@cortexkit/magic-context 0.22.4 → 0.22.5

package/dist/index.js

@@ -145789,6 +145789,7 @@ CREATE INDEX IF NOT EXISTS idx_dream_queue_pending ON dream_queue(started_at, en
   ensureColumn(db, "session_meta", "system_prompt_hash", "TEXT DEFAULT ''");
   ensureColumn(db, "session_meta", "cleared_reasoning_through_tag", "INTEGER DEFAULT 0");
   ensureColumn(db, "session_meta", "stripped_placeholder_ids", "TEXT DEFAULT ''");
+  ensureColumn(db, "session_meta", "stale_reduce_stripped_ids", "TEXT DEFAULT ''");
   ensureColumn(db, "compartments", "start_message_id", "TEXT DEFAULT ''");
   ensureColumn(db, "compartments", "end_message_id", "TEXT DEFAULT ''");
   ensureColumn(db, "memory_embeddings", "model_id", "TEXT");
@@ -145939,6 +145940,7 @@ function healNullTextColumns(db) {
     ["todo_synthetic_state_json", ""],
     ["system_prompt_hash", ""],
     ["stripped_placeholder_ids", ""],
+    ["stale_reduce_stripped_ids", ""],
     ["memory_block_cache", ""],
     ["memory_block_ids", ""],
     ["compaction_marker_state", ""],
@@ -146914,9 +146916,10 @@ var init_migrations = __esm(async () => {
 });
 
 // ../plugin/src/features/magic-context/project-docs-hash.ts
-var docsCache;
+var MAX_PROJECT_DOC_BYTES, docsCache;
 var init_project_docs_hash = __esm(() => {
   init_compartment_storage();
+  MAX_PROJECT_DOC_BYTES = 256 * 1024;
   docsCache = new Map;
 });
 
@@ -147595,6 +147598,98 @@ function migrateLegacyExperimental(rawConfig, warnings) {
   return patched;
 }
 
+// ../plugin/src/config/project-security.ts
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stripUnsafeProjectConfigFields(projectRaw) {
+  const warnings = [];
+  if ("auto_update" in projectRaw) {
+    delete projectRaw.auto_update;
+    warnings.push("Ignoring auto_update from project config (security: this setting only honors user-level config).");
+  }
+  for (const agentKey of HIDDEN_AGENT_KEYS) {
+    const block = projectRaw[agentKey];
+    if (!isPlainObject(block))
+      continue;
+    const removed = [];
+    for (const field of AGENT_ESCALATION_FIELDS) {
+      if (field in block) {
+        delete block[field];
+        removed.push(field);
+      }
+    }
+    if (removed.length > 0) {
+      warnings.push(`Ignoring ${agentKey}.${removed.join("/")} from project config ` + "(security: a repository cannot reprogram or re-permission hidden agents).");
+    }
+  }
+  return warnings;
+}
+function normalizeEndpoint(value) {
+  if (typeof value !== "string")
+    return;
+  const trimmed = value.trim().replace(/\/+$/, "");
+  return trimmed.length > 0 ? trimmed.toLowerCase() : undefined;
+}
+function dropInheritedEmbeddingKeyOnRedirect(projectRaw, mergedRaw, userRaw) {
+  const projectEmbedding = projectRaw.embedding;
+  if (!isPlainObject(projectEmbedding))
+    return [];
+  const redirectsEndpoint = "endpoint" in projectEmbedding;
+  if (!redirectsEndpoint)
+    return [];
+  const userEmbedding = userRaw?.embedding;
+  if (isPlainObject(userEmbedding)) {
+    const projectEndpoint = normalizeEndpoint(projectEmbedding.endpoint);
+    const userEndpoint = normalizeEndpoint(userEmbedding.endpoint);
+    if (projectEndpoint !== undefined && projectEndpoint === userEndpoint) {
+      return [];
+    }
+  }
+  const providesOwnKey = typeof projectEmbedding.api_key === "string" && projectEmbedding.api_key.length > 0;
+  if (providesOwnKey)
+    return [];
+  const mergedEmbedding = mergedRaw.embedding;
+  if (!isPlainObject(mergedEmbedding))
+    return [];
+  if (!("api_key" in mergedEmbedding))
+    return [];
+  delete mergedEmbedding.api_key;
+  return [
+    "Dropped inherited user embedding api_key because project config redirected " + "embedding.endpoint without supplying its own key (security: prevents key " + "exfiltration to a repository-chosen endpoint)."
