsonc_parser();
   ENV_PATTERN = /\{env:([^}]+)\}/g;
   FILE_PATTERN = /\{file:([^}]+)\}/g;
 });
@@ -27448,13 +27463,17 @@ function getUserConfigBasePath() {
 function getProjectConfigBasePath(directory) {
   return join11(directory, ".opencode", CONFIG_FILE_BASENAME);
 }
-function loadConfigFile(configPath) {
+function loadConfigFile(configPath, isProjectConfig = false) {
   try {
     if (!existsSync13(configPath)) {
       return null;
     }
     const rawText = readFileSync8(configPath, "utf-8");
-    const substituted = substituteConfigVariables({ text: rawText, configPath });
+    const substituted = substituteConfigVariables({
+      text: rawText,
+      configPath,
+      isProjectConfig
+    });
     return {
       config: parseJsonc3(substituted.text),
       warnings: substituted.warnings.map((w3) => `${configPath}: ${w3}`)
@@ -27618,7 +27637,7 @@ function loadPluginConfig(directory) {
   const dotOpenCodeDetected = detectConfigFile(getProjectConfigBasePath(directory));
   const projectDetected = rootDetected.format !== "none" ? rootDetected : dotOpenCodeDetected;
   const userLoaded = userDetected.format === "none" ? null : loadConfigFile(userDetected.path);
-  const projectLoaded = projectDetected.format === "none" ? null : loadConfigFile(projectDetected.path);
+  const projectLoaded = projectDetected.format === "none" ? null : loadConfigFile(projectDetected.path, true);
   const allWarnings = [];
   let mergedRaw = {};
   if (userLoaded) {
@@ -27964,7 +27983,38 @@ function redactionTypeForKey(key) {
   return suffix || "secret";
 }
 function isSecretKey(key) {
-  return SECRET_KEY_PATTERN.test(key);
+  const segments = key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().split(/[._-]+/).filter(Boolean);
+  if (segments.length === 0)
+    return false;
+  if (segments.length === 1) {
+    const first = segments[0];
+    return Boolean(first && SECRET_SEGMENT_PATTERN.test(first));
+  }
+  for (let i = 0;i < segments.length; i++) {
+    const seg = segments[i];
+    if (!seg || !SECRET_SEGMENT_PATTERN.test(seg))
+      continue;
+    let trailingOk = true;
+    for (let j3 = i + 1;j3 < segments.length; j3++) {
+      const tail = segments[j3];
+      if (!tail)
+        continue;
+      if (TRAILING_DESCRIPTORS.has(tail))
+        continue;
+      if (SECRET_SEGMENT_PATTERN.test(tail))
+        continue;
+      trailingOk = false;
+      break;
+    }
+    if (!trailingOk)
+      continue;
+    for (let k2 = i - 1;k2 >= 0; k2--) {
+      const lead = segments[k2];
+      if (lead && SECRET_QUALIFIERS.has(lead))
+        return true;
+    }
+  }
+  return false;
 }
 function sanitizePathString(value) {
   const home = homedir10();
@@ -28013,9 +28063,41 @@ function sanitizeConfigValue(value, keyPath = []) {
   }
   return value;
 }
-var SECRET_KEY_PATTERN, SECRET_TEXT_PATTERNS;
+var SECRET_WORDS, SECRET_SEGMENT_PATTERN, TRAILING_DESCRIPTORS, SECRET_QUALIFIERS, SECRET_TEXT_PATTERNS;
 var init_redaction = __esm(() => {
-  SECRET_KEY_PATTERN = /(?:key|token|secret|password|auth|bearer|credential)/i;
+  SECRET_WORDS = [
+    "key",
+    "token",
+    "secret",
+    "password",
+    "auth",
+    "authorization",
+    "bearer",
+    "credential"
+  ];
+  SECRET_SEGMENT_PATTERN = new RegExp(`^(?:${SECRET_WORDS.map((w3) => `${w3}s?`).join("|")})$`, "i");
+  TRAILING_DESCRIPTORS = new Set(["id", "ids", "value", "values", "header", "headers"]);
+  SECRET_QUALIFIERS = new Set([
+    "api",
+    "access",
+    "private",
+    "client",
+    "auth",
+    "authorization",
+    "secret",
+    "bearer",
+    "session",
+    "refresh",
+    "service",
+    "x",
+    "openai",
+    "anthropic",
+    "google",
+    "github",
+    "huggingface",
+    "aws",
+    "azure"
+  ]);
   SECRET_TEXT_PATTERNS = [
     {
       pattern: /\bsk-ant-(?:api03-)?[A-Za-z0-9_-]{32,}/g,
@@ -28970,12 +29052,15 @@ async function runDoctor(options = {}) {
       let mcChanged = false;
       const experimental = mcConfig.experimental;
       if (experimental && "compaction_markers" in experimental) {
-        if (!("compaction_markers" in mcConfig)) {
-          mcConfig.compaction_markers = experimental.compaction_markers;
-        }
         delete experimental.compaction_markers;
         mcChanged = true;
-        log.success("Migrated experimental.compaction_markers → compaction_markers (now default: true)");
+        log.success("Removed deprecated experimental.compaction_markers (always-on since v0.21.4)");
+        fixed++;
+      }
+      if ("compaction_markers" in mcConfig) {
+        delete mcConfig.compaction_markers;
+        mcChanged = true;
