@cortexkit/magic-context 0.40.1 → 0.41.1

package/dist/index.js

@@ -2253,6 +2253,7 @@ __export(exports_data_path, {
   getMagicContextHistorianDir: () => getMagicContextHistorianDir,
   getMagicContextLogPath: () => getMagicContextLogPath,
   getMagicContextStorageDir: () => getMagicContextStorageDir,
+  getMagicContextStorageResolution: () => getMagicContextStorageResolution,
   getMagicContextTempDir: () => getMagicContextTempDir,
   getOpenCodeCacheDir: () => getOpenCodeCacheDir,
   getOpenCodeStorageDir: () => getOpenCodeStorageDir,
@@ -2308,15 +2309,43 @@ function getProjectMagicContextHistorianDir(directory) {
 function getOpenCodeStorageDir() {
   return path.join(getDataDir(), "opencode", "storage");
 }
-function getMagicContextStorageDir() {
-  if (!process.env.XDG_DATA_HOME) {
-    const testDataDir = process.env.MAGIC_CONTEXT_TEST_DATA_DIR;
-    if (testDataDir) {
-      return path.join(testDataDir, "cortexkit", "magic-context");
+function getMagicContextStorageResolution() {
+  const testDataDir = process.env.MAGIC_CONTEXT_TEST_DATA_DIR?.trim();
+  if (testDataDir) {
+    const perTestDataHome = process.env.XDG_DATA_HOME?.trim();
+    if (perTestDataHome && path.resolve(perTestDataHome) !== path.resolve(testDataDir)) {
+      return {
+        path: path.join(perTestDataHome, "cortexkit", "magic-context"),
+        source: "test isolation"
+      };
     }
-    if (false) {}
+    return {
+      path: path.join(testDataDir, "cortexkit", "magic-context"),
+      source: "test isolation"
+    };
   }
-  return path.join(getDataDir(), "cortexkit", "magic-context");
+  if (false) {}
+  const explicitStorageDir = process.env.MAGIC_CONTEXT_STORAGE_DIR?.trim();
+  if (explicitStorageDir) {
+    if (!path.isAbsolute(explicitStorageDir)) {
+      throw new Error("MAGIC_CONTEXT_STORAGE_DIR must be an absolute path");
+    }
+    return { path: explicitStorageDir, source: "environment override" };
+  }
+  const xdgDataHome = process.env.XDG_DATA_HOME?.trim();
+  if (xdgDataHome) {
+    return {
+      path: path.join(xdgDataHome, "cortexkit", "magic-context"),
+      source: "XDG_DATA_HOME"
+    };
+  }
+  return {
+    path: path.join(os.homedir(), ".local", "share", "cortexkit", "magic-context"),
+    source: "platform default"
+  };
+}
+function getMagicContextStorageDir() {
+  return getMagicContextStorageResolution().path;
 }
 function getLegacyOpenCodeMagicContextStorageDir() {
   return path.join(getOpenCodeStorageDir(), "plugin", "magic-context");
@@ -2333,7 +2362,7 @@ var init_data_path = () => {};
 // src/lib/paths.ts
 import { existsSync as existsSync4, readdirSync, statSync as statSync3 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { delimiter as delimiter2, dirname as dirname2, join as join4, resolve } from "node:path";
+import { delimiter as delimiter2, dirname as dirname2, join as join4, resolve as resolve2 } from "node:path";
 function getOpenCodeConfigDir() {
   const envDir = process.env.OPENCODE_CONFIG_DIR?.trim();
   if (envDir)
@@ -2431,7 +2460,7 @@ function resolveOmpPaths() {
   const configRoot = profile ? join4(baseConfigRoot, "profiles", profile) : baseConfigRoot;
   const defaultAgentDir = join4(configRoot, "agent");
   const override = profile ? undefined : process.env.PI_CODING_AGENT_DIR?.trim();
-  const agentDir = override ? resolve(override) : defaultAgentDir;
+  const agentDir = override ? resolve2(override) : defaultAgentDir;
   const canUseXdg = (process.platform === "linux" || process.platform === "darwin") && agentDir === defaultAgentDir;
   let dataRoot = configRoot;
   if (canUseXdg) {
@@ -2469,18 +2498,18 @@ function getOmpPackageDir() {
   if (value === "~")
     return envFirstHomeDir();
   if (value.startsWith("~/") || value.startsWith("~\\")) {
-    return resolve(envFirstHomeDir(), value.slice(2));
+    return resolve2(envFirstHomeDir(), value.slice(2));
   }
-  return resolve(value);
+  return resolve2(value);
 }
 function getOmpNonGlobalConfigSources(cwd = process.cwd()) {
   const sources = process.env.PI_CONFIG_FILES?.split(delimiter2).map((entry) => entry.trim()).filter(Boolean).map((entry) => {
     if (entry === "~")
       return envFirstHomeDir();
     const expanded = entry.startsWith("~/") || entry.startsWith("~\\") ? join4(envFirstHomeDir(), entry.slice(2)) : entry;
-    return resolve(cwd, expanded);
+    return resolve2(cwd, expanded);
   }) ?? [];
-  const projectConfig = resolve(cwd, ".omp", "config.yml");
+  const projectConfig = resolve2(cwd, ".omp", "config.yml");
   if (existsSync4(projectConfig))
     sources.push(projectConfig);
   return [...new Set(sources)];
@@ -10959,7 +10988,7 @@ var init_opencode_plugin_cache = __esm(() => {
 
 // src/adapters/opencode.ts
 import { existsSync as existsSync8, readFileSync as readFileSync5, statSync as statSync5 } from "node:fs";
-import { dirname as dirname4, isAbsolute as isAbsolute2, parse as parsePath, resolve as resolve2 } from "node:path";
+import { dirname as dirname4, isAbsolute as isAbsolute3, parse as parsePath, resolve as resolve3 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 class OpenCodeAdapter {
@@ -11157,7 +11186,7 @@ function isLocalPathPluginEntry(entry) {
   const candidate = typeof entry === "string" ? entry : Array.isArray(entry) && typeof entry[0] === "string" ? entry[0] : null;
   if (!candidate)
     return false;
-  return candidate.startsWith("file://") || isAbsolute2(candidate) || candidate.startsWith("./") || candidate.startsWith("../");
+  return candidate.startsWith("file://") || isAbsolute3(candidate) || candidate.startsWith("./") || candidate.startsWith("../");
 }
 function isDevPathPluginEntry(entry) {
   const candidate = typeof entry === "string" ? entry : Array.isArray(entry) && typeof entry[0] === "string" ? entry[0] : null;
@@ -11168,13 +11197,13 @@ function isDevPathPluginEntry(entry) {
     if (candidate.startsWith("file://")) {
       localPath = fileURLToPath(candidate);
     } else {
-      localPath = resolve2(candidate);
+      localPath = resolve3(candidate);
     }
     if (statSync5(localPath).isFile())
       localPath = dirname4(localPath);
     const root = parsePath(localPath).root;
     while (localPath !== root) {
-      const packagePath = resolve2(localPath, "package.json");
+      const packagePath = resolve3(localPath, "package.json");
       if (existsSync8(packagePath)) {
         const pkg = JSON.parse(readFileSync5(packagePath, "utf8"));
         return pkg.name === OPENCODE_PLUGIN_NAME;
@@ -14480,19 +14509,272 @@ var init_setup_omp = __esm(() => {
   OMP_HOST = createOmpHost(DEFAULT_DEPS2);
 });
 
+// ../plugin/src/shared/redaction.ts
+import { homedir as homedir7, userInfo } from "node:os";
+function escapeRegex(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function redactionTypeForKey(key) {
+  const normalized = key.trim().toLowerCase().replace(/[^a-z0-9_.-]+/g, "_");
+  const suffix = normalized.split(".").filter(Boolean).at(-1) ?? normalized;
+  return suffix || "secret";
+}
+function isNonSecretScalarValue(value) {
+  const v = value.trim();
+  if (v === "true" || v === "false" || v === "null" || v === "undefined")
+    return true;
+  return /^[+-]?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?$/.test(v);
+}
+function isSecretKey(key) {
+  const segments = key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().split(/[._-]+/).filter(Boolean);
+  if (segments.length === 0)
+    return false;
+  if (segments.length === 1) {