+  ];
+}
+var HIDDEN_AGENT_KEYS, AGENT_ESCALATION_FIELDS;
+var init_project_security = __esm(() => {
+  HIDDEN_AGENT_KEYS = ["historian", "dreamer", "sidekick"];
+  AGENT_ESCALATION_FIELDS = ["prompt", "permission", "tools", "system_prompt"];
+});
+
+// ../plugin/src/config/prune-config-leaf.ts
+function isPlainObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function pruneNestedConfigLeaf(block, relativePath) {
+  if (relativePath.length === 0)
+    return null;
+  const result = { ...block };
+  let cursor = result;
+  for (let i = 0;i < relativePath.length - 1; i++) {
+    const seg = String(relativePath[i]);
+    const child = cursor[seg];
+    if (!isPlainObject2(child))
+      return null;
+    const clonedChild = { ...child };
+    cursor[seg] = clonedChild;
+    cursor = clonedChild;
+  }
+  const leaf = String(relativePath[relativePath.length - 1]);
+  if (!(leaf in cursor))
+    return null;
+  delete cursor[leaf];
+  return { block: result, removed: relativePath.map(String).join(".") };
+}
+
 // ../../node_modules/.bun/zod@4.4.3/node_modules/zod/v4/core/core.js
 function $constructor(name2, initializer, params) {
   function init(inst, def) {
@@ -147705,7 +147800,7 @@ __export(exports_util, {
   jsonStringifyReplacer: () => jsonStringifyReplacer,
   joinValues: () => joinValues,
   issue: () => issue,
-  isPlainObject: () => isPlainObject,
+  isPlainObject: () => isPlainObject3,
   isObject: () => isObject,
   hexToUint8Array: () => hexToUint8Array,
   getSizableOrigin: () => getSizableOrigin,
@@ -147870,7 +147965,7 @@ function slugify(input) {
 function isObject(data) {
   return typeof data === "object" && data !== null && !Array.isArray(data);
 }
-function isPlainObject(o) {
+function isPlainObject3(o) {
   if (isObject(o) === false)
     return false;
   const ctor = o.constructor;
@@ -147887,7 +147982,7 @@ function isPlainObject(o) {
   return true;
 }
 function shallowClone(o) {
-  if (isPlainObject(o))
+  if (isPlainObject3(o))
     return { ...o };
   if (Array.isArray(o))
     return [...o];
@@ -148027,7 +148122,7 @@ function omit(schema, mask) {
   return clone(schema, def);
 }
 function extend(schema, shape) {
-  if (!isPlainObject(shape)) {
+  if (!isPlainObject3(shape)) {
     throw new Error("Invalid input to extend: expected a plain object");
   }
   const checks = schema._zod.def.checks;
@@ -148050,7 +148145,7 @@ function extend(schema, shape) {
   return clone(schema, def);
 }
 function safeExtend(schema, shape) {
-  if (!isPlainObject(shape)) {
+  if (!isPlainObject3(shape)) {
     throw new Error("Invalid input to safeExtend: expected a plain object");
   }
   const def = mergeDefs(schema._zod.def, {
@@ -149533,7 +149628,7 @@ function mergeValues(a, b2) {
   if (a instanceof Date && b2 instanceof Date && +a === +b2) {
     return { valid: true, data: a };
   }
-  if (isPlainObject(a) && isPlainObject(b2)) {
+  if (isPlainObject3(a) && isPlainObject3(b2)) {
     const bKeys = Object.keys(b2);
     const sharedKeys = Object.keys(a).filter((key) => bKeys.indexOf(key) !== -1);
     const newObj = { ...a, ...b2 };
@@ -150790,7 +150885,7 @@ var init_schemas = __esm(() => {
     $ZodType.init(inst, def);
     inst._zod.parse = (payload, ctx) => {
       const input = payload.value;
-      if (!isPlainObject(input)) {
+      if (!isPlainObject3(input)) {
         payload.issues.push({
           expected: "record",
           code: "invalid_type",
@@ -162427,6 +162522,21 @@ var init_magic_context = __esm(() => {
