@cortexkit/magic-context 0.31.2 → 0.31.4

package/dist/index.js

@@ -8476,7 +8476,7 @@ var init_data_path = () => {};
 // src/lib/paths.ts
 import { existsSync as existsSync4, readdirSync, statSync as statSync4 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { join as join5 } from "node:path";
+import { dirname as dirname3, join as join5 } from "node:path";
 function getOpenCodeConfigDir() {
   const envDir = process.env.OPENCODE_CONFIG_DIR?.trim();
   if (envDir)
@@ -8540,11 +8540,24 @@ function detectConfigPaths() {
     tuiConfigFormat
   };
 }
-function getPiAgentConfigDir() {
+function envFirstHomeDir() {
+  const home = process.env.HOME?.trim();
+  return home || homedir4();
+}
+function getPiAgentDir() {
   const envDir = process.env.PI_CODING_AGENT_DIR?.trim();
   if (envDir)
     return envDir;
-  return join5(homedir4(), ".pi", "agent");
+  return join5(envFirstHomeDir(), ".pi", "agent");
+}
+function getPiAgentConfigDir() {
+  return getPiAgentDir();
+}
+function getPiSessionsRoot() {
+  return join5(getPiAgentDir(), "sessions");
+}
+function getPiCacheRoot() {
+  return join5(dirname3(getPiAgentDir()), "cache");
 }
 function getPiUserConfigPath() {
   return resolveCortexKitUserConfigPath();
@@ -8622,7 +8635,7 @@ var init_opencode_plugin_cache = __esm(() => {
 
 // src/adapters/opencode.ts
 import { existsSync as existsSync5, readFileSync as readFileSync2 } from "node:fs";
-import { dirname as dirname3 } from "node:path";
+import { dirname as dirname4 } from "node:path";
 
 class OpenCodeAdapter {
   kind = "opencode";
@@ -8843,7 +8856,7 @@ function matchesPluginEntry(entry, pkgName) {
   return head === pkgName;
 }
 function ensureDir(filePath) {
-  const dir = dirname3(filePath);
+  const dir = dirname4(filePath);
   if (!existsSync5(dir)) {
     const { mkdirSync: mkdirSync3 } = __require("node:fs");
     mkdirSync3(dir, { recursive: true });
@@ -8948,7 +8961,7 @@ var init_pi_helpers = __esm(() => {
 // src/adapters/pi.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { existsSync as existsSync7, readFileSync as readFileSync3 } from "node:fs";
-import { dirname as dirname4 } from "node:path";
+import { dirname as dirname5 } from "node:path";
 
 class PiAdapter {
   kind = "pi";
@@ -9105,7 +9118,7 @@ function matchesPiPackage(entry) {
   return false;
 }
 function ensureDir2(filePath) {
-  const dir = dirname4(filePath);
+  const dir = dirname5(filePath);
   if (!existsSync7(dir)) {
     const { mkdirSync: mkdirSync3 } = __require("node:fs");
     mkdirSync3(dir, { recursive: true });
@@ -11974,7 +11987,7 @@ var init_opencode_helpers = () => {};
 
 // src/commands/setup-opencode.ts
 import { existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync6 } from "node:fs";
-import { basename as basename2, dirname as dirname5 } from "node:path";
+import { basename as basename2, dirname as dirname6 } from "node:path";
 function ensureDir3(dir) {
   if (!existsSync10(dir)) {
     mkdirSync3(dir, { recursive: true });
@@ -11990,7 +12003,7 @@ function readJsonc(path2) {
   }
 }
 function addPluginToOpenCodeConfig(configPath, format) {
-  ensureDir3(dirname5(configPath));
+  ensureDir3(dirname6(configPath));
   if (format === "none") {
     const config = {
       plugin: [OPENCODE_PLUGIN_ENTRY_WITH_VERSION],
@@ -12020,7 +12033,7 @@ function addPluginToOpenCodeConfig(configPath, format) {
 `);
 }
 function addPluginToTuiConfig(configPath, format) {
-  ensureDir3(dirname5(configPath));
+  ensureDir3(dirname6(configPath));
   if (format === "none") {
     writeFileAtomic(configPath, `${import_comment_json4.stringify({ plugin: [OPENCODE_PLUGIN_ENTRY_WITH_VERSION] }, null, 2)}
 `);
@@ -12386,7 +12399,7 @@ var PI_MAGIC_CONTEXT_PACKAGE_NAME = "@cortexkit/pi-magic-context";
 
 // src/commands/setup-pi.ts
 import { existsSync as existsSync11, mkdirSync as mkdirSync4, readFileSync as readFileSync7 } from "node:fs";
-import { dirname as dirname6 } from "node:path";
+import { dirname as dirname7 } from "node:path";
 function ensureDir4(path2) {
   if (!existsSync11(path2))
     mkdirSync4(path2, { recursive: true });
@@ -12429,7 +12442,7 @@ function comparePiVersion(a3, b2) {
   return 0;
 }
 function writePiSettingsPackage(settingsPath, packageSource = PI_PACKAGE_SOURCE) {
-  ensureDir4(dirname6(settingsPath));
+  ensureDir4(dirname7(settingsPath));
   const settings2 = existsSync11(settingsPath) ? readJsonc2(settingsPath) ?? {} : {};
   const packages = Array.isArray(settings2.packages) ? settings2.packages : [];
   const hasPackage = hasPiMagicContextPackage(packages);
@@ -12441,7 +12454,7 @@ function writePiSettingsPackage(settingsPath, packageSource = PI_PACKAGE_SOURCE)
   return !hasPackage;
 }
 function writeMagicContextConfig2(configPath, options) {
-  ensureDir4(dirname6(configPath));
+  ensureDir4(dirname7(configPath));
   const config = existsSync11(configPath) ? readJsonc2(configPath) ?? {} : {};
   if (!config.$schema) {
     config.$schema = "https://raw.githubusercontent.com/cortexkit/magic-context/master/assets/magic-context.schema.json";
@@ -12775,7 +12788,7 @@ __export(exports_migrate, {
   formatPiFilenameTimestamp: () => formatPiFilenameTimestamp
 });
 import { randomBytes } from "node:crypto";
-import { existsSync as existsSync12, mkdirSync as mkdirSync5, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { unlinkSync as unlinkSync2 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
 import { join as join11 } from "node:path";
 function defaultOpenCodeDbPath() {
@@ -12785,10 +12798,10 @@ function defaultCortexkitDbPath() {
   return join11(getMagicContextStorageDir(), "context.db");
 }
 function defaultPiSessionsRoot() {
-  return join11(homedir7(), ".pi", "agent", "sessions");
+  return getPiSessionsRoot();
 }
 function defaultFs() {
-  return { existsSync: existsSync12, mkdirSync: mkdirSync5, writeFileSync: writeFileSync4, unlinkSync: unlinkSync2 };
+  return { writeFileAtomic, unlinkSync: unlinkSync2 };
 }
 function stmt(db, sql) {
   return db.prepare(sql);
@@ -13259,9 +13272,7 @@ function migrateOpenCodeSessionToPi(opts) {
 `)}
 `;
     if (!opts.dryRun) {
-      if (!fs.existsSync(outputDir))
-        fs.mkdirSync(outputDir, { recursive: true });
-      fs.writeFileSync(outputPath, jsonl);
+      fs.writeFileAtomic(outputPath, jsonl);
       try {
         commitMagicContextState?.();
       } catch (commitError) {
@@ -13386,6 +13397,8 @@ async function runMigrateCli(args) {
 var DEFAULT_PROVIDER = "openai-codex", DEFAULT_MODEL = "gpt-5.5", MIGRATION_COMPACTION_SUMMARY = "Magic Context compacted prior conversation. See <session-history> block for the structured summary.";
 var init_migrate = __esm(async () => {
   init_data_path();
+  init_atomic_write();
+  init_paths();
   await init_sqlite();
 });
 
@@ -13452,7 +13465,7 @@ var init_logger = __esm(() => {
 // ../plugin/src/features/magic-context/memory/project-identity.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { createHash } from "node:crypto";
-import { existsSync as existsSync13, realpathSync, statSync as statSync5 } from "node:fs";
+import { existsSync as existsSync12, realpathSync, statSync as statSync5 } from "node:fs";
 import path3 from "node:path";
 function asError(error) {
   return error instanceof Error ? error : undefined;
@@ -13691,7 +13704,7 @@ function hasGitDir(canonical) {
 function hasGitDirInAncestorChain(startDirectory) {
   let current = startDirectory;
   while (true) {
-    if (existsSync13(path3.join(current, ".git"))) {
+    if (existsSync12(path3.join(current, ".git"))) {
       return true;
     }
     const parent = path3.dirname(current);
@@ -13855,7 +13868,7 @@ __export(exports_migrate_session, {
   planMigrateSession: () => planMigrateSession,
   applyMigrateSession: () => applyMigrateSession
 });
-import { copyFileSync, existsSync as existsSync14, realpathSync as realpathSync2 } from "node:fs";
+import { copyFileSync, existsSync as existsSync13, realpathSync as realpathSync2 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
 import path4, { join as join12 } from "node:path";
 function existingSessionColumns(db) {
@@ -14018,7 +14031,7 @@ function realDeps(opencodeDb, contextDb) {
     opencodeDb,
     contextDb,
     resolveIdentity: resolveProjectIdentity,
-    hasGitDir: (dir) => existsSync14(join12(dir, ".git")),
+    hasGitDir: (dir) => existsSync13(join12(dir, ".git")),
     realpath: (p2) => realpathSync2(p2)
   };
 }
@@ -14097,7 +14110,7 @@ async function runMigrateSessionCli(args) {
     return 1;
   }
   const expandedTo = toDir.startsWith("~") ? join12(homedir8(), toDir.slice(1).replace(/^[/\\]/, "")) : toDir;
-  if (!existsSync14(expandedTo)) {
+  if (!existsSync13(expandedTo)) {
     console.error(`Target directory does not exist: ${expandedTo}`);
     return 1;
   }
@@ -146830,14 +146843,17 @@ var init_read_session_chunk = __esm(async () => {
 });
 
 // ../plugin/src/features/magic-context/message-index.ts
-var lastIndexedStatements, insertMessageStatements, upsertIndexStatements, deleteFtsStatements, deleteIndexStatements, countIndexedMessageStatements;
+var lastIndexedStatements, insertMessageStatements, upsertIndexStatements, upsertCleanIndexStatements, upsertDirtyFloorStatements, deleteFtsStatements, deleteFtsFromOrdinalStatements, deleteIndexStatements, countIndexedMessageStatements;
 var init_message_index = __esm(async () => {
   init_compression_depth_storage();
   await init_read_session_chunk();
   lastIndexedStatements = new WeakMap;
   insertMessageStatements = new WeakMap;
   upsertIndexStatements = new WeakMap;
+  upsertCleanIndexStatements = new WeakMap;
+  upsertDirtyFloorStatements = new WeakMap;
   deleteFtsStatements = new WeakMap;
+  deleteFtsFromOrdinalStatements = new WeakMap;
   deleteIndexStatements = new WeakMap;
   countIndexedMessageStatements = new WeakMap;
 });
@@ -146876,6 +146892,7 @@ function healNullTextColumns(db) {
     ["cache_ttl", ""],
     ["last_nudge_band", ""],
     ["last_nudge_level", ""],
+    ["channel2_nudge_claim_token", ""],
     ["last_transform_error", ""],
     ["nudge_anchor_message_id", ""],
     ["nudge_anchor_text", ""],
@@ -147016,6 +147033,7 @@ function bumpEpochsForWorkspaceMemberSet(db, identities, now = Date.now()) {
 }
 var VALID_SHARE_CATEGORIES;
 var init_workspaces = __esm(() => {
+  init_logger();
   init_constants();
   init_project_identity2();
   VALID_SHARE_CATEGORIES = new Set(V2_MEMORY_CATEGORIES);
@@ -148469,7 +148487,7 @@ var init_tool_definition_tokens = __esm(() => {
 });
 
 // ../plugin/src/features/magic-context/tool-owner-backfill.ts
-import { existsSync as existsSync15 } from "node:fs";
+import { existsSync as existsSync14 } from "node:fs";
 import { join as join13 } from "node:path";
 function resolveOpencodeDbPath() {
   return join13(getDataDir(), "opencode", "opencode.db");
@@ -148507,7 +148525,7 @@ function runToolOwnerBackfill(db) {
     return result;
   }
   const opencodeDbPath = resolveOpencodeDbPath();
-  if (!existsSync15(opencodeDbPath)) {
+  if (!existsSync14(opencodeDbPath)) {
     log3(`[backfill] OpenCode DB not found at ${opencodeDbPath} — marking all unbackfilled sessions as skipped. Lazy adoption (defense-in-depth) handles legacy rows at runtime.`);
     markAllUnbackfilledSessionsSkipped(db);
     result.sessionsSkippedNoOcDb = countSessionsByStatus(db, "skipped");
@@ -148731,10 +148749,10 @@ var init_tool_owner_backfill = __esm(() => {
 });
 