+    const first = segments[0];
+    return Boolean(first && SECRET_SEGMENT_PATTERN.test(first));
+  }
+  for (let i2 = 0;i2 < segments.length; i2++) {
+    const seg = segments[i2];
+    if (!seg || !SECRET_SEGMENT_PATTERN.test(seg))
+      continue;
+    let trailingOk = true;
+    for (let j = i2 + 1;j < segments.length; j++) {
+      const tail = segments[j];
+      if (!tail)
+        continue;
+      if (TRAILING_DESCRIPTORS.has(tail))
+        continue;
+      if (SECRET_SEGMENT_PATTERN.test(tail))
+        continue;
+      trailingOk = false;
+      break;
+    }
+    if (!trailingOk)
+      continue;
+    for (let k = i2 - 1;k >= 0; k--) {
+      const lead = segments[k];
+      if (lead && SECRET_QUALIFIERS.has(lead))
+        return true;
+    }
+  }
+  return false;
+}
+function sanitizePathString(value) {
+  const home = process.env.HOME || process.env.USERPROFILE || homedir7();
+  const username = userInfo().username;
+  let sanitized = value;
+  if (home) {
+    sanitized = sanitized.replace(new RegExp(escapeRegex(home), "g"), "~");
+  }
+  sanitized = sanitized.replace(/\/Users\/[^/]+\//g, "/Users/<USER>/");
+  sanitized = sanitized.replace(/\/home\/[^/]+\//g, "/home/<USER>/");
+  sanitized = sanitized.replace(/C:\\Users\\[^\\]+\\/g, "C:\\Users\\<USER>\\");
+  if (username) {
+    sanitized = sanitized.replace(new RegExp(escapeRegex(username), "g"), "<USER>");
+  }
+  return sanitized;
+}
+function redactSecretText(value) {
+  let redacted = value;
+  for (const { pattern, replacement } of SECRET_TEXT_PATTERNS) {
+    if (typeof replacement === "string") {
+      redacted = redacted.replace(pattern, replacement);
+    } else {
+      redacted = redacted.replace(pattern, replacement);
+    }
+  }
+  return redacted;
+}
+function sanitizeDiagnosticText(value) {
+  return redactSecretText(sanitizePathString(value));
+}
+function sanitizeConfigValue(value, keyPath = []) {
+  if (value === null || typeof value === "number" || typeof value === "boolean")
+    return value;
+  const key = keyPath.at(-1) ?? "";
+  if (key && isSecretKey(key)) {
+    return `<REDACTED:${redactionTypeForKey(key)}>`;
+  }
+  if (typeof value === "string")
+    return sanitizeDiagnosticText(value);
+  if (Array.isArray(value)) {
+    return value.map((entry, index) => sanitizeConfigValue(entry, [...keyPath, String(index)]));
+  }
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).map(([entryKey, entry]) => [
+      entryKey,
+      sanitizeConfigValue(entry, [...keyPath, entryKey])
+    ]));
+  }
+  return value;
+}
+var SECRET_WORDS, SECRET_SEGMENT_PATTERN, TRAILING_DESCRIPTORS, SECRET_QUALIFIERS, SECRET_TEXT_PATTERNS;
+var init_redaction = __esm(() => {
+  SECRET_WORDS = [
+    "key",
+    "token",
+    "secret",
+    "password",
+    "auth",
+    "authorization",
+    "bearer",
+    "credential"
+  ];
+  SECRET_SEGMENT_PATTERN = new RegExp(`^(?:${SECRET_WORDS.map((w) => `${w}s?`).join("|")})$`, "i");
+  TRAILING_DESCRIPTORS = new Set(["id", "ids", "value", "values", "header", "headers"]);
+  SECRET_QUALIFIERS = new Set([
+    "api",
+    "access",
+    "private",
+    "client",
+    "auth",
+    "authorization",
+    "secret",
+    "bearer",
+    "session",
+    "refresh",
+    "service",
+    "x",
+    "openai",
+    "anthropic",
+    "google",
+    "github",
+    "huggingface",
+    "aws",
+    "azure"
+  ]);
+  SECRET_TEXT_PATTERNS = [
+    {
+      pattern: /\bsk-ant-(?:api03-)?[A-Za-z0-9_-]{32,}/g,
+      replacement: "<ANTHROPIC_API_KEY_REDACTED>"
+    },
+    {
+      pattern: /\bsk-(?:proj-)?[A-Za-z0-9_-]{12,}/g,
+      replacement: "<OPENAI_API_KEY_REDACTED>"
+    },
+    {
+      pattern: /\bgithub_pat_[A-Za-z0-9_]{20,}/g,
+      replacement: "<GITHUB_PAT_REDACTED>"
+    },
+    {
+      pattern: /\b(?:gh[opsu]|ghr)_[A-Za-z0-9]{30,}/g,
+      replacement: "<GITHUB_TOKEN_REDACTED>"
+    },
+    {
+      pattern: /\bhf_[A-Za-z0-9]{30,}/g,
+      replacement: "<HUGGINGFACE_TOKEN_REDACTED>"
+    },
+    {
+      pattern: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g,
+      replacement: "<AWS_ACCESS_KEY_ID_REDACTED>"
+    },
+    {
+      pattern: /\bxox[abprsuvc]-[A-Za-z0-9-]{10,}/g,
+      replacement: "<SLACK_TOKEN_REDACTED>"
+    },
+    {
+      pattern: /\bAIza[A-Za-z0-9_-]{35}\b/g,
+      replacement: "<GOOGLE_API_KEY_REDACTED>"
+    },
+    {
+      pattern: /\b(Authorization\s*:\s*Bearer\s+)([A-Za-z0-9._~+/=-]{8,})/gi,
+      replacement: (_full, prefix) => `${prefix}<REDACTED:bearer>`
+    },
+    {
+      pattern: /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
+      replacement: "<JWT_REDACTED>"
+    },
+    {
+      pattern: /(["'])([^"']*(?:key|token|secret|password|auth|bearer|credential)[^"']*)\1(\s*:\s*)(["'])([^"']*)\4/gi,
+      replacement: (full, quote, key, separator, valueQuote, value) => isNonSecretScalarValue(value) ? full : `${quote}${key}${quote}${separator}${valueQuote}<REDACTED:${redactionTypeForKey(key)}>${valueQuote}`
+    },
+    {
+      pattern: /\b([A-Za-z0-9_.-]*(?:key|token|secret|password|auth|bearer|credential)[A-Za-z0-9_.-]*)\s*=\s*([^\s'"`]+)/gi,
+      replacement: (full, key, value) => isNonSecretScalarValue(value) ? full : `${key}=<REDACTED:${redactionTypeForKey(key)}>`
+    }
+  ];
+});
+
 // ../plugin/src/shared/logger.ts
 import * as fs from "node:fs";
 import * as path2 from "node:path";
 function recordSwallowedWrite(error) {
   try {
     swallowedWriteCount++;
-    lastErrorMessage = error instanceof Error ? error.message : String(error);
+    lastErrorMessage = sanitizeDiagnosticText(error instanceof Error ? error.message : String(error));
     lastErrorTime = new Date().toISOString();
   } catch {}
 }
 function ensureDir4(filePath) {
   fs.mkdirSync(path2.dirname(filePath), { recursive: true });
 }
+function isMissingFile(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+function getCurrentLogSize(logFile) {
+  if (activeLogFile === logFile && activeLogSize !== null && flushesSinceSizeCheck < SIZE_CHECK_INTERVAL_FLUSHES) {
+    return activeLogSize;
+  }
+  try {
+    const stat = fs.statSync(logFile);
+    if (!stat.isFile()) {
+      throw new Error(`Magic Context log path is not a regular file: ${logFile}`);
+    }
+    fs.chmodSync(logFile, 384);
+    activeLogFile = logFile;
+    activeLogSize = stat.size;
+    flushesSinceSizeCheck = 0;
+    return stat.size;
+  } catch (error) {
+    if (!isMissingFile(error))
+      throw error;
+    activeLogFile = logFile;
+    activeLogSize = 0;
+    flushesSinceSizeCheck = 0;
+    return 0;
+  }
+}
+function capLogData(data) {
+  if (Buffer.byteLength(data) <= MAX_LOG_FILE_BYTES)
+    return data;
+  let bounded = Buffer.from(data).subarray(0, MAX_LOG_FILE_BYTES).toString("utf8");
+  while (Buffer.byteLength(bounded) > MAX_LOG_FILE_BYTES) {
+    bounded = bounded.slice(0, -1);
+  }
+  return bounded;
+}
+function writeBoundedPredecessor(logFile, predecessorPath, size) {
+  const predecessorFd = fs.openSync(predecessorPath, "w", 384);
+  try {
+    fs.fchmodSync(predecessorFd, 384);
+    const bytesToCopy = Math.min(size, MAX_LOG_FILE_BYTES);
+    const sourceFd = fs.openSync(logFile, "r");
+    try {
+      const chunk = Buffer.allocUnsafe(Math.min(64 * 1024, bytesToCopy));
+      let remaining = bytesToCopy;
+      let position = Math.max(0, size - bytesToCopy);
+      while (remaining > 0) {
+        const bytesRead = fs.readSync(sourceFd, chunk, 0, Math.min(chunk.length, remaining), position);
+        if (bytesRead === 0)
