@cortexkit/magic-context 0.39.0 → 0.40.0

package/dist/index.js

@@ -29680,7 +29680,7 @@ function expandConfigPath(value) {
     return `${homedir7()}/${trimmed.slice(2)}`;
   return trimmed;
 }
-var DEFAULT_EXECUTE_THRESHOLD_PERCENTAGE = 65, EXECUTE_THRESHOLD_CAP_MESSAGE = "execute_threshold is capped at 90% for cache safety: output capacity is reserved from the usable context window, and the remaining 10% absorbs mid-turn growth before the absolute 95% emergency wall. Use a value between 20 and 90.", DEFAULT_HISTORIAN_TIMEOUT_MS = 600000, DEFAULT_HISTORY_BUDGET_PERCENTAGE = 0.15, DEFAULT_LOCAL_EMBEDDING_MODEL = "Xenova/all-MiniLM-L6-v2", PiThinkingLevelSchema, PiConfigSchema, PromptSurfacePresetSchema, PromptSurfaceModelKeySchema, PromptSurfaceToolKeySchema, PromptSurfaceConfigSchema, PER_HARNESS_MIGRATION_INVENTORY, OcEntryObjectSchema, OcEntrySchema, PiEntryObjectSchema, PiEntrySchema, OpenCodeHarnessBlockSchema, PiHarnessBlockSchema, OpenCodeTaskExecutionSchema, PiTaskExecutionSchema, DreamerOpenCodeHarnessBlockSchema, DreamerPiHarnessBlockSchema, CronScheduleSchema, DreamTaskBaseConfigSchema, PromotionThresholdSchema, PrimerPromotionThresholdSchema, DreamTaskConfigSchema, ReviewUserMemoriesTaskConfigSchema, PromotePrimersTaskConfigSchema, DEFAULT_TASK_SCHEDULES2, DreamTasksSchema, AgentMetadataSchema, DreamerConfigSchema, SidekickConfigSchema, HistorianConfigSchema, EmbeddingFallbackProviderSchema, BaseEmbeddingConfigSchema, EmbeddingConfigSchema, MagicContextConfigSchema;
+var DEFAULT_EXECUTE_THRESHOLD_PERCENTAGE = 65, EXECUTE_THRESHOLD_CAP_MESSAGE = "execute_threshold is capped at 90% for cache safety: output capacity is reserved from the usable context window, and the remaining 10% absorbs mid-turn growth before the absolute 95% emergency wall. Use a value between 20 and 90.", DEFAULT_HISTORIAN_TIMEOUT_MS = 600000, DEFAULT_HISTORY_BUDGET_PERCENTAGE = 0.15, DEFAULT_LOCAL_EMBEDDING_MODEL = "Xenova/all-MiniLM-L6-v2", PiThinkingLevelSchema, PiConfigSchema, PromptSurfacePresetSchema, PromptSurfaceModelKeySchema, PromptSurfaceToolKeySchema, PromptSurfaceConfigSchema, PER_HARNESS_MIGRATION_INVENTORY, OcEntryObjectSchema, OcEntrySchema, PiEntryObjectSchema, PiEntrySchema, OpenCodeHarnessBlockSchema, PiHarnessBlockSchema, OpenCodeTaskExecutionSchema, PiTaskExecutionSchema, DreamerOpenCodeHarnessBlockSchema, DreamerPiHarnessBlockSchema, ProfileOpenCodeModelBlockSchema, ProfilePiModelBlockSchema, ProfileHistorianSchema, ProfileDreamerSchema, ProfileSidekickSchema, ConfigProfileSchema, ConfigProfilesSchema, CronScheduleSchema, DreamTaskBaseConfigSchema, PromotionThresholdSchema, PrimerPromotionThresholdSchema, DreamTaskConfigSchema, ReviewUserMemoriesTaskConfigSchema, PromotePrimersTaskConfigSchema, DEFAULT_TASK_SCHEDULES2, DreamTasksSchema, AgentMetadataSchema, DreamerConfigSchema, SidekickConfigSchema, HistorianConfigSchema, EmbeddingFallbackProviderSchema, BaseEmbeddingConfigSchema, EmbeddingConfigSchema, MagicContextConfigSchema;
 var init_magic_context = __esm(() => {
   init_zod();
   init_language_directive();
@@ -29799,6 +29799,37 @@ var init_magic_context = __esm(() => {
     thinking_level: PiThinkingLevelSchema.describe("Pi thinking level for the primary entry when it declares none. Fallback entries declare thinking levels per-entry."),
     tasks: exports_external.record(exports_external.string(), PiTaskExecutionSchema).optional().describe("Pi task execution overrides. Each named task accepts only model, fallback_models, thinking_level, and timeout_minutes.")
   }).strict().describe("Strict Pi dreamer model-resolution block. It accepts no OpenCode vocabulary.");
+  ProfileOpenCodeModelBlockSchema = exports_external.object({
+    model: OcEntrySchema.optional().describe("Primary OpenCode model entry."),
+    fallback_models: exports_external.array(OcEntrySchema).optional().describe("Ordered fallback OpenCode model entries."),
+    variant: exports_external.string().optional().describe("OpenCode reasoning variant for the primary model entry.")
+  }).strict().describe("Strict profile-only OpenCode model-selection block.");
+  ProfilePiModelBlockSchema = exports_external.object({
+    model: PiEntrySchema.optional().describe("Primary Pi model entry."),
+    fallback_models: exports_external.array(PiEntrySchema).optional().describe("Ordered fallback Pi model entries."),
+    thinking_level: PiThinkingLevelSchema.describe("Pi thinking level for the primary model entry.")
+  }).strict().describe("Strict profile-only Pi model-selection block.");
+  ProfileHistorianSchema = exports_external.object({
+    opencode: ProfileOpenCodeModelBlockSchema.optional(),
+    pi: ProfilePiModelBlockSchema.optional()
+  }).strict();
+  ProfileDreamerSchema = exports_external.object({
+    opencode: ProfileOpenCodeModelBlockSchema.optional(),
+    pi: ProfilePiModelBlockSchema.optional()
+  }).strict();
+  ProfileSidekickSchema = AgentOverrideConfigSchema.pick({
+    model: true,
+    fallback_models: true,
+    variant: true
+  }).extend({
+    thinking_level: PiThinkingLevelSchema.describe("Pi thinking level for the sidekick model selection.")
+  }).strict();
+  ConfigProfileSchema = exports_external.object({
+    historian: ProfileHistorianSchema.optional(),
+    dreamer: ProfileDreamerSchema.optional(),
+    sidekick: ProfileSidekickSchema.optional()
+  }).strict().describe("User-owned model-selection overlay. Only historian/dreamer harness model blocks and sidekick model-selection fields are allowed.");
+  ConfigProfilesSchema = exports_external.record(exports_external.string().trim().min(1, "Profile names must not be empty or whitespace-only."), ConfigProfileSchema);
   CronScheduleSchema = exports_external.string().refine((s) => s.trim() === "" || isValidCron(s), {
     message: 'Invalid schedule: use a 5-field cron expression (e.g. "0 3 * * *" for 3am daily, "0 3 * * 0" for Sunday 3am, "0 */6 * * *" every 6h) or "" to disable.'
   }).describe('5-field cron schedule (e.g. "0 3 * * *"), or "" to disable this task.');
@@ -29973,6 +30004,8 @@ var init_magic_context = __esm(() => {
     transform_mode: exports_external.enum(["ts", "rust"]).default("ts").describe('Experimental: routes the entire Magic Context runtime for the project through the ck-mc Rust module over subc (requires user-level `subc` config); "ts" is the current TypeScript pipeline.'),
     auto_update: exports_external.boolean().optional().describe("Enable automatic npm self-update checks for the OpenCode plugin. Security: USER-only in config loader, so hostile project configs cannot suppress updates."),
     language: exports_external.string().trim().toLowerCase().refine((s) => isValidLanguageCode(s), 'language must be a 2-letter ISO 639-1 code (e.g. "tr", "es", "de")').optional().describe("Output language for Magic Context's generated content and guidance, as a " + '2-letter ISO 639-1 code (e.g. "tr", "es", "de", "ja", "pt"). When set, the ' + "historian, dreamer, sidekick, and the agent-guidance block instruct the model to " + "write its PROSE in this language while keeping all structural tokens (XML tags, " + "the five memory category names, code identifiers, file paths) in English. " + "USER-LEVEL ONLY (ignored in project config for security). Unset = today's " + "behavior (model mirrors the conversation; English scaffolding). Changing it " + "triggers one cache re-materialization; existing compartments/memories keep their " + "original language until naturally rewritten."),
+    profile: exports_external.string().trim().min(1).optional().describe("Select a named user-owned model profile. A valid project name overrides this user default; an empty string, null, or other non-string project value is ignored with a warning so the user selection still applies. Unknown names warn and use the base configuration."),
+    profiles: ConfigProfilesSchema.optional().describe("User-level named model profiles. A profile may contain only historian/dreamer model, fallback_models, OpenCode variant, and Pi thinking_level fields plus sidekick model-selection fields; task execution policy (including timeout_minutes) is excluded. Project configs may select a name but cannot define profiles."),
     historian: HistorianConfigSchema.describe("Historian metadata plus independent strict OpenCode and Pi execution blocks. Retained metadata stays at historian; model, fallback_models, variant, and thinking_level belong only in historian.opencode or historian.pi."),
     dreamer: DreamerConfigSchema.optional().describe("Dreamer metadata and scheduling plus independent strict OpenCode and Pi execution blocks. schedule and promotion_threshold stay at dreamer.tasks; model, fallback_models, variant, thinking_level, and timeout_minutes belong only in the matching harness block."),
     smart_notes: exports_external.object({
@@ -30075,6 +30108,72 @@ var init_magic_context = __esm(() => {
   });
 });
 