 // ../plugin/src/features/magic-context/storage-db.ts
-import { chmodSync as chmodSync2, copyFileSync as copyFileSync2, cpSync, existsSync as existsSync16, mkdirSync as mkdirSync7, mkdtempSync } from "node:fs";
-import { dirname as dirname8, join as join14 } from "node:path";
+import { chmodSync as chmodSync2, copyFileSync as copyFileSync2, cpSync, existsSync as existsSync15, mkdirSync as mkdirSync6, mkdtempSync } from "node:fs";
+import { dirname as dirname9, join as join14 } from "node:path";
 function ensureSecureStorageDir(dir) {
-  mkdirSync7(dir, { recursive: true, mode: 448 });
+  mkdirSync6(dir, { recursive: true, mode: 448 });
   if (!PERMISSIONS_ENFORCEABLE)
     return;
   try {
@@ -148748,7 +148766,7 @@ function restrictDatabaseFilePermissions(dbPath) {
     return;
   for (const suffix of ["", "-wal", "-shm"]) {
     const file = `${dbPath}${suffix}`;
-    if (!existsSync16(file))
+    if (!existsSync15(file))
       continue;
     try {
       chmodSync2(file, 384);
@@ -148759,7 +148777,7 @@ function restrictDatabaseFilePermissions(dbPath) {
 }
 function resolveDatabasePath(dbPathOverride) {
   if (dbPathOverride) {
-    return { dbDir: dirname8(dbPathOverride), dbPath: dbPathOverride };
+    return { dbDir: dirname9(dbPathOverride), dbPath: dbPathOverride };
   }
   const testDataDir = process.env.MAGIC_CONTEXT_TEST_DATA_DIR;
   if (testDataDir && !process.env.XDG_DATA_HOME) {
@@ -148771,11 +148789,11 @@ function resolveDatabasePath(dbPathOverride) {
   return { dbDir, dbPath: join14(dbDir, "context.db") };
 }
 function migrateLegacyStorageIfNeeded(targetDbPath, targetDbDir) {
-  if (existsSync16(targetDbPath))
+  if (existsSync15(targetDbPath))
     return;
   const legacyDir = getLegacyOpenCodeMagicContextStorageDir();
   const legacyDbPath = join14(legacyDir, "context.db");
-  if (!existsSync16(legacyDbPath))
+  if (!existsSync15(legacyDbPath))
     return;
   log3(`[magic-context] migrating legacy plugin storage: ${legacyDir} -> ${targetDbDir} (legacy left in place as backup)`);
   ensureSecureStorageDir(targetDbDir);
@@ -148792,7 +148810,7 @@ function migrateLegacyStorageIfNeeded(targetDbPath, targetDbDir) {
   for (const suffix of ["", "-wal", "-shm"]) {
     const src = `${legacyDbPath}${suffix}`;
     const dst = join14(targetDbDir, `context.db${suffix}`);
-    if (existsSync16(src)) {
+    if (existsSync15(src)) {
       try {
         copyFileSync2(src, dst);
       } catch (error) {
@@ -148802,7 +148820,7 @@ function migrateLegacyStorageIfNeeded(targetDbPath, targetDbDir) {
   }
   const legacyModelsDir = join14(legacyDir, "models");
   const targetModelsDir = join14(targetDbDir, "models");
-  if (existsSync16(legacyModelsDir) && !existsSync16(targetModelsDir)) {
+  if (existsSync15(legacyModelsDir) && !existsSync15(targetModelsDir)) {
     try {
       cpSync(legacyModelsDir, targetModelsDir, { recursive: true });
     } catch (error) {
@@ -149293,6 +149311,7 @@ CREATE INDEX IF NOT EXISTS idx_dream_queue_pending ON dream_queue(started_at, en
     CREATE TABLE IF NOT EXISTS message_history_index (
       session_id TEXT PRIMARY KEY,
       last_indexed_ordinal INTEGER NOT NULL DEFAULT 0,
+      dirty_floor_ordinal INTEGER NOT NULL DEFAULT 0,
       updated_at INTEGER NOT NULL,
       harness TEXT NOT NULL DEFAULT 'opencode'
     );
@@ -149322,6 +149341,7 @@ CREATE INDEX IF NOT EXISTS idx_dream_queue_pending ON dream_queue(started_at, en
       last_nudge_level TEXT DEFAULT '',
       channel2_nudge_state TEXT DEFAULT '',
       channel2_nudge_claimed_at INTEGER DEFAULT 0,
+      channel2_nudge_claim_token TEXT DEFAULT '',
       last_emergency_input_sample INTEGER DEFAULT 0,
       last_transform_error TEXT DEFAULT '',
       nudge_anchor_message_id TEXT DEFAULT '',
@@ -149568,6 +149588,7 @@ CREATE INDEX IF NOT EXISTS idx_dream_queue_pending ON dream_queue(started_at, en
   ensureColumn(db, "session_meta", "last_nudge_level", "TEXT DEFAULT ''");
   ensureColumn(db, "session_meta", "channel2_nudge_state", "TEXT DEFAULT ''");
   ensureColumn(db, "session_meta", "channel2_nudge_claimed_at", "INTEGER DEFAULT 0");
+  ensureColumn(db, "session_meta", "channel2_nudge_claim_token", "TEXT DEFAULT ''");
   ensureColumn(db, "session_meta", "last_emergency_input_sample", "INTEGER DEFAULT 0");
   ensureColumn(db, "session_meta", "last_transform_error", "TEXT DEFAULT ''");
   ensureColumn(db, "session_meta", "nudge_anchor_message_id", "TEXT DEFAULT ''");
@@ -149780,6 +149801,7 @@ CREATE INDEX IF NOT EXISTS idx_dream_queue_pending ON dream_queue(started_at, en
         ON transform_decisions(session_id, harness);
     `);
   ensureColumn(db, "tags", "harness", "TEXT NOT NULL DEFAULT 'opencode'");
+  ensureColumn(db, "message_history_index", "dirty_floor_ordinal", "INTEGER NOT NULL DEFAULT 0");
   ensureColumn(db, "pending_ops", "harness", "TEXT NOT NULL DEFAULT 'opencode'");
   ensureColumn(db, "source_contents", "harness", "TEXT NOT NULL DEFAULT 'opencode'");
   ensureColumn(db, "compartments", "harness", "TEXT NOT NULL DEFAULT 'opencode'");
@@ -149794,7 +149816,7 @@ CREATE INDEX IF NOT EXISTS idx_dream_queue_pending ON dream_queue(started_at, en
 function healWedgedChannel2Claims(db) {
   try {
     const staleBefore = Date.now() - CHANNEL2_CLAIM_TTL_MS;
-    db.prepare("UPDATE session_meta SET channel2_nudge_state = 'pending', channel2_nudge_claimed_at = 0 WHERE channel2_nudge_state = 'claimed' AND (channel2_nudge_claimed_at IS NULL OR channel2_nudge_claimed_at = 0 OR channel2_nudge_claimed_at <= ?)").run(staleBefore);
+    db.prepare("UPDATE session_meta SET channel2_nudge_state = 'pending', channel2_nudge_claimed_at = 0, channel2_nudge_claim_token = '' WHERE channel2_nudge_state = 'claimed' AND (channel2_nudge_claimed_at IS NULL OR channel2_nudge_claimed_at = 0 OR channel2_nudge_claimed_at <= ?)").run(staleBefore);
   } catch {}
 }
 function openDatabase(dbPathOrOptions) {
@@ -150605,127 +150627,6 @@ function migrateLegacyExperimental(rawConfig, warnings) {
   return patched;
 }
 
-// ../plugin/src/config/project-security.ts
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function stripUnsafeProjectConfigFields(projectRaw) {
-  const warnings = [];
-  if ("auto_update" in projectRaw) {
-    delete projectRaw.auto_update;
-    warnings.push("Ignoring auto_update from project config (security: this setting only honors user-level config).");
-  }
-  if ("language" in projectRaw) {
-    delete projectRaw.language;
-    warnings.push("Ignoring language from project config (security: output language is a user-level setting).");
-  }
-  if ("sqlite" in projectRaw) {
-    delete projectRaw.sqlite;
-    warnings.push("Ignoring sqlite.* from project config (security: SQLite cache/mmap PRAGMAs apply to the " + "process-global shared database handle; only user-level config may set them).");
-  }
-  const embedding = projectRaw.embedding;
-  if (isPlainObject(embedding)) {
-    const removed = [];
-    for (const field of EMBEDDING_DESTINATION_FIELDS) {
-      if (field in embedding) {
-        delete embedding[field];
-        removed.push(field);
-      }
-    }
-    if (removed.length > 0) {
-      warnings.push(`Ignoring embedding.${removed.join("/")} from project config ` + "(security: a repository cannot choose where private text is embedded).");
-    }
-  }
-  for (const agentKey of HIDDEN_AGENT_KEYS) {
-    const block2 = projectRaw[agentKey];
-    if (!isPlainObject(block2))
-      continue;
-    const removed = [];
-    for (const field of AGENT_ESCALATION_FIELDS) {
-      if (field in block2) {
-        delete block2[field];
-        removed.push(field);
-      }
-    }
-    if (removed.length > 0) {
-      warnings.push(`Ignoring ${agentKey}.${removed.join("/")} from project config ` + "(security: a repository cannot reprogram or re-permission hidden agents).");
-    }
-  }
-  return warnings;
-}
-function normalizeEndpoint(value) {
-  if (typeof value !== "string")
-    return;
-  const trimmed = value.trim().replace(/\/+$/, "");
-  return trimmed.length > 0 ? trimmed.toLowerCase() : undefined;
-}
-function dropInheritedEmbeddingKeyOnRedirect(projectRaw, mergedRaw, userRaw) {
-  const projectEmbedding = projectRaw.embedding;
-  if (!isPlainObject(projectEmbedding))
-    return [];
-  const redirectsEndpoint = "endpoint" in projectEmbedding;
-  if (!redirectsEndpoint)
-    return [];
-  const userEmbedding = userRaw?.embedding;
-  if (isPlainObject(userEmbedding)) {
-    const projectEndpoint = normalizeEndpoint(projectEmbedding.endpoint);
-    const userEndpoint = normalizeEndpoint(userEmbedding.endpoint);
-    if (projectEndpoint !== undefined && projectEndpoint === userEndpoint) {
-      return [];
-    }
-  }
-  const providesOwnKey = typeof projectEmbedding.api_key === "string" && projectEmbedding.api_key.length > 0;
-  if (providesOwnKey)
-    return [];
-  const mergedEmbedding = mergedRaw.embedding;
-  if (!isPlainObject(mergedEmbedding))
-    return [];
-  if (!("api_key" in mergedEmbedding))
-    return [];
-  delete mergedEmbedding.api_key;
-  return [
-    "Dropped inherited user embedding api_key because project config redirected " + "embedding.endpoint without supplying its own key (security: prevents key " + "exfiltration to a repository-chosen endpoint)."
-  ];
-}
-var HIDDEN_AGENT_KEYS, AGENT_ESCALATION_FIELDS, EMBEDDING_DESTINATION_FIELDS;
-var init_project_security = __esm(() => {
-  HIDDEN_AGENT_KEYS = ["historian", "dreamer", "sidekick"];
-  AGENT_ESCALATION_FIELDS = ["prompt", "permission", "tools", "system_prompt"];
-  EMBEDDING_DESTINATION_FIELDS = ["endpoint", "provider"];
-});
-
-// ../plugin/src/config/prune-config-leaf.ts
-function isPlainObject2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function pruneNestedConfigLeaf(block2, relativePath) {
-  if (relativePath.length === 0)
-    return null;
-  const result = { ...block2 };
-  let cursor3 = result;
-  for (let i2 = 0;i2 < relativePath.length - 1; i2++) {
-    const seg = String(relativePath[i2]);
-    const child = cursor3[seg];
-    if (!isPlainObject2(child)) {
-      if (!(seg in cursor3))
-        return null;
-      delete cursor3[seg];
-      return {
-        block: result,
-        removed: relativePath.slice(0, i2 + 1).map(String).join(".")
-      };
-    }
-    const clonedChild = { ...child };
-    cursor3[seg] = clonedChild;
-    cursor3 = clonedChild;
-  }
-  const leaf = String(relativePath[relativePath.length - 1]);
-  if (!(leaf in cursor3))
-    return null;
-  delete cursor3[leaf];
-  return { block: result, removed: relativePath.map(String).join(".") };
-}
-
 // ../../node_modules/.bun/zod@4.4.3/node_modules/zod/v4/core/core.js
 function $constructor(name2, initializer, params) {
   function init(inst, def) {
@@ -150836,7 +150737,7 @@ __export(exports_util, {
   jsonStringifyReplacer: () => jsonStringifyReplacer,
   joinValues: () => joinValues,
   issue: () => issue,
-  isPlainObject: () => isPlainObject3,
+  isPlainObject: () => isPlainObject,
   isObject: () => isObject,
   hexToUint8Array: () => hexToUint8Array,
   getSizableOrigin: () => getSizableOrigin,
@@ -151001,7 +150902,7 @@ function slugify(input) {
 function isObject(data) {
   return typeof data === "object" && data !== null && !Array.isArray(data);
 }
-function isPlainObject3(o2) {
+function isPlainObject(o2) {
   if (isObject(o2) === false)
     return false;
   const ctor = o2.constructor;
@@ -151018,7 +150919,7 @@ function isPlainObject3(o2) {
   return true;
 }
 function shallowClone(o2) {
-  if (isPlainObject3(o2))
+  if (isPlainObject(o2))
     return { ...o2 };
   if (Array.isArray(o2))
     return [...o2];
@@ -151158,7 +151059,7 @@ function omit(schema, mask) {
   return clone(schema, def);
 }
 function extend(schema, shape) {
-  if (!isPlainObject3(shape)) {
+  if (!isPlainObject(shape)) {
     throw new Error("Invalid input to extend: expected a plain object");
   }
   const checks = schema._zod.def.checks;
@@ -151181,7 +151082,7 @@ function extend(schema, shape) {
   return clone(schema, def);
 }
 function safeExtend(schema, shape) {
-  if (!isPlainObject3(shape)) {
+  if (!isPlainObject(shape)) {
     throw new Error("Invalid input to safeExtend: expected a plain object");
   }
   const def = mergeDefs(schema._zod.def, {
@@ -152664,7 +152565,7 @@ function mergeValues(a3, b2) {
   if (a3 instanceof Date && b2 instanceof Date && +a3 === +b2) {
     return { valid: true, data: a3 };
   }
-  if (isPlainObject3(a3) && isPlainObject3(b2)) {
+  if (isPlainObject(a3) && isPlainObject(b2)) {
     const bKeys = Object.keys(b2);
     const sharedKeys = Object.keys(a3).filter((key) => bKeys.indexOf(key) !== -1);
     const newObj = { ...a3, ...b2 };
@@ -153921,7 +153822,7 @@ var init_schemas = __esm(() => {
     $ZodType.init(inst, def);
     inst._zod.parse = (payload, ctx) => {
       const input = payload.value;
-      if (!isPlainObject3(input)) {
+      if (!isPlainObject(input)) {
         payload.issues.push({
           expected: "record",
           code: "invalid_type",
@@ -165587,6 +165488,10 @@ var init_magic_context = __esm(() => {
     }).describe("Embedding provider configuration"),
     temporal_awareness: exports_external.boolean().default(true).describe('Inject wall-clock gap markers (<!-- +Xm -->) between user messages where > 5 min elapsed since the previous message, and add start/end date attributes on compartments. Gives the agent a sense of session pacing and "how long ago" across multi-day sessions. Graduated from experimental.temporal_awareness; default: true (set false to opt out).'),
     keep_subagents: exports_external.boolean().default(false).describe("Debug: keep the child sessions Magic Context spawns for its own subagents (historian, dreamer, sidekick, memory-migration) instead of deleting them on success. Useful for short-term inspection/data collection — their full transcript (prompt, tool calls, token usage, output) stays in the host session store. Kept sessions accumulate until manually cleared; leave false for normal use. Requires a restart to take effect."),
+    todowrite: exports_external.object({
+      enabled: exports_external.boolean().default(true).describe("Pi only: register Magic Context's todowrite task-list tool. Disable if you use your own todo extension. OpenCode ships its own built-in todowrite; this setting has no effect there."),
+      overlay: exports_external.boolean().default(true).describe("Pi only: show the persistent todo overlay above the editor while tasks are active.")
+    }).default({ enabled: true, overlay: true }).describe("Pi-only todowrite tool and overlay controls. Pi registers tools and widgets at extension boot, so changing this after /cd requires /reload or restart."),
     smart_drops: exports_external.boolean().default(false).describe("Content-aware reclaim of provably-superseded tool output, layered on the existing execute-pass auto-drop. When on: superseded todowrite (keep newest 1), spent ctx_reduce (keep newest 5), and zero-value meta (bash_status, bash_kill, ctx_note read/dismiss) outputs are dropped; older edits to a file are compressed to a filePath-preserving marker while the newest edit per file stays full. Only acts on passes already busting the cache, so it never originates a cache bust. Honors the protected-tag reserve. Experimental: opt-in, default off until cache stability is proven; when off the wire is byte-identical to the positional-only reclaim. Requires a restart."),
     caveman_text_compression: exports_external.object({
       enabled: exports_external.boolean().default(false).describe("Apply deterministic caveman-style text compression to old conversation text. Active for primary sessions when enabled; never for subagents. Compresses user/assistant text in oldest-first tiers: ultra (oldest 20%), full, lite, untouched (newest 40%)."),
@@ -165624,10 +165529,332 @@ var init_magic_context = __esm(() => {
   });
 });
 
