@cortexkit/magic-context 0.40.1 → 0.41.0

package/dist/index.js

@@ -2253,6 +2253,7 @@ __export(exports_data_path, {
   getMagicContextHistorianDir: () => getMagicContextHistorianDir,
   getMagicContextLogPath: () => getMagicContextLogPath,
   getMagicContextStorageDir: () => getMagicContextStorageDir,
+  getMagicContextStorageResolution: () => getMagicContextStorageResolution,
   getMagicContextTempDir: () => getMagicContextTempDir,
   getOpenCodeCacheDir: () => getOpenCodeCacheDir,
   getOpenCodeStorageDir: () => getOpenCodeStorageDir,
@@ -2308,15 +2309,43 @@ function getProjectMagicContextHistorianDir(directory) {
 function getOpenCodeStorageDir() {
   return path.join(getDataDir(), "opencode", "storage");
 }
-function getMagicContextStorageDir() {
-  if (!process.env.XDG_DATA_HOME) {
-    const testDataDir = process.env.MAGIC_CONTEXT_TEST_DATA_DIR;
-    if (testDataDir) {
-      return path.join(testDataDir, "cortexkit", "magic-context");
+function getMagicContextStorageResolution() {
+  const testDataDir = process.env.MAGIC_CONTEXT_TEST_DATA_DIR?.trim();
+  if (testDataDir) {
+    const perTestDataHome = process.env.XDG_DATA_HOME?.trim();
+    if (perTestDataHome && path.resolve(perTestDataHome) !== path.resolve(testDataDir)) {
+      return {
+        path: path.join(perTestDataHome, "cortexkit", "magic-context"),
+        source: "test isolation"
+      };
+    }
+    return {
+      path: path.join(testDataDir, "cortexkit", "magic-context"),
+      source: "test isolation"
+    };
+  }
+  if (false) {}
+  const explicitStorageDir = process.env.MAGIC_CONTEXT_STORAGE_DIR?.trim();
+  if (explicitStorageDir) {
+    if (!path.isAbsolute(explicitStorageDir)) {
+      throw new Error("MAGIC_CONTEXT_STORAGE_DIR must be an absolute path");
     }
-    if (false) {}
+    return { path: explicitStorageDir, source: "environment override" };
   }
-  return path.join(getDataDir(), "cortexkit", "magic-context");
+  const xdgDataHome = process.env.XDG_DATA_HOME?.trim();
+  if (xdgDataHome) {
+    return {
+      path: path.join(xdgDataHome, "cortexkit", "magic-context"),
+      source: "XDG_DATA_HOME"
+    };
+  }
+  return {
+    path: path.join(os.homedir(), ".local", "share", "cortexkit", "magic-context"),
+    source: "platform default"
+  };
+}
+function getMagicContextStorageDir() {
+  return getMagicContextStorageResolution().path;
 }
 function getLegacyOpenCodeMagicContextStorageDir() {
   return path.join(getOpenCodeStorageDir(), "plugin", "magic-context");
@@ -2333,7 +2362,7 @@ var init_data_path = () => {};
 // src/lib/paths.ts
 import { existsSync as existsSync4, readdirSync, statSync as statSync3 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { delimiter as delimiter2, dirname as dirname2, join as join4, resolve } from "node:path";
+import { delimiter as delimiter2, dirname as dirname2, join as join4, resolve as resolve2 } from "node:path";
 function getOpenCodeConfigDir() {
   const envDir = process.env.OPENCODE_CONFIG_DIR?.trim();
   if (envDir)
@@ -2431,7 +2460,7 @@ function resolveOmpPaths() {
   const configRoot = profile ? join4(baseConfigRoot, "profiles", profile) : baseConfigRoot;
   const defaultAgentDir = join4(configRoot, "agent");
   const override = profile ? undefined : process.env.PI_CODING_AGENT_DIR?.trim();
-  const agentDir = override ? resolve(override) : defaultAgentDir;
+  const agentDir = override ? resolve2(override) : defaultAgentDir;
   const canUseXdg = (process.platform === "linux" || process.platform === "darwin") && agentDir === defaultAgentDir;
   let dataRoot = configRoot;
   if (canUseXdg) {
@@ -2469,18 +2498,18 @@ function getOmpPackageDir() {
   if (value === "~")
     return envFirstHomeDir();
   if (value.startsWith("~/") || value.startsWith("~\\")) {
-    return resolve(envFirstHomeDir(), value.slice(2));
+    return resolve2(envFirstHomeDir(), value.slice(2));
   }
-  return resolve(value);
+  return resolve2(value);
 }
 function getOmpNonGlobalConfigSources(cwd = process.cwd()) {
   const sources = process.env.PI_CONFIG_FILES?.split(delimiter2).map((entry) => entry.trim()).filter(Boolean).map((entry) => {
     if (entry === "~")
       return envFirstHomeDir();
     const expanded = entry.startsWith("~/") || entry.startsWith("~\\") ? join4(envFirstHomeDir(), entry.slice(2)) : entry;
-    return resolve(cwd, expanded);
+    return resolve2(cwd, expanded);
   }) ?? [];
-  const projectConfig = resolve(cwd, ".omp", "config.yml");
+  const projectConfig = resolve2(cwd, ".omp", "config.yml");
   if (existsSync4(projectConfig))
     sources.push(projectConfig);
   return [...new Set(sources)];
@@ -10959,7 +10988,7 @@ var init_opencode_plugin_cache = __esm(() => {
 
 // src/adapters/opencode.ts
 import { existsSync as existsSync8, readFileSync as readFileSync5, statSync as statSync5 } from "node:fs";
-import { dirname as dirname4, isAbsolute as isAbsolute2, parse as parsePath, resolve as resolve2 } from "node:path";
+import { dirname as dirname4, isAbsolute as isAbsolute3, parse as parsePath, resolve as resolve3 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 class OpenCodeAdapter {
@@ -11157,7 +11186,7 @@ function isLocalPathPluginEntry(entry) {
   const candidate = typeof entry === "string" ? entry : Array.isArray(entry) && typeof entry[0] === "string" ? entry[0] : null;
   if (!candidate)
     return false;
-  return candidate.startsWith("file://") || isAbsolute2(candidate) || candidate.startsWith("./") || candidate.startsWith("../");
+  return candidate.startsWith("file://") || isAbsolute3(candidate) || candidate.startsWith("./") || candidate.startsWith("../");
 }
 function isDevPathPluginEntry(entry) {
   const candidate = typeof entry === "string" ? entry : Array.isArray(entry) && typeof entry[0] === "string" ? entry[0] : null;
@@ -11168,13 +11197,13 @@ function isDevPathPluginEntry(entry) {
     if (candidate.startsWith("file://")) {
       localPath = fileURLToPath(candidate);
     } else {
-      localPath = resolve2(candidate);
+      localPath = resolve3(candidate);
     }
     if (statSync5(localPath).isFile())
       localPath = dirname4(localPath);
     const root = parsePath(localPath).root;
     while (localPath !== root) {
-      const packagePath = resolve2(localPath, "package.json");
+      const packagePath = resolve3(localPath, "package.json");
       if (existsSync8(packagePath)) {
         const pkg = JSON.parse(readFileSync5(packagePath, "utf8"));
         return pkg.name === OPENCODE_PLUGIN_NAME;
@@ -14480,13 +14509,199 @@ var init_setup_omp = __esm(() => {
   OMP_HOST = createOmpHost(DEFAULT_DEPS2);
 });
 
+// ../plugin/src/shared/redaction.ts
+import { homedir as homedir7, userInfo } from "node:os";
+function escapeRegex(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function redactionTypeForKey(key) {
+  const normalized = key.trim().toLowerCase().replace(/[^a-z0-9_.-]+/g, "_");
+  const suffix = normalized.split(".").filter(Boolean).at(-1) ?? normalized;
+  return suffix || "secret";
+}
+function isNonSecretScalarValue(value) {
+  const v = value.trim();
+  if (v === "true" || v === "false" || v === "null" || v === "undefined")
+    return true;
+  return /^[+-]?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?$/.test(v);
+}
+function isSecretKey(key) {
+  const segments = key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().split(/[._-]+/).filter(Boolean);
+  if (segments.length === 0)
+    return false;
+  if (segments.length === 1) {
+    const first = segments[0];
+    return Boolean(first && SECRET_SEGMENT_PATTERN.test(first));
+  }
+  for (let i2 = 0;i2 < segments.length; i2++) {
+    const seg = segments[i2];
+    if (!seg || !SECRET_SEGMENT_PATTERN.test(seg))
+      continue;
+    let trailingOk = true;
+    for (let j = i2 + 1;j < segments.length; j++) {
+      const tail = segments[j];
+      if (!tail)
+        continue;
+      if (TRAILING_DESCRIPTORS.has(tail))
+        continue;
+      if (SECRET_SEGMENT_PATTERN.test(tail))
+        continue;
+      trailingOk = false;
+      break;
+    }
+    if (!trailingOk)
+      continue;
+    for (let k = i2 - 1;k >= 0; k--) {
+      const lead = segments[k];
+      if (lead && SECRET_QUALIFIERS.has(lead))
+        return true;
+    }
+  }
+  return false;
+}
+function sanitizePathString(value) {
+  const home = process.env.HOME || process.env.USERPROFILE || homedir7();
+  const username = userInfo().username;
+  let sanitized = value;
+  if (home) {
+    sanitized = sanitized.replace(new RegExp(escapeRegex(home), "g"), "~");
+  }
+  sanitized = sanitized.replace(/\/Users\/[^/]+\//g, "/Users/<USER>/");
+  sanitized = sanitized.replace(/\/home\/[^/]+\//g, "/home/<USER>/");
+  sanitized = sanitized.replace(/C:\\Users\\[^\\]+\\/g, "C:\\Users\\<USER>\\");
+  if (username) {
+    sanitized = sanitized.replace(new RegExp(escapeRegex(username), "g"), "<USER>");
+  }
+  return sanitized;
+}
+function redactSecretText(value) {
+  let redacted = value;
+  for (const { pattern, replacement } of SECRET_TEXT_PATTERNS) {
+    if (typeof replacement === "string") {
+      redacted = redacted.replace(pattern, replacement);
+    } else {
+      redacted = redacted.replace(pattern, replacement);
+    }
+  }
+  return redacted;
+}
+function sanitizeDiagnosticText(value) {
+  return redactSecretText(sanitizePathString(value));
+}
+function sanitizeConfigValue(value, keyPath = []) {
+  if (value === null || typeof value === "number" || typeof value === "boolean")
+    return value;
+  const key = keyPath.at(-1) ?? "";
+  if (key && isSecretKey(key)) {
+    return `<REDACTED:${redactionTypeForKey(key)}>`;
+  }
+  if (typeof value === "string")
+    return sanitizeDiagnosticText(value);
+  if (Array.isArray(value)) {
+    return value.map((entry, index) => sanitizeConfigValue(entry, [...keyPath, String(index)]));
+  }
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).map(([entryKey, entry]) => [