+          break;
+        fs.writeSync(predecessorFd, chunk, 0, bytesRead);
+        remaining -= bytesRead;
+        position += bytesRead;
+      }
+    } finally {
+      fs.closeSync(sourceFd);
+    }
+  } finally {
+    fs.closeSync(predecessorFd);
+  }
+}
+function rotateLogFile(logFile, size) {
+  const predecessorPath = `${logFile}.1`;
+  writeBoundedPredecessor(logFile, predecessorPath, size);
+  fs.truncateSync(logFile, 0);
+  activeLogSize = 0;
+  flushesSinceSizeCheck = 0;
+}
 function flush() {
   if (flushTimer) {
     clearTimeout(flushTimer);
@@ -14500,13 +14782,26 @@ function flush() {
   }
   if (buffer.length === 0)
     return;
-  const data = buffer.join("");
+  const bufferedData = buffer.join("");
   buffer = [];
   try {
+    const data = capLogData(bufferedData);
     const logFile = getMagicContextLogPath();
     ensureDir4(logFile);
-    fs.appendFileSync(logFile, data);
+    let currentSize = getCurrentLogSize(logFile);
+    const dataSize = Buffer.byteLength(data);
+    if (currentSize > 0 && currentSize + dataSize > MAX_LOG_FILE_BYTES) {
+      rotateLogFile(logFile, currentSize);
+      currentSize = 0;
+    }
+    fs.appendFileSync(logFile, data, { encoding: "utf8", mode: 384 });
+    activeLogFile = logFile;
+    activeLogSize = currentSize + dataSize;
+    flushesSinceSizeCheck++;
   } catch (error) {
+    activeLogFile = null;
+    activeLogSize = null;
+    flushesSinceSizeCheck = 0;
     recordSwallowedWrite(error);
   }
 }
@@ -14523,9 +14818,9 @@ function log3(message, data) {
     return;
   try {
     const timestamp = new Date().toISOString();
-    const serialized = data === undefined ? "" : data instanceof Error ? ` ${data.message}${data.stack ? `
-${data.stack}` : ""}` : ` ${JSON.stringify(data)}`;
-    buffer.push(`[${timestamp}] ${message}${serialized}
+    const serialized = data === undefined ? "" : data instanceof Error ? ` ${sanitizeDiagnosticText(`${data.message}${data.stack ? `
+${data.stack}` : ""}`)}` : ` ${JSON.stringify(sanitizeConfigValue(data))}`;
+    buffer.push(`[${timestamp}] ${sanitizeDiagnosticText(message)}${serialized}
 `);
     if (buffer.length >= BUFFER_SIZE_LIMIT) {
       flush();
@@ -14534,10 +14829,12 @@ ${data.stack}` : ""}` : ` ${JSON.stringify(data)}`;
     }
   } catch {}
 }
-var isTestEnv = false, buffer, flushTimer = null, FLUSH_INTERVAL_MS = 500, BUFFER_SIZE_LIMIT = 50, swallowedWriteCount = 0, lastErrorMessage = null, lastErrorTime = null;
+var isTestEnv = false, buffer, flushTimer = null, FLUSH_INTERVAL_MS = 500, BUFFER_SIZE_LIMIT = 50, MAX_LOG_FILE_BYTES, SIZE_CHECK_INTERVAL_FLUSHES = 64, activeLogFile = null, activeLogSize = null, flushesSinceSizeCheck = 0, swallowedWriteCount = 0, lastErrorMessage = null, lastErrorTime = null;
 var init_logger = __esm(() => {
   init_data_path();
+  init_redaction();
   buffer = [];
+  MAX_LOG_FILE_BYTES = 32 * 1024 * 1024;
   if (!isTestEnv) {
     process.on("exit", flush);
   }
@@ -15054,7 +15351,7 @@ __export(exports_util, {
   createTransparentProxy: () => createTransparentProxy,
   defineLazy: () => defineLazy,
   esc: () => esc,
-  escapeRegex: () => escapeRegex,
+  escapeRegex: () => escapeRegex2,
   explicitlyAborted: () => explicitlyAborted,
   extend: () => extend,
   finalizeIssue: () => finalizeIssue,
@@ -15261,7 +15558,7 @@ function numKeys(data) {
   }
   return keyCount;
 }
-function escapeRegex(str) {
+function escapeRegex2(str) {
   return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function clone(inst, def, params) {
@@ -16045,7 +16342,7 @@ var cuid, cuid2, ulid, xid, ksuid, nanoid, duration, extendedDuration, guid, uui
     return /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;
   return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);
 }, uuid4, uuid6, uuid7, email, html5Email, rfc5322Email, unicodeEmail, idnEmail, browserEmail, _emoji = `^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$`, ipv4, ipv6, mac = (delimiter3) => {
-  const escapedDelim = escapeRegex(delimiter3 ?? ":");
+  const escapedDelim = escapeRegex2(delimiter3 ?? ":");
   return new RegExp(`^(?:[0-9A-F]{2}${escapedDelim}){5}[0-9A-F]{2}$|^(?:[0-9a-f]{2}${escapedDelim}){5}[0-9a-f]{2}$`);
 }, cidrv4, cidrv6, base64, base64url, hostname, domain, httpProtocol, e164, dateSource = `(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))`, date, string = (params) => {
   const regex = params ? `[\\s\\S]{${params?.minimum ?? 0},${params?.maximum ?? ""}}` : `[\\s\\S]*`;
@@ -16553,7 +16850,7 @@ var init_checks = __esm(() => {
   });
   $ZodCheckIncludes = /* @__PURE__ */ $constructor("$ZodCheckIncludes", (inst, def) => {
     $ZodCheck.init(inst, def);
-    const escapedRegex = escapeRegex(def.includes);
+    const escapedRegex = escapeRegex2(def.includes);
     const pattern = new RegExp(typeof def.position === "number" ? `^.{${def.position}}${escapedRegex}` : escapedRegex);
     def.pattern = pattern;
     inst._zod.onattach.push((inst2) => {
@@ -16577,7 +16874,7 @@ var init_checks = __esm(() => {
   });
   $ZodCheckStartsWith = /* @__PURE__ */ $constructor("$ZodCheckStartsWith", (inst, def) => {
     $ZodCheck.init(inst, def);
-    const pattern = new RegExp(`^${escapeRegex(def.prefix)}.*`);
+    const pattern = new RegExp(`^${escapeRegex2(def.prefix)}.*`);
     def.pattern ?? (def.pattern = pattern);
     inst._zod.onattach.push((inst2) => {
       const bag = inst2._zod.bag;
@@ -16600,7 +16897,7 @@ var init_checks = __esm(() => {
   });
   $ZodCheckEndsWith = /* @__PURE__ */ $constructor("$ZodCheckEndsWith", (inst, def) => {
     $ZodCheck.init(inst, def);
-    const pattern = new RegExp(`.*${escapeRegex(def.suffix)}$`);
+    const pattern = new RegExp(`.*${escapeRegex2(def.suffix)}$`);
     def.pattern ?? (def.pattern = pattern);
     inst._zod.onattach.push((inst2) => {
       const bag = inst2._zod.bag;
@@ -18330,7 +18627,7 @@ var init_schemas = __esm(() => {
     const values = getEnumValues(def.entries);
     const valuesSet = new Set(values);
     inst._zod.values = valuesSet;
-    inst._zod.pattern = new RegExp(`^(${values.filter((k) => propertyKeyTypes.has(typeof k)).map((o2) => typeof o2 === "string" ? escapeRegex(o2) : o2.toString()).join("|")})$`);
+    inst._zod.pattern = new RegExp(`^(${values.filter((k) => propertyKeyTypes.has(typeof k)).map((o2) => typeof o2 === "string" ? escapeRegex2(o2) : o2.toString()).join("|")})$`);
     inst._zod.parse = (payload, _ctx) => {
       const input = payload.value;
       if (valuesSet.has(input)) {
@@ -18352,7 +18649,7 @@ var init_schemas = __esm(() => {
     }
     const values = new Set(def.values);
     inst._zod.values = values;
-    inst._zod.pattern = new RegExp(`^(${def.values.map((o2) => typeof o2 === "string" ? escapeRegex(o2) : o2 ? escapeRegex(o2.toString()) : String(o2)).join("|")})$`);
+    inst._zod.pattern = new RegExp(`^(${def.values.map((o2) => typeof o2 === "string" ? escapeRegex2(o2) : o2 ? escapeRegex2(o2.toString()) : String(o2)).join("|")})$`);
     inst._zod.parse = (payload, _ctx) => {
       const input = payload.value;
       if (values.has(input)) {
@@ -18656,7 +18953,7 @@ var init_schemas = __esm(() => {
         const end = source.endsWith("$") ? source.length - 1 : source.length;
         regexParts.push(source.slice(start, end));
       } else if (part === null || primitiveTypes.has(typeof part)) {
-        regexParts.push(escapeRegex(`${part}`));
+        regexParts.push(escapeRegex2(`${part}`));
       } else {