+// ../plugin/src/config/project-security.ts
+function isPlainObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isValidPercentageThreshold(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 20 && value <= 80;
+}
+function isValidTokenThreshold(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 5000 && value <= 2000000;
+}
+function normalizeTrustedPercentageThresholds(value) {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return { defaultValue: value, overrides: new Map };
+  }
+  if (isPlainObject2(value) && typeof value.default === "number" && Number.isFinite(value.default)) {
+    const overrides = new Map;
+    for (const [key, child] of Object.entries(value)) {
+      if (key === "default")
+        continue;
+      if (typeof child === "number" && Number.isFinite(child)) {
+        overrides.set(key, child);
+      }
+    }
+    return { defaultValue: value.default, overrides };
+  }
+  return { defaultValue: DEFAULT_EXECUTE_THRESHOLD_PERCENTAGE, overrides: new Map };
+}
+function normalizeTrustedTokenThresholds(value) {
+  if (!isPlainObject2(value)) {
+    return { defaultValue: undefined, overrides: new Map };
+  }
+  const overrides = new Map;
+  for (const [key, child] of Object.entries(value)) {
+    if (key === "default")
+      continue;
+    if (typeof child === "number" && Number.isFinite(child)) {
+      overrides.set(key, child);
+    }
+  }
+  return {
+    defaultValue: typeof value.default === "number" && Number.isFinite(value.default) ? value.default : undefined,
+    overrides
+  };
+}
+function clonePercentageThresholds(value) {
+  return {
+    defaultValue: value.defaultValue,
+    overrides: new Map(value.overrides)
+  };
+}
+function cloneTokenThresholds(value) {
+  return {
+    defaultValue: value.defaultValue,
+    overrides: new Map(value.overrides)
+  };
+}
+function percentageThresholdsEqual(left, right) {
+  if (left.defaultValue !== right.defaultValue)
+    return false;
+  if (left.overrides.size !== right.overrides.size)
+    return false;
+  for (const [key, value] of left.overrides) {
+    if (right.overrides.get(key) !== value)
+      return false;
+  }
+  return true;
+}
+function setMergedPercentageThreshold(mergedRaw, value) {
+  if (value.overrides.size === 0) {
+    mergedRaw.execute_threshold_percentage = value.defaultValue;
+    return;
+  }
+  const serialized = { default: value.defaultValue };
+  for (const [key, threshold] of value.overrides) {
+    serialized[key] = threshold;
+  }
+  mergedRaw.execute_threshold_percentage = serialized;
+}
+function setMergedTokenThreshold(mergedRaw, value) {
+  if (value.defaultValue === undefined && value.overrides.size === 0) {
+    delete mergedRaw.execute_threshold_tokens;
+    return;
+  }
+  const serialized = {};
+  if (value.defaultValue !== undefined) {
+    serialized.default = value.defaultValue;
+  }
+  for (const [key, threshold] of value.overrides) {
+    serialized[key] = threshold;
+  }
+  mergedRaw.execute_threshold_tokens = serialized;
+}
+function makeProjectThresholdWarning(field, reason) {
+  return `Ignoring ${field} from project config (${reason})`;
+}
+function stripUnsafeProjectConfigFields(projectRaw) {
+  const warnings = [];
+  if ("auto_update" in projectRaw) {
+    delete projectRaw.auto_update;
+    warnings.push("Ignoring auto_update from project config (security: this setting only honors user-level config).");
+  }
+  if ("language" in projectRaw) {
+    delete projectRaw.language;
+    warnings.push("Ignoring language from project config (security: output language is a user-level setting).");
+  }
+  if ("sqlite" in projectRaw) {
+    delete projectRaw.sqlite;
+    warnings.push("Ignoring sqlite.* from project config (security: SQLite cache/mmap PRAGMAs apply to the " + "process-global shared database handle; only user-level config may set them).");
+  }
+  const embedding = projectRaw.embedding;
+  if (isPlainObject2(embedding)) {
+    const removed = [];
+    for (const field of EMBEDDING_DESTINATION_FIELDS) {
+      if (field in embedding) {
+        delete embedding[field];
+        removed.push(field);
+      }
+    }
+    if (removed.length > 0) {
+      warnings.push(`Ignoring embedding.${removed.join("/")} from project config ` + "(security: a repository cannot choose where private text is embedded).");
+    }
+  }
+  const historian = projectRaw.historian;
+  if (isPlainObject2(historian)) {
+    const removed = [];
+    for (const field of HISTORIAN_USER_ONLY_FIELDS) {
+      if (field in historian) {
+        delete historian[field];
+        removed.push(field);
+      }
+    }
+    if (removed.length > 0) {
+      warnings.push(`Ignoring historian.${removed.join("/")} from project config ` + "(security: historian model selection is user-level only; a repository cannot force extra compaction cost).");
+    }
+  }
+  for (const agentKey of HIDDEN_AGENT_KEYS) {
+    const block2 = projectRaw[agentKey];
+    if (!isPlainObject2(block2))
+      continue;
+    const removed = [];
+    for (const field of AGENT_ESCALATION_FIELDS) {
+      if (field in block2) {
+        delete block2[field];
+        removed.push(field);
+      }
+    }
+    if (removed.length > 0) {
+      warnings.push(`Ignoring ${agentKey}.${removed.join("/")} from project config ` + "(security: a repository cannot reprogram or re-permission hidden agents).");
+    }
+  }
+  return warnings;
+}
+function constrainProjectThresholdOverrides(args) {
+  const warnings = [];
+  const basePercentage = normalizeTrustedPercentageThresholds(args.trustedBaseConfig.execute_threshold_percentage);
+  const baseTokens = normalizeTrustedTokenThresholds(args.trustedBaseConfig.execute_threshold_tokens);
+  if ("execute_threshold_percentage" in args.projectRaw) {
+    const projectValue = args.projectRaw.execute_threshold_percentage;
+    if (isValidPercentageThreshold(projectValue)) {
+      const constrained = clonePercentageThresholds(basePercentage);
+      constrained.defaultValue = Math.max(basePercentage.defaultValue, projectValue);
+      for (const [modelKey, threshold] of basePercentage.overrides) {
+        const raisedThreshold = Math.max(threshold, projectValue);
+        if (raisedThreshold === constrained.defaultValue) {
+          constrained.overrides.delete(modelKey);
+        } else {
+          constrained.overrides.set(modelKey, raisedThreshold);
+        }
+      }
+      setMergedPercentageThreshold(args.mergedRaw, constrained);
+      if (percentageThresholdsEqual(constrained, basePercentage)) {
+        warnings.push(makeProjectThresholdWarning("execute_threshold_percentage", PERCENTAGE_THRESHOLD_REASON));
+      }
+    } else if (isPlainObject2(projectValue)) {
+      const constrained = clonePercentageThresholds(basePercentage);
+      let touchedValidEntry = false;
+      if (isValidPercentageThreshold(projectValue.default)) {
+        touchedValidEntry = true;
+        if (projectValue.default > basePercentage.defaultValue) {
+          constrained.defaultValue = projectValue.default;
+        } else {
+          warnings.push(makeProjectThresholdWarning("execute_threshold_percentage.default", PERCENTAGE_THRESHOLD_REASON));
+        }
+      }
+      for (const [modelKey, rawValue] of Object.entries(projectValue)) {
+        if (modelKey === "default")
+          continue;
+        if (!isValidPercentageThreshold(rawValue))
+          continue;
+        touchedValidEntry = true;
+        const baseValue = basePercentage.overrides.get(modelKey) ?? basePercentage.defaultValue;
+        if (rawValue > baseValue) {
+          if (rawValue === constrained.defaultValue) {
+            constrained.overrides.delete(modelKey);
+          } else {
+            constrained.overrides.set(modelKey, rawValue);
+          }
+        } else {
+          warnings.push(makeProjectThresholdWarning(`execute_threshold_percentage.${modelKey}`, PERCENTAGE_THRESHOLD_REASON));
+        }
+      }
+      if (touchedValidEntry) {
+        setMergedPercentageThreshold(args.mergedRaw, constrained);
+      }
+    }
+  }
+  if ("execute_threshold_tokens" in args.projectRaw && isPlainObject2(args.projectRaw.execute_threshold_tokens)) {
+    const projectValue = args.projectRaw.execute_threshold_tokens;
+    const constrained = cloneTokenThresholds(baseTokens);
+    let touchedValidEntry = false;
+    if (isValidTokenThreshold(projectValue.default)) {
+      touchedValidEntry = true;
+      if (baseTokens.defaultValue === undefined) {
+        warnings.push(makeProjectThresholdWarning("execute_threshold_tokens.default", TOKEN_THRESHOLD_INTRODUCTION_REASON));
+      } else if (projectValue.default > baseTokens.defaultValue) {
+        constrained.defaultValue = projectValue.default;
+      } else {
+        warnings.push(makeProjectThresholdWarning("execute_threshold_tokens.default", TOKEN_THRESHOLD_REASON));
+      }
+    }
+    for (const [modelKey, rawValue] of Object.entries(projectValue)) {
+      if (modelKey === "default")
+        continue;
+      if (!isValidTokenThreshold(rawValue))
+        continue;
+      touchedValidEntry = true;
+      const baseValue = baseTokens.overrides.get(modelKey) ?? baseTokens.defaultValue;
+      if (baseValue === undefined) {
+        warnings.push(makeProjectThresholdWarning(`execute_threshold_tokens.${modelKey}`, TOKEN_THRESHOLD_INTRODUCTION_REASON));
+        continue;
+      }
+      if (rawValue > baseValue) {
+        if (rawValue === constrained.defaultValue) {
+          constrained.overrides.delete(modelKey);
+        } else {
+          constrained.overrides.set(modelKey, rawValue);
+        }
+      } else {
+        warnings.push(makeProjectThresholdWarning(`execute_threshold_tokens.${modelKey}`, TOKEN_THRESHOLD_REASON));
+      }
+    }
+    if (touchedValidEntry) {
+      setMergedTokenThreshold(args.mergedRaw, constrained);
+    }
+  }
+  return warnings;
+}
+function normalizeEndpoint(value) {
+  if (typeof value !== "string")
+    return;
+  const trimmed = value.trim().replace(/\/+$/, "");
+  return trimmed.length > 0 ? trimmed.toLowerCase() : undefined;
+}
+function dropInheritedEmbeddingKeyOnRedirect(projectRaw, mergedRaw, userRaw) {
+  const projectEmbedding = projectRaw.embedding;
+  if (!isPlainObject2(projectEmbedding))
+    return [];
+  const redirectsEndpoint = "endpoint" in projectEmbedding;
+  if (!redirectsEndpoint)
+    return [];
+  const userEmbedding = userRaw?.embedding;
+  if (isPlainObject2(userEmbedding)) {
+    const projectEndpoint = normalizeEndpoint(projectEmbedding.endpoint);
+    const userEndpoint = normalizeEndpoint(userEmbedding.endpoint);
+    if (projectEndpoint !== undefined && projectEndpoint === userEndpoint) {
+      return [];
+    }
+  }
+  const providesOwnKey = typeof projectEmbedding.api_key === "string" && projectEmbedding.api_key.length > 0;
+  if (providesOwnKey)
+    return [];
+  const mergedEmbedding = mergedRaw.embedding;
+  if (!isPlainObject2(mergedEmbedding))
+    return [];
+  if (!("api_key" in mergedEmbedding))
+    return [];
+  delete mergedEmbedding.api_key;
+  return [
+    "Dropped inherited user embedding api_key because project config redirected " + "embedding.endpoint without supplying its own key (security: prevents key " + "exfiltration to a repository-chosen endpoint)."
+  ];
+}
+var HIDDEN_AGENT_KEYS, HISTORIAN_USER_ONLY_FIELDS, AGENT_ESCALATION_FIELDS, EMBEDDING_DESTINATION_FIELDS, PERCENTAGE_THRESHOLD_REASON = "security: a repository may only raise compaction thresholds above the user's effective value; it cannot force earlier historian work or cloned-repo cost escalation.", TOKEN_THRESHOLD_REASON = "security: a repository may only raise execute_threshold_tokens above the user's trusted token threshold; it cannot force earlier historian work or cloned-repo cost escalation.", TOKEN_THRESHOLD_INTRODUCTION_REASON = "security: a repository cannot introduce a new execute_threshold_tokens override when the user has no trusted token threshold for that key; that could force earlier historian work or cloned-repo cost escalation.";
+var init_project_security = __esm(() => {
+  init_magic_context();
+  HIDDEN_AGENT_KEYS = ["historian", "dreamer", "sidekick"];
+  HISTORIAN_USER_ONLY_FIELDS = ["model", "fallback_models"];
+  AGENT_ESCALATION_FIELDS = ["prompt", "permission", "tools", "system_prompt"];
+  EMBEDDING_DESTINATION_FIELDS = ["endpoint", "provider"];
+});
+
+// ../plugin/src/config/prune-config-leaf.ts
+function isPlainObject3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function pruneNestedConfigLeaf(block2, relativePath) {
+  if (relativePath.length === 0)
+    return null;
+  const result = { ...block2 };
+  let cursor3 = result;
+  for (let i2 = 0;i2 < relativePath.length - 1; i2++) {
+    const seg = String(relativePath[i2]);
+    const child = cursor3[seg];
+    if (!isPlainObject3(child)) {
+      if (!(seg in cursor3))
+        return null;
+      delete cursor3[seg];
+      return {
+        block: result,
+        removed: relativePath.slice(0, i2 + 1).map(String).join(".")
+      };
+    }
+    const clonedChild = { ...child };
+    cursor3[seg] = clonedChild;
+    cursor3 = clonedChild;
+  }
+  const leaf = String(relativePath[relativePath.length - 1]);
+  if (!(leaf in cursor3))
+    return null;
+  delete cursor3[leaf];
+  return { block: result, removed: relativePath.map(String).join(".") };
+}
+
 // ../plugin/src/config/variable.ts
-import { existsSync as existsSync17, readFileSync as readFileSync8 } from "node:fs";
+import { existsSync as existsSync16, readFileSync as readFileSync8 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
-import { dirname as dirname9, isAbsolute as isAbsolute2, resolve as resolve2 } from "node:path";
+import { dirname as dirname10, isAbsolute as isAbsolute2, resolve as resolve2 } from "node:path";
 function sensitiveFilePathReason(resolvedPath) {
   const home = homedir9();
   const sensitiveDirs = [
@@ -165674,7 +165901,7 @@ function substituteConfigVariables(input) {
   if (fileMatches.length === 0) {
     return { text: text3, warnings };
   }
-  const configDir = input.configPath ? dirname9(input.configPath) : process.cwd();
+  const configDir = input.configPath ? dirname10(input.configPath) : process.cwd();
   let output = "";
   let cursor3 = 0;
   for (const match of fileMatches) {
@@ -165700,7 +165927,7 @@ function substituteConfigVariables(input) {
     if (sensitiveReason) {
       warnings.push(`${token} resolves to a sensitive path (${sensitiveReason}: ${filePath}); ` + "inlining its contents into config — make sure this is intentional.");
     }
-    if (!existsSync17(filePath)) {
+    if (!existsSync16(filePath)) {
       warnings.push(`File not found for ${token} (resolved to ${filePath}); using empty string`);
       continue;
     }
@@ -165725,7 +165952,7 @@ var init_variable = __esm(() => {
 });
 