+      entryKey,
+      sanitizeConfigValue(entry, [...keyPath, entryKey])
+    ]));
+  }
+  return value;
+}
+var SECRET_WORDS, SECRET_SEGMENT_PATTERN, TRAILING_DESCRIPTORS, SECRET_QUALIFIERS, SECRET_TEXT_PATTERNS;
+var init_redaction = __esm(() => {
+  SECRET_WORDS = [
+    "key",
+    "token",
+    "secret",
+    "password",
+    "auth",
+    "authorization",
+    "bearer",
+    "credential"
+  ];
+  SECRET_SEGMENT_PATTERN = new RegExp(`^(?:${SECRET_WORDS.map((w) => `${w}s?`).join("|")})$`, "i");
+  TRAILING_DESCRIPTORS = new Set(["id", "ids", "value", "values", "header", "headers"]);
+  SECRET_QUALIFIERS = new Set([
+    "api",
+    "access",
+    "private",
+    "client",
+    "auth",
+    "authorization",
+    "secret",
+    "bearer",
+    "session",
+    "refresh",
+    "service",
+    "x",
+    "openai",
+    "anthropic",
+    "google",
+    "github",
+    "huggingface",
+    "aws",
+    "azure"
+  ]);
+  SECRET_TEXT_PATTERNS = [
+    {
+      pattern: /\bsk-ant-(?:api03-)?[A-Za-z0-9_-]{32,}/g,
+      replacement: "<ANTHROPIC_API_KEY_REDACTED>"
+    },
+    {
+      pattern: /\bsk-(?:proj-)?[A-Za-z0-9_-]{12,}/g,
+      replacement: "<OPENAI_API_KEY_REDACTED>"
+    },
+    {
+      pattern: /\bgithub_pat_[A-Za-z0-9_]{20,}/g,
+      replacement: "<GITHUB_PAT_REDACTED>"
+    },
+    {
+      pattern: /\b(?:gh[opsu]|ghr)_[A-Za-z0-9]{30,}/g,
+      replacement: "<GITHUB_TOKEN_REDACTED>"
+    },
+    {
+      pattern: /\bhf_[A-Za-z0-9]{30,}/g,
+      replacement: "<HUGGINGFACE_TOKEN_REDACTED>"
+    },
+    {
+      pattern: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g,
+      replacement: "<AWS_ACCESS_KEY_ID_REDACTED>"
+    },
+    {
+      pattern: /\bxox[abprsuvc]-[A-Za-z0-9-]{10,}/g,
+      replacement: "<SLACK_TOKEN_REDACTED>"
+    },
+    {
+      pattern: /\bAIza[A-Za-z0-9_-]{35}\b/g,
+      replacement: "<GOOGLE_API_KEY_REDACTED>"
+    },
+    {
+      pattern: /\b(Authorization\s*:\s*Bearer\s+)([A-Za-z0-9._~+/=-]{8,})/gi,
+      replacement: (_full, prefix) => `${prefix}<REDACTED:bearer>`
+    },
+    {
+      pattern: /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
+      replacement: "<JWT_REDACTED>"
+    },
+    {
+      pattern: /(["'])([^"']*(?:key|token|secret|password|auth|bearer|credential)[^"']*)\1(\s*:\s*)(["'])([^"']*)\4/gi,
+      replacement: (full, quote, key, separator, valueQuote, value) => isNonSecretScalarValue(value) ? full : `${quote}${key}${quote}${separator}${valueQuote}<REDACTED:${redactionTypeForKey(key)}>${valueQuote}`
+    },
+    {
+      pattern: /\b([A-Za-z0-9_.-]*(?:key|token|secret|password|auth|bearer|credential)[A-Za-z0-9_.-]*)\s*=\s*([^\s'"`]+)/gi,
+      replacement: (full, key, value) => isNonSecretScalarValue(value) ? full : `${key}=<REDACTED:${redactionTypeForKey(key)}>`
+    }
+  ];
+});
+
 // ../plugin/src/shared/logger.ts
 import * as fs from "node:fs";
 import * as path2 from "node:path";
 function recordSwallowedWrite(error) {
   try {
     swallowedWriteCount++;
-    lastErrorMessage = error instanceof Error ? error.message : String(error);
+    lastErrorMessage = sanitizeDiagnosticText(error instanceof Error ? error.message : String(error));
     lastErrorTime = new Date().toISOString();
   } catch {}
 }
@@ -14523,9 +14738,9 @@ function log3(message, data) {
     return;
   try {
     const timestamp = new Date().toISOString();
-    const serialized = data === undefined ? "" : data instanceof Error ? ` ${data.message}${data.stack ? `
-${data.stack}` : ""}` : ` ${JSON.stringify(data)}`;
-    buffer.push(`[${timestamp}] ${message}${serialized}
+    const serialized = data === undefined ? "" : data instanceof Error ? ` ${sanitizeDiagnosticText(`${data.message}${data.stack ? `
+${data.stack}` : ""}`)}` : ` ${JSON.stringify(sanitizeConfigValue(data))}`;
+    buffer.push(`[${timestamp}] ${sanitizeDiagnosticText(message)}${serialized}
 `);
     if (buffer.length >= BUFFER_SIZE_LIMIT) {
       flush();
@@ -14537,6 +14752,7 @@ ${data.stack}` : ""}` : ` ${JSON.stringify(data)}`;
 var isTestEnv = false, buffer, flushTimer = null, FLUSH_INTERVAL_MS = 500, BUFFER_SIZE_LIMIT = 50, swallowedWriteCount = 0, lastErrorMessage = null, lastErrorTime = null;
 var init_logger = __esm(() => {
   init_data_path();
+  init_redaction();
   buffer = [];
   if (!isTestEnv) {
     process.on("exit", flush);
@@ -15054,7 +15270,7 @@ __export(exports_util, {
   createTransparentProxy: () => createTransparentProxy,
   defineLazy: () => defineLazy,
   esc: () => esc,
-  escapeRegex: () => escapeRegex,
+  escapeRegex: () => escapeRegex2,
   explicitlyAborted: () => explicitlyAborted,
   extend: () => extend,
   finalizeIssue: () => finalizeIssue,
@@ -15261,7 +15477,7 @@ function numKeys(data) {
   }
   return keyCount;
 }
-function escapeRegex(str) {
+function escapeRegex2(str) {
   return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function clone(inst, def, params) {
@@ -16045,7 +16261,7 @@ var cuid, cuid2, ulid, xid, ksuid, nanoid, duration, extendedDuration, guid, uui
     return /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;
   return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);
 }, uuid4, uuid6, uuid7, email, html5Email, rfc5322Email, unicodeEmail, idnEmail, browserEmail, _emoji = `^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$`, ipv4, ipv6, mac = (delimiter3) => {
-  const escapedDelim = escapeRegex(delimiter3 ?? ":");
+  const escapedDelim = escapeRegex2(delimiter3 ?? ":");
   return new RegExp(`^(?:[0-9A-F]{2}${escapedDelim}){5}[0-9A-F]{2}$|^(?:[0-9a-f]{2}${escapedDelim}){5}[0-9a-f]{2}$`);
 }, cidrv4, cidrv6, base64, base64url, hostname, domain, httpProtocol, e164, dateSource = `(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))`, date, string = (params) => {
   const regex = params ? `[\\s\\S]{${params?.minimum ?? 0},${params?.maximum ?? ""}}` : `[\\s\\S]*`;
@@ -16553,7 +16769,7 @@ var init_checks = __esm(() => {
   });
   $ZodCheckIncludes = /* @__PURE__ */ $constructor("$ZodCheckIncludes", (inst, def) => {
     $ZodCheck.init(inst, def);
-    const escapedRegex = escapeRegex(def.includes);
+    const escapedRegex = escapeRegex2(def.includes);
     const pattern = new RegExp(typeof def.position === "number" ? `^.{${def.position}}${escapedRegex}` : escapedRegex);
     def.pattern = pattern;
     inst._zod.onattach.push((inst2) => {
@@ -16577,7 +16793,7 @@ var init_checks = __esm(() => {
   });
   $ZodCheckStartsWith = /* @__PURE__ */ $constructor("$ZodCheckStartsWith", (inst, def) => {
     $ZodCheck.init(inst, def);
-    const pattern = new RegExp(`^${escapeRegex(def.prefix)}.*`);
+    const pattern = new RegExp(`^${escapeRegex2(def.prefix)}.*`);
     def.pattern ?? (def.pattern = pattern);
     inst._zod.onattach.push((inst2) => {
       const bag = inst2._zod.bag;
@@ -16600,7 +16816,7 @@ var init_checks = __esm(() => {
   });
   $ZodCheckEndsWith = /* @__PURE__ */ $constructor("$ZodCheckEndsWith", (inst, def) => {
     $ZodCheck.init(inst, def);
-    const pattern = new RegExp(`.*${escapeRegex(def.suffix)}$`);
+    const pattern = new RegExp(`.*${escapeRegex2(def.suffix)}$`);
     def.pattern ?? (def.pattern = pattern);
     inst._zod.onattach.push((inst2) => {
       const bag = inst2._zod.bag;
@@ -18330,7 +18546,7 @@ var init_schemas = __esm(() => {
     const values = getEnumValues(def.entries);
     const valuesSet = new Set(values);
     inst._zod.values = valuesSet;
-    inst._zod.pattern = new RegExp(`^(${values.filter((k) => propertyKeyTypes.has(typeof k)).map((o2) => typeof o2 === "string" ? escapeRegex(o2) : o2.toString()).join("|")})$`);
+    inst._zod.pattern = new RegExp(`^(${values.filter((k) => propertyKeyTypes.has(typeof k)).map((o2) => typeof o2 === "string" ? escapeRegex2(o2) : o2.toString()).join("|")})$`);
     inst._zod.parse = (payload, _ctx) => {
       const input = payload.value;
       if (valuesSet.has(input)) {
@@ -18352,7 +18568,7 @@ var init_schemas = __esm(() => {
     }
     const values = new Set(def.values);
     inst._zod.values = values;
-    inst._zod.pattern = new RegExp(`^(${def.values.map((o2) => typeof o2 === "string" ? escapeRegex(o2) : o2 ? escapeRegex(o2.toString()) : String(o2)).join("|")})$`);
+    inst._zod.pattern = new RegExp(`^(${def.values.map((o2) => typeof o2 === "string" ? escapeRegex2(o2) : o2 ? escapeRegex2(o2.toString()) : String(o2)).join("|")})$`);
     inst._zod.parse = (payload, _ctx) => {
       const input = payload.value;
       if (values.has(input)) {
@@ -18656,7 +18872,7 @@ var init_schemas = __esm(() => {
         const end = source.endsWith("$") ? source.length - 1 : source.length;
         regexParts.push(source.slice(start, end));
       } else if (part === null || primitiveTypes.has(typeof part)) {
-        regexParts.push(escapeRegex(`${part}`));
+        regexParts.push(escapeRegex2(`${part}`));
       } else {
         throw new Error(`Invalid template literal part: ${part}`);
       }
@@ -29663,7 +29879,7 @@ var init_agent_overrides = __esm(() => {
 });
 
 // ../plugin/src/config/schema/magic-context.ts
-import { homedir as homedir7 } from "node:os";
+import { homedir as homedir8 } from "node:os";
 function defaultTaskConfig(task) {
   const base = { schedule: DEFAULT_TASK_SCHEDULES2[task] };
   if (task === "review-user-memories")
@@ -29675,9 +29891,9 @@ function defaultTaskConfig(task) {
 function expandConfigPath(value) {
   const trimmed = value.trim();
   if (trimmed === "~")
-    return homedir7();
+    return homedir8();
   if (trimmed.startsWith("~/"))
-    return `${homedir7()}/${trimmed.slice(2)}`;
+    return `${homedir8()}/${trimmed.slice(2)}`;
   return trimmed;
 }