+// ../plugin/src/config/profiles.ts
+function withoutProfileFields(raw) {
+  const copy = { ...raw };
+  delete copy.profile;
+  delete copy.profiles;
+  return copy;
+}
+function readProfileSelection(raw) {
+  if (!Object.hasOwn(raw, "profile"))
+    return { declared: false };
+  const value = raw.profile;
+  if (typeof value !== "string")
+    return { declared: true };
+  const name = value.trim();
+  return name.length > 0 ? { declared: true, name } : { declared: true };
+}
+function resolveConfigProfile(args) {
+  const warnings = [];
+  const userSelection = readProfileSelection(args.userRaw);
+  const projectSelection = readProfileSelection(args.projectRaw);
+  const selection = projectSelection.name ? { name: projectSelection.name, source: "project" } : userSelection.name ? { name: userSelection.name, source: "user" } : undefined;
+  if (projectSelection.declared && !projectSelection.name) {
+    warnings.push("Ignoring invalid profile selection from project config; expected a non-empty string.");
+  }
+  if (!projectSelection.declared && userSelection.declared && !userSelection.name) {
+    warnings.push("Ignoring invalid profile selection from user config; expected a non-empty string.");
+  }
+  let profiles = {};
+  if (Object.hasOwn(args.userRaw, "profiles")) {
+    const parsed = ConfigProfilesSchema.safeParse(args.userRaw.profiles);
+    if (parsed.success) {
+      profiles = parsed.data;
+    } else {
+      warnings.push("Ignoring profiles from user config: invalid profile configuration; profiles may contain only historian/dreamer harness model blocks and sidekick model-selection fields.");
+    }
+  }
+  if (!selection) {
+    return {
+      userBase: withoutProfileFields(args.userRaw),
+      projectBase: withoutProfileFields(args.projectRaw),
+      overlay: {},
+      warnings
+    };
+  }
+  if (!Object.hasOwn(profiles, selection.name)) {
+    warnings.push(`Unknown profile "${selection.name}" selected by ${selection.source} config; using base config without a profile.`);
+    return {
+      userBase: withoutProfileFields(args.userRaw),
+      projectBase: withoutProfileFields(args.projectRaw),
+      overlay: {},
+      warnings
+    };
+  }
+  const overlay = profiles[selection.name];
+  return {
+    userBase: withoutProfileFields(args.userRaw),
+    projectBase: withoutProfileFields(args.projectRaw),
+    overlay,
+    activeProfile: selection.name,
+    warnings
+  };
+}
+var init_profiles = __esm(() => {
+  init_magic_context();
+});
+
 // ../plugin/src/config/project-security.ts
 function isPlainObject2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -30204,6 +30303,10 @@ function makeProjectThresholdWarning(field, reason) {
 }
 function stripUnsafeProjectConfigFields(projectRaw) {
   const warnings = [];
+  if ("profiles" in projectRaw) {
+    delete projectRaw.profiles;
+    warnings.push("Ignoring profiles from project config (security: profile definitions are user-level only; a repository may select a named user profile with profile).");
+  }
   if ("auto_update" in projectRaw) {
     delete projectRaw.auto_update;
     warnings.push("Ignoring auto_update from project config (security: this setting only honors user-level config).");
@@ -30923,8 +31026,6 @@ function loadPluginConfigDetailed(directory) {
   const userLoaded = userDetected.format !== "none" ? loadConfigFileDetailed(userDetected.path, "user") : userLegacyFallback.source ? loadConfigFileDetailed(userLegacyFallback.source.path, "user") : null;
   const projectLoaded = projectDetected.format !== "none" ? loadConfigFileDetailed(projectDetected.path, "project") : projectLegacyFallback.source ? loadConfigFileDetailed(projectLegacyFallback.source.path, "project") : null;
   const allWarnings = [];
-  let mergedRaw = {};
-  const trustedBaseConfig = parsePluginConfig(userLoaded?.config ?? {});
   if (userLegacyFallback.source) {
     allWarnings.push(`[user config] reading legacy config from ${userLegacyFallback.source.path} until migration completes; run \`npx @cortexkit/magic-context doctor\` to consolidate into the shared CortexKit location.`);
   } else if (legacyUserUnmigrated) {
@@ -30937,21 +31038,31 @@ function loadPluginConfigDetailed(directory) {
   }
   if (userLoaded) {
     allWarnings.push(...userLoaded.warnings.map((w) => `[user config] ${w}`));
-    mergedRaw = deepMergeRawConfig(mergedRaw, userLoaded.config);
   }
+  let projectRaw = {};
   if (projectLoaded) {
     allWarnings.push(...projectLoaded.warnings.map((w) => `[project config] ${w}`));
-    const projectRaw = { ...projectLoaded.config };
+    projectRaw = { ...projectLoaded.config };
     for (const warning of stripUnsafeProjectConfigFields(projectRaw)) {
       allWarnings.push(`[project config] ${warning}`);
     }
-    mergedRaw = deepMergeRawConfig(mergedRaw, projectRaw);
-    for (const warning of dropInheritedEmbeddingKeyOnRedirect(projectRaw, mergedRaw, userLoaded?.config)) {
+  }
+  const profileResolution = resolveConfigProfile({
+    userRaw: userLoaded?.config ?? {},
+    projectRaw
+  });
+  allWarnings.push(...profileResolution.warnings.map((warning) => `[config] ${warning}`));
+  const trustedProfiledRaw = deepMergeRawConfig(profileResolution.userBase, profileResolution.overlay);
+  let mergedRaw = trustedProfiledRaw;
+  const trustedBaseConfig = parsePluginConfig(trustedProfiledRaw);
+  if (projectLoaded) {
+    mergedRaw = deepMergeRawConfig(mergedRaw, profileResolution.projectBase);
+    for (const warning of dropInheritedEmbeddingKeyOnRedirect(projectRaw, mergedRaw, profileResolution.userBase)) {
       allWarnings.push(`[project config] ${warning}`);
     }
     for (const warning of constrainProjectThresholdOverrides({
       mergedRaw,
-      projectRaw,
+      projectRaw: profileResolution.projectBase,
       trustedBaseConfig
     })) {
       allWarnings.push(`[project config] ${warning}`);
@@ -30959,6 +31070,8 @@ function loadPluginConfigDetailed(directory) {
   }
   const recoveredTopLevelKeys = [];
   const config2 = parsePluginConfig(mergedRaw, recoveredTopLevelKeys);
+  if (profileResolution.activeProfile)
+    config2.profile = profileResolution.activeProfile;
   setOutputReserveConfig(config2.output_reserve);
   setWindowOverlayPath(config2.models?.window_overlay_path);
   if (config2.configWarnings?.length) {
@@ -31006,6 +31119,7 @@ var init_config = __esm(() => {
   init_agent_disable();
   init_migrate_config_location();
   init_migrate_dreamer_v2();
+  init_profiles();
   init_project_security();
   init_raw_loader();
   init_magic_context();
@@ -35166,6 +35280,17 @@ function readPsProcessStartTime(pid) {
     return null;
   }
 }
+function readProcessStartTime(pid) {
+  if (!Number.isInteger(pid) || pid <= 0)
+    return null;
+  return rpcIdentityPlatform === "linux" ? readLinuxProcessStartTime(pid) : rpcIdentityPlatform === "win32" ? null : readPsProcessStartTime(pid);
+}
+function readProcessProbeEvidence(pid) {
+  return {
+    startTime: readProcessStartTime(pid),
+    commandLine: readProcessCommand(pid)
+  };
+}
 function parseCsvLine(line) {
   const fields = [];
   let field = "";
@@ -35298,16 +35423,16 @@ function commandLooksLikeOpenCode(command) {
   const normalized = command.toLowerCase();
   return OPEN_CODE_COMMAND_MARKERS.some((marker) => normalized.includes(marker));
 }
-function isPidIdentityPlausible(record2) {
+function isPidIdentityPlausible(record2, evidence) {
   if (!Number.isInteger(record2.pid) || record2.pid <= 0)
     return "implausible";
   if (Number.isFinite(record2.started_at) && record2.started_at > 0) {
-    const processStartTime = rpcIdentityPlatform === "linux" ? readLinuxProcessStartTime(record2.pid) : rpcIdentityPlatform === "win32" ? null : readPsProcessStartTime(record2.pid);
+    const processStartTime = evidence ? evidence.startTime : readProcessStartTime(record2.pid);
     if (processStartTime === null)
       return "inconclusive";
     return processStartTime <= record2.started_at + RPC_IDENTITY_SKEW_TOLERANCE_MS ? "plausible" : "implausible";
   }
-  const command = rpcIdentityPlatform === "linux" ? readLinuxProcessCommand(record2.pid) : rpcIdentityPlatform === "win32" ? readWindowsProcess(record2.pid).command ?? null : readPsProcessCommand(record2.pid);
+  const command = evidence ? evidence.commandLine : rpcIdentityPlatform === "linux" ? readLinuxProcessCommand(record2.pid) : rpcIdentityPlatform === "win32" ? readWindowsProcess(record2.pid).command ?? null : readPsProcessCommand(record2.pid);
   if (command === null)
     return "inconclusive";
   return commandLooksLikeOpenCode(command) ? "plausible" : "implausible";
@@ -35371,9 +35496,6 @@ function inspectLivePiProcesses() {
     };
   }
 }
-function discoverLivePiProcessIds() {
-  return inspectLivePiProcesses().processIds;
-}
 function parseRpcPortFile(content, fallbackPid = 0) {
   const trimmed = content.trim();
   if (!trimmed)
@@ -35417,177 +35539,500 @@ var init_rpc_utils = __esm(() => {
   rpcProcessListExecFileSync = execFileSync4;
   rpcIdentityPlatform = process.platform;
 });
-// ../plugin/src/hooks/magic-context/compartment-parser.ts
-function makeTierOpenRegex(n2) {
-  return new RegExp(`<p${n2}\\s*(/?)>`);
+// ../plugin/src/shared/redaction.ts
+import { homedir as homedir12, userInfo } from "node:os";
+function escapeRegex2(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function extractTier(inner, index) {
-  const openMatch = TIER_OPEN_REGEXES[index].exec(inner);
-  if (!openMatch)
-    return;
-  if (openMatch[1] === "/")
-    return "";
-  const rest = inner.slice(openMatch.index + openMatch[0].length);
-  const closeAt = rest.search(TIER_CLOSE_ANY_REGEX);
-  let body = closeAt === -1 ? rest : rest.slice(0, closeAt);
-  const openInside = body.search(TIER_OPEN_ANY_REGEX);
-  if (openInside !== -1)
-    body = body.slice(0, openInside);
-  return unescapeXml(body.trim());
+function redactionTypeForKey(key) {
+  const normalized = key.trim().toLowerCase().replace(/[^a-z0-9_.-]+/g, "_");
+  const suffix = normalized.split(".").filter(Boolean).at(-1) ?? normalized;
+  return suffix || "secret";
 }
-function extractTiersFromInner(inner) {
-  return {
-    p1: extractTier(inner, 0),
-    p2: extractTier(inner, 1),
-    p3: extractTier(inner, 2),
-    p4: extractTier(inner, 3)
-  };
+function isNonSecretScalarValue(value) {
+  const v = value.trim();
+  if (v === "true" || v === "false" || v === "null" || v === "undefined")
+    return true;
+  return /^[+-]?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?$/.test(v);
 }
-function parseCompartmentOutput(text3) {
-  const compartments = [];
-  const facts = [];
-  for (const match of text3.matchAll(COMPARTMENT_REGEX)) {
-    const attrs = match[1];
-    const inner = match[2];
-    const startMatch = attrs.match(ATTR_START_REGEX);
-    const endMatch = attrs.match(ATTR_END_REGEX);
-    const titleMatch = attrs.match(ATTR_TITLE_REGEX);
-    if (!startMatch || !endMatch || !titleMatch)
-      continue;
-    const startMessage = parseInt(startMatch[1], 10);
-    const endMessage = parseInt(endMatch[1], 10);
-    const title = unescapeXml(titleMatch[1]);
-    if (Number.isNaN(startMessage) || Number.isNaN(endMessage) || !title)
-      continue;
-    const episodeMatch = attrs.match(ATTR_EPISODE_REGEX);
-    const importanceMatch = attrs.match(ATTR_IMPORTANCE_REGEX);
-    const episodeType = episodeMatch ? unescapeXml(episodeMatch[1]) : undefined;
-    const importance = importanceMatch ? parseInt(importanceMatch[1], 10) : undefined;
-    const p1 = extractTier(inner, 0);
-    if (typeof p1 === "string" && p1.length > 0) {
-      const p2 = extractTier(inner, 1);
-      const p3 = extractTier(inner, 2);
-      const p4 = extractTier(inner, 3);
-      compartments.push({
-        startMessage,
-        endMessage,
-        title,
-        content: p1,
-        p1,
-        p2: typeof p2 === "string" ? p2 : p1,
-        p3: typeof p3 === "string" ? p3 : typeof p2 === "string" ? p2 : p1,
-        p4: typeof p4 === "string" ? p4 : "",
-        importance,
-        episodeType
-      });
+function isSecretKey(key) {
+  const segments = key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().split(/[._-]+/).filter(Boolean);
+  if (segments.length === 0)
+    return false;
+  if (segments.length === 1) {
+    const first = segments[0];
+    return Boolean(first && SECRET_SEGMENT_PATTERN.test(first));
+  }
+  for (let i2 = 0;i2 < segments.length; i2++) {
+    const seg = segments[i2];
+    if (!seg || !SECRET_SEGMENT_PATTERN.test(seg))
       continue;
+    let trailingOk = true;
+    for (let j = i2 + 1;j < segments.length; j++) {
+      const tail = segments[j];
+      if (!tail)
+        continue;
+      if (TRAILING_DESCRIPTORS.has(tail))
+        continue;
+      if (SECRET_SEGMENT_PATTERN.test(tail))
+        continue;
+      trailingOk = false;
+      break;
     }
-    const content = unescapeXml(inner.trim());
-    if (content) {
-      compartments.push({
-        startMessage,
-        endMessage,
-        title,
-        content,
-        importance,
-        episodeType
-      });
-    }
-  }
-  const factsBlockMatch = text3.match(FACTS_BLOCK_REGEX);
-  const factsScope = factsBlockMatch ? factsBlockMatch[1] : text3.replace(EVENTS_BLOCK_REGEX, "").replace(/<compartment\s+[^>]*?\s*>.*?<\/compartment>/gs, "");
-  for (const categoryMatch of factsScope.matchAll(CATEGORY_BLOCK_REGEX)) {
-    const category = categoryMatch[1];
-    const blockContent = categoryMatch[2];
-    for (const itemMatch of blockContent.matchAll(FACT_ITEM_REGEX)) {
-      const content = unescapeXml(itemMatch[1].trim());
-      if (content) {
-        facts.push({ category, content });
-      }
+    if (!trailingOk)
+      continue;
+    for (let k = i2 - 1;k >= 0; k--) {
+      const lead = segments[k];
+      if (lead && SECRET_QUALIFIERS.has(lead))
+        return true;
     }
   }
-  const unprocessedMatch = text3.match(UNPROCESSED_REGEX);
-  const unprocessedFrom = unprocessedMatch ? parseInt(unprocessedMatch[1], 10) : null;
-  const userObservations = [];
-  const userObsMatch = text3.match(USER_OBSERVATIONS_REGEX);
-  if (userObsMatch) {
-    for (const itemMatch of userObsMatch[1].matchAll(USER_OBS_ITEM_REGEX)) {
-      const obs = unescapeXml(itemMatch[1].trim());
-      if (obs)
-        userObservations.push(obs);
-    }
+  return false;
+}
+function sanitizePathString(value) {
+  const home = homedir12();
+  const username = userInfo().username;
+  let sanitized = value;
+  if (home) {
+    sanitized = sanitized.replace(new RegExp(escapeRegex2(home), "g"), "~");
   }
-  const primerCandidates = [];
-  const primerMatch = text3.match(PRIMER_CANDIDATES_REGEX);
-  if (primerMatch) {
-    const block2 = primerMatch[1];
-    let sawElement = false;
-    for (const el of block2.matchAll(PRIMER_ELEMENT_REGEX)) {
-      sawElement = true;
-      const question = unescapeXml(el[2].trim());
-      if (question) {
-        primerCandidates.push({
-          question,
-          originCompartmentIndex: Number.parseInt(el[1], 10)
-        });
-      }
-    }
-    if (!sawElement) {
-      for (const itemMatch of block2.matchAll(PRIMER_ITEM_REGEX)) {
-        const question = unescapeXml(itemMatch[1].trim());
-        if (question)
-          primerCandidates.push({ question });
-      }
-    }
+  sanitized = sanitized.replace(/\/Users\/[^/]+\//g, "/Users/<USER>/");
+  sanitized = sanitized.replace(/\/home\/[^/]+\//g, "/home/<USER>/");
+  sanitized = sanitized.replace(/C:\\Users\\[^\\]+\\/g, "C:\\Users\\<USER>\\");
+  if (username) {
+    sanitized = sanitized.replace(new RegExp(escapeRegex2(username), "g"), "<USER>");
   }
-  const events = parseEvents(text3);
-  compartments.sort((a3, b) => a3.startMessage - b.startMessage);
-  return { compartments, facts, events, unprocessedFrom, userObservations, primerCandidates };
+  return sanitized;
 }
-function parseEvents(text3) {
-  const blockMatch = text3.match(EVENTS_BLOCK_REGEX);
-  if (!blockMatch)
-    return [];
-  const block2 = blockMatch[1];
-  const events = [];
-  for (const elMatch of block2.matchAll(EVENT_ELEMENT_REGEX)) {
-    const kind = elMatch[1];
-    const atRaw = parseInt(elMatch[2], 10);
-    const atCompartment = Number.isNaN(atRaw) ? null : atRaw;
-    const fields = {};
-    for (const fieldMatch of elMatch[3].matchAll(EVENT_FIELD_REGEX)) {
-      const name = fieldMatch[1];
-      const value = unescapeXml(fieldMatch[2].trim());
-      if (value)
-        fields[name] = value;
+function redactSecretText(value) {
+  let redacted = value;
+  for (const { pattern, replacement } of SECRET_TEXT_PATTERNS) {
+    if (typeof replacement === "string") {
+      redacted = redacted.replace(pattern, replacement);
+    } else {
+      redacted = redacted.replace(pattern, replacement);
     }
-    events.push({ kind, atCompartment, fields });
   }
-  return events;
+  return redacted;
 }
-function unescapeXml(s) {
-  return s.replace(/&amp;/g, "&").replace(/&apos;/g, "'").replace(/&quot;/g, '"').replace(/&lt;/g, "<").replace(/&gt;/g, ">");
+function sanitizeDiagnosticText(value) {
+  return redactSecretText(sanitizePathString(value));
 }
-var COMPARTMENT_REGEX, ATTR_START_REGEX, ATTR_END_REGEX, ATTR_TITLE_REGEX, ATTR_EPISODE_REGEX, ATTR_IMPORTANCE_REGEX, TIER_OPEN_REGEXES, TIER_CLOSE_ANY_REGEX, TIER_OPEN_ANY_REGEX, CATEGORY_BLOCK_REGEX, FACT_ITEM_REGEX, UNPROCESSED_REGEX, USER_OBSERVATIONS_REGEX, USER_OBS_ITEM_REGEX, PRIMER_CANDIDATES_REGEX, PRIMER_ELEMENT_REGEX, PRIMER_ITEM_REGEX, FACTS_BLOCK_REGEX, EVENTS_BLOCK_REGEX, EVENT_ELEMENT_REGEX, EVENT_FIELD_REGEX;
-var init_compartment_parser = __esm(() => {
-  COMPARTMENT_REGEX = /<compartment\s+([^>]*?)\s*>(.*?)<\/compartment>/gs;
-  ATTR_START_REGEX = /\bstart="(\d+)"/;
-  ATTR_END_REGEX = /\bend="(\d+)"/;
-  ATTR_TITLE_REGEX = /\btitle="([^"]*)"/;
-  ATTR_EPISODE_REGEX = /\bepisode_type="([^"]*)"/;
-  ATTR_IMPORTANCE_REGEX = /\bimportance="(\d+)"/;
-  TIER_OPEN_REGEXES = [
-    makeTierOpenRegex(1),
-    makeTierOpenRegex(2),
-    makeTierOpenRegex(3),
-    makeTierOpenRegex(4)
-  ];
-  TIER_CLOSE_ANY_REGEX = /<\/p\d/;
-  TIER_OPEN_ANY_REGEX = /<p\d/;
-  CATEGORY_BLOCK_REGEX = /<(PROJECT_RULES|ARCHITECTURE|CONSTRAINTS|CONFIG_VALUES|NAMING)>(.*?)<\/\1>/gs;
-  FACT_ITEM_REGEX = /^\s*\*\s*(.+)$/gm;
-  UNPROCESSED_REGEX = /<unprocessed_from>(\d+)<\/unprocessed_from>/;
-  USER_OBSERVATIONS_REGEX = /<user_observations>(.*?)<\/user_observations>/s;
+function sanitizeConfigValue(value, keyPath = []) {
+  if (value === null || typeof value === "number" || typeof value === "boolean")
+    return value;
+  const key = keyPath.at(-1) ?? "";
+  if (key && isSecretKey(key)) {
+    return `<REDACTED:${redactionTypeForKey(key)}>`;
+  }
+  if (typeof value === "string")
+    return sanitizeDiagnosticText(value);
+  if (Array.isArray(value)) {