 // ../plugin/src/config/index.ts
-import { existsSync as existsSync18, readFileSync as readFileSync9 } from "node:fs";
+import { existsSync as existsSync17, readFileSync as readFileSync9 } from "node:fs";
 function getUserConfigBasePath() {
   return cortexKitUserConfigBasePath();
 }
@@ -165733,10 +165960,10 @@ function getProjectConfigBasePath(directory) {
   return cortexKitProjectConfigBasePath(directory);
 }
 function resolveLegacyReadFallback(sources) {
-  return { source: sources.find((s) => existsSync18(s.path)) ?? null };
+  return { source: sources.find((s) => existsSync17(s.path)) ?? null };
 }
 function loadConfigFileDetailed(configPath, source) {
-  if (!existsSync18(configPath)) {
+  if (!existsSync17(configPath)) {
     return null;
   }
   let rawText;
@@ -165951,12 +166178,13 @@ function loadPluginConfigDetailed(directory) {
   const harnessLegacy = resolveLegacyConfigSourcesForHarness(directory, "opencode");
   const userLegacyFallback = userDetected.format === "none" ? resolveLegacyReadFallback(harnessLegacy.user) : { source: null };
   const projectLegacyFallback = projectDetected.format === "none" ? resolveLegacyReadFallback(harnessLegacy.project) : { source: null };
-  const legacyUserUnmigrated = userDetected.format === "none" && !userLegacyFallback.source && legacySources.user.some((source) => existsSync18(source.path));
-  const legacyProjectUnmigrated = projectDetected.format === "none" && !projectLegacyFallback.source && legacySources.project.some((source) => existsSync18(source.path));
+  const legacyUserUnmigrated = userDetected.format === "none" && !userLegacyFallback.source && legacySources.user.some((source) => existsSync17(source.path));
+  const legacyProjectUnmigrated = projectDetected.format === "none" && !projectLegacyFallback.source && legacySources.project.some((source) => existsSync17(source.path));
   const userLoaded = userDetected.format !== "none" ? loadConfigFileDetailed(userDetected.path, "user") : userLegacyFallback.source ? loadConfigFileDetailed(userLegacyFallback.source.path, "user") : null;
   const projectLoaded = projectDetected.format !== "none" ? loadConfigFileDetailed(projectDetected.path, "project") : projectLegacyFallback.source ? loadConfigFileDetailed(projectLegacyFallback.source.path, "project") : null;
   const allWarnings = [];
   let mergedRaw = {};
+  const trustedBaseConfig = parsePluginConfig(userLoaded?.config ?? {});
   if (userLegacyFallback.source) {
     allWarnings.push(`[user config] reading legacy config from ${userLegacyFallback.source.path} until migration completes; run \`npx @cortexkit/magic-context doctor\` to consolidate into the shared CortexKit location.`);
   } else if (legacyUserUnmigrated) {
@@ -165981,6 +166209,13 @@ function loadPluginConfigDetailed(directory) {
     for (const warning of dropInheritedEmbeddingKeyOnRedirect(projectRaw, mergedRaw, userLoaded?.config)) {
       allWarnings.push(`[project config] ${warning}`);
     }
+    for (const warning of constrainProjectThresholdOverrides({
+      mergedRaw,
+      projectRaw,
+      trustedBaseConfig
+    })) {
+      allWarnings.push(`[project config] ${warning}`);
+    }
   }
   const recoveredTopLevelKeys = [];
   const config2 = parsePluginConfig(mergedRaw, recoveredTopLevelKeys);
@@ -166137,14 +166372,14 @@ var DEFAULT_TIMEOUT_MS = 1e4, MAX_PREVIEW_CHARS = 240;
 // ../plugin/src/shared/tui-config.ts
 import {
   chmodSync as chmodSync3,
-  existsSync as existsSync19,
-  mkdirSync as mkdirSync8,
+  existsSync as existsSync18,
+  mkdirSync as mkdirSync7,
   readFileSync as readFileSync10,
   renameSync as renameSync3,
   statSync as statSync6,
-  writeFileSync as writeFileSync5
+  writeFileSync as writeFileSync4
 } from "node:fs";
-import { dirname as dirname10, join as join15 } from "node:path";
+import { dirname as dirname11, join as join15 } from "node:path";
 function pluginEntryId(entry) {
   if (typeof entry === "string")
     return entry;
@@ -166175,7 +166410,7 @@ function writeTuiConfigAtomic(configPath, config2) {
   const body = `${import_comment_json6.stringify(config2, null, 2)}
 `;
   const tmpPath = `${configPath}.tmp`;
-  writeFileSync5(tmpPath, body);
+  writeFileSync4(tmpPath, body);
   try {
     if (statSync6(configPath, { throwIfNoEntry: false })?.isFile()) {
       chmodSync3(tmpPath, statSync6(configPath).mode & 511);
@@ -166187,9 +166422,9 @@ function resolveTuiConfigPath() {
   const configDir = getOpenCodeConfigPaths({ binary: "opencode" }).configDir;
   const jsoncPath = join15(configDir, "tui.jsonc");
   const jsonPath = join15(configDir, "tui.json");
-  if (existsSync19(jsoncPath))
+  if (existsSync18(jsoncPath))
     return jsoncPath;
-  if (existsSync19(jsonPath))
+  if (existsSync18(jsonPath))
     return jsonPath;
   return jsoncPath;
 }
@@ -166197,7 +166432,7 @@ function ensureTuiPluginEntry() {
   try {
     const configPath = resolveTuiConfigPath();
     let config2 = {};
-    if (existsSync19(configPath)) {
+    if (existsSync18(configPath)) {
       const raw = readFileSync10(configPath, "utf-8");
       config2 = import_comment_json6.parse(raw) ?? {};
     }
@@ -166232,7 +166467,7 @@ function ensureTuiPluginEntry() {
       }
     }
     config2.plugin = plugins;
-    mkdirSync8(dirname10(configPath), { recursive: true });
+    mkdirSync7(dirname11(configPath), { recursive: true });
     writeTuiConfigAtomic(configPath, config2);
     log3(`[magic-context] updated TUI plugin entry in ${configPath}`);
     return true;
@@ -166487,6 +166722,8 @@ function sanitizeDiagnosticText(value) {
   return redactSecretText(sanitizePathString(value));
 }
 function sanitizeConfigValue(value, keyPath = []) {
+  if (value === null || typeof value === "number" || typeof value === "boolean")
+    return value;
   const key = keyPath.at(-1) ?? "";
   if (key && isSecretKey(key)) {
     return `<REDACTED:${redactionTypeForKey(key)}>`;
@@ -166592,12 +166829,29 @@ var init_redaction = __esm(() => {
 });
 