 var DEFAULT_EXECUTE_THRESHOLD_PERCENTAGE = 65, EXECUTE_THRESHOLD_CAP_MESSAGE = "execute_threshold is capped at 90% for cache safety: output capacity is reserved from the usable context window, and the remaining 10% absorbs mid-turn growth before the absolute 95% emergency wall. Use a value between 20 and 90.", DEFAULT_HISTORIAN_TIMEOUT_MS = 600000, DEFAULT_HISTORY_BUDGET_PERCENTAGE = 0.15, DEFAULT_LOCAL_EMBEDDING_MODEL = "Xenova/all-MiniLM-L6-v2", PiThinkingLevelSchema, PiConfigSchema, PromptSurfacePresetSchema, PromptSurfaceModelKeySchema, PromptSurfaceToolKeySchema, PromptSurfaceConfigSchema, PER_HARNESS_MIGRATION_INVENTORY, OcEntryObjectSchema, OcEntrySchema, PiEntryObjectSchema, PiEntrySchema, OpenCodeHarnessBlockSchema, PiHarnessBlockSchema, OpenCodeTaskExecutionSchema, PiTaskExecutionSchema, DreamerOpenCodeHarnessBlockSchema, DreamerPiHarnessBlockSchema, ProfileOpenCodeModelBlockSchema, ProfilePiModelBlockSchema, ProfileHistorianSchema, ProfileDreamerSchema, ProfileSidekickSchema, ConfigProfileSchema, ConfigProfilesSchema, CronScheduleSchema, DreamTaskBaseConfigSchema, PromotionThresholdSchema, PrimerPromotionThresholdSchema, DreamTaskConfigSchema, ReviewUserMemoriesTaskConfigSchema, PromotePrimersTaskConfigSchema, DEFAULT_TASK_SCHEDULES2, DreamTasksSchema, AgentMetadataSchema, DreamerConfigSchema, SidekickConfigSchema, HistorianConfigSchema, EmbeddingFallbackProviderSchema, BaseEmbeddingConfigSchema, EmbeddingConfigSchema, MagicContextConfigSchema;
@@ -30654,15 +30870,15 @@ var RUST_COMPACTION_OFF_WARNING = "compaction-off mode does not support rust tra
 
 // ../plugin/src/config/variable.ts
 import { existsSync as existsSync14, readFileSync as readFileSync9 } from "node:fs";
-import { homedir as homedir8 } from "node:os";
-import { dirname as dirname9, isAbsolute as isAbsolute3, resolve as resolve3 } from "node:path";
+import { homedir as homedir9 } from "node:os";
+import { dirname as dirname9, isAbsolute as isAbsolute4, resolve as resolve4 } from "node:path";
 function sensitiveFilePathReason(resolvedPath) {
-  const home = homedir8();
+  const home = homedir9();
   const sensitiveDirs = [
-    { dir: resolve3(home, ".ssh"), label: "SSH keys" },
-    { dir: resolve3(home, ".aws"), label: "AWS credentials" },
-    { dir: resolve3(home, ".gnupg"), label: "GnuPG keyring" },
-    { dir: resolve3(home, ".config", "gh"), label: "GitHub CLI auth" }
+    { dir: resolve4(home, ".ssh"), label: "SSH keys" },
+    { dir: resolve4(home, ".aws"), label: "AWS credentials" },
+    { dir: resolve4(home, ".gnupg"), label: "GnuPG keyring" },
+    { dir: resolve4(home, ".config", "gh"), label: "GitHub CLI auth" }
   ];
   for (const { dir, label } of sensitiveDirs) {
     if (resolvedPath === dir || resolvedPath.startsWith(`${dir}/`)) {
@@ -30720,9 +30936,9 @@ function substituteConfigVariables(input) {
     }
     let filePath = rawPath.trim();
     if (filePath.startsWith("~/")) {
-      filePath = resolve3(homedir8(), filePath.slice(2));
-    } else if (!isAbsolute3(filePath)) {
-      filePath = resolve3(configDir, filePath);
+      filePath = resolve4(homedir9(), filePath.slice(2));
+    } else if (!isAbsolute4(filePath)) {
+      filePath = resolve4(configDir, filePath);
     }
     const sensitiveReason = sensitiveFilePathReason(filePath);
     if (sensitiveReason) {
@@ -31127,17 +31343,17 @@ var init_config = __esm(() => {
 });
 
 // ../plugin/src/shared/opencode-config-dir.ts
-import { homedir as homedir9 } from "node:os";
-import { join as join11, resolve as resolve4 } from "node:path";
+import { homedir as homedir10 } from "node:os";
+import { join as join11, resolve as resolve5 } from "node:path";
 function getCliConfigDir() {
   const envConfigDir = process.env.OPENCODE_CONFIG_DIR?.trim();
   if (envConfigDir) {
-    return resolve4(envConfigDir);
+    return resolve5(envConfigDir);
   }
   if (process.platform === "win32") {
-    return join11(homedir9(), ".config", "opencode");
+    return join11(homedir10(), ".config", "opencode");
   }
-  return join11(process.env.XDG_CONFIG_HOME || join11(homedir9(), ".config"), "opencode");
+  return join11(process.env.XDG_CONFIG_HOME || join11(homedir10(), ".config"), "opencode");
 }
 function getOpenCodeConfigDir2(_options) {
   return getCliConfigDir();
@@ -31155,7 +31371,7 @@ function getOpenCodeConfigPaths(options) {
 var init_opencode_config_dir = () => {};
 
 // ../plugin/src/shared/conflict-detector.ts
-import { homedir as homedir10 } from "node:os";
+import { homedir as homedir11 } from "node:os";
 import { join as join12 } from "node:path";
 function detectConflicts(directory, options) {
   const compactionEnabled = options?.compactionEnabled ?? true;
@@ -31343,7 +31559,7 @@ function readOmoDisabledHooks(directory) {
       }
     }
   }
-  const homeDir2 = process.env.HOME || homedir10();
+  const homeDir2 = process.env.HOME || homedir11();
   const omoHomeDir = join12(homeDir2, ".omo");
   for (const name of ["omo.jsonc", "omo.json"]) {
     const config2 = readJsoncFile(join12(omoHomeDir, name));
@@ -31374,7 +31590,7 @@ var init_conflict_detector = __esm(() => {
 
 // ../plugin/src/shared/conflict-fixer.ts
 import { existsSync as existsSync16, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "node:fs";
-import { homedir as homedir11 } from "node:os";
+import { homedir as homedir12 } from "node:os";
 import { join as join13 } from "node:path";
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -31434,7 +31650,7 @@ function collectOmoConfigPaths(directory) {
       paths.add(projectPath);
     }
   }
-  const homeDir2 = process.env.HOME || homedir11();
+  const homeDir2 = process.env.HOME || homedir12();
   const omoHomeDir = join13(homeDir2, ".omo");
   for (const name of OMO_UNIFIED_NAMES) {
     const userPath = join13(omoHomeDir, name);
@@ -32256,6 +32472,9 @@ async function drainAuthority(args) {
         if (next === cursor3)
           break;
       }
+      if (args.domain === "memories") {
+        resolvePendingMemoryReferencesForDrain(args.db);
+      }
       for (const step of [
         "seed",
         "memories",
@@ -32376,6 +32595,47 @@ function rowNullableString(row, key) {
   const value = row[key];
   return typeof value === "string" ? value : null;
 }
+function memorySnapshotTimestamp(row, key) {
+  const value = row[key];
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+function parsedMemorySnapshot(snapshotJson, fallback) {
+  try {
+    const parsed = JSON.parse(snapshotJson);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : fallback;
+  } catch {
+    return fallback;
+  }
+}
+function guardMemorySnapshotByRecency(args) {
+  const effectiveRow = { ...args.row };
+  if (!args.existing) {
+    return { effectiveRow, hostUpdatedNewer: false, hostVerificationNewer: false };
+  }
+  const existing = args.existing;
+  const preserve = (columns) => {
+    for (const column of columns) {
+      if (Object.hasOwn(existing, column)) {
+        effectiveRow[column] = existing[column];
+      }
+    }
+  };
+  preserve(IMMUTABLE_MEMORY_SNAPSHOT_COLUMNS);
+  const hostUpdatedNewer = memorySnapshotTimestamp(existing, "updated_at") > memorySnapshotTimestamp(args.snapshot, "updated_at");
+  const hostClassificationNewer = hostUpdatedNewer || memorySnapshotTimestamp(existing, "classified_at") > memorySnapshotTimestamp(args.snapshot, "classified_at");
+  const snapshotCarriesUpdatedAt = hasSnapshotField(args.snapshot, "updated_at");
+  const hostVerificationNewer = hostUpdatedNewer && snapshotCarriesUpdatedAt;
+  const hostMuralNewer = hostUpdatedNewer && snapshotCarriesUpdatedAt;
+  if (hostUpdatedNewer)
+    preserve(UPDATED_MEMORY_SNAPSHOT_COLUMNS);
+  if (hostClassificationNewer)
+    preserve(CLASSIFICATION_MEMORY_SNAPSHOT_COLUMNS);
+  if (hostVerificationNewer)
+    preserve(VERIFICATION_MEMORY_SNAPSHOT_COLUMNS);
+  if (hostMuralNewer)
+    preserve(MURAL_MEMORY_SNAPSHOT_COLUMNS);
+  return { effectiveRow, hostUpdatedNewer, hostVerificationNewer };
+}
 function hasSnapshotField(row, key) {
   return Object.prototype.hasOwnProperty.call(row, key);
 }
@@ -32520,11 +32780,11 @@ function prepareMirrorPageStatements(db) {
               verification_status = ?, verified_at = ?, classified_at = ?, superseded_by_memory_id = ?,
               merged_from = ?, metadata_json = ?, mural_cue = ?, mural_cue_hash = ?, mural_cue_at = ?,
               mural_cue_rejection_count = ? WHERE id = ?`),
-    updateSuperseded: db.prepare("UPDATE memories SET superseded_by_memory_id = ? WHERE id = ?"),
+    updateSuperseded: db.prepare("UPDATE memories SET superseded_by_memory_id = ?, updated_at = ? WHERE id = ?"),
     deletePendingReference: db.prepare("DELETE FROM mirror_pending_references WHERE domain = 'memories' AND module_project = ? AND module_row_id = ?"),
     upsertPendingReference: db.prepare("INSERT INTO mirror_pending_references(domain, module_project, module_row_id, target_module_row_id) VALUES ('memories', ?, ?, ?) ON CONFLICT(domain, module_project, module_row_id) DO UPDATE SET target_module_row_id = excluded.target_module_row_id"),
     deleteMemoryVerifications: db.prepare("DELETE FROM memory_verifications WHERE memory_id = ?"),
-    insertMemoryVerification: db.prepare("INSERT INTO memory_verifications(memory_id, file_path, verified_at, mapped_at) VALUES (?, ?, ?, ?)"),
+    insertMemoryVerification: db.prepare("INSERT INTO memory_verifications(memory_id, file_path, verified_at, mapped_at, mapping_origin) VALUES (?, ?, ?, ?, ?)"),
     noteById: db.prepare("SELECT * FROM notes WHERE id = ?"),
     noteIdByStoreId: db.prepare("SELECT id FROM notes WHERE id = ? AND type = 'smart' AND project_path = ?"),
     insertNote: db.prepare("INSERT INTO notes (type, status, content, project_path, session_id, created_at, updated_at) VALUES ('smart', 'active', '', ?, ?, 0, 0)"),
@@ -32552,7 +32812,8 @@ function prepareMirrorPageStatements(db) {
                        AND target.module_row_id = pending.target_module_row_id
                      WHERE pending.domain = 'memories'
                        AND source.context_row_id = memories.id
-                )
+                ),
+                    updated_at = ?