+        log.success("Removed deprecated compaction_markers (always-on since v0.21.4)");
         fixed++;
       }
       if (experimental && "user_memories" in experimental) {
@@ -161950,8 +162035,10 @@ function deleteOrphanProjectKeyFiles(db, now = Date.now()) {
     if (existsSync18(row.projectPath))
       continue;
     try {
-      db.prepare("DELETE FROM project_key_files WHERE project_path = ?").run(row.projectPath);
-      db.prepare("DELETE FROM project_key_files_version WHERE project_path = ?").run(row.projectPath);
+      db.transaction(() => {
+        db.prepare("DELETE FROM project_key_files WHERE project_path = ?").run(row.projectPath);
+        db.prepare("DELETE FROM project_key_files_version WHERE project_path = ?").run(row.projectPath);
+      })();
       deletedProjects++;
     } catch (error51) {
       log2(`[key-files] orphan GC failed for ${row.projectPath}:`, error51);
@@ -161979,7 +162066,7 @@ function getCurrentVersion(db) {
   const row = db.prepare("SELECT MAX(version) as version FROM schema_migrations").get();
   return row?.version ?? 0;
 }
-function isSiblingMigrationConflict(error51, version2) {
+function isSiblingMigrationConflict(db, error51, version2) {
   if (!(error51 instanceof Error))
     return false;
   const code = error51.code;
@@ -161991,7 +162078,8 @@ function isSiblingMigrationConflict(error51, version2) {
     return false;
   if (!msg.toLowerCase().includes("version"))
     return false;
-  return true;
+  const confirmed = db.prepare("SELECT 1 FROM schema_migrations WHERE version = ?").get(version2);
+  return confirmed != null;
 }
 function runMigrations(db) {
   ensureMigrationsTable(db);
@@ -162012,7 +162100,7 @@ function runMigrations(db) {
       log2(`[migrations] applied v${migration.version}: ${migration.description}`);
       migrationIndex += 1;
     } catch (error51) {
-      if (isSiblingMigrationConflict(error51, migration.version)) {
+      if (isSiblingMigrationConflict(db, error51, migration.version)) {
         log2(`[migrations] v${migration.version} already applied by sibling instance — resuming with re-read version`);
         const reReadVersion = getCurrentVersion(db);
         if (reReadVersion <= currentVersion) {
@@ -162418,6 +162506,16 @@ var init_migrations = __esm(async () => {
                 WHERE auto_search_hint_decisions IS NULL
             `);
       }
+    },
+    {
+      version: 18,
+      description: "Add pending_pi_compaction_marker_state column for Pi deferred marker drain",
+      up: (db) => {
+        const cols = db.prepare("PRAGMA table_info(session_meta)").all();
+        if (!cols.some((c2) => c2.name === "pending_pi_compaction_marker_state")) {
+          db.exec("ALTER TABLE session_meta ADD COLUMN pending_pi_compaction_marker_state TEXT");
+        }
+      }
     }
   ];
 });
@@ -162981,6 +163079,11 @@ CREATE INDEX IF NOT EXISTS idx_dream_queue_pending ON dream_queue(started_at, en
       -- Excluded from healNullTextColumns. Readers filter IS NOT NULL AND
       -- != empty-string defensively. Plan v6 section 3.
       pending_compaction_marker_state TEXT,
+      -- pending_pi_compaction_marker_state: intentionally NULLABLE without a
+      -- default. Absence of a deferred Pi-native marker is SQL NULL; presence
+      -- is a valid JSON blob written via setPendingPiCompactionMarkerState.
+      -- Excluded from healNullTextColumns.
+      pending_pi_compaction_marker_state TEXT,
       -- deferred_execute_state: intentionally NULLABLE without a default.
       -- Absence is SQL NULL; presence is a JSON blob written via
       -- setDeferredExecutePendingIfAbsent. Excluded from healNullTextColumns.
@@ -163077,6 +163180,7 @@ CREATE INDEX IF NOT EXISTS idx_dream_queue_pending ON dream_queue(started_at, en
   ensureColumn(db, "session_meta", "detected_context_limit", "INTEGER DEFAULT 0");
   ensureColumn(db, "session_meta", "needs_emergency_recovery", "INTEGER DEFAULT 0");
   ensureColumn(db, "session_meta", "pending_compaction_marker_state", "TEXT");
+  ensureColumn(db, "session_meta", "pending_pi_compaction_marker_state", "TEXT");
   ensureColumn(db, "session_meta", "deferred_execute_state", "TEXT");
   ensureColumn(db, "tags", "harness", "TEXT NOT NULL DEFAULT 'opencode'");
   ensureColumn(db, "pending_ops", "harness", "TEXT NOT NULL DEFAULT 'opencode'");

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@cortexkit/magic-context",
-	"version": "0.21.2",
+	"version": "0.21.5",
 	"description": "Unified CLI for Magic Context — setup, doctor, and migration across OpenCode and Pi",
 	"keywords": [
 		"opencode",