 // src/lib/redaction.ts
+function sanitizeDiagnosticEndpoint(value) {
+  const trimmed = value.trim();
+  if (!trimmed)
+    return sanitizeDiagnosticText(value);
+  try {
+    const url2 = new URL(trimmed);
+    url2.username = "";
+    url2.password = "";
+    url2.search = "";
+    url2.hash = "";
+    return sanitizeDiagnosticText(url2.toString());
+  } catch {
+    const withoutQuery = trimmed.replace(/[?#].*$/, "");
+    const withoutUserInfo = withoutQuery.replace(/^([a-z][a-z0-9+.-]*:\/\/)[^/@\s]+@/i, "$1");
+    return sanitizeDiagnosticText(withoutUserInfo);
+  }
+}
 var init_redaction2 = __esm(() => {
   init_redaction();
 });
 
 // src/lib/diagnostics-opencode.ts
-import { existsSync as existsSync20, readdirSync as readdirSync2, readFileSync as readFileSync11, statSync as statSync7 } from "node:fs";
+import { existsSync as existsSync19, readdirSync as readdirSync2, readFileSync as readFileSync11, statSync as statSync7 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
 import { homedir as homedir11 } from "node:os";
 import { join as join16 } from "node:path";
@@ -166618,7 +166872,7 @@ function getPluginCacheInfo() {
   let cached2;
   for (const installedPkgPath of getOpenCodePluginPackageJsonPaths()) {
     try {
-      if (existsSync20(installedPkgPath)) {
+      if (existsSync19(installedPkgPath)) {
         const pkg = JSON.parse(readFileSync11(installedPkgPath, "utf-8"));
         cached2 = typeof pkg.version === "string" ? pkg.version : undefined;
         if (cached2)
@@ -166636,7 +166890,7 @@ function getStorageDir() {
 }
 function fileSize(path6) {
   try {
-    return existsSync20(path6) ? statSync7(path6).size : 0;
+    return existsSync19(path6) ? statSync7(path6).size : 0;
   } catch {
     return 0;
   }
@@ -166648,7 +166902,7 @@ function sanitizeValue(value) {
   return sanitizeConfigValue(value);
 }
 function readConfig2(path6) {
-  if (!existsSync20(path6))
+  if (!existsSync19(path6))
     return { value: null };
   try {
     const raw = readFileSync11(path6, "utf-8");
@@ -166709,7 +166963,7 @@ function parseHistorianDumpMeta(path6) {
   }
 }
 function listDumpsInDir(dir, limit) {
-  if (!existsSync20(dir))
+  if (!existsSync19(dir))
     return { count: 0, recent: [] };
   try {
     const entries = readdirSync2(dir).filter((name2) => name2.endsWith(".xml")).map((name2) => {
@@ -166777,8 +167031,9 @@ function collectHistorianDumps(recentSessions) {
   };
 }
 async function collectRecentSessions() {
-  const opencodeDbPath = join16(homedir11(), ".local", "share", "opencode", "opencode.db");
-  if (!existsSync20(opencodeDbPath))
+  const dataHome = process.env.XDG_DATA_HOME || join16(process.env.HOME || homedir11(), ".local", "share");
+  const opencodeDbPath = join16(dataHome, "opencode", "opencode.db");
+  if (!existsSync19(opencodeDbPath))
     return [];
   if (typeof globalThis.Bun === "undefined") {
     return [];
@@ -166813,7 +167068,7 @@ async function collectRecentSessions() {
 }
 async function collectHistorianFailures(storageDirPath) {
   const contextDbPath = join16(storageDirPath, "context.db");
-  if (!existsSync20(contextDbPath))
+  if (!existsSync19(contextDbPath))
     return [];
   if (typeof globalThis.Bun === "undefined") {
     return [];
@@ -166847,7 +167102,7 @@ async function collectHistorianFailures(storageDirPath) {
 }
 async function collectHistorianRuns(storageDirPath) {
   const contextDbPath = join16(storageDirPath, "context.db");
-  if (!existsSync20(contextDbPath))
+  if (!existsSync19(contextDbPath))
     return [];
   if (typeof globalThis.Bun === "undefined")
     return [];
@@ -166918,7 +167173,7 @@ async function collectDiagnostics() {
   const storageDirPath = getStorageDir();
   const contextDbPath = join16(storageDirPath, "context.db");
   const logPath = getMagicContextLogPath2("opencode");
-  const logFileSize = existsSync20(logPath) ? statSync7(logPath).size : 0;
+  const logFileSize = existsSync19(logPath) ? statSync7(logPath).size : 0;
   const conflictResult = detectConflicts(process.cwd());
   const recentSessions = await collectRecentSessions();
   const openCodeDetection = detectOpenCode();
@@ -166937,14 +167192,14 @@ async function collectDiagnostics() {
     opencodeConfigHasPlugin: configHasPluginEntry(opencodeConfig.value),
     tuiConfigHasPlugin: configHasPluginEntry(tuiConfig.value),
     magicContextConfig: {
-      exists: existsSync20(configPaths.magicContextConfig),
+      exists: existsSync19(configPaths.magicContextConfig),
       ...magicContextConfig.error ? { parseError: magicContextConfig.error } : {},
       flags: sanitizeValue(magicContextConfig.value ?? {}) ?? {}
     },
     pluginCache: getPluginCacheInfo(),
     storageDir: {
       path: storageDirPath,
-      exists: existsSync20(storageDirPath),
+      exists: existsSync19(storageDirPath),
       contextDbSizeBytes: fileSize(contextDbPath)
     },
     conflicts: {
@@ -166953,7 +167208,7 @@ async function collectDiagnostics() {
     },
     logFile: {
       path: logPath,
-      exists: existsSync20(logPath),
+      exists: existsSync19(logPath),
       sizeKb: Math.round(logFileSize / 1024)
     },
     recentSessions,
@@ -167007,7 +167262,7 @@ function renderDiagnosticsMarkdown(report) {
   };
   const recentSessions = report.recentSessions.map((session) => ({
     sessionId: session.sessionId,
-    title: session.title,
+    title: sanitizeDiagnosticText(session.title),
     directory: sanitizeString(session.directory),
     lastActiveAt: session.lastActiveAt
   }));
@@ -167093,9 +167348,9 @@ var init_diagnostics_opencode = __esm(() => {
 
 // src/lib/embedding-runtime.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync21 } from "node:fs";
+import { existsSync as existsSync20 } from "node:fs";
 import { createRequire as createRequire3 } from "node:module";
-import { dirname as dirname11, join as join17, sep } from "node:path";
+import { dirname as dirname12, join as join17, sep } from "node:path";
 function describeError(error51) {
   const message = error51 instanceof Error ? error51.message : String(error51 ?? "unknown error");
   const code = error51?.code;
@@ -167208,7 +167463,7 @@ function expectedBinaryRelPath(platform, arch) {
 }
 function checkLocalEmbeddingRuntimeAt(installRoot, platform = process.platform, arch = process.arch) {
   const packageDir = join17(installRoot, "node_modules", "onnxruntime-node");
-  if (!existsSync21(join17(packageDir, "package.json"))) {
+  if (!existsSync20(join17(packageDir, "package.json"))) {
     return { state: "package-missing", packageDir };
   }
   const rel = expectedBinaryRelPath(platform, arch);
@@ -167216,13 +167471,13 @@ function checkLocalEmbeddingRuntimeAt(installRoot, platform = process.platform,
     return probeOnnxRuntimeNodeLoad(packageDir) ?? { state: "ok", binaryPath: packageDir };
   }
   const binaryPath = join17(packageDir, rel);
-  if (!existsSync21(binaryPath)) {
+  if (!existsSync20(binaryPath)) {
     return { state: "binary-missing", packageDir, expectedBinary: binaryPath };
   }
   return probeOnnxRuntimeNodeLoad(packageDir) ?? { state: "ok", binaryPath };
 }
 function checkLocalEmbeddingRuntime(installRoots, platform = process.platform, arch = process.arch) {
-  const existing = installRoots.filter((root) => existsSync21(root));
+  const existing = installRoots.filter((root) => existsSync20(root));
   if (existing.length === 0) {
     return {
       state: "unknown",
@@ -167242,10 +167497,10 @@ function checkLocalEmbeddingRuntime(installRoots, platform = process.platform, a
 function packageDirFromResolved(resolvedPath, packageName) {
   const marker = `node_modules${sep}${packageName.split("/").join(sep)}`;
   const idx = resolvedPath.indexOf(marker);
-  return idx >= 0 ? resolvedPath.slice(0, idx + marker.length) : dirname11(resolvedPath);
+  return idx >= 0 ? resolvedPath.slice(0, idx + marker.length) : dirname12(resolvedPath);
 }
 function checkLocalEmbeddingRuntimeByResolution(pluginDir, platform = process.platform, arch = process.arch) {
-  if (!existsSync21(join17(pluginDir, "package.json"))) {
+  if (!existsSync20(join17(pluginDir, "package.json"))) {
     return { state: "unknown", reason: "plugin package dir not found" };
   }
   let onnxDir = null;
@@ -167281,7 +167536,7 @@ function checkLocalEmbeddingRuntimeByResolution(pluginDir, platform = process.pl
     return probeOnnxRuntimeNodeLoad(onnxDir) ?? { state: "ok", binaryPath: onnxDir };
   }
   const binaryPath = join17(onnxDir, rel);
-  if (!existsSync21(binaryPath)) {
+  if (!existsSync20(binaryPath)) {
     return { state: "binary-missing", packageDir: onnxDir, expectedBinary: binaryPath };
   }
   return probeOnnxRuntimeNodeLoad(onnxDir) ?? { state: "ok", binaryPath };
@@ -167327,33 +167582,30 @@ function extractRecentErrors(sanitized, limit = 20) {
 function capBodyToGithubLimit(body, maxBytes = MAX_GITHUB_BODY_BYTES) {
   if (Buffer.byteLength(body, "utf8") <= maxBytes)
     return body;
+  let capped = body;
   const heading = "## Log (last";
   const headingIdx = body.indexOf(heading);
   if (headingIdx === -1) {
-    const marker = `
-
-[truncated for GitHub 64KB limit]
-`;
-    const markerBytes2 = Buffer.byteLength(marker, "utf8");
-    return truncateToByteBudget(body, maxBytes - markerBytes2) + marker;
+    const markerBytes2 = Buffer.byteLength(FALLBACK_TRUNCATION_MARKER, "utf8");
+    capped = truncateToByteBudget(body, maxBytes - markerBytes2) + FALLBACK_TRUNCATION_MARKER;
+    return enforceFinalBodyLimit(capped, maxBytes);
   }
   const fenceOpenIdx = body.indexOf("\n```", headingIdx);
   if (fenceOpenIdx === -1)
-    return body;
+    return enforceFinalBodyLimit(body, maxBytes);
   const logStart = fenceOpenIdx + "\n```\n".length;
   const fenceCloseIdx = body.indexOf("\n```", logStart);
   if (fenceCloseIdx === -1)
-    return body;
+    return enforceFinalBodyLimit(body, maxBytes);
   const head = body.slice(0, logStart);
   const log4 = body.slice(logStart, fenceCloseIdx);
   const tail = body.slice(fenceCloseIdx);
   const overheadBytes = Buffer.byteLength(head, "utf8") + Buffer.byteLength(tail, "utf8");
-  const truncationMarker = `[truncated for GitHub 64KB limit — older log lines dropped]
-`;
-  const markerBytes = Buffer.byteLength(truncationMarker, "utf8");
+  const markerBytes = Buffer.byteLength(LOG_TRUNCATION_MARKER, "utf8");
   const logBudget = maxBytes - overheadBytes - markerBytes;
   if (logBudget <= 0) {
-    return `${head}${truncationMarker}${tail}`;
+    capped = `${head}${LOG_TRUNCATION_MARKER}${tail}`;
+    return enforceFinalBodyLimit(capped, maxBytes);
   }
   const lines = log4.split(`
 `);
@@ -167369,7 +167621,17 @@ function capBodyToGithubLimit(body, maxBytes = MAX_GITHUB_BODY_BYTES) {
   if (Buffer.byteLength(kept, "utf8") > logBudget) {
     kept = truncateToByteBudget(kept, logBudget);
   }
-  return `${head}${truncationMarker}${kept}${tail}`;
+  capped = `${head}${LOG_TRUNCATION_MARKER}${kept}${tail}`;
+  return enforceFinalBodyLimit(capped, maxBytes);
+}
+function enforceFinalBodyLimit(body, maxBytes) {
+  if (Buffer.byteLength(body, "utf8") <= maxBytes)
+    return body;
+  const markerBytes = Buffer.byteLength(FINAL_TRUNCATION_MARKER, "utf8");
+  if (markerBytes >= maxBytes) {
+    return truncateToByteBudget(FINAL_TRUNCATION_MARKER, maxBytes);
+  }
+  return truncateToByteBudget(body, maxBytes - markerBytes) + FINAL_TRUNCATION_MARKER;
 }
 function truncateToByteBudget(input, maxBytes) {
   if (maxBytes <= 0)
@@ -167383,7 +167645,14 @@ function truncateToByteBudget(input, maxBytes) {
   }
   return buf.subarray(0, end).toString("utf8");
 }
-var MAX_GITHUB_BODY_BYTES = 60000, ERROR_LOG_PATTERNS;
+var MAX_GITHUB_BODY_BYTES = 60000, LOG_TRUNCATION_MARKER = `[truncated for GitHub 64KB limit — older log lines dropped]
+`, FINAL_TRUNCATION_MARKER = `
+
+[truncated further to fit GitHub body limit]
+`, FALLBACK_TRUNCATION_MARKER = `
+
+[truncated for GitHub 64KB limit]
+`, ERROR_LOG_PATTERNS;
 var init_issue_body = __esm(() => {
   ERROR_LOG_PATTERNS = [
     /\bfailed:/i,
@@ -167396,8 +167665,7 @@ var init_issue_body = __esm(() => {
 });
 