               WHERE id IN (
                     SELECT source.context_row_id
                       FROM mirror_pending_references pending
@@ -32582,7 +32843,7 @@ function prepareMirrorPageStatements(db) {
     repairPending: db.prepare("SELECT dirty FROM mirror_memory_repair_state WHERE id = 1"),
     markRepairPending: db.prepare("UPDATE mirror_memory_repair_state SET dirty = 1, updated_at = ? WHERE id = 1"),
     clearRepairPending: db.prepare("UPDATE mirror_memory_repair_state SET dirty = 0, updated_at = ? WHERE id = 1"),
-    repairCandidates: db.prepare(`SELECT memory.id, live.full_row_snapshot
+    repairCandidates: db.prepare(`SELECT memory.id, memory.updated_at, memory.classified_at, live.full_row_snapshot
                FROM memories memory
                JOIN mirror_identity identity
                  ON identity.domain = 'memories'
@@ -32596,9 +32857,14 @@ function prepareMirrorPageStatements(db) {
               WHERE (memory.source_type IS NULL OR memory.importance IS NULL)
                 AND live.full_row_snapshot IS NOT NULL`),
     repairMemory: db.prepare(`UPDATE memories
-                SET source_type = COALESCE(?, source_type),
-                    importance = COALESCE(?, importance)
-              WHERE id = ?`),
+                SET source_type = COALESCE(source_type, ?),
+                    importance = COALESCE(importance, ?),
+                    updated_at = ?
+              WHERE id = ?
+                AND COALESCE(updated_at, 0) <= ?
+                AND COALESCE(classified_at, 0) <= ?
+                AND ((source_type IS NULL AND ? IS NOT NULL)
+                  OR (importance IS NULL AND ? IS NOT NULL))`),
     updateCursor: db.prepare("INSERT INTO mirror_cursors(domain, cursor, updated_at) VALUES (?, ?, ?) ON CONFLICT(domain) DO UPDATE SET cursor = excluded.cursor, updated_at = excluded.updated_at"),
     contextStoreUuid: getContextStoreUuid(db)
   };
@@ -32682,37 +32948,46 @@ function applyMemoryRow(db, feed, statements) {
     log3(`[magic-context] skipping memory mirror update for module ${moduleProject}/${feed.module_row_id}: context row ${contextId} belongs to ${existing.project_path}`);
     return;
   }
+  const retainedRecencySnapshot = parsedMemorySnapshot(snapshotJson, row);
+  const recencySnapshot = hasSnapshotField(row, "updated_at") ? row : hasSnapshotField(row, "classified_at") ? { ...retainedRecencySnapshot, classified_at: row.classified_at } : retainedRecencySnapshot;
+  const recencyGuard = guardMemorySnapshotByRecency({
+    row,
+    snapshot: recencySnapshot,
+    existing
+  });
+  const projectedRow = recencyGuard.effectiveRow;
   const has = (key) => hasSnapshotField(row, key);
-  const nullableNumber = (key, previous) => has(key) ? typeof row[key] === "number" && Number.isFinite(row[key]) ? row[key] : null : previous ?? null;
-  const nullableString = (key, previous) => has(key) ? rowNullableString(row, key) : previous ?? null;
-  const hasSuperseded = has("superseded_by_memory_id");
+  const nullableNumber = (key, previous) => has(key) ? typeof projectedRow[key] === "number" && Number.isFinite(projectedRow[key]) ? projectedRow[key] : null : previous ?? null;
+  const nullableString = (key, previous) => has(key) ? rowNullableString(projectedRow, key) : previous ?? null;
+  const hasSuperseded = has("superseded_by_memory_id") && !recencyGuard.hostUpdatedNewer;
   const previousHash = existing?.normalized_hash;
-  statements.updateMemory.run(has("project_path") ? rowString(row, "project_path") : existing?.project_path ?? moduleProject, has("category") ? rowString(row, "category", "CONSTRAINTS") : existing?.category ?? "CONSTRAINTS", has("content") ? rowString(row, "content") : existing?.content ?? "", has("normalized_hash") ? rowString(row, "normalized_hash") : existing?.normalized_hash ?? "", has("importance") ? typeof row.importance === "number" && Number.isFinite(row.importance) ? row.importance : null : existing?.importance ?? null, has("scope") ? rowString(row, "scope", "project") : existing?.scope ?? "project", has("shareable") ? rowNumber(row, "shareable") : existing?.shareable ?? 0, nullableString("source_session_id", existing?.source_session_id), nullableString("source_type", existing?.source_type), has("seen_count") ? rowNumber(row, "seen_count", 1) : existing?.seen_count ?? 1, has("retrieval_count") ? rowNumber(row, "retrieval_count") : existing?.retrieval_count ?? 0, has("first_seen_at") ? rowNumber(row, "first_seen_at") : existing?.first_seen_at ?? 0, has("created_at") ? rowNumber(row, "created_at") : existing?.created_at ?? 0, has("updated_at") ? rowNumber(row, "updated_at") : existing?.updated_at ?? 0, has("last_seen_at") ? rowNumber(row, "last_seen_at") : existing?.last_seen_at ?? 0, nullableNumber("last_retrieved_at", existing?.last_retrieved_at), has("status") ? rowString(row, "status", "active") : existing?.status ?? "active", nullableNumber("expires_at", existing?.expires_at), has("verification_status") ? rowString(row, "verification_status", "unverified") : existing?.verification_status ?? "unverified", nullableNumber("verified_at", existing?.verified_at), nullableNumber("classified_at", existing?.classified_at), hasSuperseded ? null : existing?.superseded_by_memory_id ?? null, nullableString("merged_from", existing?.merged_from), nullableString("metadata_json", existing?.metadata_json), nullableString("mural_cue", existing?.mural_cue), nullableString("mural_cue_hash", existing?.mural_cue_hash), nullableNumber("mural_cue_at", existing?.mural_cue_at), has("mural_cue_rejection_count") ? rowNumber(row, "mural_cue_rejection_count") : existing?.mural_cue_rejection_count ?? 0, contextId);
-  if (hasSuperseded && typeof row.superseded_by_memory_id === "number") {
-    const translated = mirrorIdentity(db, "memories", moduleProject, row.superseded_by_memory_id, statements);
+  statements.updateMemory.run(has("project_path") ? rowString(projectedRow, "project_path") : existing?.project_path ?? moduleProject, has("category") ? rowString(projectedRow, "category", "CONSTRAINTS") : existing?.category ?? "CONSTRAINTS", has("content") ? rowString(projectedRow, "content") : existing?.content ?? "", has("normalized_hash") ? rowString(projectedRow, "normalized_hash") : existing?.normalized_hash ?? "", has("importance") ? typeof projectedRow.importance === "number" && Number.isFinite(projectedRow.importance) ? projectedRow.importance : null : existing?.importance ?? null, has("scope") ? rowString(projectedRow, "scope", "project") : existing?.scope ?? "project", has("shareable") ? rowNumber(projectedRow, "shareable") : existing?.shareable ?? 0, nullableString("source_session_id", existing?.source_session_id), nullableString("source_type", existing?.source_type), has("seen_count") ? rowNumber(projectedRow, "seen_count", 1) : existing?.seen_count ?? 1, has("retrieval_count") ? rowNumber(projectedRow, "retrieval_count") : existing?.retrieval_count ?? 0, has("first_seen_at") ? rowNumber(projectedRow, "first_seen_at") : existing?.first_seen_at ?? 0, has("created_at") ? rowNumber(projectedRow, "created_at") : existing?.created_at ?? 0, has("updated_at") ? rowNumber(projectedRow, "updated_at") : existing?.updated_at ?? 0, has("last_seen_at") ? rowNumber(projectedRow, "last_seen_at") : existing?.last_seen_at ?? 0, nullableNumber("last_retrieved_at", existing?.last_retrieved_at), has("status") ? rowString(projectedRow, "status", "active") : existing?.status ?? "active", nullableNumber("expires_at", existing?.expires_at), has("verification_status") ? rowString(projectedRow, "verification_status", "unverified") : existing?.verification_status ?? "unverified", nullableNumber("verified_at", existing?.verified_at), nullableNumber("classified_at", existing?.classified_at), hasSuperseded ? null : existing?.superseded_by_memory_id ?? null, nullableString("merged_from", existing?.merged_from), nullableString("metadata_json", existing?.metadata_json), nullableString("mural_cue", existing?.mural_cue), nullableString("mural_cue_hash", existing?.mural_cue_hash), nullableNumber("mural_cue_at", existing?.mural_cue_at), has("mural_cue_rejection_count") ? rowNumber(projectedRow, "mural_cue_rejection_count") : existing?.mural_cue_rejection_count ?? 0, contextId);
+  if (hasSuperseded && typeof projectedRow.superseded_by_memory_id === "number") {
+    const translated = mirrorIdentity(db, "memories", moduleProject, projectedRow.superseded_by_memory_id, statements);
     if (translated) {
-      statements.updateSuperseded.run(translated.context_row_id, contextId);
+      statements.updateSuperseded.run(translated.context_row_id, Date.now(), contextId);
       statements.deletePendingReference.run(moduleProject, feed.module_row_id);
     } else {
-      statements.upsertPendingReference.run(moduleProject, feed.module_row_id, row.superseded_by_memory_id);
+      statements.upsertPendingReference.run(moduleProject, feed.module_row_id, projectedRow.superseded_by_memory_id);
     }
   } else if (hasSuperseded) {
     statements.deletePendingReference.run(moduleProject, feed.module_row_id);
   }
-  const appliedHash = has("normalized_hash") ? rowString(row, "normalized_hash") : previousHash;
+  const appliedHash = has("normalized_hash") ? rowString(projectedRow, "normalized_hash") : previousHash;
   if (previousHash !== appliedHash && appliedHash !== undefined) {
     statements.deleteMemoryEmbeddings.run(contextId);
   }
-  if (has("mapping")) {
+  if (has("mapping") && !recencyGuard.hostVerificationNewer) {
     statements.deleteMemoryVerifications.run(contextId);
-    if (Array.isArray(row.mapping)) {
+    if (Array.isArray(projectedRow.mapping)) {
       const files = [
-        ...new Set(row.mapping.filter((file2) => typeof file2 === "string").sort())
+        ...new Set(projectedRow.mapping.filter((file2) => typeof file2 === "string").sort())
       ];
-      const verifiedAt = rowNumber(row, "verified_at");
-      const mappedAt = rowNumber(row, "updated_at", Date.now());
+      const verifiedAt = rowNumber(projectedRow, "verified_at");
+      const mappedAt = rowNumber(projectedRow, "updated_at", Date.now());
+      const mappingOrigin = projectedRow.mapping_origin === "host_rejected_fallback" ? "host_rejected_fallback" : "mapper";
       for (const file2 of files.length > 0 ? files : [""]) {
-        statements.insertMemoryVerification.run(contextId, file2, verifiedAt, mappedAt);