         throw new Error(`Invalid template literal part: ${part}`);
       }
@@ -29663,7 +29960,7 @@ var init_agent_overrides = __esm(() => {
 });
 
 // ../plugin/src/config/schema/magic-context.ts
-import { homedir as homedir7 } from "node:os";
+import { homedir as homedir8 } from "node:os";
 function defaultTaskConfig(task) {
   const base = { schedule: DEFAULT_TASK_SCHEDULES2[task] };
   if (task === "review-user-memories")
@@ -29675,9 +29972,9 @@ function defaultTaskConfig(task) {
 function expandConfigPath(value) {
   const trimmed = value.trim();
   if (trimmed === "~")
-    return homedir7();
+    return homedir8();
   if (trimmed.startsWith("~/"))
-    return `${homedir7()}/${trimmed.slice(2)}`;
+    return `${homedir8()}/${trimmed.slice(2)}`;
   return trimmed;
 }
 var DEFAULT_EXECUTE_THRESHOLD_PERCENTAGE = 65, EXECUTE_THRESHOLD_CAP_MESSAGE = "execute_threshold is capped at 90% for cache safety: output capacity is reserved from the usable context window, and the remaining 10% absorbs mid-turn growth before the absolute 95% emergency wall. Use a value between 20 and 90.", DEFAULT_HISTORIAN_TIMEOUT_MS = 600000, DEFAULT_HISTORY_BUDGET_PERCENTAGE = 0.15, DEFAULT_LOCAL_EMBEDDING_MODEL = "Xenova/all-MiniLM-L6-v2", PiThinkingLevelSchema, PiConfigSchema, PromptSurfacePresetSchema, PromptSurfaceModelKeySchema, PromptSurfaceToolKeySchema, PromptSurfaceConfigSchema, PER_HARNESS_MIGRATION_INVENTORY, OcEntryObjectSchema, OcEntrySchema, PiEntryObjectSchema, PiEntrySchema, OpenCodeHarnessBlockSchema, PiHarnessBlockSchema, OpenCodeTaskExecutionSchema, PiTaskExecutionSchema, DreamerOpenCodeHarnessBlockSchema, DreamerPiHarnessBlockSchema, ProfileOpenCodeModelBlockSchema, ProfilePiModelBlockSchema, ProfileHistorianSchema, ProfileDreamerSchema, ProfileSidekickSchema, ConfigProfileSchema, ConfigProfilesSchema, CronScheduleSchema, DreamTaskBaseConfigSchema, PromotionThresholdSchema, PrimerPromotionThresholdSchema, DreamTaskConfigSchema, ReviewUserMemoriesTaskConfigSchema, PromotePrimersTaskConfigSchema, DEFAULT_TASK_SCHEDULES2, DreamTasksSchema, AgentMetadataSchema, DreamerConfigSchema, SidekickConfigSchema, HistorianConfigSchema, EmbeddingFallbackProviderSchema, BaseEmbeddingConfigSchema, EmbeddingConfigSchema, MagicContextConfigSchema;
@@ -29916,6 +30213,7 @@ var init_magic_context = __esm(() => {
     query_input_type: exports_external.string().optional().describe("Optional input_type for query (search) embeddings on asymmetric models (e.g. NVIDIA NIM 'query'). When unset, query embeddings use embedding.input_type. Passage/stored content always uses embedding.input_type."),
     truncate: exports_external.string().optional().describe("Optional truncate mode sent in the embedding request body (e.g. NVIDIA NIM accepts 'NONE' | 'START' | 'END'). Omitted from the request when unset."),
     max_input_tokens: exports_external.number().int().positive().optional().describe("Optional maximum input tokens for chunk embeddings. Defaults conservatively to 512 when omitted."),
+    local_runtime: exports_external.enum(["auto", "native", "wasm"]).default("auto").describe("Local provider only: ONNX runtime selection. 'auto' uses native under Node and uses WASM under Bun versions before 1.4.0, where Bun's NAPI teardown race can panic on quit; native is restored automatically on Bun 1.4.0+. Set 'native' only to prefer speed while accepting that pre-1.4.0 Bun crash risk, or 'wasm' to avoid loading the native addon."),
     local_dtype: exports_external.enum([
       "auto",
       "fp32",
@@ -29972,6 +30270,7 @@ var init_magic_context = __esm(() => {
       return {
         provider: "local",
         model: data.model?.trim() || DEFAULT_LOCAL_EMBEDDING_MODEL,
+        local_runtime: data.local_runtime,
         ...data.max_input_tokens ? { max_input_tokens: data.max_input_tokens } : {},
         ...data.local_dtype ? { local_dtype: data.local_dtype } : {}
       };
@@ -30052,7 +30351,8 @@ var init_magic_context = __esm(() => {
     }).default({ enforce_private_permissions: true }).describe("Storage permission policy. The default keeps session content and memories owner-private. Disabling enforcement is for trusted shared-group storage managed externally; every group member able to read the storage can read all stored session content and memories."),
     embedding: EmbeddingConfigSchema.default({
       provider: "local",
-      model: DEFAULT_LOCAL_EMBEDDING_MODEL
+      model: DEFAULT_LOCAL_EMBEDDING_MODEL,
+      local_runtime: "auto"
     }).describe("Embedding provider configuration"),
     subc: exports_external.object({
       connection_file: exports_external.string().trim().min(1).transform(expandConfigPath).describe("Path to the owner-only subc connection file.")
@@ -30654,15 +30954,15 @@ var RUST_COMPACTION_OFF_WARNING = "compaction-off mode does not support rust tra
 
 // ../plugin/src/config/variable.ts
 import { existsSync as existsSync14, readFileSync as readFileSync9 } from "node:fs";
-import { homedir as homedir8 } from "node:os";
-import { dirname as dirname9, isAbsolute as isAbsolute3, resolve as resolve3 } from "node:path";
+import { homedir as homedir9 } from "node:os";
+import { dirname as dirname9, isAbsolute as isAbsolute4, resolve as resolve4 } from "node:path";
 function sensitiveFilePathReason(resolvedPath) {
-  const home = homedir8();
+  const home = homedir9();
   const sensitiveDirs = [
-    { dir: resolve3(home, ".ssh"), label: "SSH keys" },
-    { dir: resolve3(home, ".aws"), label: "AWS credentials" },
-    { dir: resolve3(home, ".gnupg"), label: "GnuPG keyring" },
-    { dir: resolve3(home, ".config", "gh"), label: "GitHub CLI auth" }
+    { dir: resolve4(home, ".ssh"), label: "SSH keys" },
+    { dir: resolve4(home, ".aws"), label: "AWS credentials" },
+    { dir: resolve4(home, ".gnupg"), label: "GnuPG keyring" },
+    { dir: resolve4(home, ".config", "gh"), label: "GitHub CLI auth" }
   ];
   for (const { dir, label } of sensitiveDirs) {
     if (resolvedPath === dir || resolvedPath.startsWith(`${dir}/`)) {
@@ -30720,9 +31020,9 @@ function substituteConfigVariables(input) {
     }
     let filePath = rawPath.trim();
     if (filePath.startsWith("~/")) {
-      filePath = resolve3(homedir8(), filePath.slice(2));
-    } else if (!isAbsolute3(filePath)) {
-      filePath = resolve3(configDir, filePath);
+      filePath = resolve4(homedir9(), filePath.slice(2));
+    } else if (!isAbsolute4(filePath)) {
+      filePath = resolve4(configDir, filePath);
     }
     const sensitiveReason = sensitiveFilePathReason(filePath);
     if (sensitiveReason) {
@@ -31127,17 +31427,17 @@ var init_config = __esm(() => {
 });
 
 // ../plugin/src/shared/opencode-config-dir.ts
-import { homedir as homedir9 } from "node:os";
-import { join as join11, resolve as resolve4 } from "node:path";
+import { homedir as homedir10 } from "node:os";
+import { join as join11, resolve as resolve5 } from "node:path";
 function getCliConfigDir() {
   const envConfigDir = process.env.OPENCODE_CONFIG_DIR?.trim();
   if (envConfigDir) {
-    return resolve4(envConfigDir);
+    return resolve5(envConfigDir);
   }
   if (process.platform === "win32") {
-    return join11(homedir9(), ".config", "opencode");
+    return join11(homedir10(), ".config", "opencode");
   }
-  return join11(process.env.XDG_CONFIG_HOME || join11(homedir9(), ".config"), "opencode");
+  return join11(process.env.XDG_CONFIG_HOME || join11(homedir10(), ".config"), "opencode");
 }
 function getOpenCodeConfigDir2(_options) {