 // src/lib/logs-opencode.ts
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync6 } from "node:fs";
-import { homedir as homedir12 } from "node:os";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync5 } from "node:fs";
 import { join as join18 } from "node:path";
 function sanitizeLogContent(content) {
   return sanitizeDiagnosticText(content);
@@ -167438,7 +167706,7 @@ function filterLogLinesBySession(lines, sessionId) {
     return matches.every((id) => id === sessionId);
   });
 }
-async function bundleIssueReport(report, description, _title, sessionFilter = null) {
+async function bundleIssueReport(report, description, title, sessionFilter = null) {
   const LOG_TAIL_LINES = 400;
   const allLogLines = report.logFile.exists ? readFileSync12(report.logFile.path, "utf-8").split(/\r?\n/) : [];
   const logLines = filterLogLinesBySession(allLogLines, sessionFilter);
@@ -167451,10 +167719,13 @@ async function bundleIssueReport(report, description, _title, sessionFilter = nu
 `));
   const recentErrorLines = extractRecentErrors(errorScanWindow, 20);
   const configBody = JSON.stringify(sanitizeConfigValue(report.magicContextConfig.flags), null, 2);
-  const sanitizedConfigPath = report.configPaths.magicContextConfig.replace(homedir12(), "~");
+  const sanitizedConfigPath = sanitizeDiagnosticText(report.configPaths.magicContextConfig);
+  const sanitizedDescription = sanitizeDiagnosticText(description);
+  const sanitizedTitle = sanitizeDiagnosticText(title).trim();
   const rawBodyMarkdown = [
+    ...sanitizedTitle ? ["## Title", sanitizedTitle, ""] : [],
     "## Description",
-    description,
+    sanitizedDescription,
     "",
     "## Environment",
     `- Plugin: v${report.pluginVersion}`,
@@ -167489,7 +167760,7 @@ async function bundleIssueReport(report, description, _title, sessionFilter = nu
 `);
   const bodyMarkdown = capBodyToGithubLimit(rawBodyMarkdown);
   const path6 = join18(process.cwd(), `magic-context-issue-${formatTimestamp(new Date)}.md`);
-  writeFileSync6(path6, `${bodyMarkdown}
+  writeFileSync5(path6, `${bodyMarkdown}
 `);
   return { path: path6, bodyMarkdown };
 }
@@ -167752,11 +168023,11 @@ function migrateExperimentalPinKeyFilesForDoctor(mcConfig) {
 }
 
 // src/commands/doctor-opencode-cache.ts
-import { existsSync as existsSync22, readFileSync as readFileSync13, rmSync as rmSync2 } from "node:fs";
+import { existsSync as existsSync21, readFileSync as readFileSync13, rmSync as rmSync2 } from "node:fs";
 function readCachedPluginVersion(pluginCacheDir) {
   try {
     const installedPkgPath = getOpenCodePluginPackageJsonPath(pluginCacheDir);
-    if (!existsSync22(installedPkgPath))
+    if (!existsSync21(installedPkgPath))
       return;
     const pkg = JSON.parse(readFileSync13(installedPkgPath, "utf-8"));
     return typeof pkg.version === "string" ? pkg.version : undefined;
@@ -167767,7 +168038,7 @@ function readCachedPluginVersion(pluginCacheDir) {
 async function clearPluginCache(options = {}, deps = {}) {
   const remove = deps.remove ?? ((path6) => rmSync2(path6, { recursive: true, force: true }));
   const pluginCacheRoots = getOpenCodePluginCacheRoots();
-  const existingRoots = pluginCacheRoots.filter((root) => existsSync22(root));
+  const existingRoots = pluginCacheRoots.filter((root) => existsSync21(root));
   if (existingRoots.length === 0) {
     return { action: "not_found", path: pluginCacheRoots[0] ?? "" };
   }
@@ -167815,6 +168086,8 @@ async function clearPluginCache(options = {}, deps = {}) {
       action: "error",
       path: firstFailure?.path ?? clearTargets[0]?.path ?? existingRoots[0] ?? "",
       paths: failed.map((entry) => entry.path),
+      clearedPaths: cleared.map((entry) => entry.path),
+      failedPaths: failed.map((entry) => entry.path),
       error: firstFailure?.error
     };
   }
@@ -167833,9 +168106,9 @@ var init_doctor_opencode_cache = __esm(() => {
 
 // src/commands/doctor-opencode.ts
 import { execSync as execSync2, spawnSync as spawnSync3 } from "node:child_process";
-import { existsSync as existsSync23, readFileSync as readFileSync14, statSync as statSync8 } from "node:fs";
+import { existsSync as existsSync22, readFileSync as readFileSync14, statSync as statSync8 } from "node:fs";
 import { createRequire as createRequire4 } from "node:module";
-import { homedir as homedir13 } from "node:os";
+import { homedir as homedir12 } from "node:os";
 import { join as join19 } from "node:path";
 function migrateLegacyAgentEnabledConfigForDoctor(mcConfig, logs) {
   let changed = false;
@@ -167905,6 +168178,38 @@ function getSelfVersion2() {
   }
   return "0.0.0";
 }
+function isPinnedOpenCodePluginSpecifier(specifier) {
+  if (specifier === OPENCODE_PLUGIN_NAME || specifier === OPENCODE_PLUGIN_ENTRY_WITH_VERSION)
+    return false;
+  return specifier.startsWith(`${OPENCODE_PLUGIN_NAME}@`);
+}
+function getUserNpmrcPath() {
+  const custom2 = process.env.NPM_CONFIG_USERCONFIG?.trim();
+  if (custom2)
+    return custom2;
+  const home = process.env.HOME?.trim();
+  return join19(home || homedir12(), ".npmrc");
+}
+function collectNpmReleaseAgeWarnings() {
+  const ageWarnings = [];
+  const npmrcPath = getUserNpmrcPath();
+  if (!existsSync22(npmrcPath))
+    return ageWarnings;
+  try {
+    const npmrc = readFileSync14(npmrcPath, "utf-8");
+    for (const line of npmrc.split(`
+`)) {
+      const trimmed = line.trim();
+      if (trimmed.startsWith("#") || trimmed.startsWith(";"))
+        continue;
+      const [key] = trimmed.split("=").map((s) => s.trim());
+      if (key === "min-release-age" || key === "before") {
+        ageWarnings.push(`${sanitizePathString(npmrcPath)} has '${sanitizeDiagnosticText(trimmed)}'`);
+      }
+    }
+  } catch {}
+  return ageWarnings;
+}
 function compareVersions(a3, b2) {
   const pa = a3.split(/[.-]/).map((s) => Number.parseInt(s, 10));
   const pb = b2.split(/[.-]/).map((s) => Number.parseInt(s, 10));
@@ -168026,7 +168331,7 @@ function checkLocalEmbeddingRuntimeForDoctor() {
   return { issues: 0 };
 }
 async function checkEmbeddingConfig(magicContextConfigPath) {
-  if (!existsSync23(magicContextConfigPath)) {
+  if (!existsSync22(magicContextConfigPath)) {
     return checkLocalEmbeddingRuntimeForDoctor();
   }
   let rawText;
@@ -168089,7 +168394,7 @@ async function checkEmbeddingConfig(magicContextConfigPath) {
     }
   }
   const probeSpinner = spinner2();
-  probeSpinner.start(`Testing embedding endpoint ${endpoint} (model: ${model})`);
+  probeSpinner.start(`Testing embedding endpoint ${sanitizeDiagnosticEndpoint(endpoint)} (model: ${sanitizeDiagnosticText(model)})`);
   let outcome;
   try {
     outcome = await probeEmbeddingEndpoint({
@@ -168102,7 +168407,7 @@ async function checkEmbeddingConfig(magicContextConfigPath) {
     });
   } catch (error51) {
     probeSpinner.stop("Embedding probe failed unexpectedly");
-    log2.error(`Probe threw: ${error51 instanceof Error ? error51.message : String(error51)}`);
+    log2.error(`Probe threw: ${sanitizeDiagnosticText(error51 instanceof Error ? error51.message : String(error51))}`);
     return { issues: localIssues + 1 };
   }
   probeSpinner.stop("Embedding endpoint probed");
@@ -168113,28 +168418,28 @@ async function checkEmbeddingConfig(magicContextConfigPath) {
     case "auth_failed":
       log2.error(`Embedding endpoint rejected credentials (${outcome.status}) — check api_key / env var`);
       if (outcome.preview)
-        log2.info(`  ${outcome.preview}`);
+        log2.info(`  ${sanitizeDiagnosticText(outcome.preview)}`);
       return { issues: localIssues + 1 };
     case "endpoint_unsupported":
       log2.error(`Embedding endpoint does not support embeddings (${outcome.status})`);
       if (outcome.preview)
-        log2.info(`  ${outcome.preview}`);
+        log2.info(`  ${sanitizeDiagnosticText(outcome.preview)}`);
       log2.info("  Common causes: endpoint points at a chat-completion route (should be the provider base, e.g. '.../v1'), or the provider doesn't offer an embeddings API");
       log2.info("  Known non-embedding providers: OpenRouter (chat proxy), Anthropic (no embeddings endpoint). Use OpenAI, Voyage, Together, or a local provider instead.");
       return { issues: localIssues + 1 };
     case "http_error":
       log2.error(`Embedding endpoint returned ${outcome.status}`);
       if (outcome.preview)
-        log2.info(`  ${outcome.preview}`);
+        log2.info(`  ${sanitizeDiagnosticText(outcome.preview)}`);
       return { issues: localIssues + 1 };
     case "timeout":
       log2.warn(`Embedding endpoint did not respond within ${outcome.timeoutMs}ms — check endpoint URL and network`);
       return { issues: localIssues + 1 };
     case "network_error":
-      log2.error(`Could not reach embedding endpoint: ${outcome.message}`);
+      log2.error(`Could not reach embedding endpoint: ${sanitizeDiagnosticText(outcome.message)}`);
       return { issues: localIssues + 1 };
     case "invalid_scheme":
-      log2.error(`Embedding endpoint must start with http:// or https://: ${outcome.endpoint}`);
+      log2.error(`Embedding endpoint must start with http:// or https://: ${sanitizeDiagnosticEndpoint(outcome.endpoint)}`);
       return { issues: localIssues + 1 };
   }
 }
@@ -168202,7 +168507,7 @@ async function runDoctor(options = {}) {
   } else {
     pass(`OpenCode config: ${paths.opencodeConfig}`);
   }
-  if (existsSync23(paths.magicContextConfig)) {
+  if (existsSync22(paths.magicContextConfig)) {
     pass(`Magic Context config: ${paths.magicContextConfig}`);
     try {
       const raw = readFileSync14(paths.magicContextConfig, "utf-8");
@@ -168230,7 +168535,7 @@ async function runDoctor(options = {}) {
     warn(`No magic-context.jsonc found — using defaults`);
     log2.info("  Run 'setup' to create one with model recommendations");
   }
-  if (existsSync23(paths.magicContextConfig)) {
+  if (existsSync22(paths.magicContextConfig)) {
     try {
       const mcRaw = readFileSync14(paths.magicContextConfig, "utf-8");
       const mcConfig = import_comment_json8.parse(mcRaw);
@@ -168369,7 +168674,7 @@ async function runDoctor(options = {}) {
         if (isDevPathPluginEntry(oldEntry)) {
           pass(`Plugin registered in ${configName} (dev path: ${oldEntryStr})`);
         } else {
-          const isPinned = oldEntryStr !== OPENCODE_PLUGIN_NAME && oldEntryStr !== OPENCODE_PLUGIN_ENTRY_WITH_VERSION && /^@cortexkit\/opencode-magic-context@\d/.test(oldEntryStr);
+          const isPinned = isPinnedOpenCodePluginSpecifier(oldEntryStr);
           if (isPinned && !options.force) {
             warn(`Plugin pinned to ${oldEntryStr} in ${configName} — use 'doctor --force' to upgrade`);
           } else {
@@ -168421,7 +168726,7 @@ async function runDoctor(options = {}) {
     pass("Added TUI sidebar plugin to tui.json");
     warn("Restart OpenCode to see the sidebar");
     fixed++;
-  } else if (existsSync23(paths.tuiConfig)) {
+  } else if (existsSync22(paths.tuiConfig)) {
     try {
       const tuiRaw = readFileSync14(paths.tuiConfig, "utf-8");
       const tuiConfig = import_comment_json8.parse(tuiRaw);
@@ -168440,7 +168745,7 @@ async function runDoctor(options = {}) {
         if (isDevPathPluginEntry(tuiEntry)) {
           pass(`TUI sidebar plugin configured (dev path: ${tuiEntryStr})`);
         } else {
-          const tuiPinned = tuiEntryStr !== OPENCODE_PLUGIN_NAME && tuiEntryStr !== OPENCODE_PLUGIN_ENTRY_WITH_VERSION && /^@cortexkit\/opencode-magic-context@\d/.test(tuiEntryStr);
+          const tuiPinned = isPinnedOpenCodePluginSpecifier(tuiEntryStr);
           if (tuiPinned && !options.force) {
             warn(`TUI plugin pinned to ${tuiEntryStr} — use 'doctor --force' to upgrade`);
           } else if (tuiPinned && options.force) {
@@ -168469,7 +168774,7 @@ async function runDoctor(options = {}) {
   } else {
     pass("TUI sidebar plugin configured (tui.json created)");
   }
-  if (existsSync23(paths.magicContextConfig)) {
+  if (existsSync22(paths.magicContextConfig)) {
     try {
       const mcRaw = readFileSync14(paths.magicContextConfig, "utf-8");
       const mcConfig = import_comment_json8.parse(mcRaw);
@@ -168490,7 +168795,7 @@ async function runDoctor(options = {}) {
   else
     passCount++;
   const dbPath = join19(getMagicContextStorageDir(), "context.db");
-  if (!existsSync23(dbPath)) {
+  if (!existsSync22(dbPath)) {
     log2.info(`Shared context DB not yet created at ${dbPath} (will be created on first run)`);
   } else {
     pass(`Shared context DB exists at ${dbPath}`);
@@ -168550,29 +168855,20 @@ async function runDoctor(options = {}) {
     warn(`Plugin cache version check unavailable; preserving cached plugin${cacheResult.cached ? ` (cached: ${cacheResult.cached})` : ""}. Use doctor --force to reinstall it.`);
   } else if (cacheResult.action === "error") {
     warn(`Could not clear plugin cache: ${cacheResult.error}`);
-    log2.info(`  Manually delete: ${cacheResult.path}`);
+    if (cacheResult.clearedPaths && cacheResult.clearedPaths.length > 0) {
+      log2.info(`  Cleared roots: ${cacheResult.clearedPaths.join(", ")}`);
+    }
+    if (cacheResult.failedPaths && cacheResult.failedPaths.length > 0) {
+      log2.info(`  Failed roots: ${cacheResult.failedPaths.join(", ")}`);
+    } else {
+      log2.info(`  Manually delete: ${cacheResult.path}`);
+    }
     issues++;
   } else {
     pass("Plugin cache clean (no cached version found)");
   }
   {
-    const ageWarnings = [];
-    const npmrcPath = join19(homedir13(), ".npmrc");
-    if (existsSync23(npmrcPath)) {
-      try {
-        const npmrc = readFileSync14(npmrcPath, "utf-8");
-        for (const line of npmrc.split(`
-`)) {
-          const trimmed = line.trim();
-          if (trimmed.startsWith("#") || trimmed.startsWith(";"))
-            continue;
-          const [key] = trimmed.split("=").map((s) => s.trim());
-          if (key === "min-release-age" || key === "before") {
-            ageWarnings.push(`~/.npmrc has '${trimmed}'`);
-          }
-        }
-      } catch {}
-    }
+    const ageWarnings = collectNpmReleaseAgeWarnings();
     if (ageWarnings.length > 0) {
       log2.warn("npm min-release-age restriction detected — this can prevent OpenCode from installing the latest plugin version");
       for (const w of ageWarnings) {
@@ -168584,7 +168880,7 @@ async function runDoctor(options = {}) {
     }
   }
   const logPath = getMagicContextLogPath2("opencode");
-  if (existsSync23(logPath)) {
+  if (existsSync22(logPath)) {
     const logStat = statSync8(logPath);
     const sizeKb = (logStat.size / 1024).toFixed(0);
     log2.info(`Log file: ${logPath} (${sizeKb} KB)`);
@@ -168649,6 +168945,7 @@ var init_doctor_opencode = __esm(async () => {
   init_opencode_plugin_cache();
   init_paths();
   init_prompts();
+  init_redaction2();
   init_v22_backfill_commands();
   init_doctor_opencode_cache();
   await __promiseAll([
@@ -168659,7 +168956,7 @@ var init_doctor_opencode = __esm(async () => {
 });
 