+        statements.insertMemoryVerification.run(contextId, file2, verifiedAt, mappedAt, mappingOrigin);
       }
     }
   }
@@ -32738,7 +33013,11 @@ function repairNullClobberedMemoryRows(statements) {
     const importance = hasSnapshotField(snapshot, "importance") && typeof snapshot.importance === "number" && Number.isFinite(snapshot.importance) ? snapshot.importance : null;
     if (sourceType === null && importance === null)
       continue;
-    statements.repairMemory.run(sourceType, importance, candidate.id);
+    const snapshotVintage = Math.max(memorySnapshotTimestamp(snapshot, "updated_at"), memorySnapshotTimestamp(snapshot, "classified_at"));
+    const hostVintage = Math.max(candidate.updated_at ?? 0, candidate.classified_at ?? 0);
+    if (hostVintage > snapshotVintage)
+      continue;
+    statements.repairMemory.run(sourceType, importance, Date.now(), candidate.id, snapshotVintage, snapshotVintage, sourceType, importance);
   }
   statements.clearRepairPending.run(Date.now());
 }
@@ -32763,9 +33042,17 @@ function contextNoteId(db, feed, moduleProject, statements) {
   return contextId;
 }
 function translateMemoryReferences(statements) {
-  statements.translateMemoryReferences.run();
+  statements.translateMemoryReferences.run(Date.now());
   statements.clearTranslatedReferences.run();
 }
+function resolvePendingMemoryReferencesForDrain(db) {
+  withPrivilegedWriter(db, () => {
+    db.transaction(() => {
+      const statements = prepareMirrorPageStatements(db);
+      translateMemoryReferences(statements);
+    }).immediate();
+  });
+}
 function applyNoteRow(db, feed, statements) {
   const row = feed.full_row_snapshot;
   const moduleProject = rowString(row, "project_path");
@@ -32944,11 +33231,12 @@ async function ensureLiveMemoryResnapshot(args) {
     }).immediate();
   });
 }
-var AUTHORITY_DOMAINS, moduleNoteEvaluationBridges, MAX_DRAIN_RECAPTURE_ATTEMPTS = 5, MAX_AUTHORITY_SEED_FRAME_BYTES, MEMORY_SNAPSHOT_COLUMNS, mirrorFlights;
+var AUTHORITY_DOMAINS, observedAuthorityRoutingByProject, moduleNoteEvaluationBridges, MAX_DRAIN_RECAPTURE_ATTEMPTS = 5, MAX_AUTHORITY_SEED_FRAME_BYTES, MEMORY_SNAPSHOT_COLUMNS, IMMUTABLE_MEMORY_SNAPSHOT_COLUMNS, CLASSIFICATION_MEMORY_SNAPSHOT_COLUMNS, VERIFICATION_MEMORY_SNAPSHOT_COLUMNS, MURAL_MEMORY_SNAPSHOT_COLUMNS, UPDATED_MEMORY_SNAPSHOT_COLUMNS, mirrorFlights;
 var init_context_authority = __esm(async () => {
   init_logger();
   await init_sqlite();
   AUTHORITY_DOMAINS = ["memories", "notes"];
+  observedAuthorityRoutingByProject = new Map;
   moduleNoteEvaluationBridges = new Map;
   MAX_AUTHORITY_SEED_FRAME_BYTES = 900 * 1024;
   MEMORY_SNAPSHOT_COLUMNS = [
@@ -32984,6 +33272,42 @@ var init_context_authority = __esm(async () => {
     "mural_cue_at",
     "mural_cue_rejection_count"
   ];
+  IMMUTABLE_MEMORY_SNAPSHOT_COLUMNS = ["project_path", "first_seen_at", "created_at"];
+  CLASSIFICATION_MEMORY_SNAPSHOT_COLUMNS = [
+    "importance",
+    "scope",
+    "shareable",
+    "source_type",
+    "classified_at"
+  ];
+  VERIFICATION_MEMORY_SNAPSHOT_COLUMNS = [
+    "verification_status",
+    "verified_at",
+    "mapping",
+    "mapping_origin"
+  ];
+  MURAL_MEMORY_SNAPSHOT_COLUMNS = [
+    "mural_cue",
+    "mural_cue_hash",
+    "mural_cue_at",
+    "mural_cue_rejection_count"
+  ];
+  UPDATED_MEMORY_SNAPSHOT_COLUMNS = [
+    "category",
+    "content",
+    "normalized_hash",
+    "source_session_id",
+    "seen_count",
+    "retrieval_count",
+    "updated_at",
+    "last_seen_at",
+    "last_retrieved_at",
+    "status",
+    "expires_at",
+    "superseded_by_memory_id",
+    "merged_from",
+    "metadata_json"
+  ];
   mirrorFlights = new WeakMap;
 });
 
@@ -33645,7 +33969,7 @@ class SubcSocket {
     return this.sock.localPort ?? null;
   }
   static connect(host, port, deadlineMs) {
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       const sock = net.connect({ host, port });
       sock.setNoDelay(true);
       const timer = setTimeout(() => {
@@ -33654,7 +33978,7 @@ class SubcSocket {
       }, Math.max(0, deadlineMs - Date.now()));
       sock.once("connect", () => {
         clearTimeout(timer);
-        resolve5(new SubcSocket(sock));
+        resolve6(new SubcSocket(sock));
       });
       sock.once("error", (err) => {
         clearTimeout(timer);
@@ -33686,7 +34010,7 @@ class SubcSocket {
     }
     if (n2 === 0)
       return Promise.resolve(new Uint8Array(0));
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       let timer = null;
       if (Number.isFinite(deadlineMs)) {
         const remaining = deadlineMs - Date.now();
@@ -33699,7 +34023,7 @@ class SubcSocket {
           reject(new SocketTimeoutError(`timed out waiting for ${n2} bytes`));
         }, remaining);
       }
-      this.waiter = { need: n2, resolve: resolve5, reject, timer };
+      this.waiter = { need: n2, resolve: resolve6, reject, timer };
       this.tryServe();
     });
   }
@@ -33723,7 +34047,7 @@ class SubcSocket {
     let queued = false;
     let settled = false;
     let timer = null;
-    const completed = new Promise((resolve5, reject) => {
+    const completed = new Promise((resolve6, reject) => {
       const settle = (run) => {
         if (settled)
           return;
@@ -33747,7 +34071,7 @@ class SubcSocket {
             if (err) {
               reject(new SocketWriteQueuedError("subc socket reported a write error after bytes were handed to the socket", err instanceof Error ? err : new Error(String(err))));
             } else {
-              resolve5();
+              resolve6();
             }
           });
         });
@@ -33948,14 +34272,14 @@ class SubcClient {
     const admission = opts.admissionClass ?? AdmissionClass.Normal;
     const corr = this.allocateCorr();
     const key = pendingKey(handle, corr);
-    const closed = new Promise((resolve5, reject) => {
+    const closed = new Promise((resolve6, reject) => {
       if (this.closedErr) {
         reject(this.closedErr);
         return;
       }
       this.pending.set(key, {
         handle,
-        resolve: () => resolve5(),
+        resolve: () => resolve6(),
         reject,
         onProgress: onEvent,
         timer: null,
@@ -34040,11 +34364,11 @@ class SubcClient {
     const waiters = [];
     for (const pending of this.pending.values()) {
       if (pending.handle === handle && !pending.subscription) {
-        waiters.push(new Promise((resolve5) => {
+        waiters.push(new Promise((resolve6) => {
           const previous = pending.onSettle;
           pending.onSettle = () => {
             previous?.();
-            resolve5();
+            resolve6();
           };
         }));
       }
@@ -34100,11 +34424,11 @@ class SubcClient {
     const channel = handle?.channel ?? 0;
     const epoch = handle?.epoch ?? 0;
     const frame = buildFrame(FrameType.Request, buildFlags(false, priority, false, admission), channel, epoch, corr, body);
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       const ms = timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
       const pending = {
         handle,
-        resolve: resolve5,
+        resolve: resolve6,
         reject,
         onProgress,
         timer: null,
@@ -34178,11 +34502,11 @@ class SubcClient {
       }
       return this.outcomeUnknownCallError("connection dropped before the managed call returned a response", error51);
     };
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       const ms = timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
       const pending = {
         handle,
-        resolve: resolve5,
+        resolve: resolve6,
         reject,
         onProgress,
         timer: null,
@@ -34562,7 +34886,7 @@ function normalizeConnectOptions(opts) {
     identity: opts.identity,
     targetKind: opts.targetKind ?? DEFAULT_MANAGED_TARGET_KIND,
     reconnectBackoff: opts.reconnectBackoff ?? DEFAULT_RECONNECT_BACKOFF,
-    sleep: opts.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms))),
+    sleep: opts.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms))),
     timeoutArbitrationGraceMs: opts.timeoutArbitrationGraceMs ?? TIMEOUT_ARBITRATION_GRACE_MS
   };
 }
@@ -34715,6 +35039,12 @@ function isConnectionFailure(error51) {
     ].includes(code) || /\bclient closed\b|\bconnection closed\b|\bclosed the connection\b/i.test(message);
   });
 }
+function routeOpenWithoutAmbientConsumerIdentity(client, target, identity, options = {}) {
+  return client.routeOpen(target, identity, {
+    ...options,
+    consumerIdentity: null
+  });
+}
 
 class SubcModuleTransport {
   connectionFile;
@@ -34861,7 +35191,7 @@ class SubcModuleTransport {
     if (this.queuedLaneWaiters >= SERIAL_LANE_MAX_WAITERS || lane.waiters.length >= SERIAL_LANE_MAX_WAITERS_PER_SESSION) {
       return Promise.reject(this.queueFullError());
     }
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       const waiter = {};
       const removeAndReject = (error51) => {
         if (waiter.settled)
@@ -34879,7 +35209,7 @@ class SubcModuleTransport {
       };
       waiter.signal = signal;
       waiter.deadlineMs = deadlineMs;
-      waiter.resolve = resolve5;
+      waiter.resolve = resolve6;
       waiter.reject = reject;
       waiter.settled = false;
       waiter.onAbort = () => removeAndReject(signal?.reason ?? new Error("module transport call aborted"));
@@ -35088,7 +35418,7 @@ class SubcModuleTransport {
         harness: getHarness(),
         session: `${this.routeSessionPrefix}${sessionId}`
       };
-      const route = await this.beforeDeadline(client.routeOpen(target, identity), deadlineMs, "opening the module route");
+      const route = await this.beforeDeadline(routeOpenWithoutAmbientConsumerIdentity(client, target, identity), deadlineMs, "opening the module route");
       if (this.client !== client || generation !== this.connectionGeneration) {
         await client.closeRoute(route).catch(() => {
           return;
@@ -35146,7 +35476,7 @@ class SubcModuleTransport {
     return error51;
   }
   sleepAbortable(durationMs, signal) {
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       if (signal?.aborted) {
         reject(signal.reason ?? new Error("module transport call aborted"));
         return;
@@ -35158,7 +35488,7 @@ class SubcModuleTransport {
       };
       const timer = setTimeout(() => {