   return getCliConfigDir();
@@ -31155,7 +31455,7 @@ function getOpenCodeConfigPaths(options) {
 var init_opencode_config_dir = () => {};
 
 // ../plugin/src/shared/conflict-detector.ts
-import { homedir as homedir10 } from "node:os";
+import { homedir as homedir11 } from "node:os";
 import { join as join12 } from "node:path";
 function detectConflicts(directory, options) {
   const compactionEnabled = options?.compactionEnabled ?? true;
@@ -31343,7 +31643,7 @@ function readOmoDisabledHooks(directory) {
       }
     }
   }
-  const homeDir2 = process.env.HOME || homedir10();
+  const homeDir2 = process.env.HOME || homedir11();
   const omoHomeDir = join12(homeDir2, ".omo");
   for (const name of ["omo.jsonc", "omo.json"]) {
     const config2 = readJsoncFile(join12(omoHomeDir, name));
@@ -31374,7 +31674,7 @@ var init_conflict_detector = __esm(() => {
 
 // ../plugin/src/shared/conflict-fixer.ts
 import { existsSync as existsSync16, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "node:fs";
-import { homedir as homedir11 } from "node:os";
+import { homedir as homedir12 } from "node:os";
 import { join as join13 } from "node:path";
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -31434,7 +31734,7 @@ function collectOmoConfigPaths(directory) {
       paths.add(projectPath);
     }
   }
-  const homeDir2 = process.env.HOME || homedir11();
+  const homeDir2 = process.env.HOME || homedir12();
   const omoHomeDir = join13(homeDir2, ".omo");
   for (const name of OMO_UNIFIED_NAMES) {
     const userPath = join13(omoHomeDir, name);
@@ -32256,6 +32556,9 @@ async function drainAuthority(args) {
         if (next === cursor3)
           break;
       }
+      if (args.domain === "memories") {
+        resolvePendingMemoryReferencesForDrain(args.db);
+      }
       for (const step of [
         "seed",
         "memories",
@@ -32376,6 +32679,47 @@ function rowNullableString(row, key) {
   const value = row[key];
   return typeof value === "string" ? value : null;
 }
+function memorySnapshotTimestamp(row, key) {
+  const value = row[key];
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+function parsedMemorySnapshot(snapshotJson, fallback) {
+  try {
+    const parsed = JSON.parse(snapshotJson);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : fallback;
+  } catch {
+    return fallback;
+  }
+}
+function guardMemorySnapshotByRecency(args) {
+  const effectiveRow = { ...args.row };
+  if (!args.existing) {
+    return { effectiveRow, hostUpdatedNewer: false, hostVerificationNewer: false };
+  }
+  const existing = args.existing;
+  const preserve = (columns) => {
+    for (const column of columns) {
+      if (Object.hasOwn(existing, column)) {
+        effectiveRow[column] = existing[column];
+      }
+    }
+  };
+  preserve(IMMUTABLE_MEMORY_SNAPSHOT_COLUMNS);
+  const hostUpdatedNewer = memorySnapshotTimestamp(existing, "updated_at") > memorySnapshotTimestamp(args.snapshot, "updated_at");
+  const hostClassificationNewer = hostUpdatedNewer || memorySnapshotTimestamp(existing, "classified_at") > memorySnapshotTimestamp(args.snapshot, "classified_at");
+  const snapshotCarriesUpdatedAt = hasSnapshotField(args.snapshot, "updated_at");
+  const hostVerificationNewer = hostUpdatedNewer && snapshotCarriesUpdatedAt;
+  const hostMuralNewer = hostUpdatedNewer && snapshotCarriesUpdatedAt;
+  if (hostUpdatedNewer)
+    preserve(UPDATED_MEMORY_SNAPSHOT_COLUMNS);
+  if (hostClassificationNewer)
+    preserve(CLASSIFICATION_MEMORY_SNAPSHOT_COLUMNS);
+  if (hostVerificationNewer)
+    preserve(VERIFICATION_MEMORY_SNAPSHOT_COLUMNS);
+  if (hostMuralNewer)
+    preserve(MURAL_MEMORY_SNAPSHOT_COLUMNS);
+  return { effectiveRow, hostUpdatedNewer, hostVerificationNewer };
+}
 function hasSnapshotField(row, key) {
   return Object.prototype.hasOwnProperty.call(row, key);
 }
@@ -32520,11 +32864,11 @@ function prepareMirrorPageStatements(db) {
               verification_status = ?, verified_at = ?, classified_at = ?, superseded_by_memory_id = ?,
               merged_from = ?, metadata_json = ?, mural_cue = ?, mural_cue_hash = ?, mural_cue_at = ?,
               mural_cue_rejection_count = ? WHERE id = ?`),
-    updateSuperseded: db.prepare("UPDATE memories SET superseded_by_memory_id = ? WHERE id = ?"),
+    updateSuperseded: db.prepare("UPDATE memories SET superseded_by_memory_id = ?, updated_at = ? WHERE id = ?"),
     deletePendingReference: db.prepare("DELETE FROM mirror_pending_references WHERE domain = 'memories' AND module_project = ? AND module_row_id = ?"),
     upsertPendingReference: db.prepare("INSERT INTO mirror_pending_references(domain, module_project, module_row_id, target_module_row_id) VALUES ('memories', ?, ?, ?) ON CONFLICT(domain, module_project, module_row_id) DO UPDATE SET target_module_row_id = excluded.target_module_row_id"),
     deleteMemoryVerifications: db.prepare("DELETE FROM memory_verifications WHERE memory_id = ?"),
-    insertMemoryVerification: db.prepare("INSERT INTO memory_verifications(memory_id, file_path, verified_at, mapped_at) VALUES (?, ?, ?, ?)"),
+    insertMemoryVerification: db.prepare("INSERT INTO memory_verifications(memory_id, file_path, verified_at, mapped_at, mapping_origin) VALUES (?, ?, ?, ?, ?)"),
     noteById: db.prepare("SELECT * FROM notes WHERE id = ?"),
     noteIdByStoreId: db.prepare("SELECT id FROM notes WHERE id = ? AND type = 'smart' AND project_path = ?"),
     insertNote: db.prepare("INSERT INTO notes (type, status, content, project_path, session_id, created_at, updated_at) VALUES ('smart', 'active', '', ?, ?, 0, 0)"),
@@ -32552,7 +32896,8 @@ function prepareMirrorPageStatements(db) {
                        AND target.module_row_id = pending.target_module_row_id
                      WHERE pending.domain = 'memories'
                        AND source.context_row_id = memories.id
-                )
+                ),
+                    updated_at = ?
               WHERE id IN (
                     SELECT source.context_row_id
                       FROM mirror_pending_references pending
@@ -32582,7 +32927,7 @@ function prepareMirrorPageStatements(db) {
     repairPending: db.prepare("SELECT dirty FROM mirror_memory_repair_state WHERE id = 1"),
     markRepairPending: db.prepare("UPDATE mirror_memory_repair_state SET dirty = 1, updated_at = ? WHERE id = 1"),
     clearRepairPending: db.prepare("UPDATE mirror_memory_repair_state SET dirty = 0, updated_at = ? WHERE id = 1"),
-    repairCandidates: db.prepare(`SELECT memory.id, live.full_row_snapshot
+    repairCandidates: db.prepare(`SELECT memory.id, memory.updated_at, memory.classified_at, live.full_row_snapshot
                FROM memories memory
                JOIN mirror_identity identity
                  ON identity.domain = 'memories'
@@ -32596,9 +32941,14 @@ function prepareMirrorPageStatements(db) {
               WHERE (memory.source_type IS NULL OR memory.importance IS NULL)
                 AND live.full_row_snapshot IS NOT NULL`),
     repairMemory: db.prepare(`UPDATE memories
-                SET source_type = COALESCE(?, source_type),
-                    importance = COALESCE(?, importance)
-              WHERE id = ?`),
+                SET source_type = COALESCE(source_type, ?),
+                    importance = COALESCE(importance, ?),
+                    updated_at = ?
+              WHERE id = ?
+                AND COALESCE(updated_at, 0) <= ?
+                AND COALESCE(classified_at, 0) <= ?