 // ../pi-plugin/src/config/index.ts
-import { existsSync as existsSync24, readFileSync as readFileSync15 } from "node:fs";
+import { existsSync as existsSync23, readFileSync as readFileSync15 } from "node:fs";
 function getProjectConfigPaths(cwd) {
   const basePath = cortexKitProjectConfigBasePath(cwd);
   return [`${basePath}.jsonc`, `${basePath}.json`];
@@ -168669,10 +168966,10 @@ function getUserConfigPaths() {
   return [`${basePath}.jsonc`, `${basePath}.json`];
 }
 function resolveFirstExisting(paths) {
-  return paths.find((path6) => existsSync24(path6));
+  return paths.find((path6) => existsSync23(path6));
 }
 function resolvePiLegacyFallback(sources) {
-  return sources.find((source) => existsSync24(source.path)) ?? null;
+  return sources.find((source) => existsSync23(source.path)) ?? null;
 }
 function loadConfigFile(path6, scope) {
   try {
@@ -168809,7 +169106,7 @@ function loadPiConfig(opts = {}) {
     if (loaded)
       loadedFiles.push(loaded);
   }
-  const legacyProjectUnmigrated = !projectPath && !projectLegacyFallback && legacySources.project.some((source) => existsSync24(source.path));
+  const legacyProjectUnmigrated = !projectPath && !projectLegacyFallback && legacySources.project.some((source) => existsSync23(source.path));
   const userPath = resolveFirstExisting(getUserConfigPaths());
   const userLegacyFallback = userPath ? null : resolvePiLegacyFallback(harnessLegacy.user);
   const userReadPath = userPath ?? userLegacyFallback?.path;
@@ -168818,7 +169115,7 @@ function loadPiConfig(opts = {}) {
     if (loaded)
       loadedFiles.push(loaded);
   }
-  const legacyUserUnmigrated = !userPath && !userLegacyFallback && legacySources.user.some((source) => existsSync24(source.path));
+  const legacyUserUnmigrated = !userPath && !userLegacyFallback && legacySources.user.some((source) => existsSync23(source.path));
   if (userLegacyFallback) {
     warnings.push(`[user config] reading legacy config from ${userLegacyFallback.path} until migration completes; run \`npx @cortexkit/magic-context doctor\` to consolidate into the shared CortexKit location.`);
   } else if (legacyUserUnmigrated) {
@@ -168836,6 +169133,7 @@ function loadPiConfig(opts = {}) {
     return a3.scope === "user" ? -1 : 1;
   });
   const userRaw = mergeFiles.find((f2) => f2.scope === "user")?.config;
+  const trustedBaseConfig = parsePiConfig(userRaw ?? {}).config;
   for (const loaded of mergeFiles) {
     const prefix = loaded.scope === "user" ? "[user config]" : "[project config]";
     warnings.push(...loaded.warnings.map((warning) => `${prefix} ${warning}`));
@@ -168848,6 +169146,13 @@ function loadPiConfig(opts = {}) {
       for (const warning of dropInheritedEmbeddingKeyOnRedirect(projectRaw, rawConfig, userRaw)) {
         warnings.push(`${prefix} ${warning}`);
       }
+      for (const warning of constrainProjectThresholdOverrides({
+        mergedRaw: rawConfig,
+        projectRaw,
+        trustedBaseConfig
+      })) {
+        warnings.push(`${prefix} ${warning}`);
+      }
     } else {
       rawConfig = mergeRawConfigs(rawConfig, loaded.config);
     }
@@ -168872,9 +169177,9 @@ var init_config2 = __esm(() => {
 
 // src/lib/diagnostics-pi.ts
 import { createHash as createHash3 } from "node:crypto";
-import { existsSync as existsSync25, readdirSync as readdirSync3, readFileSync as readFileSync16, statSync as statSync9 } from "node:fs";
+import { existsSync as existsSync24, readdirSync as readdirSync3, readFileSync as readFileSync16, statSync as statSync9 } from "node:fs";
 import { createRequire as createRequire5 } from "node:module";
-import { homedir as homedir14, userInfo as userInfo2 } from "node:os";
+import { homedir as homedir13, userInfo as userInfo2 } from "node:os";
 import { join as join20 } from "node:path";
 function getSelfVersion3() {
   const req = createRequire5(import.meta.url);
@@ -168890,7 +169195,7 @@ function getSelfVersion3() {
 }
 function fileSize2(path6) {
   try {
-    return existsSync25(path6) ? statSync9(path6).size : 0;
+    return existsSync24(path6) ? statSync9(path6).size : 0;
   } catch {
     return 0;
   }
@@ -168906,7 +169211,7 @@ function redactSecretString(value) {
   return redactSecretText(value).replace(/Bearer\s+[A-Za-z0-9._~+\-/=]+/g, "Bearer <REDACTED>").replace(/sk-[A-Za-z0-9_-]{12,}/g, "sk-<REDACTED>").replace(/api[_-]?key=([^\s&]+)/gi, "api_key=<REDACTED>").replace(/token=([^\s&]+)/gi, "token=<REDACTED>");
 }
 function sanitizeString2(value) {
-  const home = process.env.HOME || homedir14();
+  const home = process.env.HOME || homedir13();
   const username = userInfo2().username;
   const userHash = `<USER:${currentUserHash()}>`;
   let sanitized = redactSecretString(value);
@@ -168925,6 +169230,8 @@ function shouldRedactKey(key) {
   return /api[_-]?key|token|secret|password|authorization|cookie/i.test(key);
 }
 function sanitizeValue2(value, key = "") {
+  if (value === null || typeof value === "number" || typeof value === "boolean")
+    return value;
   if (shouldRedactKey(key))
     return "<REDACTED>";
   if (typeof value === "string")
@@ -168940,7 +169247,7 @@ function sanitizeValue2(value, key = "") {
   return value;
 }
 function readJsonc3(path6) {
-  if (!existsSync25(path6))
+  if (!existsSync24(path6))
     return { value: {} };
   try {
     return {
@@ -168960,7 +169267,7 @@ function readConfigDiagnostic(path6) {
   const parsed = readJsonc3(path6);
   return {
     path: path6,
-    exists: existsSync25(path6),
+    exists: existsSync24(path6),
     ...parsed.parseError ? { parseError: parsed.parseError } : {},
     flags: sanitizeValue2(parsed.value)
   };
@@ -168977,8 +169284,8 @@ function reverseSlugToDirectory(slug) {
   return `/${inner.replace(/-/g, "/")}`;
 }
 function collectPiRecentSessions() {
-  const sessionsRoot = join20(homedir14(), ".pi", "agent", "sessions");
-  if (!existsSync25(sessionsRoot))
+  const sessionsRoot = getPiSessionsRoot();
+  if (!existsSync24(sessionsRoot))
     return [];
   try {
     const slugs = readdirSync3(sessionsRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
@@ -169047,7 +169354,7 @@ function parseHistorianDumpMeta2(path6) {
   }
 }
 function listDumpsInDir2(dir, limit) {
-  if (!existsSync25(dir))
+  if (!existsSync24(dir))
     return { count: 0, recent: [] };
   try {
     const entries = readdirSync3(dir).filter((name2) => name2.endsWith(".xml")).map((name2) => {
@@ -169125,7 +169432,7 @@ async function collectDiagnostics2(cwd = process.cwd()) {
   const storageDirPath = getMagicContextStorageDir();
   const dbPath = join20(storageDirPath, "context.db");
   const logPath = getMagicContextLogPath2("pi");
-  const logFileSize = existsSync25(logPath) ? statSync9(logPath).size : 0;
+  const logFileSize = existsSync24(logPath) ? statSync9(logPath).size : 0;
   const otherPiExtensions = packages.filter((entry) => !isPiMagicContextPackageEntry(entry)).map(describePiPackageEntry);
   const recentSessions = collectPiRecentSessions();
   const historianDumps = collectPiHistorianDumps(recentSessions);
@@ -169140,7 +169447,7 @@ async function collectDiagnostics2(cwd = process.cwd()) {
     piVersion: pi ? getPiVersion(pi.path) : null,
     settings: {
       path: settingsPath,
-      exists: existsSync25(settingsPath),
+      exists: existsSync24(settingsPath),
       ...settingsParsed.parseError ? { parseError: settingsParsed.parseError } : {},
       hasMagicContextPackage: hasPiMagicContextPackage(packages),
       packages: sanitizeValue2(packages)
@@ -169156,7 +169463,7 @@ async function collectDiagnostics2(cwd = process.cwd()) {
     loadWarnings: loaded.warnings.map(sanitizeString2),
     storageDir: {
       path: storageDirPath,
-      exists: existsSync25(storageDirPath),
+      exists: existsSync24(storageDirPath),
       contextDbSizeBytes: fileSize2(dbPath)
     },
     conflicts: {
@@ -169165,7 +169472,7 @@ async function collectDiagnostics2(cwd = process.cwd()) {
     },
     logFile: {
       path: logPath,
-      exists: existsSync25(logPath),
+      exists: existsSync24(logPath),
       sizeKb: Math.round(logFileSize / 1024)
     },
     recentSessions,
@@ -169259,7 +169566,7 @@ var init_diagnostics_pi = __esm(() => {
 });
 