         signal?.removeEventListener("abort", onAbort);
-        resolve5();
+        resolve6();
       }, Math.max(0, durationMs));
       signal?.addEventListener("abort", onAbort, { once: true });
     });
@@ -35539,192 +35869,6 @@ var init_rpc_utils = __esm(() => {
   rpcProcessListExecFileSync = execFileSync4;
   rpcIdentityPlatform = process.platform;
 });
-// ../plugin/src/shared/redaction.ts
-import { homedir as homedir12, userInfo } from "node:os";
-function escapeRegex2(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function redactionTypeForKey(key) {
-  const normalized = key.trim().toLowerCase().replace(/[^a-z0-9_.-]+/g, "_");
-  const suffix = normalized.split(".").filter(Boolean).at(-1) ?? normalized;
-  return suffix || "secret";
-}
-function isNonSecretScalarValue(value) {
-  const v = value.trim();
-  if (v === "true" || v === "false" || v === "null" || v === "undefined")
-    return true;
-  return /^[+-]?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?$/.test(v);
-}
-function isSecretKey(key) {
-  const segments = key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().split(/[._-]+/).filter(Boolean);
-  if (segments.length === 0)
-    return false;
-  if (segments.length === 1) {
-    const first = segments[0];
-    return Boolean(first && SECRET_SEGMENT_PATTERN.test(first));
-  }
-  for (let i2 = 0;i2 < segments.length; i2++) {
-    const seg = segments[i2];
-    if (!seg || !SECRET_SEGMENT_PATTERN.test(seg))
-      continue;
-    let trailingOk = true;
-    for (let j = i2 + 1;j < segments.length; j++) {
-      const tail = segments[j];
-      if (!tail)
-        continue;
-      if (TRAILING_DESCRIPTORS.has(tail))
-        continue;
-      if (SECRET_SEGMENT_PATTERN.test(tail))
-        continue;
-      trailingOk = false;
-      break;
-    }
-    if (!trailingOk)
-      continue;
-    for (let k = i2 - 1;k >= 0; k--) {
-      const lead = segments[k];
-      if (lead && SECRET_QUALIFIERS.has(lead))
-        return true;
-    }
-  }
-  return false;
-}
-function sanitizePathString(value) {
-  const home = homedir12();
-  const username = userInfo().username;
-  let sanitized = value;
-  if (home) {
-    sanitized = sanitized.replace(new RegExp(escapeRegex2(home), "g"), "~");
-  }
-  sanitized = sanitized.replace(/\/Users\/[^/]+\//g, "/Users/<USER>/");
-  sanitized = sanitized.replace(/\/home\/[^/]+\//g, "/home/<USER>/");
-  sanitized = sanitized.replace(/C:\\Users\\[^\\]+\\/g, "C:\\Users\\<USER>\\");
-  if (username) {
-    sanitized = sanitized.replace(new RegExp(escapeRegex2(username), "g"), "<USER>");
-  }
-  return sanitized;
-}
-function redactSecretText(value) {
-  let redacted = value;
-  for (const { pattern, replacement } of SECRET_TEXT_PATTERNS) {
-    if (typeof replacement === "string") {
-      redacted = redacted.replace(pattern, replacement);
-    } else {
-      redacted = redacted.replace(pattern, replacement);
-    }
-  }
-  return redacted;
-}
-function sanitizeDiagnosticText(value) {
-  return redactSecretText(sanitizePathString(value));
-}
-function sanitizeConfigValue(value, keyPath = []) {
-  if (value === null || typeof value === "number" || typeof value === "boolean")
-    return value;
-  const key = keyPath.at(-1) ?? "";
-  if (key && isSecretKey(key)) {
-    return `<REDACTED:${redactionTypeForKey(key)}>`;
-  }
-  if (typeof value === "string")
-    return sanitizeDiagnosticText(value);
-  if (Array.isArray(value)) {
-    return value.map((entry, index) => sanitizeConfigValue(entry, [...keyPath, String(index)]));
-  }
-  if (value && typeof value === "object") {
-    return Object.fromEntries(Object.entries(value).map(([entryKey, entry]) => [
-      entryKey,
-      sanitizeConfigValue(entry, [...keyPath, entryKey])
-    ]));
-  }
-  return value;
-}
-var SECRET_WORDS, SECRET_SEGMENT_PATTERN, TRAILING_DESCRIPTORS, SECRET_QUALIFIERS, SECRET_TEXT_PATTERNS;
-var init_redaction = __esm(() => {
-  SECRET_WORDS = [
-    "key",
-    "token",
-    "secret",
-    "password",
-    "auth",
-    "authorization",
-    "bearer",
-    "credential"
-  ];
-  SECRET_SEGMENT_PATTERN = new RegExp(`^(?:${SECRET_WORDS.map((w) => `${w}s?`).join("|")})$`, "i");
-  TRAILING_DESCRIPTORS = new Set(["id", "ids", "value", "values", "header", "headers"]);
-  SECRET_QUALIFIERS = new Set([
-    "api",
-    "access",
-    "private",
-    "client",
-    "auth",
-    "authorization",
-    "secret",
-    "bearer",
-    "session",
-    "refresh",
-    "service",
-    "x",
-    "openai",
-    "anthropic",
-    "google",
-    "github",
-    "huggingface",
-    "aws",
-    "azure"
-  ]);
-  SECRET_TEXT_PATTERNS = [
-    {
-      pattern: /\bsk-ant-(?:api03-)?[A-Za-z0-9_-]{32,}/g,
-      replacement: "<ANTHROPIC_API_KEY_REDACTED>"
-    },
-    {
-      pattern: /\bsk-(?:proj-)?[A-Za-z0-9_-]{32,}/g,
-      replacement: "<OPENAI_API_KEY_REDACTED>"
-    },
-    {
-      pattern: /\bgithub_pat_[A-Za-z0-9_]{20,}/g,
-      replacement: "<GITHUB_PAT_REDACTED>"
-    },
-    {
-      pattern: /\b(?:gh[opsu]|ghr)_[A-Za-z0-9]{30,}/g,
-      replacement: "<GITHUB_TOKEN_REDACTED>"
-    },
-    {
-      pattern: /\bhf_[A-Za-z0-9]{30,}/g,
-      replacement: "<HUGGINGFACE_TOKEN_REDACTED>"
-    },
-    {
-      pattern: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g,
-      replacement: "<AWS_ACCESS_KEY_ID_REDACTED>"
-    },
-    {
-      pattern: /\bxox[abprsuvc]-[A-Za-z0-9-]{10,}/g,
-      replacement: "<SLACK_TOKEN_REDACTED>"
-    },
-    {
-      pattern: /\bAIza[A-Za-z0-9_-]{35}\b/g,
-      replacement: "<GOOGLE_API_KEY_REDACTED>"
-    },
-    {
-      pattern: /\b(Authorization\s*:\s*Bearer\s+)([A-Za-z0-9._~+/=-]{8,})/gi,
-      replacement: (_full, prefix) => `${prefix}<REDACTED:bearer>`
-    },
-    {
-      pattern: /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
-      replacement: "<JWT_REDACTED>"
-    },
-    {
-      pattern: /(["'])([^"']*(?:key|token|secret|password|auth|bearer|credential)[^"']*)\1(\s*:\s*)(["'])([^"']*)\4/gi,
-      replacement: (full, quote, key, separator, valueQuote, value) => isNonSecretScalarValue(value) ? full : `${quote}${key}${quote}${separator}${valueQuote}<REDACTED:${redactionTypeForKey(key)}>${valueQuote}`
-    },
-    {
-      pattern: /\b([A-Za-z0-9_.-]*(?:key|token|secret|password|auth|bearer|credential)[A-Za-z0-9_.-]*)\s*=\s*([^\s'"`]+)/gi,
-      replacement: (full, key, value) => isNonSecretScalarValue(value) ? full : `${key}=<REDACTED:${redactionTypeForKey(key)}>`
-    }
-  ];
-});
-
 // ../plugin/src/features/magic-context/fail-closed-block.ts
 function attachFailClosedBlockingProcessEvidence(process3, evidence) {
   Object.defineProperties(process3, {
@@ -36043,6 +36187,20 @@ var init_compartment_parser = __esm(() => {
   EVENT_FIELD_REGEX = /<([a-z_]+)\s*>(.*?)<\/\1>/gs;
 });
 
+// ../plugin/src/shared/write-transaction-timing.ts
+function logSlowWriteTransaction(site, startedAt, thresholdMs = SLOW_WRITE_TRANSACTION_THRESHOLD_MS) {
+  try {
+    const durationMs = performance.now() - startedAt;
+    if (durationMs < thresholdMs)
+      return;
+    log3(`[magic-context] slow write transaction: site=${site} held=${durationMs.toFixed(1)}ms`);
+  } catch {}
+}
+var SLOW_WRITE_TRANSACTION_THRESHOLD_MS = 1000;
+var init_write_transaction_timing = __esm(() => {
+  init_logger();
+});
+
 // ../plugin/src/features/magic-context/storage-schema-helpers.ts
 function ensureColumn(db, table, column, definition) {
   if (!/^[a-z][a-z0-9_]*$/.test(table) || !/^[a-z][a-z0-9_]*$/.test(column) || !/^[A-Z0-9_"'(),[\]\s]+$/i.test(definition)) {
@@ -36374,6 +36532,7 @@ function runMigrations(db) {
     let migration;
     let currentVersion = 0;
     try {
+      const transactionStartedAt = performance.now();
       const applied = db.transaction(() => {
         currentVersion = getCurrentVersion(db);
         migration = MIGRATIONS.find((candidate) => candidate.version > currentVersion && !isMigrationApplied(db, candidate.version));
@@ -36388,6 +36547,7 @@ function runMigrations(db) {
         db.prepare("INSERT INTO schema_migrations (version, description, applied_at) VALUES (?, ?, ?)").run(migration.version, migration.description, Date.now());
         return true;
       }).immediate();
+      logSlowWriteTransaction("migration-runner", transactionStartedAt);
       if (!applied || !migration)
         break;
       if (migration.version <= 61)
@@ -36412,7 +36572,9 @@ function runMigrations(db) {
   }
   if (touchedLegacyAuthorityBatch) {
     try {
+      const transactionStartedAt = performance.now();
       db.transaction(() => installLatestAuthorityTriggers(db)).immediate();
+      logSlowWriteTransaction("migration-runner", transactionStartedAt);
     } catch (error51) {
       throw new Error(`Migration authority-trigger postcondition failed: ${error51 instanceof Error ? error51.message : String(error51)}. Database may need manual repair.`);
     }
@@ -36425,6 +36587,7 @@ var FORK_MIGRATION_VERSION_FLOOR = 1e4, MigrationLockBusyError, MIGRATIONS, LATE
 var init_migrations = __esm(() => {
   init_compartment_parser();
   init_logger();
+  init_write_transaction_timing();
   init_workspaces();
   MigrationLockBusyError = class MigrationLockBusyError extends Error {
     constructor(message) {
@@ -38451,6 +38614,15 @@ var init_migrations = __esm(() => {
                 );
             `);
       }
+    },
+    {
+      version: 82,
+      description: "record the origin of memory file-independent mappings",
+      up(db) {
+        if (!tableExists(db, "memory_verifications"))
+          return;
+        ensureColumn(db, "memory_verifications", "mapping_origin", "TEXT NOT NULL DEFAULT 'mapper'");
+      }
     }
   ];
   LATEST_MIGRATION_VERSION = MIGRATIONS.reduce((max, m3) => Math.max(max, m3.version), 0);
@@ -38494,7 +38666,7 @@ import {
   statSync as statSync8,
   unlinkSync as unlinkSync3
 } from "node:fs";
-import { basename as basename4, dirname as dirname11, join as join15, resolve as resolve5 } from "node:path";
+import { basename as basename4, dirname as dirname11, join as join15, resolve as resolve6 } from "node:path";
 function getPersistedSchemaVersion(db) {
   const hasMigrationsTable = db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'schema_migrations'").get();
   if (!hasMigrationsTable) {
@@ -39025,8 +39197,10 @@ function initializeDatabase(db) {
       -- verified_at=0 means "mapped (files known) but not yet content-verified".