+                AND ((source_type IS NULL AND ? IS NOT NULL)
+                  OR (importance IS NULL AND ? IS NOT NULL))`),
     updateCursor: db.prepare("INSERT INTO mirror_cursors(domain, cursor, updated_at) VALUES (?, ?, ?) ON CONFLICT(domain) DO UPDATE SET cursor = excluded.cursor, updated_at = excluded.updated_at"),
     contextStoreUuid: getContextStoreUuid(db)
   };
@@ -32606,11 +32956,16 @@ function prepareMirrorPageStatements(db) {
 function mirrorIdentity(db, domain2, moduleProject, moduleRowId, statements) {
   return (statements?.identityByModule ?? db.prepare("SELECT context_row_id FROM mirror_identity WHERE domain = ? AND module_project = ? AND module_row_id = ?")).get(domain2, moduleProject, moduleRowId) ?? null;
 }
-function rememberIdentity(db, domain2, moduleProject, moduleRowId, contextRowId, statements) {
+function rememberIdentity(db, domain2, moduleProject, moduleRowId, contextRowId, statements, replaceContextIdentity = domain2 === "notes") {
   const existing = mirrorIdentity(db, domain2, moduleProject, moduleRowId, statements);
-  if (existing)
+  if (existing?.context_row_id === contextRowId)
     return;
-  if (domain2 === "notes") {
+  if (existing) {
+    if (!replaceContextIdentity)
+      return;
+    (statements?.deleteIdentity ?? db.prepare("DELETE FROM mirror_identity WHERE domain = ? AND module_project = ? AND module_row_id = ?")).run(domain2, moduleProject, moduleRowId);
+  }
+  if (replaceContextIdentity) {
     (statements?.deleteIdentityByContext ?? db.prepare("DELETE FROM mirror_identity WHERE domain = ? AND context_row_id = ?")).run(domain2, contextRowId);
   }
   (statements?.insertIdentity ?? db.prepare("INSERT OR IGNORE INTO mirror_identity(domain, module_project, module_row_id, context_row_id) VALUES (?, ?, ?, ?)")).run(domain2, moduleProject, moduleRowId, contextRowId);
@@ -32625,7 +32980,7 @@ function contextMemoryId(db, domain2, moduleProject, row, moduleRowId, statement
   if (sourceUuid && sourceUuid === localStoreUuid && sourceId >= 0) {
     const existing = (statements?.memoryIdByStoreId ?? db.prepare("SELECT id FROM memories WHERE id = ? AND project_path = ?")).get(sourceId, moduleProject);
     if (existing?.id !== undefined) {
-      rememberIdentity(db, domain2, moduleProject, moduleRowId, existing.id, statements);
+      rememberIdentity(db, domain2, moduleProject, moduleRowId, existing.id, statements, true);
       return existing.id;
     }
   }
@@ -32682,37 +33037,46 @@ function applyMemoryRow(db, feed, statements) {
     log3(`[magic-context] skipping memory mirror update for module ${moduleProject}/${feed.module_row_id}: context row ${contextId} belongs to ${existing.project_path}`);
     return;
   }
+  const retainedRecencySnapshot = parsedMemorySnapshot(snapshotJson, row);
+  const recencySnapshot = hasSnapshotField(row, "updated_at") ? row : hasSnapshotField(row, "classified_at") ? { ...retainedRecencySnapshot, classified_at: row.classified_at } : retainedRecencySnapshot;
+  const recencyGuard = guardMemorySnapshotByRecency({
+    row,
+    snapshot: recencySnapshot,
+    existing
+  });
+  const projectedRow = recencyGuard.effectiveRow;
   const has = (key) => hasSnapshotField(row, key);
-  const nullableNumber = (key, previous) => has(key) ? typeof row[key] === "number" && Number.isFinite(row[key]) ? row[key] : null : previous ?? null;
-  const nullableString = (key, previous) => has(key) ? rowNullableString(row, key) : previous ?? null;
-  const hasSuperseded = has("superseded_by_memory_id");
+  const nullableNumber = (key, previous) => has(key) ? typeof projectedRow[key] === "number" && Number.isFinite(projectedRow[key]) ? projectedRow[key] : null : previous ?? null;
+  const nullableString = (key, previous) => has(key) ? rowNullableString(projectedRow, key) : previous ?? null;
+  const hasSuperseded = has("superseded_by_memory_id") && !recencyGuard.hostUpdatedNewer;
   const previousHash = existing?.normalized_hash;
-  statements.updateMemory.run(has("project_path") ? rowString(row, "project_path") : existing?.project_path ?? moduleProject, has("category") ? rowString(row, "category", "CONSTRAINTS") : existing?.category ?? "CONSTRAINTS", has("content") ? rowString(row, "content") : existing?.content ?? "", has("normalized_hash") ? rowString(row, "normalized_hash") : existing?.normalized_hash ?? "", has("importance") ? typeof row.importance === "number" && Number.isFinite(row.importance) ? row.importance : null : existing?.importance ?? null, has("scope") ? rowString(row, "scope", "project") : existing?.scope ?? "project", has("shareable") ? rowNumber(row, "shareable") : existing?.shareable ?? 0, nullableString("source_session_id", existing?.source_session_id), nullableString("source_type", existing?.source_type), has("seen_count") ? rowNumber(row, "seen_count", 1) : existing?.seen_count ?? 1, has("retrieval_count") ? rowNumber(row, "retrieval_count") : existing?.retrieval_count ?? 0, has("first_seen_at") ? rowNumber(row, "first_seen_at") : existing?.first_seen_at ?? 0, has("created_at") ? rowNumber(row, "created_at") : existing?.created_at ?? 0, has("updated_at") ? rowNumber(row, "updated_at") : existing?.updated_at ?? 0, has("last_seen_at") ? rowNumber(row, "last_seen_at") : existing?.last_seen_at ?? 0, nullableNumber("last_retrieved_at", existing?.last_retrieved_at), has("status") ? rowString(row, "status", "active") : existing?.status ?? "active", nullableNumber("expires_at", existing?.expires_at), has("verification_status") ? rowString(row, "verification_status", "unverified") : existing?.verification_status ?? "unverified", nullableNumber("verified_at", existing?.verified_at), nullableNumber("classified_at", existing?.classified_at), hasSuperseded ? null : existing?.superseded_by_memory_id ?? null, nullableString("merged_from", existing?.merged_from), nullableString("metadata_json", existing?.metadata_json), nullableString("mural_cue", existing?.mural_cue), nullableString("mural_cue_hash", existing?.mural_cue_hash), nullableNumber("mural_cue_at", existing?.mural_cue_at), has("mural_cue_rejection_count") ? rowNumber(row, "mural_cue_rejection_count") : existing?.mural_cue_rejection_count ?? 0, contextId);
-  if (hasSuperseded && typeof row.superseded_by_memory_id === "number") {
-    const translated = mirrorIdentity(db, "memories", moduleProject, row.superseded_by_memory_id, statements);
+  statements.updateMemory.run(has("project_path") ? rowString(projectedRow, "project_path") : existing?.project_path ?? moduleProject, has("category") ? rowString(projectedRow, "category", "CONSTRAINTS") : existing?.category ?? "CONSTRAINTS", has("content") ? rowString(projectedRow, "content") : existing?.content ?? "", has("normalized_hash") ? rowString(projectedRow, "normalized_hash") : existing?.normalized_hash ?? "", has("importance") ? typeof projectedRow.importance === "number" && Number.isFinite(projectedRow.importance) ? projectedRow.importance : null : existing?.importance ?? null, has("scope") ? rowString(projectedRow, "scope", "project") : existing?.scope ?? "project", has("shareable") ? rowNumber(projectedRow, "shareable") : existing?.shareable ?? 0, nullableString("source_session_id", existing?.source_session_id), nullableString("source_type", existing?.source_type), has("seen_count") ? rowNumber(projectedRow, "seen_count", 1) : existing?.seen_count ?? 1, has("retrieval_count") ? rowNumber(projectedRow, "retrieval_count") : existing?.retrieval_count ?? 0, has("first_seen_at") ? rowNumber(projectedRow, "first_seen_at") : existing?.first_seen_at ?? 0, has("created_at") ? rowNumber(projectedRow, "created_at") : existing?.created_at ?? 0, has("updated_at") ? rowNumber(projectedRow, "updated_at") : existing?.updated_at ?? 0, has("last_seen_at") ? rowNumber(projectedRow, "last_seen_at") : existing?.last_seen_at ?? 0, nullableNumber("last_retrieved_at", existing?.last_retrieved_at), has("status") ? rowString(projectedRow, "status", "active") : existing?.status ?? "active", nullableNumber("expires_at", existing?.expires_at), has("verification_status") ? rowString(projectedRow, "verification_status", "unverified") : existing?.verification_status ?? "unverified", nullableNumber("verified_at", existing?.verified_at), nullableNumber("classified_at", existing?.classified_at), hasSuperseded ? null : existing?.superseded_by_memory_id ?? null, nullableString("merged_from", existing?.merged_from), nullableString("metadata_json", existing?.metadata_json), nullableString("mural_cue", existing?.mural_cue), nullableString("mural_cue_hash", existing?.mural_cue_hash), nullableNumber("mural_cue_at", existing?.mural_cue_at), has("mural_cue_rejection_count") ? rowNumber(projectedRow, "mural_cue_rejection_count") : existing?.mural_cue_rejection_count ?? 0, contextId);