+    return value.map((entry, index) => sanitizeConfigValue(entry, [...keyPath, String(index)]));
+  }
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).map(([entryKey, entry]) => [
+      entryKey,
+      sanitizeConfigValue(entry, [...keyPath, entryKey])
+    ]));
+  }
+  return value;
+}
+var SECRET_WORDS, SECRET_SEGMENT_PATTERN, TRAILING_DESCRIPTORS, SECRET_QUALIFIERS, SECRET_TEXT_PATTERNS;
+var init_redaction = __esm(() => {
+  SECRET_WORDS = [
+    "key",
+    "token",
+    "secret",
+    "password",
+    "auth",
+    "authorization",
+    "bearer",
+    "credential"
+  ];
+  SECRET_SEGMENT_PATTERN = new RegExp(`^(?:${SECRET_WORDS.map((w) => `${w}s?`).join("|")})$`, "i");
+  TRAILING_DESCRIPTORS = new Set(["id", "ids", "value", "values", "header", "headers"]);
+  SECRET_QUALIFIERS = new Set([
+    "api",
+    "access",
+    "private",
+    "client",
+    "auth",
+    "authorization",
+    "secret",
+    "bearer",
+    "session",
+    "refresh",
+    "service",
+    "x",
+    "openai",
+    "anthropic",
+    "google",
+    "github",
+    "huggingface",
+    "aws",
+    "azure"
+  ]);
+  SECRET_TEXT_PATTERNS = [
+    {
+      pattern: /\bsk-ant-(?:api03-)?[A-Za-z0-9_-]{32,}/g,
+      replacement: "<ANTHROPIC_API_KEY_REDACTED>"
+    },
+    {
+      pattern: /\bsk-(?:proj-)?[A-Za-z0-9_-]{32,}/g,
+      replacement: "<OPENAI_API_KEY_REDACTED>"
+    },
+    {
+      pattern: /\bgithub_pat_[A-Za-z0-9_]{20,}/g,
+      replacement: "<GITHUB_PAT_REDACTED>"
+    },
+    {
+      pattern: /\b(?:gh[opsu]|ghr)_[A-Za-z0-9]{30,}/g,
+      replacement: "<GITHUB_TOKEN_REDACTED>"
+    },
+    {
+      pattern: /\bhf_[A-Za-z0-9]{30,}/g,
+      replacement: "<HUGGINGFACE_TOKEN_REDACTED>"
+    },
+    {
+      pattern: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g,
+      replacement: "<AWS_ACCESS_KEY_ID_REDACTED>"
+    },
+    {
+      pattern: /\bxox[abprsuvc]-[A-Za-z0-9-]{10,}/g,
+      replacement: "<SLACK_TOKEN_REDACTED>"
+    },
+    {
+      pattern: /\bAIza[A-Za-z0-9_-]{35}\b/g,
+      replacement: "<GOOGLE_API_KEY_REDACTED>"
+    },
+    {
+      pattern: /\b(Authorization\s*:\s*Bearer\s+)([A-Za-z0-9._~+/=-]{8,})/gi,
+      replacement: (_full, prefix) => `${prefix}<REDACTED:bearer>`
+    },
+    {
+      pattern: /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
+      replacement: "<JWT_REDACTED>"
+    },
+    {
+      pattern: /(["'])([^"']*(?:key|token|secret|password|auth|bearer|credential)[^"']*)\1(\s*:\s*)(["'])([^"']*)\4/gi,
+      replacement: (full, quote, key, separator, valueQuote, value) => isNonSecretScalarValue(value) ? full : `${quote}${key}${quote}${separator}${valueQuote}<REDACTED:${redactionTypeForKey(key)}>${valueQuote}`
+    },
+    {
+      pattern: /\b([A-Za-z0-9_.-]*(?:key|token|secret|password|auth|bearer|credential)[A-Za-z0-9_.-]*)\s*=\s*([^\s'"`]+)/gi,
+      replacement: (full, key, value) => isNonSecretScalarValue(value) ? full : `${key}=<REDACTED:${redactionTypeForKey(key)}>`
+    }
+  ];
+});
+
+// ../plugin/src/features/magic-context/fail-closed-block.ts
+function attachFailClosedBlockingProcessEvidence(process3, evidence) {
+  Object.defineProperties(process3, {
+    startTime: { configurable: true, value: evidence.startTime },
+    commandLine: { configurable: true, value: evidence.commandLine }
+  });
+  return process3;
+}
+function normalizeFailClosedProcessKind(process3) {
+  switch (process3.kind) {
+    case "OpenCode server":
+    case "OpenCode instance (TUI/CLI)":
+    case "Pi":
+    case "process":
+      return process3.kind;
+  }
+  switch (process3.harness?.trim().toLowerCase()) {
+    case "opencode server":
+      return "OpenCode server";
+    case "opencode instance (tui/cli)":
+    case "opencode instance":
+      return "OpenCode instance (TUI/CLI)";
+    case "pi":
+    case "pi harness":
+    case "omp":
+      return "Pi";
+    default:
+      return "process";
+  }
+}
+function formatFailClosedProcessStartTime(startTime) {
+  if (!Number.isFinite(startTime) || startTime <= 0)
+    return "unverified";
+  try {
+    const parts = new Intl.DateTimeFormat("en-US", {
+      day: "numeric",
+      hour: "2-digit",
+      minute: "2-digit",
+      month: "short",
+      hour12: false
+    }).formatToParts(new Date(startTime));
+    const values = Object.fromEntries(parts.map(({ type, value }) => [type, value]));
+    if (!values.month || !values.day || !values.hour || !values.minute)
+      return "unverified";
+    return `${values.month} ${values.day} ${values.hour}:${values.minute}`;
+  } catch {
+    return "unverified";
+  }
+}
+function formatFailClosedCommandLine(commandLine) {
+  if (typeof commandLine !== "string" || commandLine.trim().length === 0)
+    return "unverified";
+  try {
+    const normalized = commandLine.replaceAll("\x00", " ").replace(/\s+/g, " ").trim();
+    if (normalized.length === 0)
+      return "unverified";
+    const sanitized = sanitizeDiagnosticText(normalized).trim();
+    if (sanitized.length === 0)
+      return "unverified";
+    return sanitized.length > MAX_FORMATTED_COMMAND_LINE_LENGTH ? `${sanitized.slice(0, MAX_FORMATTED_COMMAND_LINE_LENGTH - 3)}...` : sanitized;
+  } catch {
+    return "unverified";
+  }
+}
+function formatFailClosedBlockingProcesses(processes) {
+  const uniqueProcesses = new Map;
+  for (const process3 of processes) {
+    if (!Number.isInteger(process3.pid) || process3.pid <= 0)
+      continue;
+    const candidate = {
+      kind: normalizeFailClosedProcessKind(process3),
+      pid: process3.pid,
+      startTime: process3.startTime,
+      commandLine: process3.commandLine
+    };
+    const previous = uniqueProcesses.get(process3.pid);
+    if (!previous || previous.kind === "process" && candidate.kind !== "process") {
+      uniqueProcesses.set(process3.pid, candidate);
+    } else {
+      uniqueProcesses.set(process3.pid, {
+        ...previous,
+        startTime: previous.startTime ?? candidate.startTime,
+        commandLine: previous.commandLine ?? candidate.commandLine
+      });
+    }
+  }
+  const entries = [...uniqueProcesses.values()];
+  const visible = entries.slice(0, MAX_FORMATTED_BLOCKING_PROCESSES);
+  const rendered = visible.map(({ kind, pid }) => `${kind} (PID ${pid})`);
+  const omitted = entries.length - visible.length;
+  if (omitted > 0)
+    rendered.push(`${omitted} more blocking process(es)`);
+  if (rendered.length === 0)
+    return "a live process";
+  const summary = rendered.length === 1 ? rendered[0] : `${rendered.slice(0, -1).join(", ")}, and ${rendered.at(-1)}`;
+  const evidence = entries.map(({ kind, pid, startTime, commandLine }) => `- PID ${pid}: ${kind}, started ${formatFailClosedProcessStartTime(startTime)}, cmd: ${formatFailClosedCommandLine(commandLine)}`).join(`
+`);
+  return `${summary}
+Blocking process evidence:
+${evidence}`;
+}
+function formatFailClosedBlockingMessage(reason) {
+  if (reason.kind === "migration_guard") {
+    if (reason.unreadableFile) {
+      const arm = reason.unreadableArm ?? "io";
+      const recovery = arm === "io" ? `If none of these processes are running, it is safe to delete ${reason.unreadableFile} and retry.` : `The file may be a recent incomplete write; retry after the file is older than the ten-minute grace window, or stop the relevant process before deleting it.`;
+      return [
+        `Magic Context cannot migrate the shared database because RPC discovery file ${reason.unreadableFile} is uncertain (${arm} arm), so the absence of a live process cannot be proven.`,
+        recovery,
+        `Recovery: ${FAIL_CLOSED_DOCTOR_COMMAND}`
+      ].join(" ");
+    }
+    return [
+      `Magic Context cannot migrate the shared database because ${formatFailClosedBlockingProcesses(reason.blockingProcesses)} may be running an older Magic Context build that would fail against the migrated database.`,
+      "Restart the blocking process (it will pick up the new build and migrate on start), or shut it down and retry.",
+      `Recovery: ${FAIL_CLOSED_DOCTOR_COMMAND}`
+    ].join(" ");
+  }
+  if (reason.kind === "schema_fence") {
+    return [
+      `Magic Context cannot operate: this Magic Context build is older than the database; upgrade/restart this harness (upstream migration lane v${reason.persistedVersion}, build supports through v${reason.supportedVersion}).`,
+      `Recovery: ${FAIL_CLOSED_DOCTOR_COMMAND}`
+    ].join(" ");
+  }
+  const cause = reason.cause.trim().length > 0 ? reason.cause.trim() : "unknown storage error";
+  return [
+    `Magic Context cannot operate: persistent storage failed (${cause}).`,
+    "The plugin will not silently degrade to native compaction while enabled.",
+    `Recovery: ${FAIL_CLOSED_DOCTOR_COMMAND}`
+  ].join(" ");
+}
+var FAIL_CLOSED_DOCTOR_COMMAND = "npx @cortexkit/magic-context@latest doctor", OPENCODE_INTERNAL_AGENT_NAMES, MAX_FORMATTED_BLOCKING_PROCESSES = 8, MAX_FORMATTED_COMMAND_LINE_LENGTH = 80;
+var init_fail_closed_block = __esm(() => {
+  init_redaction();
+  OPENCODE_INTERNAL_AGENT_NAMES = new Set(["title", "summary", "compaction"]);
+});
+
+// ../plugin/src/hooks/magic-context/compartment-parser.ts
+function makeTierOpenRegex(n2) {
+  return new RegExp(`<p${n2}\\s*(/?)>`);
+}
+function extractTier(inner, index) {
+  const openMatch = TIER_OPEN_REGEXES[index].exec(inner);
+  if (!openMatch)
+    return;
+  if (openMatch[1] === "/")
+    return "";
+  const rest = inner.slice(openMatch.index + openMatch[0].length);
+  const closeAt = rest.search(TIER_CLOSE_ANY_REGEX);
+  let body = closeAt === -1 ? rest : rest.slice(0, closeAt);
+  const openInside = body.search(TIER_OPEN_ANY_REGEX);
+  if (openInside !== -1)
+    body = body.slice(0, openInside);
+  return unescapeXml(body.trim());
+}
+function extractTiersFromInner(inner) {
+  return {
+    p1: extractTier(inner, 0),
+    p2: extractTier(inner, 1),
+    p3: extractTier(inner, 2),
+    p4: extractTier(inner, 3)
+  };
+}
+function parseCompartmentOutput(text3) {
+  const compartments = [];
+  const facts = [];
+  for (const match of text3.matchAll(COMPARTMENT_REGEX)) {
+    const attrs = match[1];
+    const inner = match[2];
+    const startMatch = attrs.match(ATTR_START_REGEX);
+    const endMatch = attrs.match(ATTR_END_REGEX);
+    const titleMatch = attrs.match(ATTR_TITLE_REGEX);
+    if (!startMatch || !endMatch || !titleMatch)
+      continue;
+    const startMessage = parseInt(startMatch[1], 10);
+    const endMessage = parseInt(endMatch[1], 10);
+    const title = unescapeXml(titleMatch[1]);
+    if (Number.isNaN(startMessage) || Number.isNaN(endMessage) || !title)
+      continue;
+    const episodeMatch = attrs.match(ATTR_EPISODE_REGEX);
+    const importanceMatch = attrs.match(ATTR_IMPORTANCE_REGEX);
+    const episodeType = episodeMatch ? unescapeXml(episodeMatch[1]) : undefined;
+    const importance = importanceMatch ? parseInt(importanceMatch[1], 10) : undefined;
+    const p1 = extractTier(inner, 0);
+    if (typeof p1 === "string" && p1.length > 0) {
+      const p2 = extractTier(inner, 1);
+      const p3 = extractTier(inner, 2);
+      const p4 = extractTier(inner, 3);
+      compartments.push({
+        startMessage,
+        endMessage,
+        title,
+        content: p1,
+        p1,
+        p2: typeof p2 === "string" ? p2 : p1,
+        p3: typeof p3 === "string" ? p3 : typeof p2 === "string" ? p2 : p1,
+        p4: typeof p4 === "string" ? p4 : "",
+        importance,
+        episodeType
+      });
+      continue;
+    }
+    const content = unescapeXml(inner.trim());
+    if (content) {
+      compartments.push({
+        startMessage,
+        endMessage,
+        title,
+        content,
+        importance,
+        episodeType
+      });
+    }
+  }
+  const factsBlockMatch = text3.match(FACTS_BLOCK_REGEX);
+  const factsScope = factsBlockMatch ? factsBlockMatch[1] : text3.replace(EVENTS_BLOCK_REGEX, "").replace(/<compartment\s+[^>]*?\s*>.*?<\/compartment>/gs, "");
+  for (const categoryMatch of factsScope.matchAll(CATEGORY_BLOCK_REGEX)) {
+    const category = categoryMatch[1];
+    const blockContent = categoryMatch[2];
+    for (const itemMatch of blockContent.matchAll(FACT_ITEM_REGEX)) {
+      const content = unescapeXml(itemMatch[1].trim());
+      if (content) {
+        facts.push({ category, content });
+      }
+    }
+  }
+  const unprocessedMatch = text3.match(UNPROCESSED_REGEX);
+  const unprocessedFrom = unprocessedMatch ? parseInt(unprocessedMatch[1], 10) : null;
+  const userObservations = [];
+  const userObsMatch = text3.match(USER_OBSERVATIONS_REGEX);
+  if (userObsMatch) {
+    for (const itemMatch of userObsMatch[1].matchAll(USER_OBS_ITEM_REGEX)) {
+      const obs = unescapeXml(itemMatch[1].trim());
+      if (obs)
+        userObservations.push(obs);
+    }
+  }
+  const primerCandidates = [];
+  const primerMatch = text3.match(PRIMER_CANDIDATES_REGEX);
+  if (primerMatch) {
+    const block2 = primerMatch[1];
+    let sawElement = false;
+    for (const el of block2.matchAll(PRIMER_ELEMENT_REGEX)) {
+      sawElement = true;
+      const question = unescapeXml(el[2].trim());
+      if (question) {
+        primerCandidates.push({
+          question,
+          originCompartmentIndex: Number.parseInt(el[1], 10)
+        });
+      }
+    }
+    if (!sawElement) {
+      for (const itemMatch of block2.matchAll(PRIMER_ITEM_REGEX)) {
+        const question = unescapeXml(itemMatch[1].trim());
+        if (question)
+          primerCandidates.push({ question });
+      }
+    }
+  }
+  const events = parseEvents(text3);
+  compartments.sort((a3, b) => a3.startMessage - b.startMessage);
+  return { compartments, facts, events, unprocessedFrom, userObservations, primerCandidates };
+}
+function parseEvents(text3) {
+  const blockMatch = text3.match(EVENTS_BLOCK_REGEX);
+  if (!blockMatch)
+    return [];
+  const block2 = blockMatch[1];
+  const events = [];
+  for (const elMatch of block2.matchAll(EVENT_ELEMENT_REGEX)) {
+    const kind = elMatch[1];
+    const atRaw = parseInt(elMatch[2], 10);
+    const atCompartment = Number.isNaN(atRaw) ? null : atRaw;
+    const fields = {};
+    for (const fieldMatch of elMatch[3].matchAll(EVENT_FIELD_REGEX)) {
+      const name = fieldMatch[1];
+      const value = unescapeXml(fieldMatch[2].trim());
+      if (value)
+        fields[name] = value;
+    }
+    events.push({ kind, atCompartment, fields });
+  }
+  return events;
+}
+function unescapeXml(s) {
+  return s.replace(/&amp;/g, "&").replace(/&apos;/g, "'").replace(/&quot;/g, '"').replace(/&lt;/g, "<").replace(/&gt;/g, ">");
+}
+var COMPARTMENT_REGEX, ATTR_START_REGEX, ATTR_END_REGEX, ATTR_TITLE_REGEX, ATTR_EPISODE_REGEX, ATTR_IMPORTANCE_REGEX, TIER_OPEN_REGEXES, TIER_CLOSE_ANY_REGEX, TIER_OPEN_ANY_REGEX, CATEGORY_BLOCK_REGEX, FACT_ITEM_REGEX, UNPROCESSED_REGEX, USER_OBSERVATIONS_REGEX, USER_OBS_ITEM_REGEX, PRIMER_CANDIDATES_REGEX, PRIMER_ELEMENT_REGEX, PRIMER_ITEM_REGEX, FACTS_BLOCK_REGEX, EVENTS_BLOCK_REGEX, EVENT_ELEMENT_REGEX, EVENT_FIELD_REGEX;
+var init_compartment_parser = __esm(() => {
+  COMPARTMENT_REGEX = /<compartment\s+([^>]*?)\s*>(.*?)<\/compartment>/gs;
+  ATTR_START_REGEX = /\bstart="(\d+)"/;
+  ATTR_END_REGEX = /\bend="(\d+)"/;
+  ATTR_TITLE_REGEX = /\btitle="([^"]*)"/;
+  ATTR_EPISODE_REGEX = /\bepisode_type="([^"]*)"/;
+  ATTR_IMPORTANCE_REGEX = /\bimportance="(\d+)"/;
+  TIER_OPEN_REGEXES = [
+    makeTierOpenRegex(1),
+    makeTierOpenRegex(2),
+    makeTierOpenRegex(3),
+    makeTierOpenRegex(4)
+  ];
+  TIER_CLOSE_ANY_REGEX = /<\/p\d/;
+  TIER_OPEN_ANY_REGEX = /<p\d/;
+  CATEGORY_BLOCK_REGEX = /<(PROJECT_RULES|ARCHITECTURE|CONSTRAINTS|CONFIG_VALUES|NAMING)>(.*?)<\/\1>/gs;
+  FACT_ITEM_REGEX = /^\s*\*\s*(.+)$/gm;
+  UNPROCESSED_REGEX = /<unprocessed_from>(\d+)<\/unprocessed_from>/;
+  USER_OBSERVATIONS_REGEX = /<user_observations>(.*?)<\/user_observations>/s;
   USER_OBS_ITEM_REGEX = /^\s*\*\s*(.+)$/gm;
   PRIMER_CANDIDATES_REGEX = /<primer_candidates>(.*?)<\/primer_candidates>/s;
   PRIMER_ELEMENT_REGEX = /<primer\s+at_compartment="(\d+)"\s*>(.*?)<\/primer>/gs;
@@ -38100,8 +38545,8 @@ function classifyDiscoveryRecordKind(record2) {
   }
   return null;
 }
-function classifyRpcProcess(record2) {
-  return classifyDiscoveryRecordKind(record2) ?? classifyProcessKind(readProcessCommand(record2.pid));
+function classifyRpcProcess(record2, commandLine) {
+  return classifyDiscoveryRecordKind(record2) ?? classifyProcessKind(commandLine === undefined ? readProcessProbeEvidence(record2.pid).commandLine : commandLine);
 }
 function classifyJunkDiscovery(portFile, raw, staleFiles) {
   let mtimeMs;
@@ -38178,18 +38623,23 @@ function inspectRpcServerDiscovery(storageDir) {
       continue;
     }
     const liveness = isPidAlive(record2.pid);
-    const identity = liveness === "dead" ? "implausible" : isPidIdentityPlausible(record2);
-    if (liveness === "alive" && identity === "plausible") {
+    if (liveness === "dead") {
+      staleFiles.push(portFile);
+      continue;
+    }
+    const evidence = readProcessProbeEvidence(record2.pid);
+    const identity = isPidIdentityPlausible(record2, evidence);
+    if (identity === "plausible") {
       pids.add(record2.pid);
-      const detected = {
-        kind: classifyRpcProcess(record2),
+      const detected = attachFailClosedBlockingProcessEvidence({
+        kind: classifyRpcProcess(record2, evidence.commandLine),
         pid: record2.pid
-      };
+      }, evidence);
       const previous = processByPid.get(record2.pid);
       if (!previous || previous.kind === "process" && detected.kind !== "process") {
         processByPid.set(record2.pid, detected);
       }
-    } else if (liveness === "dead" || identity === "implausible") {
+    } else if (identity === "implausible") {
       staleFiles.push(portFile);
     } else {
       inconclusivePids.add(record2.pid);
@@ -38222,10 +38672,14 @@ function inspectRpcServerDiscovery(storageDir) {
   }
   return { state: "stale", serverPids: [], staleFiles };
 }
+function createPiBlockingProcess(pid) {
+  return attachFailClosedBlockingProcessEvidence({ kind: "Pi", pid }, readProcessProbeEvidence(pid));
+}
 function getLiveMigrationBlockingProcesses(storageDir) {
   const discovery = inspectRpcServerDiscovery(storageDir);
   const openCode = discovery.state === "live" ? discovery.serverProcesses ?? [] : [];
-  const pi = discoverLivePiProcessIds().map((pid) => ({ kind: "Pi", pid }));
+  const piDiscovery = inspectLivePiProcesses();
+  const pi = piDiscovery.processIds.map(createPiBlockingProcess);
   return [...openCode, ...pi];
 }
 function applySqliteTuningPragmas(db) {
@@ -39359,6 +39813,7 @@ var init_storage_db = __esm(async () => {
   init_data_path();
   init_logger();
   init_rpc_utils();
+  init_fail_closed_block();
   init_migrations();
   init_tool_definition_tokens();
   init_tool_owner_backfill();
@@ -40508,11 +40963,11 @@ var init_doctor_repair_db = __esm(async () => {
 });
 