       -- map-memories sets mapped_at + verified_at=0; verify sets verified_at=now.
       verified_at  INTEGER NOT NULL,
-      mapped_at    INTEGER NOT NULL DEFAULT 0,
-      PRIMARY KEY (memory_id, file_path)
+       mapped_at    INTEGER NOT NULL DEFAULT 0,
+       -- Distinguishes mapper-authored independence from a host rejection fallback.
+       mapping_origin TEXT NOT NULL DEFAULT 'mapper',
+       PRIMARY KEY (memory_id, file_path)
     );
     CREATE INDEX IF NOT EXISTS idx_memory_verifications_memory ON memory_verifications(memory_id);
 
@@ -39810,7 +39984,7 @@ CREATE INDEX IF NOT EXISTS idx_dream_queue_pending ON dream_queue(started_at, en
     `);
   ensureColumn(db, "workspaces", "share_categories", `TEXT NOT NULL DEFAULT '["CONSTRAINTS"]'`);
 }
-var databases, pendingAsyncOpens, persistenceByDatabase, persistenceErrorByDatabase, pathByDatabase, LATEST_SUPPORTED_VERSION = 81, PERMISSIONS_ENFORCEABLE, RPC_DISCOVERY_PARSE_GRACE_MS, defaultRpcDiscoveryFs, rpcDiscoveryFs, sqlitePragmaConfig, CHANNEL2_CLAIM_TTL_MS;
+var databases, pendingAsyncOpens, persistenceByDatabase, persistenceErrorByDatabase, pathByDatabase, LATEST_SUPPORTED_VERSION = 82, PERMISSIONS_ENFORCEABLE, RPC_DISCOVERY_PARSE_GRACE_MS, defaultRpcDiscoveryFs, rpcDiscoveryFs, sqlitePragmaConfig, CHANNEL2_CLAIM_TTL_MS;
 var init_storage_db = __esm(async () => {
   init_data_path();
   init_logger();
@@ -40188,13 +40362,14 @@ function mergeMemoryRow(db, row, fromIdentity, toIdentity, mergedAt) {
               LIMIT 1`).get(toIdentity, row.category, row.normalized_hash, sourceId);
   if (collision && typeof collision.id === "number") {
     const targetId = collision.id;
-    const mergedSeen = Math.max(Number(collision.seen_count ?? 1), Number(row.seen_count ?? 1));
+    const targetSeen = Number(collision.seen_count ?? 1);
+    const mergedSeen = Math.max(targetSeen, Number(row.seen_count ?? 1));
     const sourceClassifiedAt = Number(row.classified_at ?? 0);
     const targetClassifiedAt = Number(collision.classified_at ?? 0);
     if (sourceClassifiedAt > targetClassifiedAt) {
       db.prepare(`UPDATE memories
-                    SET importance = ?, scope = ?, shareable = ?, classified_at = ?
-                  WHERE id = ?`).run(row.importance, row.scope, row.shareable, row.classified_at, targetId);
+                     SET importance = ?, scope = ?, shareable = ?, classified_at = ?, updated_at = ?
+                   WHERE id = ?`).run(row.importance, row.scope, row.shareable, row.classified_at, mergedAt, targetId);
     }
     const sourceHasCue = typeof row.mural_cue === "string" && row.mural_cue.length > 0;
     const targetHasCue = typeof collision.mural_cue === "string" && collision.mural_cue.length > 0;
@@ -40202,19 +40377,27 @@ function mergeMemoryRow(db, row, fromIdentity, toIdentity, mergedAt) {
     const targetCueAt = Number(collision.mural_cue_at ?? 0);
     if (sourceHasCue && (!targetHasCue || sourceCueAt > targetCueAt)) {
       db.prepare(`UPDATE memories
-                    SET mural_cue = ?, mural_cue_hash = ?, mural_cue_at = ?,
-                        mural_cue_rejection_count = ?
-                  WHERE id = ?`).run(row.mural_cue, row.mural_cue_hash, row.mural_cue_at, row.mural_cue_rejection_count, targetId);
-    }
-    db.prepare(`INSERT INTO memory_verifications (memory_id, file_path, verified_at, mapped_at)
-             SELECT ?, file_path, verified_at, mapped_at
-               FROM memory_verifications
-              WHERE memory_id = ?
-             ON CONFLICT(memory_id, file_path) DO UPDATE SET
-                verified_at = MAX(memory_verifications.verified_at, excluded.verified_at),
-                mapped_at = MAX(memory_verifications.mapped_at, excluded.mapped_at)`).run(targetId, sourceId);
+                     SET mural_cue = ?, mural_cue_hash = ?, mural_cue_at = ?,
+                         mural_cue_rejection_count = ?, updated_at = ?
+                   WHERE id = ?`).run(row.mural_cue, row.mural_cue_hash, row.mural_cue_at, row.mural_cue_rejection_count, mergedAt, targetId);
+    }
+    db.prepare(`INSERT INTO memory_verifications
+                 (memory_id, file_path, verified_at, mapped_at, mapping_origin)
+              SELECT ?, file_path, verified_at, mapped_at, mapping_origin
+                FROM memory_verifications
+               WHERE memory_id = ?
+              ON CONFLICT(memory_id, file_path) DO UPDATE SET
+                 verified_at = MAX(memory_verifications.verified_at, excluded.verified_at),
+                 mapped_at = MAX(memory_verifications.mapped_at, excluded.mapped_at),
+                 mapping_origin = CASE
+                     WHEN excluded.mapped_at >= memory_verifications.mapped_at
+                         THEN excluded.mapping_origin
+                     ELSE memory_verifications.mapping_origin
+                 END`).run(targetId, sourceId);
     db.prepare("DELETE FROM memory_verifications WHERE memory_id = ?").run(sourceId);
-    db.prepare("UPDATE memories SET seen_count = ?, status = COALESCE(status, 'active') WHERE id = ?").run(mergedSeen, targetId);
+    if (mergedSeen !== targetSeen || collision.status === null || collision.status === undefined) {
+      db.prepare("UPDATE memories SET seen_count = ?, status = COALESCE(status, 'active'), updated_at = ? WHERE id = ?").run(mergedSeen, mergedAt, targetId);
+    }
     db.prepare(`UPDATE memories
                 SET status = 'archived',
                     superseded_by_memory_id = ?,
@@ -40230,7 +40413,7 @@ function mergeMemoryRow(db, row, fromIdentity, toIdentity, mergedAt) {
     logRow(db, fromIdentity, toIdentity, "memories", String(sourceId), "superseded", String(targetId), mergedAt);
     return true;
   }
-  const result = db.prepare("UPDATE memories SET project_path = ? WHERE id = ? AND project_path = ?").run(toIdentity, sourceId, fromIdentity);
+  const result = db.prepare("UPDATE memories SET project_path = ?, updated_at = ? WHERE id = ? AND project_path = ?").run(toIdentity, mergedAt, sourceId, fromIdentity);
   if ((result.changes ?? 0) === 0)
     return false;
   logRow(db, fromIdentity, toIdentity, "memories", String(sourceId), "rekeyed", null, mergedAt);
@@ -41036,6 +41219,18 @@ function migrationKeyFor(sourceSessionId, targetHarness) {
   return createHash3("sha256").update(`${sourceSessionId}
 ${targetHarness}`).digest("hex");
 }
+function moduleManagedProjectForSession(db, sessionId) {
+  const tables = db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name IN ('authority_managed', 'session_projects')").all();
+  const names = new Set(tables.flatMap((row2) => typeof row2.name === "string" ? [row2.name] : []));
+  if (!names.has("authority_managed") || !names.has("session_projects"))
+    return null;
+  const row = db.prepare(`SELECT am.project_path
+               FROM authority_managed am
+               JOIN session_projects sp ON sp.project_path = am.project_path
+              WHERE sp.session_id = ? AND sp.harness = 'opencode'
+              LIMIT 1`).get(sessionId);
+  return typeof row?.project_path === "string" ? row.project_path : null;
+}
 function hasMigrationJournal(db) {
   return Boolean(stmt(db, "SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'migration_pending'").get());
 }
@@ -41596,6 +41791,10 @@ function migrateOpenCodeSessionToPi(opts) {
     const cwd = session.directory ?? session.path ?? process.cwd();
     const outputDir = join19(piSessionsRoot, projectPathToPiDirSlug(cwd));
     const targetHarness = opts.targetHarness ?? "pi";
+    const moduleManagedProject = cortexkitDb === null ? null : moduleManagedProjectForSession(cortexkitDb, session.id);
+    if (moduleManagedProject) {
+      throw new Error(`Migration refused: source session ${session.id} belongs to module-managed project ${moduleManagedProject}; context.db may contain only host mirrors, not the Rust engine truth. Drain authority to TypeScript with \`magic-context doctor drain-authority ${cwd}\`, then retry.`);
+    }
     const journalActive = cortexkitDb !== null && !opts.dryRun;
     let recovery;
     let migrationKey;
@@ -43009,7 +43208,7 @@ var init_redaction2 = __esm(() => {
 import { execFileSync as execFileSync5, spawnSync as spawnSync5 } from "node:child_process";
 import { existsSync as existsSync25, mkdirSync as mkdirSync9, readFileSync as readFileSync15 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
-import { dirname as dirname14, join as join21, resolve as resolve6 } from "node:path";
+import { dirname as dirname14, join as join21, resolve as resolve7 } from "node:path";
 function parseSemver(value) {
   const match = value?.match(/(\d+)\.(\d+)\.(\d+)/);
   return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : null;
@@ -43135,8 +43334,8 @@ async function runHealthChecks(options) {
     if (!reportedAgentDir.ok) {
       add(results, "warn", "Could not verify OMP active agent directory");
     } else {
-      const reportedPath = resolve6(reportedAgentDir.stdout);
-      const expectedPath = resolve6(getOmpAgentDir());
+      const reportedPath = resolve7(reportedAgentDir.stdout);
+      const expectedPath = resolve7(getOmpAgentDir());
       if (reportedPath === expectedPath) {
         add(results, "pass", `OMP agent directory resolved to ${getOmpAgentDir()}`);
       } else {
@@ -43161,7 +43360,9 @@ async function runHealthChecks(options) {