 // src/lib/logs-pi.ts
-import { readFileSync as readFileSync17, writeFileSync as writeFileSync7 } from "node:fs";
+import { readFileSync as readFileSync17, writeFileSync as writeFileSync6 } from "node:fs";
 import { join as join21 } from "node:path";
 function sanitizeLogContent2(content) {
   return sanitizeString2(content);
@@ -169326,7 +169633,7 @@ async function bundleIssueReport2(report, description, title, options = {}) {
   const bodyMarkdown = capBodyToGithubLimit(rawBodyMarkdown);
   const cwd = options.cwd ?? process.cwd();
   const path6 = join21(cwd, `magic-context-pi-issue-${formatTimestamp2(options.now ?? new Date)}.md`);
-  writeFileSync7(path6, `${bodyMarkdown}
+  writeFileSync6(path6, `${bodyMarkdown}
 `);
   return { path: path6, bodyMarkdown };
 }
@@ -169337,10 +169644,10 @@ var init_logs_pi = __esm(() => {
 
 // src/commands/doctor-pi.ts
 import { execFileSync as execFileSync5, spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync26, mkdirSync as mkdirSync9, readdirSync as readdirSync4, readFileSync as readFileSync18, rmSync as rmSync3, statSync as statSync10 } from "node:fs";
+import { existsSync as existsSync25, mkdirSync as mkdirSync8, readdirSync as readdirSync4, readFileSync as readFileSync18, rmSync as rmSync3, statSync as statSync10 } from "node:fs";
 import { createRequire as createRequire6 } from "node:module";
-import { homedir as homedir15 } from "node:os";
-import { dirname as dirname12, isAbsolute as isAbsolute3, join as join22 } from "node:path";
+import { homedir as homedir14 } from "node:os";
+import { dirname as dirname13, isAbsolute as isAbsolute3, join as join22 } from "node:path";
 function depsFrom(options) {
   return {
     ...DEFAULT_DEPS,
@@ -169454,13 +169761,13 @@ function piPluginDirCandidates(packages, cwd) {
   }
   dirs.push(join22(agentDir, "npm", "node_modules", PACKAGE_NAME));
   dirs.push(join22(cwd, ".pi", "npm", "node_modules", PACKAGE_NAME));
-  return dirs.filter((dir) => existsSync26(join22(dir, "package.json")));
+  return dirs.filter((dir) => existsSync25(join22(dir, "package.json")));
 }
 function projectConfigPath(cwd) {
   return resolveCortexKitProjectConfigPath(cwd);
 }
 function readConfigForEmbedding(path6, isProjectConfig) {
-  if (!existsSync26(path6))
+  if (!existsSync25(path6))
     return null;
   try {
     const rawText = readFileSync18(path6, "utf-8");
@@ -169494,7 +169801,7 @@ function classifyEmbeddingOutcome(outcome) {
     case "network_error":
       return {
         status: "fail",
-        message: `Embedding endpoint network error: ${outcome.message}`
+        message: `Embedding endpoint network error: ${sanitizeDiagnosticText(outcome.message)}`
       };
     case "endpoint_unsupported":
       return {
@@ -169509,7 +169816,7 @@ function classifyEmbeddingOutcome(outcome) {
     case "invalid_scheme":
       return {
         status: "fail",
-        message: `Embedding endpoint must start with http:// or https://: ${outcome.endpoint}`
+        message: `Embedding endpoint must start with http:// or https://: ${sanitizeDiagnosticEndpoint(outcome.endpoint)}`
       };
   }
 }
@@ -169522,11 +169829,12 @@ function countTable(db, table) {
   }
 }
 function cacheRoots() {
-  const home = homedir15();
-  const cacheHome = process.env.XDG_CACHE_HOME || join22(home, ".cache");
+  const home = process.env.HOME?.trim();
+  const cacheHome = process.env.XDG_CACHE_HOME || join22(home || homedir14(), ".cache");
+  const piCacheRoot = getPiCacheRoot();
   return [
-    join22(home, ".pi", "cache", "extensions"),
-    join22(home, ".pi", "cache", "packages"),
+    join22(piCacheRoot, "extensions"),
+    join22(piCacheRoot, "packages"),
     join22(cacheHome, "pi", "extensions"),
     join22(cacheHome, "pi", "packages"),
     join22(getPiAgentConfigDir(), "cache", "extensions")
@@ -169535,7 +169843,7 @@ function cacheRoots() {
 function findPiMagicContextCacheDirs(self, force = false) {
   const found = new Map;
   const visit = (path6, depth) => {
-    if (depth < 0 || !existsSync26(path6))
+    if (depth < 0 || !existsSync25(path6))
       return;
     let stat;
     try {
@@ -169546,7 +169854,7 @@ function findPiMagicContextCacheDirs(self, force = false) {
     if (!stat.isDirectory())
       return;
     const packageJson = join22(path6, "package.json");
-    if (existsSync26(packageJson)) {
+    if (existsSync25(packageJson)) {
       try {
         const pkg = JSON.parse(readFileSync18(packageJson, "utf-8"));
         const name2 = typeof pkg.name === "string" ? pkg.name : "";
@@ -169581,7 +169889,7 @@ async function runHealthChecks(options) {
     writeUserConfig: false,
     clearCachePaths: []
   };
-  const self = selfVersion();
+  const self = options.deps.selfVersion();
   const pi = options.deps.detectPiBinary();
   if (!pi) {
     add(results, "fail", "Pi binary not found on PATH or at ~/.pi/bin/pi");
@@ -169596,16 +169904,19 @@ async function runHealthChecks(options) {
     }
   }
   const latest = options.deps.getLatestNpmVersion();
-  if (latest && compareSemver(self, latest) === -1) {
+  const latestCompare = latest ? compareSemver(self, latest) : null;
+  if (latest && latestCompare === -1) {
     add(results, "warn", `Magic Context for Pi CLI v${self} is older than npm latest v${latest}`);
-  } else if (latest) {
+  } else if (latest && latestCompare !== null) {
     add(results, "pass", `Magic Context for Pi CLI v${self} is current (npm latest v${latest})`);
+  } else if (latest) {
+    add(results, "info", `Magic Context for Pi CLI version unknown; npm latest is v${latest}`);
   } else {
     add(results, "info", `Magic Context for Pi CLI v${self}; npm latest check unavailable`);
   }
   const settingsPath = getPiUserExtensionsPath();
   let packages = [];
-  if (!existsSync26(settingsPath)) {
+  if (!existsSync25(settingsPath)) {
     add(results, "warn", `Pi settings not found at ${settingsPath}`);
     repairPlan.addPackageEntry = true;
   } else {
@@ -169629,7 +169940,7 @@ async function runHealthChecks(options) {
     ["user", userConfigPath, true],
     ["project", projectPath, false]
   ]) {
-    if (!existsSync26(path6)) {
+    if (!existsSync25(path6)) {
       if (required2) {
         add(results, "warn", `No ${label} magic-context.jsonc found at ${path6}`);
         if (userConfigMigrationRefused) {
@@ -169667,7 +169978,7 @@ async function runHealthChecks(options) {
   }
   const storageDir = getMagicContextStorageDir();
   const dbPath = join22(storageDir, "context.db");
-  const existedBeforeOpen = existsSync26(dbPath);
+  const existedBeforeOpen = existsSync25(dbPath);
   if (existedBeforeOpen)
     add(results, "pass", `Shared context DB exists at ${dbPath}`);
   else
@@ -169731,7 +170042,7 @@ async function runHealthChecks(options) {
         const classified = classifyEmbeddingOutcome(outcome);
         add(results, classified.status, classified.message);
       } catch (error51) {
-        add(results, "fail", `Embedding probe threw: ${error51 instanceof Error ? error51.message : String(error51)}`);
+        add(results, "fail", `Embedding probe threw: ${sanitizeDiagnosticText(error51 instanceof Error ? error51.message : String(error51))}`);
       }
     }
   } else if (loadedConfig.config.embedding.provider === "off") {
@@ -169775,7 +170086,7 @@ async function runHealthChecks(options) {
     add(results, "pass", "Pi extension cache clean (no stale cached package found)");
   }
   const logPath = getMagicContextLogPath2("pi");
-  if (existsSync26(logPath)) {
+  if (existsSync25(logPath)) {
     const stat = statSync10(logPath);
     const sizeKb = (stat.size / 1024).toFixed(0);
     const lines = readFileSync18(logPath, "utf-8").split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
@@ -169813,7 +170124,7 @@ async function runHealthChecks(options) {
   return { results, repairPlan, ...summarize(results) };
 }
 function writeDefaultMagicContextConfig(path6) {
-  mkdirSync9(dirname12(path6), { recursive: true });
+  mkdirSync8(dirname13(path6), { recursive: true });
   const config2 = {
     $schema: "https://raw.githubusercontent.com/cortexkit/magic-context/master/assets/magic-context.schema.json",
     ...MagicContextConfigSchema.parse({})
@@ -169835,7 +170146,7 @@ function repair(plan, prompts) {
   }
   if (plan.writeUserConfig) {
     const configPath = getPiUserConfigPath();
-    if (!existsSync26(configPath)) {
+    if (!existsSync25(configPath)) {
       try {
         writeDefaultMagicContextConfig(configPath);
         prompts.log.success(`Wrote default Magic Context config to ${configPath}`);
@@ -170038,6 +170349,7 @@ var init_doctor_pi = __esm(async () => {
     detectPiBinary,
     getPiVersion,
     getLatestNpmVersion: () => getLatestNpmVersion(PACKAGE_NAME),
+    selfVersion,
     probeEmbeddingEndpoint,
     openDatabase,
     isDatabasePersisted,
@@ -170053,7 +170365,7 @@ var exports_doctor = {};
 __export(exports_doctor, {
   runDoctor: () => runDoctor3
 });
-import { existsSync as existsSync27, rmSync as rmSync4 } from "node:fs";
+import { existsSync as existsSync26, rmSync as rmSync4 } from "node:fs";
 async function runDoctor3(options) {
   if (options.clear)
     return runClear();
@@ -170142,7 +170454,7 @@ async function runClear() {
     const s = spinner2();
     s.start(`Clearing ${item.path}`);
     try {
-      if (existsSync27(item.path)) {
+      if (existsSync26(item.path)) {
         rmSync4(item.path, { recursive: true, force: true });
       }
       s.stop(`Cleared ${item.path}`);