 // src/lib/migration-paths.ts
-import { homedir as homedir12 } from "node:os";
+import { homedir as homedir13 } from "node:os";
 import { join as join18 } from "node:path";
 function getOpenCodeDatabasePath() {
   const dataHome = process.env.XDG_DATA_HOME?.trim();
-  return join18(dataHome || join18(homedir12(), ".local", "share"), "opencode", "opencode.db");
+  return join18(dataHome || join18(homedir13(), ".local", "share"), "opencode", "opencode.db");
 }
 function projectPathToPiSessionSlug(projectPath, platform = process.platform) {
   const separators = platform === "win32" ? /[:\\/]+/g : /\/+/g;
@@ -41487,7 +41942,7 @@ __export(exports_migrate_session, {
   runMigrateSessionCli: () => runMigrateSessionCli
 });
 import { existsSync as existsSync23, realpathSync as realpathSync4 } from "node:fs";
-import { homedir as homedir13 } from "node:os";
+import { homedir as homedir14 } from "node:os";
 import path4, { join as join20 } from "node:path";
 function existingSessionColumns(db) {
   const rows = db.prepare("PRAGMA table_info(session)").all();
@@ -41783,7 +42238,7 @@ async function runMigrateSessionCli(args) {
     printMigrateSessionHelp();
     return 1;
   }
-  const expandedTo = toDir.startsWith("~") ? join20(homedir13(), toDir.slice(1).replace(/^[/\\]/, "")) : toDir;
+  const expandedTo = toDir.startsWith("~") ? join20(homedir14(), toDir.slice(1).replace(/^[/\\]/, "")) : toDir;
   if (!existsSync23(expandedTo)) {
     console.error(`Target directory does not exist: ${expandedTo}`);
     return 1;
@@ -42370,38 +42825,45 @@ function loadPiConfig(opts = {}) {
   } else if (legacyProjectUnmigrated) {
     warnings.push("[project config] legacy Magic Context config exists but the shared CortexKit config is absent; embedding registration is paused until config migration completes.");
   }
-  let rawConfig = {};
   const mergeFiles = [...loadedFiles].sort((a3, b) => {
     if (a3.scope === b.scope)
       return 0;
     return a3.scope === "user" ? -1 : 1;
   });
-  const userRaw = mergeFiles.find((f) => f.scope === "user")?.config;
-  const trustedBaseConfig = parsePiConfig(userRaw ?? {}).config;
+  const userRaw = mergeFiles.find((f) => f.scope === "user")?.config ?? {};
+  const projectLoaded = mergeFiles.find((f) => f.scope === "project");
+  let projectRaw = {};
   for (const loaded of mergeFiles) {
     const prefix = loaded.scope === "user" ? "[user config]" : "[project config]";
     warnings.push(...loaded.warnings.map((warning) => `${prefix} ${warning}`));
-    if (loaded.scope === "project") {
-      const projectRaw = { ...loaded.config };
-      for (const warning of stripUnsafeProjectConfigFields(projectRaw)) {
-        warnings.push(`${prefix} ${warning}`);
-      }
-      rawConfig = mergeRawConfigs(rawConfig, projectRaw);
-      for (const warning of dropInheritedEmbeddingKeyOnRedirect(projectRaw, rawConfig, userRaw)) {
-        warnings.push(`${prefix} ${warning}`);
-      }
-      for (const warning of constrainProjectThresholdOverrides({
-        mergedRaw: rawConfig,
-        projectRaw,
-        trustedBaseConfig
-      })) {
-        warnings.push(`${prefix} ${warning}`);
-      }
-    } else {
-      rawConfig = mergeRawConfigs(rawConfig, loaded.config);
+    if (loaded.scope !== "project")
+      continue;
+    projectRaw = { ...loaded.config };
+    for (const warning of stripUnsafeProjectConfigFields(projectRaw)) {
+      warnings.push(`${prefix} ${warning}`);
+    }
+  }
+  const profileResolution = resolveConfigProfile({ userRaw, projectRaw });
+  warnings.push(...profileResolution.warnings.map((warning) => `[config] ${warning}`));
+  const trustedProfiledRaw = mergeRawConfigs(profileResolution.userBase, profileResolution.overlay);
+  let rawConfig = trustedProfiledRaw;
+  const trustedBaseConfig = parsePiConfig(trustedProfiledRaw).config;
+  if (projectLoaded) {
+    rawConfig = mergeRawConfigs(rawConfig, profileResolution.projectBase);
+    for (const warning of dropInheritedEmbeddingKeyOnRedirect(projectRaw, rawConfig, profileResolution.userBase)) {
+      warnings.push(`[project config] ${warning}`);
+    }
+    for (const warning of constrainProjectThresholdOverrides({
+      mergedRaw: rawConfig,
+      projectRaw: profileResolution.projectBase,
+      trustedBaseConfig
+    })) {
+      warnings.push(`[project config] ${warning}`);
     }
   }
   const parsed = parsePiConfig(rawConfig);
+  if (profileResolution.activeProfile)
+    parsed.config.profile = profileResolution.activeProfile;
   setOutputReserveConfig(parsed.config.output_reserve);
   setWindowOverlayPath(parsed.config.models?.window_overlay_path);
   warnings.push(...parsed.warnings.map((warning) => `[merged config] ${warning}`));
@@ -42417,6 +42879,7 @@ var init_config2 = __esm(() => {
   init_migrate_config_location();
   init_agent_disable();
   init_migrate_dreamer_v2();
+  init_profiles();
   init_project_security();
   init_raw_loader();
   init_magic_context();
@@ -42433,191 +42896,90 @@ function formatDatabaseRepairGuidance(dbPath) {
 }
 var DATABASE_REPAIR_COMMAND = "bunx @cortexkit/magic-context@latest doctor repair-db";
 