 import { existsSync as existsSync14, readFileSync as readFileSync8 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
 import { dirname as dirname7, isAbsolute, resolve as resolve2 } from "node:path";
+function sensitiveFilePathReason(resolvedPath) {
+  const home = homedir7();
+  const sensitiveDirs = [
+    { dir: resolve2(home, ".ssh"), label: "SSH keys" },
+    { dir: resolve2(home, ".aws"), label: "AWS credentials" },
+    { dir: resolve2(home, ".gnupg"), label: "GnuPG keyring" },
+    { dir: resolve2(home, ".config", "gh"), label: "GitHub CLI auth" }
+  ];
+  for (const { dir, label } of sensitiveDirs) {
+    if (resolvedPath === dir || resolvedPath.startsWith(`${dir}/`)) {
+      return label;
+    }
+  }
+  return null;
+}
 function substituteConfigVariables(input) {
   const warnings = [];
   let text2 = input.text;
@@ -162480,6 +162590,10 @@ function substituteConfigVariables(input) {
     } else if (!isAbsolute(filePath)) {
       filePath = resolve2(configDir, filePath);
     }
+    const sensitiveReason = sensitiveFilePathReason(filePath);
+    if (sensitiveReason) {
+      warnings.push(`${token} resolves to a sensitive path (${sensitiveReason}: ${filePath}); ` + "inlining its contents into config — make sure this is intentional.");
+    }
     if (!existsSync14(filePath)) {
       warnings.push(`File not found for ${token} (resolved to ${filePath}); using empty string`);
       continue;
@@ -162550,9 +162664,6 @@ function deepMergeRawConfig(base, override) {
   }
   return result;
 }
-function getProjectUserOnlyFields(config2) {
-  return "auto_update" in config2 ? ["auto_update"] : [];
-}
 function redactConfigValue(value) {
   if (value === undefined)
     return "<missing>";
@@ -162591,12 +162702,16 @@ function parsePluginConfig(rawConfig, recoveredTopLevelKeys = []) {
   const warnings = [];
   const errorPaths = new Set;
   const customMessagesByKey = new Map;
+  const issuePathsByKey = new Map;
   const GENERIC_ZOD_PREFIXES = ["Too big", "Too small", "Invalid input", "Invalid", "Expected"];
   for (const issue2 of parsed.error.issues) {
     const topKey = issue2.path[0];
     if (topKey !== undefined) {
       const key = String(topKey);
       errorPaths.add(key);
+      const paths = issuePathsByKey.get(key) ?? [];
+      paths.push([...issue2.path]);
+      issuePathsByKey.set(key, paths);
       const msg = issue2.message;
       if (msg && !GENERIC_ZOD_PREFIXES.some((p2) => msg.startsWith(p2))) {
         if (!customMessagesByKey.has(key)) {
@@ -162612,12 +162727,33 @@ function parsePluginConfig(rawConfig, recoveredTopLevelKeys = []) {
     if (isAgentConfig) {
       delete patched[key];
       warnings.push(`"${key}": invalid agent configuration, ignoring. Check your magic-context.jsonc.`);
-    } else {
-      delete patched[key];
-      const defaultVal = defaults[key];
-      const reason = customMessagesByKey.get(key);
-      warnings.push(`"${key}": invalid value (${redactConfigValue(rawConfig[key])}), using default ${JSON.stringify(defaultVal)}.${reason ? ` ${reason}` : ""}`);
+      continue;
+    }
+    const issuePaths = issuePathsByKey.get(key) ?? [];
+    const rawValue = rawConfig[key];
+    const allNested = issuePaths.length > 0 && issuePaths.every((p2) => p2.length >= 2) && typeof rawValue === "object" && rawValue !== null && !Array.isArray(rawValue);
+    if (allNested) {
+      let prunedBlock = {
+        ...rawValue
+      };
+      const prunedLeaves = [];
+      for (const p2 of issuePaths) {
+        const relative = p2.slice(1);