   else
     for (const warning of loaded.warnings.slice(0, 5))
       add(results, "warn", warning);
-  const dbPath = join21(getMagicContextStorageDir(), "context.db");
+  const storage = getMagicContextStorageResolution();
+  const dbPath = join21(storage.path, "context.db");
+  add(results, "info", `Shared storage: ${storage.path} (source: ${storage.source})`);
   if (!existsSync25(dbPath))
     add(results, "info", `Shared context DB will be created at ${dbPath}`);
   else {
@@ -43632,9 +43833,8 @@ function getPluginCacheInfo() {
   }
   return { path: path6, cached: cached2, latest: getSelfVersion() };
 }
-function getStorageDir() {
-  const dataHome = process.env.XDG_DATA_HOME || join23(homedir15(), ".local", "share");
-  return join23(dataHome, "cortexkit", "magic-context");
+function getStorageResolution() {
+  return getMagicContextStorageResolution();
 }
 function fileSize(path6) {
   try {
@@ -43965,7 +44165,8 @@ async function collectDiagnostics() {
   const opencodeConfig = readConfig3(configPaths.opencodeConfig);
   const tuiConfig = readConfig3(configPaths.tuiConfig);
   const magicContextConfig = readConfig3(configPaths.magicContextConfig);
-  const storageDirPath = getStorageDir();
+  const storageResolution = getStorageResolution();
+  const storageDirPath = storageResolution.path;
   const contextDbPath = join23(storageDirPath, "context.db");
   const logPath = getMagicContextLogPath2("opencode");
   const logFileSize = existsSync27(logPath) ? statSync11(logPath).size : 0;
@@ -44003,6 +44204,7 @@ async function collectDiagnostics() {
     pluginCache: getPluginCacheInfo(),
     storageDir: {
       path: storageDirPath,
+      source: storageResolution.source,
       exists: existsSync27(storageDirPath),
       contextDbSizeBytes: fileSize(contextDbPath)
     },
@@ -44049,6 +44251,7 @@ function renderDiagnosticsMarkdown(report) {
   };
   const storage = {
     path: sanitizeString(report.storageDir.path),
+    source: report.storageDir.source ?? "unknown",
     exists: report.storageDir.exists,
     context_db_size: formatBytes(report.storageDir.contextDbSizeBytes)
   };
@@ -44971,7 +45174,7 @@ import {
   statSync as statSync12,
   writeFileSync as writeFileSync9
 } from "node:fs";
-import { dirname as dirname17, isAbsolute as isAbsolute4, join as join27, resolve as resolve7 } from "node:path";
+import { dirname as dirname17, isAbsolute as isAbsolute5, join as join27, resolve as resolve8 } from "node:path";
 function warn(message) {
   log3(`WARN: ${message}`);
 }
@@ -46164,7 +46367,9 @@ async function runDoctor2(options = {}) {
     warnCount++;
   else
     passCount++;
-  const dbPath = join29(getMagicContextStorageDir(), "context.db");
+  const storage = getMagicContextStorageResolution();
+  const dbPath = join29(storage.path, "context.db");
+  log2.info(`Shared storage: ${storage.path} (source: ${storage.source})`);
   if (!existsSync32(dbPath)) {
     log2.info(`Shared context DB not yet created at ${dbPath} (will be created on first run)`);
   } else {
@@ -46370,10 +46575,8 @@ var init_doctor_opencode = __esm(async () => {
 });
 
 // src/lib/diagnostics-pi.ts
-import { createHash as createHash5 } from "node:crypto";
 import { existsSync as existsSync33, readdirSync as readdirSync5, readFileSync as readFileSync23, statSync as statSync14 } from "node:fs";
 import { createRequire as createRequire6 } from "node:module";
-import { homedir as homedir18, userInfo as userInfo2 } from "node:os";
 import { join as join30 } from "node:path";
 function getSelfVersion3() {
   const req = createRequire6(import.meta.url);
@@ -46394,51 +46597,11 @@ function fileSize2(path6) {
     return 0;
   }
 }
-function escapeRegex3(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function currentUserHash() {
-  const username = userInfo2().username || "unknown";
-  return createHash5("sha256").update(username).digest("hex").slice(0, 12);
-}
-function redactSecretString(value) {
-  return redactSecretText(value).replace(/Bearer\s+[A-Za-z0-9._~+\-/=]+/g, "Bearer <REDACTED>").replace(/sk-[A-Za-z0-9_-]{12,}/g, "sk-<REDACTED>").replace(/api[_-]?key=([^\s&]+)/gi, "api_key=<REDACTED>").replace(/token=([^\s&]+)/gi, "token=<REDACTED>");
-}
 function sanitizeString2(value) {
-  const home = process.env.HOME || homedir18();
-  const username = userInfo2().username;
-  const userHash = `<USER:${currentUserHash()}>`;
-  let sanitized = redactSecretString(value);
-  if (home) {
-    sanitized = sanitized.replace(new RegExp(escapeRegex3(home), "g"), "<HOME>");
-  }
-  sanitized = sanitized.replace(/\/Users\/[^/]+\//g, `/Users/${userHash}/`);
-  sanitized = sanitized.replace(/\/home\/[^/]+\//g, `/home/${userHash}/`);
-  sanitized = sanitized.replace(/C:\\Users\\[^\\]+\\/g, `C:\\Users\\${userHash}\\`);
-  if (username) {
-    sanitized = sanitized.replace(new RegExp(escapeRegex3(username), "g"), userHash);
-  }
-  return sanitized;
+  return sanitizeDiagnosticText(value);
 }
-function shouldRedactKey(key) {
-  return /api[_-]?key|token|secret|password|authorization|cookie/i.test(key);
-}
-function sanitizeValue2(value, key = "") {
-  if (value === null || typeof value === "number" || typeof value === "boolean")
-    return value;
-  if (shouldRedactKey(key))
-    return "<REDACTED>";
-  if (typeof value === "string")
-    return sanitizeString2(value);
-  if (Array.isArray(value))
-    return value.map((entry) => sanitizeValue2(entry));
-  if (value && typeof value === "object") {
-    return Object.fromEntries(Object.entries(value).map(([entryKey, entry]) => [
-      entryKey,
-      sanitizeValue2(entry, entryKey)
-    ]));
-  }
-  return value;
+function sanitizeValue2(value) {
+  return sanitizeConfigValue(value);
 }
 function readJsonc(path6) {
   if (!existsSync33(path6))
@@ -46623,7 +46786,8 @@ async function collectDiagnostics2(cwd = process.cwd()) {
   const userConfigPath = getPiUserConfigPath();
   const projectConfigPath = getProjectConfigPath(cwd);
   const loaded = loadPiConfig({ cwd });
-  const storageDirPath = getMagicContextStorageDir();
+  const storageResolution = getMagicContextStorageResolution();
+  const storageDirPath = storageResolution.path;
   const dbPath = join30(storageDirPath, "context.db");
   const logPath = getMagicContextLogPath2("pi");
   const logFileSize = existsSync33(logPath) ? statSync14(logPath).size : 0;
@@ -46657,6 +46821,7 @@ async function collectDiagnostics2(cwd = process.cwd()) {
     loadWarnings: loaded.warnings.map(sanitizeString2),
     storageDir: {
       path: storageDirPath,
+      source: storageResolution.source,
       exists: existsSync33(storageDirPath),
       contextDbSizeBytes: fileSize2(dbPath)
     },
@@ -46687,6 +46852,7 @@ function renderDiagnosticsMarkdown2(report) {
   const settings2 = sanitizeValue2(report.settings);
   const storage = {
     path: sanitizeString2(report.storageDir.path),
+    source: report.storageDir.source ?? "unknown",
     exists: report.storageDir.exists,
     context_db_size: formatBytes2(report.storageDir.contextDbSizeBytes)
   };
@@ -46846,8 +47012,8 @@ var init_logs_pi = __esm(() => {
 import { execFileSync as execFileSync6, spawnSync as spawnSync8 } from "node:child_process";
 import { existsSync as existsSync34, mkdirSync as mkdirSync11, readdirSync as readdirSync6, readFileSync as readFileSync25, rmSync as rmSync4, statSync as statSync15 } from "node:fs";
 import { createRequire as createRequire7 } from "node:module";
-import { homedir as homedir19 } from "node:os";
-import { dirname as dirname18, isAbsolute as isAbsolute5, join as join32 } from "node:path";
+import { homedir as homedir18 } from "node:os";
+import { dirname as dirname18, isAbsolute as isAbsolute6, join as join32 } from "node:path";
 function depsFrom(options) {
   return {
     ...DEFAULT_DEPS5,
@@ -46969,7 +47135,7 @@ function piPluginDirCandidates(packages, cwd) {
     const spec = typeof entry === "string" ? entry.trim() : "";
     if (!spec || spec.startsWith("npm:"))
       continue;
-    const resolved = isAbsolute5(spec) ? spec : join32(agentDir, spec);
+    const resolved = isAbsolute6(spec) ? spec : join32(agentDir, spec);
     dirs.push(resolved);
   }
   dirs.push(join32(agentDir, "npm", "node_modules", PACKAGE_NAME2));
@@ -47066,7 +47232,7 @@ function pinnedVersionFromPackageSpecifier(specifier) {
 }
 function cacheRoots(cwd) {
   const home = process.env.HOME?.trim();
-  const cacheHome = process.env.XDG_CACHE_HOME || join32(home || homedir19(), ".cache");
+  const cacheHome = process.env.XDG_CACHE_HOME || join32(home || homedir18(), ".cache");
   const piCacheRoot = getPiCacheRoot();
   return [
     join32(piCacheRoot, "extensions"),
@@ -47221,8 +47387,10 @@ async function runHealthChecks2(options) {
   } else if (historianModel.startsWith("github-copilot/") && historianThinkingLevel) {
     add2(results, "pass", `historian.model "${historianModel}" has thinking_level "${historianThinkingLevel}" configured`);
   }
-  const storageDir = getMagicContextStorageDir();
+  const storage = getMagicContextStorageResolution();
+  const storageDir = storage.path;
   const dbPath = join32(storageDir, "context.db");
+  add2(results, "info", `Shared storage: ${storageDir} (source: ${storage.source})`);
   const existedBeforeOpen = existsSync34(dbPath);
   if (existedBeforeOpen)
     add2(results, "pass", `Shared context DB exists at ${dbPath}`);