-// ../plugin/src/shared/redaction.ts
-import { homedir as homedir14, userInfo } from "node:os";
-function escapeRegex2(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function redactionTypeForKey(key) {
-  const normalized = key.trim().toLowerCase().replace(/[^a-z0-9_.-]+/g, "_");
-  const suffix = normalized.split(".").filter(Boolean).at(-1) ?? normalized;
-  return suffix || "secret";
-}
-function isNonSecretScalarValue(value) {
-  const v = value.trim();
-  if (v === "true" || v === "false" || v === "null" || v === "undefined")
-    return true;
-  return /^[+-]?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?$/.test(v);
-}
-function isSecretKey(key) {
-  const segments = key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().split(/[._-]+/).filter(Boolean);
-  if (segments.length === 0)
-    return false;
-  if (segments.length === 1) {
-    const first = segments[0];
-    return Boolean(first && SECRET_SEGMENT_PATTERN.test(first));
-  }
-  for (let i2 = 0;i2 < segments.length; i2++) {
-    const seg = segments[i2];
-    if (!seg || !SECRET_SEGMENT_PATTERN.test(seg))
-      continue;
-    let trailingOk = true;
-    for (let j = i2 + 1;j < segments.length; j++) {
-      const tail = segments[j];
-      if (!tail)
-        continue;
-      if (TRAILING_DESCRIPTORS.has(tail))
-        continue;
-      if (SECRET_SEGMENT_PATTERN.test(tail))
-        continue;
-      trailingOk = false;
-      break;
-    }
-    if (!trailingOk)
-      continue;
-    for (let k = i2 - 1;k >= 0; k--) {
-      const lead = segments[k];
-      if (lead && SECRET_QUALIFIERS.has(lead))
-        return true;
-    }
+// src/lib/github-issue.ts
+import { spawnSync as spawnSync4 } from "node:child_process";
+import { readFileSync as readFileSync14 } from "node:fs";
+function runGhCommand(args) {
+  try {
+    const result = spawnSync4("gh", args, {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    return {
+      status: result.status,
+      stdout: String(result.stdout ?? ""),
+      stderr: String(result.stderr ?? "")
+    };
+  } catch (error51) {
+    return {
+      status: null,
+      stdout: "",
+      stderr: error51 instanceof Error ? error51.message : String(error51)
+    };
   }
-  return false;
 }
-function sanitizePathString(value) {
-  const home = homedir14();
-  const username = userInfo().username;
-  let sanitized = value;
-  if (home) {
-    sanitized = sanitized.replace(new RegExp(escapeRegex2(home), "g"), "~");
-  }
-  sanitized = sanitized.replace(/\/Users\/[^/]+\//g, "/Users/<USER>/");
-  sanitized = sanitized.replace(/\/home\/[^/]+\//g, "/home/<USER>/");
-  sanitized = sanitized.replace(/C:\\Users\\[^\\]+\\/g, "C:\\Users\\<USER>\\");
-  if (username) {
-    sanitized = sanitized.replace(new RegExp(escapeRegex2(username), "g"), "<USER>");
-  }
-  return sanitized;
+function failed(result) {
+  return result.status !== 0;
 }
-function redactSecretText(value) {
-  let redacted = value;
-  for (const { pattern, replacement } of SECRET_TEXT_PATTERNS) {
-    if (typeof replacement === "string") {
-      redacted = redacted.replace(pattern, replacement);
-    } else {
-      redacted = redacted.replace(pattern, replacement);
-    }
+function submitGithubIssue(title, bodyPath, runner = runGhCommand) {
+  let body;
+  try {
+    body = readFileSync14(bodyPath, "utf-8");
+  } catch (error51) {
+    return {
+      ok: false,
+      reason: "body-unreadable",
+      message: `The diagnostics file could not be read (${error51 instanceof Error ? error51.message : String(error51)}).`
+    };
   }
-  return redacted;
-}
-function sanitizeDiagnosticText(value) {
-  return redactSecretText(sanitizePathString(value));
-}
-function sanitizeConfigValue(value, keyPath = []) {
-  if (value === null || typeof value === "number" || typeof value === "boolean")
-    return value;
-  const key = keyPath.at(-1) ?? "";
-  if (key && isSecretKey(key)) {
-    return `<REDACTED:${redactionTypeForKey(key)}>`;
+  if (Array.from(body).length > MAX_GITHUB_ISSUE_BODY_CHARS || Buffer.byteLength(body, "utf8") > MAX_GITHUB_ISSUE_BODY_CHARS) {
+    return {
+      ok: false,
+      reason: "body-too-large",
+      message: `The GitHub issue body is larger than GitHub's ${MAX_GITHUB_ISSUE_BODY_CHARS.toLocaleString()}-character limit.`
+    };
   }
-  if (typeof value === "string")
-    return sanitizeDiagnosticText(value);
-  if (Array.isArray(value)) {
-    return value.map((entry, index) => sanitizeConfigValue(entry, [...keyPath, String(index)]));
+  const installed = runner(["--version"]);
+  if (failed(installed)) {
+    return {
+      ok: false,
+      reason: "gh-not-installed",
+      message: "The GitHub CLI (gh) is not installed or could not be started."
+    };
   }
-  if (value && typeof value === "object") {
-    return Object.fromEntries(Object.entries(value).map(([entryKey, entry]) => [
-      entryKey,
-      sanitizeConfigValue(entry, [...keyPath, entryKey])
-    ]));
+  const auth = runner(["auth", "status", "--hostname", "github.com"]);
+  if (failed(auth)) {
+    return {
+      ok: false,
+      reason: "not-authenticated",
+      message: "gh is not authenticated. Run `gh auth login` before submitting an issue."
+    };
   }
-  return value;
-}
-var SECRET_WORDS, SECRET_SEGMENT_PATTERN, TRAILING_DESCRIPTORS, SECRET_QUALIFIERS, SECRET_TEXT_PATTERNS;
-var init_redaction = __esm(() => {
-  SECRET_WORDS = [
-    "key",
-    "token",
-    "secret",
-    "password",
-    "auth",
-    "authorization",
-    "bearer",
-    "credential"
-  ];
-  SECRET_SEGMENT_PATTERN = new RegExp(`^(?:${SECRET_WORDS.map((w) => `${w}s?`).join("|")})$`, "i");
-  TRAILING_DESCRIPTORS = new Set(["id", "ids", "value", "values", "header", "headers"]);
-  SECRET_QUALIFIERS = new Set([
-    "api",
-    "access",
-    "private",
-    "client",
-    "auth",
-    "authorization",
-    "secret",
-    "bearer",
-    "session",
-    "refresh",
-    "service",
-    "x",
-    "openai",
-    "anthropic",
-    "google",
-    "github",
-    "huggingface",
-    "aws",
-    "azure"
+  const result = runner([
+    "issue",
+    "create",
+    "-R",
+    "cortexkit/magic-context",
+    "--title",
+    title,
+    "--body-file",
+    bodyPath
   ]);
-  SECRET_TEXT_PATTERNS = [
-    {
-      pattern: /\bsk-ant-(?:api03-)?[A-Za-z0-9_-]{32,}/g,
-      replacement: "<ANTHROPIC_API_KEY_REDACTED>"
-    },
-    {
-      pattern: /\bsk-(?:proj-)?[A-Za-z0-9_-]{32,}/g,
-      replacement: "<OPENAI_API_KEY_REDACTED>"
-    },
-    {
-      pattern: /\bgithub_pat_[A-Za-z0-9_]{20,}/g,
-      replacement: "<GITHUB_PAT_REDACTED>"
-    },
-    {
-      pattern: /\b(?:gh[opsu]|ghr)_[A-Za-z0-9]{30,}/g,
-      replacement: "<GITHUB_TOKEN_REDACTED>"
-    },
-    {
-      pattern: /\bhf_[A-Za-z0-9]{30,}/g,
-      replacement: "<HUGGINGFACE_TOKEN_REDACTED>"
-    },
-    {
-      pattern: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g,
-      replacement: "<AWS_ACCESS_KEY_ID_REDACTED>"
-    },
-    {
-      pattern: /\bxox[abprsuvc]-[A-Za-z0-9-]{10,}/g,
-      replacement: "<SLACK_TOKEN_REDACTED>"
-    },
-    {
-      pattern: /\bAIza[A-Za-z0-9_-]{35}\b/g,
-      replacement: "<GOOGLE_API_KEY_REDACTED>"
-    },
-    {
-      pattern: /\b(Authorization\s*:\s*Bearer\s+)([A-Za-z0-9._~+/=-]{8,})/gi,
-      replacement: (_full, prefix) => `${prefix}<REDACTED:bearer>`
-    },
-    {
-      pattern: /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
-      replacement: "<JWT_REDACTED>"
-    },
-    {
-      pattern: /(["'])([^"']*(?:key|token|secret|password|auth|bearer|credential)[^"']*)\1(\s*:\s*)(["'])([^"']*)\4/gi,
-      replacement: (full, quote, key, separator, valueQuote, value) => isNonSecretScalarValue(value) ? full : `${quote}${key}${quote}${separator}${valueQuote}<REDACTED:${redactionTypeForKey(key)}>${valueQuote}`
-    },
-    {
-      pattern: /\b([A-Za-z0-9_.-]*(?:key|token|secret|password|auth|bearer|credential)[A-Za-z0-9_.-]*)\s*=\s*([^\s'"`]+)/gi,
-      replacement: (full, key, value) => isNonSecretScalarValue(value) ? full : `${key}=<REDACTED:${redactionTypeForKey(key)}>`
-    }
-  ];
-});
+  if (result.status === 0) {
+    return { ok: true, output: result.stdout.trim() };
+  }
+  const details = result.stderr.trim() || result.stdout.trim();
+  return {
+    ok: false,
+    reason: "create-failed",
+    message: details ? `GitHub issue creation failed: ${details}` : "GitHub issue creation failed: gh returned a non-zero status."
+  };
+}
+function formatGithubIssueFallback(submission, fallbackPath) {
+  return `${submission.message} The sanitized diagnostics are saved at ${fallbackPath}; open https://github.com/cortexkit/magic-context/issues/new and drag that file into the issue before submitting manually.`;
+}
+var MAX_GITHUB_ISSUE_BODY_CHARS = 65536;
+var init_github_issue = () => {};
 