+        const result = pruneNestedConfigLeaf(prunedBlock, relative);
+        if (result) {
+          prunedBlock = result.block;
+          prunedLeaves.push(result.removed);
+        }
+      }
+      patched[key] = prunedBlock;
+      const reason2 = customMessagesByKey.get(key);
+      warnings.push(`"${key}": invalid nested field(s) ${prunedLeaves.map((l) => `"${l}"`).join(", ")}, using defaults for those.${reason2 ? ` ${reason2}` : ""}`);
+      continue;
     }
+    delete patched[key];
+    const defaultVal = defaults[key];
+    const reason = customMessagesByKey.get(key);
+    warnings.push(`"${key}": invalid value (${redactConfigValue(rawConfig[key])}), using default ${JSON.stringify(defaultVal)}.${reason ? ` ${reason}` : ""}`);
   }
   const retryMigrated = migrateLegacyExperimental(patched, preMigrationWarnings);
   const retryParsed = MagicContextConfigSchema.safeParse(retryMigrated);
@@ -162653,14 +162789,13 @@ function loadPluginConfig(directory) {
   if (projectLoaded) {
     allWarnings.push(...projectLoaded.warnings.map((w3) => `[project config] ${w3}`));
     const projectRaw = { ...projectLoaded.config };
-    const strippedUserOnlyFields = getProjectUserOnlyFields(projectRaw);
-    if (strippedUserOnlyFields.length > 0) {
-      for (const key of strippedUserOnlyFields) {
-        delete projectRaw[key];
-      }
-      allWarnings.push(`[project config] Ignoring ${strippedUserOnlyFields.join(", ")} from project config (security: these settings only honor user-level config)`);
+    for (const warning of stripUnsafeProjectConfigFields(projectRaw)) {
+      allWarnings.push(`[project config] ${warning}`);
     }
     mergedRaw = deepMergeRawConfig(mergedRaw, projectRaw);
+    for (const warning of dropInheritedEmbeddingKeyOnRedirect(projectRaw, mergedRaw, userLoaded?.config)) {
+      allWarnings.push(`[project config] ${warning}`);
+    }
   }
   const config2 = parsePluginConfig(mergedRaw);
   if (config2.configWarnings?.length) {
@@ -162682,6 +162817,7 @@ function loadPluginConfig(directory) {
 var CONFIG_FILE_BASENAME = "magic-context";
 var init_config = __esm(() => {
   init_jsonc_parser();
+  init_project_security();
   init_magic_context();
   init_variable();
 });
@@ -164775,7 +164911,8 @@ function loadConfigFile2(path5, scope) {
     const rawText = readFileSync15(path5, "utf-8");
     const substituted = substituteConfigVariables({
       text: rawText,
-      configPath: path5
+      configPath: path5,
+      isProjectConfig: scope === "project"
     });
     return {
       path: path5,
@@ -164817,14 +164954,14 @@ function redactConfigValue2(value) {
   }
   return typeof value;
 }
-function isPlainObject2(value) {
+function isPlainObject4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function mergeRawConfigs(base, override) {
   const merged = { ...base };
   for (const [key, overrideValue] of Object.entries(override)) {
     const baseValue = merged[key];
-    merged[key] = isPlainObject2(baseValue) && isPlainObject2(overrideValue) ? mergeRawConfigs(baseValue, overrideValue) : overrideValue;
+    merged[key] = isPlainObject4(baseValue) && isPlainObject4(overrideValue) ? mergeRawConfigs(baseValue, overrideValue) : overrideValue;
   }
   return merged;
 }
@@ -164838,10 +164975,15 @@ function parsePiConfig(rawConfig, recoveredTopLevelKeys = []) {
   }
   const defaults = MagicContextConfigSchema.parse({});
   const errorPaths = new Set;
+  const issuePathsByKey = new Map;
   for (const issue2 of parsed.error.issues) {