+  if (hasSuperseded && typeof projectedRow.superseded_by_memory_id === "number") {
+    const translated = mirrorIdentity(db, "memories", moduleProject, projectedRow.superseded_by_memory_id, statements);
     if (translated) {
-      statements.updateSuperseded.run(translated.context_row_id, contextId);
+      statements.updateSuperseded.run(translated.context_row_id, Date.now(), contextId);
       statements.deletePendingReference.run(moduleProject, feed.module_row_id);
     } else {
-      statements.upsertPendingReference.run(moduleProject, feed.module_row_id, row.superseded_by_memory_id);
+      statements.upsertPendingReference.run(moduleProject, feed.module_row_id, projectedRow.superseded_by_memory_id);
     }
   } else if (hasSuperseded) {
     statements.deletePendingReference.run(moduleProject, feed.module_row_id);
   }
-  const appliedHash = has("normalized_hash") ? rowString(row, "normalized_hash") : previousHash;
+  const appliedHash = has("normalized_hash") ? rowString(projectedRow, "normalized_hash") : previousHash;
   if (previousHash !== appliedHash && appliedHash !== undefined) {
     statements.deleteMemoryEmbeddings.run(contextId);
   }
-  if (has("mapping")) {
+  if (has("mapping") && !recencyGuard.hostVerificationNewer) {
     statements.deleteMemoryVerifications.run(contextId);
-    if (Array.isArray(row.mapping)) {
+    if (Array.isArray(projectedRow.mapping)) {
       const files = [
-        ...new Set(row.mapping.filter((file2) => typeof file2 === "string").sort())
+        ...new Set(projectedRow.mapping.filter((file2) => typeof file2 === "string").sort())
       ];
-      const verifiedAt = rowNumber(row, "verified_at");
-      const mappedAt = rowNumber(row, "updated_at", Date.now());
+      const verifiedAt = rowNumber(projectedRow, "verified_at");
+      const mappedAt = rowNumber(projectedRow, "updated_at", Date.now());
+      const mappingOrigin = projectedRow.mapping_origin === "host_rejected_fallback" ? "host_rejected_fallback" : "mapper";
       for (const file2 of files.length > 0 ? files : [""]) {
-        statements.insertMemoryVerification.run(contextId, file2, verifiedAt, mappedAt);
+        statements.insertMemoryVerification.run(contextId, file2, verifiedAt, mappedAt, mappingOrigin);
       }
     }
   }
@@ -32738,7 +33102,11 @@ function repairNullClobberedMemoryRows(statements) {
     const importance = hasSnapshotField(snapshot, "importance") && typeof snapshot.importance === "number" && Number.isFinite(snapshot.importance) ? snapshot.importance : null;
     if (sourceType === null && importance === null)
       continue;
-    statements.repairMemory.run(sourceType, importance, candidate.id);
+    const snapshotVintage = Math.max(memorySnapshotTimestamp(snapshot, "updated_at"), memorySnapshotTimestamp(snapshot, "classified_at"));
+    const hostVintage = Math.max(candidate.updated_at ?? 0, candidate.classified_at ?? 0);
+    if (hostVintage > snapshotVintage)
+      continue;
+    statements.repairMemory.run(sourceType, importance, Date.now(), candidate.id, snapshotVintage, snapshotVintage, sourceType, importance);
   }
   statements.clearRepairPending.run(Date.now());
 }
@@ -32763,9 +33131,17 @@ function contextNoteId(db, feed, moduleProject, statements) {
   return contextId;
 }
 function translateMemoryReferences(statements) {
-  statements.translateMemoryReferences.run();
+  statements.translateMemoryReferences.run(Date.now());
   statements.clearTranslatedReferences.run();
 }
+function resolvePendingMemoryReferencesForDrain(db) {
+  withPrivilegedWriter(db, () => {
+    db.transaction(() => {
+      const statements = prepareMirrorPageStatements(db);
+      translateMemoryReferences(statements);
+    }).immediate();
+  });
+}
 function applyNoteRow(db, feed, statements) {
   const row = feed.full_row_snapshot;
   const moduleProject = rowString(row, "project_path");
@@ -32833,6 +33209,24 @@ function applyMirrorPage(args) {
       if (page.domain === "memories" && resnapshotStatus !== "complete" && page.rows.some((feed) => feed.op === "tombstone")) {
         throw new Error("memory mirror resnapshot must complete before tombstones");
       }
+      if (page.domain === "memories") {
+        for (const feed of page.rows) {
+          if (feed.domain !== "memories" || feed.op === "tombstone" || feed.feed_seq <= durableCursor) {
+            continue;
+          }
+          const row = feed.full_row_snapshot;
+          const moduleProject = rowString(row, "project_path");
+          const sourceUuid = rowNullableString(row, "context_store_uuid");
+          const sourceId = rowNumber(row, "context_row_id", -1);
+          if (!moduleProject || !sourceUuid || sourceUuid !== statements.contextStoreUuid || sourceId < 0) {
+            continue;
+          }
+          const existing = statements.memoryIdByStoreId.get(sourceId, moduleProject);
+          if (existing?.id === undefined)
+            continue;
+          rememberIdentity(db, "memories", moduleProject, feed.module_row_id, existing.id, statements, true);
+        }
+      }
       const touchedProjects = new Set;
       for (const feed of page.rows) {
         if (feed.domain !== page.domain || feed.feed_seq <= nextCursor)
@@ -32944,11 +33338,12 @@ async function ensureLiveMemoryResnapshot(args) {
     }).immediate();
   });
 }
-var AUTHORITY_DOMAINS, moduleNoteEvaluationBridges, MAX_DRAIN_RECAPTURE_ATTEMPTS = 5, MAX_AUTHORITY_SEED_FRAME_BYTES, MEMORY_SNAPSHOT_COLUMNS, mirrorFlights;
+var AUTHORITY_DOMAINS, observedAuthorityRoutingByProject, moduleNoteEvaluationBridges, MAX_DRAIN_RECAPTURE_ATTEMPTS = 5, MAX_AUTHORITY_SEED_FRAME_BYTES, MEMORY_SNAPSHOT_COLUMNS, IMMUTABLE_MEMORY_SNAPSHOT_COLUMNS, CLASSIFICATION_MEMORY_SNAPSHOT_COLUMNS, VERIFICATION_MEMORY_SNAPSHOT_COLUMNS, MURAL_MEMORY_SNAPSHOT_COLUMNS, UPDATED_MEMORY_SNAPSHOT_COLUMNS, mirrorFlights;
 var init_context_authority = __esm(async () => {
   init_logger();
   await init_sqlite();
   AUTHORITY_DOMAINS = ["memories", "notes"];
+  observedAuthorityRoutingByProject = new Map;
   moduleNoteEvaluationBridges = new Map;
   MAX_AUTHORITY_SEED_FRAME_BYTES = 900 * 1024;
   MEMORY_SNAPSHOT_COLUMNS = [
@@ -32984,13 +33379,49 @@ var init_context_authority = __esm(async () => {
     "mural_cue_at",
     "mural_cue_rejection_count"
   ];
+  IMMUTABLE_MEMORY_SNAPSHOT_COLUMNS = ["project_path", "first_seen_at", "created_at"];
+  CLASSIFICATION_MEMORY_SNAPSHOT_COLUMNS = [
+    "importance",
+    "scope",
+    "shareable",
+    "source_type",
+    "classified_at"
+  ];
+  VERIFICATION_MEMORY_SNAPSHOT_COLUMNS = [
+    "verification_status",
+    "verified_at",
+    "mapping",
+    "mapping_origin"
+  ];
+  MURAL_MEMORY_SNAPSHOT_COLUMNS = [
+    "mural_cue",
+    "mural_cue_hash",
+    "mural_cue_at",
+    "mural_cue_rejection_count"
+  ];
+  UPDATED_MEMORY_SNAPSHOT_COLUMNS = [
+    "category",
+    "content",
+    "normalized_hash",
+    "source_session_id",
+    "seen_count",
+    "retrieval_count",
+    "updated_at",
+    "last_seen_at",
+    "last_retrieved_at",
+    "status",
+    "expires_at",
+    "superseded_by_memory_id",
+    "merged_from",
+    "metadata_json"
+  ];
   mirrorFlights = new WeakMap;
 });
 
 // ../plugin/src/features/magic-context/memory/project-identity.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync18, realpathSync as realpathSync2, statSync as statSync7 } from "node:fs";
+import { existsSync as existsSync18, realpathSync as realpathSync2, statSync as statSync8 } from "node:fs";
 import path3 from "node:path";
 function asError(error51) {
   return error51 instanceof Error ? error51 : undefined;
@@ -33035,7 +33466,7 @@ function directoryFallback(directory) {
 }