 // src/lib/redaction.ts
 function sanitizeDiagnosticEndpoint(value) {
@@ -42642,8 +43004,8 @@ var init_redaction2 = __esm(() => {
 });
 
 // src/commands/doctor-omp.ts
-import { execFileSync as execFileSync5, spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync25, mkdirSync as mkdirSync9, readFileSync as readFileSync14 } from "node:fs";
+import { execFileSync as execFileSync5, spawnSync as spawnSync5 } from "node:child_process";
+import { existsSync as existsSync25, mkdirSync as mkdirSync9, readFileSync as readFileSync15 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
 import { dirname as dirname14, join as join21, resolve as resolve6 } from "node:path";
 function parseSemver(value) {
@@ -42690,7 +43052,7 @@ function readConfig2(path6) {
   if (!existsSync25(path6))
     return {};
   try {
-    const parsed = import_comment_json8.parse(readFileSync14(path6, "utf-8"));
+    const parsed = import_comment_json8.parse(readFileSync15(path6, "utf-8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? {} : { error: "top level is not an object" };
   } catch (error51) {
     return { error: error51 instanceof Error ? error51.message : String(error51) };
@@ -42700,7 +43062,7 @@ function pluginDeclaresOmp(path6) {
   if (!path6)
     return null;
   try {
-    const pkg = JSON.parse(readFileSync14(join21(path6, "package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync15(join21(path6, "package.json"), "utf-8"));
     return Array.isArray(pkg.omp?.extensions) || Array.isArray(pkg.pi?.extensions);
   } catch {
     return null;
@@ -42889,6 +43251,33 @@ async function repair(plan, deps, prompts, cwd) {
 function timestamp2(date5) {
   return date5.toISOString().replace(/[-:]/g, "").replace(/\.\d{3}Z$/, "Z");
 }
+function runGhCommandWithDeps(deps, args) {
+  if (args[0] === "issue") {
+    const result = deps.spawnSync("gh", args, {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    return {
+      status: result.status,
+      stdout: String(result.stdout ?? ""),
+      stderr: String(result.stderr ?? "")
+    };
+  }
+  try {
+    const output = deps.execFileSync("gh", args, {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    return { status: 0, stdout: String(output ?? ""), stderr: "" };
+  } catch (error51) {
+    const result = error51;
+    return {
+      status: typeof result.status === "number" ? result.status : 1,
+      stdout: String(result.stdout ?? ""),
+      stderr: String(result.stderr ?? "")
+    };
+  }
+}
 async function runIssueFlow(options) {
   const title = await options.prompts.text("Issue title", {
     placeholder: "Short summary of the OMP problem",
@@ -42912,34 +43301,15 @@ async function runIssueFlow(options) {
   writeFileAtomic(path6, `${body}
 `);
   options.prompts.log.success(`Sanitized report written to ${path6}`);
-  try {
-    options.deps.execFileSync("gh", ["--version"], { stdio: "ignore" });
-  } catch {
-    options.prompts.log.info("gh CLI unavailable; submit the generated report manually");
-    return 0;
-  }
-  try {
-    options.deps.execFileSync("gh", ["auth", "status"], { stdio: "ignore" });
-  } catch {
-    options.prompts.log.info("gh CLI is installed but not authenticated; submit the generated report manually");
-    return 0;
-  }
   if (await options.prompts.confirm("Submit this issue on GitHub now?", false)) {
-    const result = options.deps.spawnSync("gh", [
-      "issue",
-      "create",
-      "-R",
-      "cortexkit/magic-context",
-      "--title",
-      `[omp] ${title}`,
-      "--body-file",
-      path6
-    ], { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] });
-    if (result.status === 0)
-      options.prompts.log.success(String(result.stdout).trim());
-    else
-      options.prompts.log.warn(String(result.stderr).trim());
+    const result = submitGithubIssue(`[omp] ${title}`, path6, (args) => runGhCommandWithDeps(options.deps, args));
+    if (result.ok) {
+      options.prompts.log.success(result.output);
+    } else {
+      options.prompts.log.warn(formatGithubIssueFallback(result, path6));
+    }
   }
+  options.prompts.log.info(`Open https://github.com/cortexkit/magic-context/issues/new and drag ${path6} into the issue`);
   return 0;
 }
 async function runDoctor(options = {}) {
@@ -42979,6 +43349,7 @@ var init_doctor_omp = __esm(async () => {
   init_omp();
   init_atomic_write();
   init_config_location_migration();
+  init_github_issue();
   init_omp_helpers();
   init_paths();
   init_prompts();
@@ -42995,7 +43366,7 @@ var init_doctor_omp = __esm(async () => {
     openExistingContextDatabase,
     now: () => new Date,
     execFileSync: execFileSync5,
-    spawnSync: spawnSync4
+    spawnSync: spawnSync5
   };
 });
 
@@ -43115,7 +43486,7 @@ import {
   chmodSync as chmodSync4,
   existsSync as existsSync26,
   mkdirSync as mkdirSync10,
-  readFileSync as readFileSync15,
+  readFileSync as readFileSync16,
   renameSync as renameSync6,
   statSync as statSync10,
   writeFileSync as writeFileSync7
@@ -43174,7 +43545,7 @@ function ensureTuiPluginEntry(options = {}) {
     const configPath = resolveTuiConfigPath(options.configDir);
     let config2 = {};
     if (existsSync26(configPath)) {
-      const raw = readFileSync15(configPath, "utf-8");
+      const raw = readFileSync16(configPath, "utf-8");
       config2 = import_comment_json9.parse(raw) ?? {};
     }
     const plugins = Array.isArray(config2.plugin) ? [...config2.plugin] : [];
@@ -43226,7 +43597,7 @@ var init_tui_config = __esm(() => {
 });
 
 // src/lib/diagnostics-opencode.ts
-import { existsSync as existsSync27, readdirSync as readdirSync3, readFileSync as readFileSync16, statSync as statSync11 } from "node:fs";
+import { existsSync as existsSync27, readdirSync as readdirSync3, readFileSync as readFileSync17, statSync as statSync11 } from "node:fs";
 import { createRequire as createRequire3 } from "node:module";
 import { homedir as homedir15 } from "node:os";
 import { join as join23 } from "node:path";
@@ -43248,7 +43619,7 @@ function getPluginCacheInfo() {
   for (const installedPkgPath of getOpenCodePluginPackageJsonPaths()) {
     try {
       if (existsSync27(installedPkgPath)) {
-        const pkg = JSON.parse(readFileSync16(installedPkgPath, "utf-8"));
+        const pkg = JSON.parse(readFileSync17(installedPkgPath, "utf-8"));
         cached2 = typeof pkg.version === "string" ? pkg.version : undefined;
         if (cached2)
           break;
@@ -43280,7 +43651,7 @@ function readConfig3(path6) {
   if (!existsSync27(path6))
     return { value: null };
   try {
-    const raw = readFileSync16(path6, "utf-8");
+    const raw = readFileSync17(path6, "utf-8");
     const value = import_comment_json10.parse(raw);
     return { value };
   } catch (error51) {
@@ -43305,7 +43676,7 @@ function configHasPluginEntry(config2) {
 }
 function parseHistorianDumpMeta(path6) {
   try {
-    const xml = readFileSync16(path6, "utf-8");
+    const xml = readFileSync17(path6, "utf-8");
     const parsed = parseCompartmentOutput(xml);
     const factCountByCategory = {};
     for (const fact of parsed.facts) {
@@ -43405,6 +43776,62 @@ function collectHistorianDumps(recentSessions) {
     }
   };
 }
+function collectRecentSessionsFromDatabase(database) {
+  const rows = database.prepare(`WITH active AS (
+                SELECT id, directory, title, time_updated, parent_id
+                FROM session
+                WHERE time_archived IS NULL
+            ),
+            root_activity AS (
+                SELECT p.id AS root_id,
+                       MAX(
+                           CASE
+                               WHEN c.time_updated > p.time_updated THEN c.time_updated
+                               ELSE p.time_updated
+                           END
+                       ) AS latest_activity
+                FROM active p
+                LEFT JOIN active c ON c.parent_id = p.id
+                WHERE p.parent_id IS NULL
+                GROUP BY p.id
+            ),
+            selected_roots AS (
+                SELECT p.id, p.directory, p.title, p.time_updated, r.latest_activity
+                FROM active p
+                JOIN root_activity r ON r.root_id = p.id
+                ORDER BY r.latest_activity DESC
+                LIMIT ${RECENT_SESSION_GROUP_LIMIT}
+            ),
+            ranked_children AS (
+                SELECT c.id, c.directory, c.title, c.time_updated, c.parent_id,
+                       r.latest_activity,
+                       ROW_NUMBER() OVER (
+                           PARTITION BY c.parent_id
+                           ORDER BY c.time_updated DESC
+                       ) AS child_rank
+                FROM active c
+                JOIN selected_roots r ON c.parent_id = r.id
+            )
+            SELECT id, directory, title, time_updated, NULL AS parent_id,
+                   latest_activity, 0 AS row_kind, 0 AS child_rank
+            FROM selected_roots
+            UNION ALL
+            SELECT id, directory, title, time_updated, parent_id,
+                   latest_activity, 1 AS row_kind, child_rank
+            FROM ranked_children
+            WHERE child_rank <= ${CHILD_SESSIONS_PER_PARENT_LIMIT}
+            ORDER BY latest_activity DESC, row_kind ASC, child_rank ASC, time_updated DESC`).all();
+  return rows.flatMap((row) => {
+    const sessionId = typeof row.id === "string" ? row.id : null;
+    const directory = typeof row.directory === "string" ? row.directory : null;
+    if (!sessionId || !directory)
+      return [];
+    const title = typeof row.title === "string" ? row.title : "";
+    const lastActiveAt = typeof row.time_updated === "number" ? new Date(row.time_updated).toISOString() : "";
+    const parentSessionId = typeof row.parent_id === "string" && row.parent_id.length > 0 ? row.parent_id : null;
+    return [{ sessionId, title, directory, lastActiveAt, parentSessionId }];
+  });
+}
 async function collectRecentSessions() {
   const dataHome = process.env.XDG_DATA_HOME || join23(process.env.HOME || homedir15(), ".local", "share");
   const opencodeDbPath = join23(dataHome, "opencode", "opencode.db");
@@ -43423,16 +43850,7 @@ async function collectRecentSessions() {
   let db = null;
   try {
     db = new DatabaseClass(opencodeDbPath, { readonly: true });
-    const rows = db.prepare("SELECT id, directory, title, time_updated FROM session " + "WHERE time_archived IS NULL AND parent_id IS NULL " + "ORDER BY time_updated DESC LIMIT 5").all();
-    return rows.flatMap((row) => {
-      const sessionId = typeof row.id === "string" ? row.id : null;
-      const directory = typeof row.directory === "string" ? row.directory : null;
-      if (!sessionId || !directory)
-        return [];
-      const title = typeof row.title === "string" ? row.title : "";
-      const lastActiveAt = typeof row.time_updated === "number" ? new Date(row.time_updated).toISOString() : "";
-      return [{ sessionId, title, directory, lastActiveAt }];
-    });
+    return collectRecentSessionsFromDatabase(db);
   } catch {
     return [];
   } finally {
@@ -43658,7 +44076,8 @@ function renderDiagnosticsMarkdown(report) {
     sessionId: session.sessionId,
     title: sanitizeDiagnosticText(session.title),
     directory: sanitizeString(session.directory),
-    lastActiveAt: session.lastActiveAt
+    lastActiveAt: session.lastActiveAt,
+    parentSessionId: session.parentSessionId ?? null
   }));
   return [
     `- Timestamp: ${report.timestamp}`,
@@ -43730,7 +44149,7 @@ function renderDiagnosticsMarkdown(report) {
   ].join(`
 `);
 }
-var import_comment_json10;
+var import_comment_json10, RECENT_SESSION_GROUP_LIMIT = 5, CHILD_SESSIONS_PER_PARENT_LIMIT = 3;
 var init_diagnostics_opencode = __esm(() => {
   init_config();
   init_agent_disable();
@@ -43746,7 +44165,7 @@ var init_diagnostics_opencode = __esm(() => {
 });
 
 // src/lib/embedding-runtime.ts
-import { spawnSync as spawnSync5 } from "node:child_process";
+import { spawnSync as spawnSync6 } from "node:child_process";
 import { existsSync as existsSync28 } from "node:fs";
 import { createRequire as createRequire4 } from "node:module";
 import { dirname as dirname16, join as join24, sep } from "node:path";
@@ -43756,7 +44175,7 @@ function describeError(error51) {
   return typeof code === "string" && code.length > 0 ? `${code}: ${message}` : message;
 }
 function runOnnxRuntimeNodeLoadProbeChild(packageDir) {
-  return spawnSync5(process.execPath, ["-e", ONNX_RUNTIME_NODE_LOAD_PROBE_SCRIPT], {
+  return spawnSync6(process.execPath, ["-e", ONNX_RUNTIME_NODE_LOAD_PROBE_SCRIPT], {
     encoding: "utf8",
     env: { ...process.env, [ONNX_LOAD_PROBE_PACKAGE_DIR_ENV]: packageDir },
     stdio: ["ignore", "pipe", "pipe"],
@@ -44064,7 +44483,7 @@ var init_issue_body = __esm(() => {
 });
 