     const topKey = issue2.path[0];
     if (topKey !== undefined) {
-      errorPaths.add(String(topKey));
+      const key = String(topKey);
+      errorPaths.add(key);
+      const paths = issuePathsByKey.get(key) ?? [];
+      paths.push([...issue2.path]);
+      issuePathsByKey.set(key, paths);
     }
   }
   const patched = { ...migrated };
@@ -164849,11 +164991,32 @@ function parsePiConfig(rawConfig, recoveredTopLevelKeys = []) {
   for (const key of errorPaths) {
     recoveredTopLevelKeys.push(key);
     const isAgentConfig = key === "historian" || key === "dreamer" || key === "sidekick";
-    delete patched[key];
     if (isAgentConfig) {
+      delete patched[key];
       warnings.push(`"${key}": invalid agent configuration, ignoring. Check your magic-context.jsonc.`);
       continue;
     }
+    const issuePaths = issuePathsByKey.get(key) ?? [];
+    const rawValue = migrated[key];
+    const allNested = issuePaths.length > 0 && issuePaths.every((p2) => p2.length >= 2) && typeof rawValue === "object" && rawValue !== null && !Array.isArray(rawValue);
+    if (allNested) {
+      let prunedBlock = {
+        ...rawValue
+      };
+      const prunedLeaves = [];
+      for (const p2 of issuePaths) {
+        const relative = p2.slice(1);
+        const result = pruneNestedConfigLeaf(prunedBlock, relative);
+        if (result) {
+          prunedBlock = result.block;
+          prunedLeaves.push(result.removed);
+        }
+      }
+      patched[key] = prunedBlock;
+      warnings.push(`"${key}": invalid nested field(s) ${prunedLeaves.map((l) => `"${l}"`).join(", ")}, using defaults for those.`);
+      continue;
+    }
+    delete patched[key];
     const defaultValue = defaults[key];
     warnings.push(`"${key}": invalid value (${redactConfigValue2(rawConfig[key])}), using default ${JSON.stringify(defaultValue)}.`);
   }
@@ -164886,10 +165049,22 @@ function loadPiConfig(opts = {}) {
       return 0;
     return a.scope === "user" ? -1 : 1;
   });
+  const userRaw = mergeFiles.find((f) => f.scope === "user")?.config;
   for (const loaded of mergeFiles) {
     const prefix = loaded.scope === "user" ? "[user config]" : "[project config]";
     warnings.push(...loaded.warnings.map((warning) => `${prefix} ${warning}`));
-    rawConfig = mergeRawConfigs(rawConfig, loaded.config);
+    if (loaded.scope === "project") {
+      const projectRaw = { ...loaded.config };
+      for (const warning of stripUnsafeProjectConfigFields(projectRaw)) {
+        warnings.push(`${prefix} ${warning}`);
+      }
+      rawConfig = mergeRawConfigs(rawConfig, projectRaw);
+      for (const warning of dropInheritedEmbeddingKeyOnRedirect(projectRaw, rawConfig, userRaw)) {
+        warnings.push(`${prefix} ${warning}`);
+      }
+    } else {
+      rawConfig = mergeRawConfigs(rawConfig, loaded.config);
+    }
   }
   const parsed = parsePiConfig(rawConfig);
   warnings.push(...parsed.warnings.map((warning) => `[merged config] ${warning}`));
@@ -164901,6 +165076,7 @@ function loadPiConfig(opts = {}) {
 }
 var import_comment_json10, CONFIG_FILE_NAME = "magic-context";
 var init_config2 = __esm(() => {
+  init_project_security();
   init_magic_context();
   init_variable();
   import_comment_json10 = __toESM(require_src2(), 1);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@cortexkit/magic-context",
-	"version": "0.22.4",
+	"version": "0.22.5",
 	"description": "Unified CLI for Magic Context — setup, doctor, and migration across OpenCode and Pi",
 	"keywords": [
 		"opencode",