 // src/lib/logs-opencode.ts
-import { readFileSync as readFileSync17, writeFileSync as writeFileSync8 } from "node:fs";
+import { readFileSync as readFileSync18, writeFileSync as writeFileSync8 } from "node:fs";
 import { join as join25 } from "node:path";
 function sanitizeLogContent(content) {
   return sanitizeDiagnosticText(content);
@@ -44107,7 +44526,7 @@ function filterLogLinesBySession(lines, sessionId) {
 }
 async function bundleIssueReport(report, description, title, sessionFilter = null) {
   const LOG_TAIL_LINES = 400;
-  const allLogLines = report.logFile.exists ? readFileSync17(report.logFile.path, "utf-8").split(/\r?\n/) : [];
+  const allLogLines = report.logFile.exists ? readFileSync18(report.logFile.path, "utf-8").split(/\r?\n/) : [];
   const logLines = filterLogLinesBySession(allLogLines, sessionFilter);
   const recentLog = sanitizeLogContent(logLines.slice(-LOG_TAIL_LINES).join(`
 `)).trim();
@@ -44121,8 +44540,16 @@ async function bundleIssueReport(report, description, title, sessionFilter = nul
   const sanitizedConfigPath = sanitizeDiagnosticText(report.configPaths.magicContextConfig);
   const sanitizedDescription = sanitizeDiagnosticText(description);
   const sanitizedTitle = sanitizeDiagnosticText(title).trim();
+  const selectedSession = sessionFilter ? report.recentSessions.find((session) => session.sessionId === sessionFilter) : undefined;
+  const sessionContext = selectedSession ? [
+    "## Session context",
+    `- Selected session: ${sanitizeDiagnosticText(selectedSession.sessionId)}`,
+    `- Parent session: ${sanitizeDiagnosticText(selectedSession.parentSessionId ?? "none")}`,
+    ""
+  ] : [];
   const rawBodyMarkdown = [
     ...sanitizedTitle ? ["## Title", sanitizedTitle, ""] : [],
+    ...sessionContext,
     "## Description",
     sanitizedDescription,
     "",
@@ -44158,10 +44585,16 @@ async function bundleIssueReport(report, description, title, sessionFilter = nul
   ].join(`
 `);
   const bodyMarkdown = capBodyToGithubLimit(rawBodyMarkdown);
-  const path6 = join25(process.cwd(), `magic-context-issue-${formatTimestamp(new Date)}.md`);
+  const truncated = bodyMarkdown !== rawBodyMarkdown;
+  const timestamp3 = formatTimestamp(new Date);
+  const path6 = join25(process.cwd(), `magic-context-issue-${timestamp3}.md`);
   writeFileSync8(path6, `${bodyMarkdown}
 `);
-  return { path: path6, bodyMarkdown };
+  const fullPath = truncated ? join25(process.cwd(), `magic-context-issue-${timestamp3}-full.md`) : undefined;
+  if (fullPath)
+    writeFileSync8(fullPath, `${rawBodyMarkdown}
+`);
+  return { path: path6, bodyMarkdown, ...fullPath ? { fullPath } : {}, truncated };
 }
 var HISTORIAN_LOG_PATTERNS;
 var init_logs_opencode = __esm(() => {
@@ -44465,7 +44898,7 @@ import {
   accessSync as accessSync2,
   existsSync as existsSync29,
   constants as fsConstants,
-  readFileSync as readFileSync18,
+  readFileSync as readFileSync19,
   renameSync as renameSync7,
   statSync as statSync12,
   writeFileSync as writeFileSync9
@@ -44519,7 +44952,7 @@ function getWinningConfig(directory, surface) {
     try {
       if (!existsSync29(path6))
         continue;
-      const parsed = parseJsonConfig(readFileSync18(path6, "utf-8"));
+      const parsed = parseJsonConfig(readFileSync19(path6, "utf-8"));
       const entries = getPluginEntries(parsed);
       if (entries.some((entry) => entry === PACKAGE_NAME || entry.startsWith(`${PACKAGE_NAME}@`))) {
         if (winner) {
@@ -44555,14 +44988,14 @@ var init_checker = __esm(() => {
 });
 
 // src/lib/opencode-plugin-schema-fence.ts
-import { existsSync as existsSync30, readdirSync as readdirSync4, readFileSync as readFileSync19 } from "node:fs";
+import { existsSync as existsSync30, readdirSync as readdirSync4, readFileSync as readFileSync20 } from "node:fs";
 import { join as join28 } from "node:path";
 import { gunzipSync } from "node:zlib";
 function readPackageVersion(packageJsonPath) {
   try {
     if (!existsSync30(packageJsonPath))
       return null;
-    const packageJson = JSON.parse(readFileSync19(packageJsonPath, "utf-8"));
+    const packageJson = JSON.parse(readFileSync20(packageJsonPath, "utf-8"));
     if (packageJson.name !== OPENCODE_PLUGIN_NAME || typeof packageJson.version !== "string") {
       return null;
     }
@@ -44599,7 +45032,7 @@ function readFenceFromDist(packageDirectory) {
         }
         if (!entry.isFile() || !/\.(?:[cm]?js|ts)$/.test(entry.name))
           continue;
-        const fence = readFenceValue(readFileSync19(path6, "utf-8"));
+        const fence = readFenceValue(readFileSync20(path6, "utf-8"));
         if (fence !== null)
           fenceValues.add(fence);
       }
@@ -44767,85 +45200,6 @@ var init_opencode_plugin_schema_fence = __esm(() => {
   EXACT_VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
 });
 
-// ../plugin/src/features/magic-context/fail-closed-block.ts
-function normalizeFailClosedProcessKind(process3) {
-  switch (process3.kind) {
-    case "OpenCode server":
-    case "OpenCode instance (TUI/CLI)":
-    case "Pi":
-    case "process":
-      return process3.kind;
-  }
-  switch (process3.harness?.trim().toLowerCase()) {
-    case "opencode server":
-      return "OpenCode server";
-    case "opencode instance (tui/cli)":
-    case "opencode instance":
-      return "OpenCode instance (TUI/CLI)";
-    case "pi":
-    case "pi harness":
-    case "omp":
-      return "Pi";
-    default:
-      return "process";
-  }
-}
-function formatFailClosedBlockingProcesses(processes) {
-  const uniqueProcesses = new Map;
-  for (const process3 of processes) {
-    if (!Number.isInteger(process3.pid) || process3.pid <= 0)
-      continue;
-    const kind = normalizeFailClosedProcessKind(process3);
-    uniqueProcesses.set(`${kind}\x00${process3.pid}`, { kind, pid: process3.pid });
-  }
-  const entries = [...uniqueProcesses.values()];
-  const visible = entries.slice(0, MAX_FORMATTED_BLOCKING_PROCESSES);
-  const rendered = visible.map(({ kind, pid }) => `${kind} (PID ${pid})`);
-  const omitted = entries.length - visible.length;
-  if (omitted > 0)
-    rendered.push(`${omitted} more blocking process(es)`);
-  if (rendered.length === 0)
-    return "a live process";
-  if (rendered.length === 1)
-    return rendered[0];
-  const last = rendered.pop();
-  return `${rendered.join(", ")}, and ${last}`;
-}
-function formatFailClosedBlockingMessage(reason) {
-  if (reason.kind === "migration_guard") {
-    if (reason.unreadableFile) {
-      const arm = reason.unreadableArm ?? "io";
-      const recovery = arm === "io" ? `If none of these processes are running, it is safe to delete ${reason.unreadableFile} and retry.` : `The file may be a recent incomplete write; retry after the file is older than the ten-minute grace window, or stop the relevant process before deleting it.`;
-      return [
-        `Magic Context cannot migrate the shared database because RPC discovery file ${reason.unreadableFile} is uncertain (${arm} arm), so the absence of a live process cannot be proven.`,
-        recovery,
-        `Recovery: ${FAIL_CLOSED_DOCTOR_COMMAND}`
-      ].join(" ");
-    }
-    return [
-      `Magic Context cannot migrate the shared database because ${formatFailClosedBlockingProcesses(reason.blockingProcesses)} may be running an older Magic Context build that would fail against the migrated database.`,
-      "Restart the blocking process (it will pick up the new build and migrate on start), or shut it down and retry.",
-      `Recovery: ${FAIL_CLOSED_DOCTOR_COMMAND}`
-    ].join(" ");
-  }
-  if (reason.kind === "schema_fence") {
-    return [
-      `Magic Context cannot operate: this Magic Context build is older than the database; upgrade/restart this harness (upstream migration lane v${reason.persistedVersion}, build supports through v${reason.supportedVersion}).`,
-      `Recovery: ${FAIL_CLOSED_DOCTOR_COMMAND}`
-    ].join(" ");
-  }
-  const cause = reason.cause.trim().length > 0 ? reason.cause.trim() : "unknown storage error";
-  return [
-    `Magic Context cannot operate: persistent storage failed (${cause}).`,
-    "The plugin will not silently degrade to native compaction while enabled.",
-    `Recovery: ${FAIL_CLOSED_DOCTOR_COMMAND}`
-  ].join(" ");
-}
-var FAIL_CLOSED_DOCTOR_COMMAND = "npx @cortexkit/magic-context@latest doctor", OPENCODE_INTERNAL_AGENT_NAMES, MAX_FORMATTED_BLOCKING_PROCESSES = 8;
-var init_fail_closed_block = __esm(() => {
-  OPENCODE_INTERNAL_AGENT_NAMES = new Set(["title", "summary", "compaction"]);
-});
-
 // src/lib/storage-versions.ts
 function checkStorageVersionFence(versions2, options = {}) {
   const {
@@ -44896,13 +45250,13 @@ var init_storage_versions = __esm(async () => {
 });
 
 // src/commands/doctor-opencode-cache.ts
-import { existsSync as existsSync31, readFileSync as readFileSync20, rmSync as rmSync3 } from "node:fs";
+import { existsSync as existsSync31, readFileSync as readFileSync21, rmSync as rmSync3 } from "node:fs";
 function readCachedPluginVersion(pluginCacheDir) {
   try {
     const installedPkgPath = getOpenCodePluginPackageJsonPath(pluginCacheDir);
     if (!existsSync31(installedPkgPath))
       return;
-    const pkg = JSON.parse(readFileSync20(installedPkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync21(installedPkgPath, "utf-8"));
     return typeof pkg.version === "string" ? pkg.version : undefined;
   } catch {
     return;
@@ -44941,26 +45295,26 @@ async function clearPluginCache(options = {}, deps = {}) {
     };
   }
   const cleared = [];
-  const failed = [];
+  const failed2 = [];
   for (const entry of clearTargets) {
     try {
       remove(entry.path);
       cleared.push(entry);
     } catch (err) {
-      failed.push({
+      failed2.push({
         path: entry.path,
         error: err instanceof Error ? err.message : String(err)
       });
     }
   }
-  if (failed.length > 0) {
-    const firstFailure = failed[0];
+  if (failed2.length > 0) {
+    const firstFailure = failed2[0];
     return {
       action: "error",
       path: firstFailure?.path ?? clearTargets[0]?.path ?? existingRoots[0] ?? "",
-      paths: failed.map((entry) => entry.path),
+      paths: failed2.map((entry) => entry.path),
       clearedPaths: cleared.map((entry) => entry.path),
-      failedPaths: failed.map((entry) => entry.path),
+      failedPaths: failed2.map((entry) => entry.path),
       error: firstFailure?.error
     };
   }
@@ -44978,8 +45332,8 @@ var init_doctor_opencode_cache = __esm(() => {
 });
 
 // src/commands/doctor-opencode.ts
-import { execSync as execSync2, spawnSync as spawnSync6 } from "node:child_process";
-import { existsSync as existsSync32, readFileSync as readFileSync21, statSync as statSync13 } from "node:fs";
+import { spawnSync as spawnSync7 } from "node:child_process";
+import { existsSync as existsSync32, readFileSync as readFileSync22, statSync as statSync13 } from "node:fs";
 import { createRequire as createRequire5 } from "node:module";
 import { homedir as homedir17 } from "node:os";
 import { join as join29 } from "node:path";
@@ -45089,7 +45443,7 @@ function collectNpmReleaseAgeWarnings() {
   if (!existsSync32(npmrcPath))
     return ageWarnings;
   try {
-    const npmrc = readFileSync21(npmrcPath, "utf-8");
+    const npmrc = readFileSync22(npmrcPath, "utf-8");
     for (const line of npmrc.split(`
 `)) {
       const trimmed = line.trim();
@@ -45119,26 +45473,18 @@ function compareVersions(a3, b) {
   }
   return 0;
 }
-function isGhInstalled() {
-  try {
-    execSync2("gh --version", { stdio: "pipe" });
-    return true;
-  } catch {
-    return false;
-  }
-}
 function openBrowser(url2) {
   try {
     if (process.platform === "darwin") {
-      const child = spawnSync6("open", [url2], { stdio: "ignore" });
+      const child = spawnSync7("open", [url2], { stdio: "ignore" });
       if (child.status === 0)
         return;
     } else if (process.platform === "linux") {
-      const child = spawnSync6("xdg-open", [url2], { stdio: "ignore" });
+      const child = spawnSync7("xdg-open", [url2], { stdio: "ignore" });
       if (child.status === 0)
         return;
     } else if (process.platform === "win32") {
-      const child = spawnSync6("cmd", ["/c", "start", "", url2], { stdio: "ignore" });
+      const child = spawnSync7("cmd", ["/c", "start", "", url2], { stdio: "ignore" });
       if (child.status === 0)
         return;
     }
@@ -45165,8 +45511,10 @@ async function runIssueFlow2() {
         ...report.recentSessions.map((session, index) => {
           const displayTitle = session.title.trim() || "(no title)";
           const truncatedTitle = displayTitle.length > 50 ? `${displayTitle.slice(0, 47)}...` : displayTitle;
+          const childPrefix = session.parentSessionId ? "  ↳ " : "";
+          const parentSuffix = session.parentSessionId ? ` (child of ${session.parentSessionId})` : "";
           return {
-            label: `${truncatedTitle} — ${session.sessionId}${index === 0 ? " (most recent)" : ""}`,
+            label: `${childPrefix}${truncatedTitle} — ${session.sessionId}${parentSuffix}${index === 0 ? " (most recent)" : ""}`,
             value: session.sessionId
           };
         }),
@@ -45179,30 +45527,23 @@ async function runIssueFlow2() {
     }
     s.start("Bundling issue report");
     const bundled = await bundleIssueReport(report, description, title, sessionFilter);
-    s.stop(`Report written to ${bundled.path}`);
+    s.stop(bundled.fullPath ? `Report written to ${bundled.path}; full bundle at ${bundled.fullPath}` : `Report written to ${bundled.path}`);
     const shouldSubmit = await confirm2("Submit this issue on GitHub now?", true);
-    if (shouldSubmit && isGhInstalled()) {
-      const result = spawnSync6("gh", [
-        "issue",
-        "create",
-        "-R",
-        "cortexkit/magic-context",
-        "--title",
-        title,
-        "--body-file",
-        bundled.path
-      ], { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] });
-      if (result.status === 0) {
-        log2.success(result.stdout.trim());
+    if (shouldSubmit) {
+      const result = submitGithubIssue(title, bundled.path);
+      if (result.ok) {
+        log2.success(result.output);
+        if (bundled.fullPath) {
+          log2.info(`Full diagnostics bundle available to drag onto the issue: ${bundled.fullPath}`);
+        }
         outro2("Issue submitted — thanks for the report!");
         return 0;
       }
-      log2.warn(result.stderr.trim() || "gh issue create failed");
-    } else if (shouldSubmit && !isGhInstalled()) {
-      log2.warn("gh CLI not found — falling back to browser");
+      const fallbackPath = bundled.fullPath ?? bundled.path;
+      log2.warn(formatGithubIssueFallback(result, fallbackPath));
     }
     const url2 = `https://github.com/cortexkit/magic-context/issues/new?title=${encodeURIComponent(title)}&template=bug_report.yml`;
-    log2.info(`Open this URL and paste the contents of ${bundled.path} into the Diagnostics field:`);
+    log2.info(`Open this URL and drag ${bundled.fullPath ?? bundled.path} into the Diagnostics field:`);
     log2.info(url2);
     openBrowser(url2);
     outro2("Issue report ready");
@@ -45594,7 +45935,7 @@ async function runDoctor2(options = {}) {
   }
   if (paths.opencodeConfigFormat !== "none") {
     try {
-      const raw = readFileSync21(paths.opencodeConfig, "utf-8");
+      const raw = readFileSync22(paths.opencodeConfig, "utf-8");
       const config2 = import_comment_json12.parse(raw);
       const rawPlugins = Array.isArray(config2?.plugin) ? config2.plugin : [];
       const existingIdx = rawPlugins.findIndex((entry) => matchesPluginEntry(entry, OPENCODE_PLUGIN_NAME) || isDevPathPluginEntry(entry));
@@ -45681,7 +46022,7 @@ async function runDoctor2(options = {}) {
     fixed++;
   } else if (existsSync32(paths.tuiConfig)) {
     try {
-      const tuiRaw = readFileSync21(paths.tuiConfig, "utf-8");
+      const tuiRaw = readFileSync22(paths.tuiConfig, "utf-8");
       const tuiConfig = import_comment_json12.parse(tuiRaw);
       const tuiRawPlugins = Array.isArray(tuiConfig?.plugin) ? tuiConfig.plugin : [];
       const tuiIdx = tuiRawPlugins.findIndex((entry) => matchesPluginEntry(entry, OPENCODE_PLUGIN_NAME) || isDevPathPluginEntry(entry));
@@ -45935,6 +46276,7 @@ var init_doctor_opencode = __esm(async () => {
   init_config_location_migration();
   init_diagnostics_opencode();
   init_embedding_runtime();
+  init_github_issue();
   init_logs_opencode();
   init_migrate_dreamer_v2_doctor();
   init_opencode_detect();
@@ -45957,7 +46299,7 @@ var init_doctor_opencode = __esm(async () => {
 
 // src/lib/diagnostics-pi.ts
 import { createHash as createHash5 } from "node:crypto";
-import { existsSync as existsSync33, readdirSync as readdirSync5, readFileSync as readFileSync22, statSync as statSync14 } from "node:fs";
+import { existsSync as existsSync33, readdirSync as readdirSync5, readFileSync as readFileSync23, statSync as statSync14 } from "node:fs";
 import { createRequire as createRequire6 } from "node:module";
 import { homedir as homedir18, userInfo as userInfo2 } from "node:os";
 import { join as join30 } from "node:path";
@@ -46031,7 +46373,7 @@ function readJsonc(path6) {
     return { value: {} };
   try {
     return {
-      value: import_comment_json13.parse(readFileSync22(path6, "utf-8"))
+      value: import_comment_json13.parse(readFileSync23(path6, "utf-8"))
     };
   } catch (error51) {
     return {
@@ -46101,7 +46443,7 @@ function collectPiRecentSessions() {
 }
 function parseHistorianDumpMeta2(path6) {
   try {
-    const xml = readFileSync22(path6, "utf-8");
+    const xml = readFileSync23(path6, "utf-8");
     const parsed = parseCompartmentOutput(xml);
     const factCountByCategory = {};
     for (const fact of parsed.facts) {
@@ -46346,7 +46688,7 @@ var init_diagnostics_pi = __esm(() => {
 });
 
 // src/lib/logs-pi.ts
-import { readFileSync as readFileSync23, writeFileSync as writeFileSync10 } from "node:fs";
+import { readFileSync as readFileSync24, writeFileSync as writeFileSync10 } from "node:fs";
 import { join as join31 } from "node:path";
 function sanitizeLogContent2(content) {
   return sanitizeString2(content);
@@ -46376,7 +46718,7 @@ function filterLogLinesBySession2(lines, sessionId) {
 }
 async function bundleIssueReport2(report, description, title, options = {}) {
   const LOG_TAIL_LINES = 400;
-  const allLogLines = report.logFile.exists ? readFileSync23(report.logFile.path, "utf-8").split(/\r?\n/) : [];
+  const allLogLines = report.logFile.exists ? readFileSync24(report.logFile.path, "utf-8").split(/\r?\n/) : [];
   const logLines = filterLogLinesBySession2(allLogLines, options.sessionFilter ?? null);
   const recentLog = sanitizeLogContent2(logLines.slice(-LOG_TAIL_LINES).join(`
 `)).trim();
@@ -46411,11 +46753,17 @@ async function bundleIssueReport2(report, description, title, options = {}) {
   ].join(`
 `);
   const bodyMarkdown = capBodyToGithubLimit(rawBodyMarkdown);
+  const truncated = bodyMarkdown !== rawBodyMarkdown;
   const cwd = options.cwd ?? process.cwd();
-  const path6 = join31(cwd, `magic-context-pi-issue-${formatTimestamp2(options.now ?? new Date)}.md`);
+  const timestamp3 = formatTimestamp2(options.now ?? new Date);
+  const path6 = join31(cwd, `magic-context-pi-issue-${timestamp3}.md`);
   writeFileSync10(path6, `${bodyMarkdown}
 `);
-  return { path: path6, bodyMarkdown };
+  const fullPath = truncated ? join31(cwd, `magic-context-pi-issue-${timestamp3}-full.md`) : undefined;
+  if (fullPath)
+    writeFileSync10(fullPath, `${rawBodyMarkdown}
+`);
+  return { path: path6, bodyMarkdown, ...fullPath ? { fullPath } : {}, truncated };
 }
 var init_logs_pi = __esm(() => {
   init_diagnostics_pi();
@@ -46423,8 +46771,8 @@ var init_logs_pi = __esm(() => {
 });
 
 // src/commands/doctor-pi.ts
-import { execFileSync as execFileSync6, spawnSync as spawnSync7 } from "node:child_process";
-import { existsSync as existsSync34, mkdirSync as mkdirSync11, readdirSync as readdirSync6, readFileSync as readFileSync24, rmSync as rmSync4, statSync as statSync15 } from "node:fs";
+import { execFileSync as execFileSync6, spawnSync as spawnSync8 } from "node:child_process";
+import { existsSync as existsSync34, mkdirSync as mkdirSync11, readdirSync as readdirSync6, readFileSync as readFileSync25, rmSync as rmSync4, statSync as statSync15 } from "node:fs";
 import { createRequire as createRequire7 } from "node:module";
 import { homedir as homedir19 } from "node:os";
 import { dirname as dirname18, isAbsolute as isAbsolute5, join as join32 } from "node:path";
@@ -46517,7 +46865,7 @@ function summarize(results) {
 function readJsonc2(path6) {
   try {
     return {
-      value: import_comment_json14.parse(readFileSync24(path6, "utf-8"))
+      value: import_comment_json14.parse(readFileSync25(path6, "utf-8"))
     };
   } catch (error51) {
     return {
@@ -46674,7 +47022,7 @@ function findPiMagicContextCacheDirs(cwd, expectedVersion, force = false) {
     const packageJson = join32(path6, "package.json");
     if (existsSync34(packageJson)) {
       try {
-        const pkg = JSON.parse(readFileSync24(packageJson, "utf-8"));
+        const pkg = JSON.parse(readFileSync25(packageJson, "utf-8"));
         const name = typeof pkg.name === "string" ? pkg.name : "";
         const version2 = typeof pkg.version === "string" ? pkg.version : undefined;
         if (name === PACKAGE_NAME2) {
@@ -46943,7 +47291,7 @@ ${formatDatabaseRepairGuidance(dbPath)}`);
   if (existsSync34(logPath)) {
     const stat = statSync15(logPath);
     const sizeKb = (stat.size / 1024).toFixed(0);
-    const lines = readFileSync24(logPath, "utf-8").split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+    const lines = readFileSync25(logPath, "utf-8").split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
     add2(results, "info", `Log file: ${logPath} (${sizeKb} KB)`);
     const lastLine = lines.at(-1);
     add2(results, "info", `Last plugin log line: ${lastLine ? sanitizeDiagnosticText(lastLine) : "<empty log>"}`);
@@ -47021,17 +47369,31 @@ function repair2(plan, prompts) {
   }
   return fixed;
 }
-function ghAvailableAndAuthed(deps) {
-  try {
-    deps.execFileSync("gh", ["--version"], {
-      stdio: ["ignore", "pipe", "ignore"]
+function runGhCommandWithDeps2(deps, args) {
+  if (args[0] === "issue") {
+    const result = deps.spawnSync("gh", args, {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"]
     });
-    deps.execFileSync("gh", ["auth", "status"], {
-      stdio: ["ignore", "pipe", "ignore"]
+    return {
+      status: result.status,
+      stdout: String(result.stdout ?? ""),
+      stderr: String(result.stderr ?? "")
+    };
+  }
+  try {
+    const output = deps.execFileSync("gh", args, {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"]
     });
-    return true;
-  } catch {
-    return false;
+    return { status: 0, stdout: String(output ?? ""), stderr: "" };
+  } catch (error51) {
+    const result = error51;
+    return {
+      status: typeof result.status === "number" ? result.status : 1,
+      stdout: String(result.stdout ?? ""),
+      stderr: String(result.stderr ?? "")
+    };
   }
 }
 async function runIssueFlow3(options) {
@@ -47069,32 +47431,22 @@ async function runIssueFlow3(options) {
       now: options.deps.now(),
       sessionFilter
     });
-    spinner3.stop(`Report written to ${bundled.path}`);
-    if (ghAvailableAndAuthed(options.deps)) {
-      const shouldSubmit = await options.prompts.confirm("Submit this issue on GitHub now?", false);
-      if (shouldSubmit) {
-        const result = options.deps.spawnSync("gh", [
-          "issue",
-          "create",
-          "-R",
-          "cortexkit/magic-context",
-          "--title",
-          `[pi] ${title}`,
-          "--body-file",
-          bundled.path
-        ], { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] });
-        if (result.status === 0) {
-          options.prompts.log.success(String(result.stdout).trim());
-          options.prompts.outro("Issue submitted — thanks for the report!");
-          return 0;
-        }
-        options.prompts.log.warn(String(result.stderr).trim() || "gh issue create failed");
+    spinner3.stop(bundled.fullPath ? `Report written to ${bundled.path}; full bundle at ${bundled.fullPath}` : `Report written to ${bundled.path}`);
+    const shouldSubmit = await options.prompts.confirm("Submit this issue on GitHub now?", false);
+    if (shouldSubmit) {
+      const result = submitGithubIssue(`[pi] ${title}`, bundled.path, (args) => runGhCommandWithDeps2(options.deps, args));
+      if (result.ok) {
+        options.prompts.log.success(result.output);
+        if (bundled.fullPath) {
+          options.prompts.log.info(`Full diagnostics bundle available to drag onto the issue: ${bundled.fullPath}`);
+        }
+        options.prompts.outro("Issue submitted — thanks for the report!");
+        return 0;
       }
-    } else {
-      options.prompts.log.warn("gh CLI is unavailable or not authenticated; printing report for manual issue creation");
+      options.prompts.log.warn(formatGithubIssueFallback(result, bundled.fullPath ?? bundled.path));
     }
     console.log(bundled.bodyMarkdown);
-    options.prompts.log.info(`Open https://github.com/cortexkit/magic-context/issues/new and attach ${bundled.path}`);
+    options.prompts.log.info(`Open https://github.com/cortexkit/magic-context/issues/new and drag ${bundled.fullPath ?? bundled.path} into the issue`);
     options.prompts.outro("Issue report ready");
     return 0;
   } catch (error51) {
@@ -47199,6 +47551,7 @@ var init_doctor_pi = __esm(async () => {
   init_config_location_migration();
   init_diagnostics_pi();
   init_embedding_runtime();
+  init_github_issue();
   init_logs_pi();
   init_paths();
   init_pi_helpers();
@@ -47224,7 +47577,7 @@ var init_doctor_pi = __esm(async () => {
     openExistingContextDatabase,
     now: () => new Date,
     execFileSync: execFileSync6,
-    spawnSync: spawnSync7
+    spawnSync: spawnSync8
   };
 });
 
@@ -47353,7 +47706,7 @@ async function runClear() {
     outro2("Done.");
     return 0;
   }
-  let failed = 0;
+  let failed2 = 0;
   for (const idxStr of picks) {
     const idx = Number.parseInt(idxStr, 10);
     const item = items[idx];
@@ -47369,11 +47722,11 @@ async function runClear() {
     } catch (err) {
       s.stop(`Failed: ${item.path}`);
       log2.error(err.message);
-      failed += 1;
+      failed2 += 1;
     }
   }
-  outro2(failed === 0 ? "Done." : `Done with ${failed} failure(s).`);
-  return failed === 0 ? 0 : 1;
+  outro2(failed2 === 0 ? "Done." : `Done with ${failed2} failure(s).`);
+  return failed2 === 0 ? 0 : 1;
 }
 function formatSize(bytes) {
   if (bytes < 1024)