 function assertDirectoryUsable(canonicalDirectory, rawDirectory) {
   try {
-    const stat = statSync7(canonicalDirectory);
+    const stat = statSync8(canonicalDirectory);
     if (!stat.isDirectory()) {
       throw new ProjectIdentityError("unknown", rawDirectory, `Project path is not a directory: ${canonicalDirectory}`);
     }
@@ -33645,7 +34076,7 @@ class SubcSocket {
     return this.sock.localPort ?? null;
   }
   static connect(host, port, deadlineMs) {
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       const sock = net.connect({ host, port });
       sock.setNoDelay(true);
       const timer = setTimeout(() => {
@@ -33654,7 +34085,7 @@ class SubcSocket {
       }, Math.max(0, deadlineMs - Date.now()));
       sock.once("connect", () => {
         clearTimeout(timer);
-        resolve5(new SubcSocket(sock));
+        resolve6(new SubcSocket(sock));
       });
       sock.once("error", (err) => {
         clearTimeout(timer);
@@ -33686,7 +34117,7 @@ class SubcSocket {
     }
     if (n2 === 0)
       return Promise.resolve(new Uint8Array(0));
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       let timer = null;
       if (Number.isFinite(deadlineMs)) {
         const remaining = deadlineMs - Date.now();
@@ -33699,7 +34130,7 @@ class SubcSocket {
           reject(new SocketTimeoutError(`timed out waiting for ${n2} bytes`));
         }, remaining);
       }
-      this.waiter = { need: n2, resolve: resolve5, reject, timer };
+      this.waiter = { need: n2, resolve: resolve6, reject, timer };
       this.tryServe();
     });
   }
@@ -33723,7 +34154,7 @@ class SubcSocket {
     let queued = false;
     let settled = false;
     let timer = null;
-    const completed = new Promise((resolve5, reject) => {
+    const completed = new Promise((resolve6, reject) => {
       const settle = (run) => {
         if (settled)
           return;
@@ -33747,7 +34178,7 @@ class SubcSocket {
             if (err) {
               reject(new SocketWriteQueuedError("subc socket reported a write error after bytes were handed to the socket", err instanceof Error ? err : new Error(String(err))));
             } else {
-              resolve5();
+              resolve6();
             }
           });
         });
@@ -33948,14 +34379,14 @@ class SubcClient {
     const admission = opts.admissionClass ?? AdmissionClass.Normal;
     const corr = this.allocateCorr();
     const key = pendingKey(handle, corr);
-    const closed = new Promise((resolve5, reject) => {
+    const closed = new Promise((resolve6, reject) => {
       if (this.closedErr) {
         reject(this.closedErr);
         return;
       }
       this.pending.set(key, {
         handle,
-        resolve: () => resolve5(),
+        resolve: () => resolve6(),
         reject,
         onProgress: onEvent,
         timer: null,
@@ -34040,11 +34471,11 @@ class SubcClient {
     const waiters = [];
     for (const pending of this.pending.values()) {
       if (pending.handle === handle && !pending.subscription) {
-        waiters.push(new Promise((resolve5) => {
+        waiters.push(new Promise((resolve6) => {
           const previous = pending.onSettle;
           pending.onSettle = () => {
             previous?.();
-            resolve5();
+            resolve6();
           };
         }));
       }
@@ -34100,11 +34531,11 @@ class SubcClient {
     const channel = handle?.channel ?? 0;
     const epoch = handle?.epoch ?? 0;
     const frame = buildFrame(FrameType.Request, buildFlags(false, priority, false, admission), channel, epoch, corr, body);
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       const ms = timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
       const pending = {
         handle,
-        resolve: resolve5,
+        resolve: resolve6,
         reject,
         onProgress,
         timer: null,
@@ -34178,11 +34609,11 @@ class SubcClient {
       }
       return this.outcomeUnknownCallError("connection dropped before the managed call returned a response", error51);
     };
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       const ms = timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
       const pending = {
         handle,
-        resolve: resolve5,
+        resolve: resolve6,
         reject,
         onProgress,
         timer: null,
@@ -34562,7 +34993,7 @@ function normalizeConnectOptions(opts) {
     identity: opts.identity,
     targetKind: opts.targetKind ?? DEFAULT_MANAGED_TARGET_KIND,
     reconnectBackoff: opts.reconnectBackoff ?? DEFAULT_RECONNECT_BACKOFF,
-    sleep: opts.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms))),
+    sleep: opts.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms))),
     timeoutArbitrationGraceMs: opts.timeoutArbitrationGraceMs ?? TIMEOUT_ARBITRATION_GRACE_MS
   };
 }
@@ -34715,6 +35146,12 @@ function isConnectionFailure(error51) {
     ].includes(code) || /\bclient closed\b|\bconnection closed\b|\bclosed the connection\b/i.test(message);
   });
 }
+function routeOpenWithoutAmbientConsumerIdentity(client, target, identity, options = {}) {
+  return client.routeOpen(target, identity, {
+    ...options,
+    consumerIdentity: null
+  });
+}
 
 class SubcModuleTransport {
   connectionFile;
@@ -34861,7 +35298,7 @@ class SubcModuleTransport {
     if (this.queuedLaneWaiters >= SERIAL_LANE_MAX_WAITERS || lane.waiters.length >= SERIAL_LANE_MAX_WAITERS_PER_SESSION) {
       return Promise.reject(this.queueFullError());
     }
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       const waiter = {};
       const removeAndReject = (error51) => {
         if (waiter.settled)
@@ -34879,7 +35316,7 @@ class SubcModuleTransport {
       };
       waiter.signal = signal;
       waiter.deadlineMs = deadlineMs;
-      waiter.resolve = resolve5;
+      waiter.resolve = resolve6;
       waiter.reject = reject;
       waiter.settled = false;
       waiter.onAbort = () => removeAndReject(signal?.reason ?? new Error("module transport call aborted"));
@@ -35088,7 +35525,7 @@ class SubcModuleTransport {
         harness: getHarness(),
         session: `${this.routeSessionPrefix}${sessionId}`
       };
-      const route = await this.beforeDeadline(client.routeOpen(target, identity), deadlineMs, "opening the module route");
+      const route = await this.beforeDeadline(routeOpenWithoutAmbientConsumerIdentity(client, target, identity), deadlineMs, "opening the module route");
       if (this.client !== client || generation !== this.connectionGeneration) {
         await client.closeRoute(route).catch(() => {
           return;
@@ -35146,7 +35583,7 @@ class SubcModuleTransport {
     return error51;
   }
   sleepAbortable(durationMs, signal) {
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       if (signal?.aborted) {
         reject(signal.reason ?? new Error("module transport call aborted"));
         return;
@@ -35158,7 +35595,7 @@ class SubcModuleTransport {
       };
       const timer = setTimeout(() => {
         signal?.removeEventListener("abort", onAbort);
-        resolve5();
+        resolve6();
       }, Math.max(0, durationMs));
       signal?.addEventListener("abort", onAbort, { once: true });
     });
@@ -35539,192 +35976,6 @@ var init_rpc_utils = __esm(() => {
   rpcProcessListExecFileSync = execFileSync4;
   rpcIdentityPlatform = process.platform;
 });
-// ../plugin/src/shared/redaction.ts
-import { homedir as homedir12, userInfo } from "node:os";
-function escapeRegex2(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function redactionTypeForKey(key) {
-  const normalized = key.trim().toLowerCase().replace(/[^a-z0-9_.-]+/g, "_");
-  const suffix = normalized.split(".").filter(Boolean).at(-1) ?? normalized;
-  return suffix || "secret";
-}
-function isNonSecretScalarValue(value) {
-  const v = value.trim();
-  if (v === "true" || v === "false" || v === "null" || v === "undefined")
-    return true;
-  return /^[+-]?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?$/.test(v);
-}
-function isSecretKey(key) {
-  const segments = key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().split(/[._-]+/).filter(Boolean);
-  if (segments.length === 0)
-    return false;
-  if (segments.length === 1) {
-    const first = segments[0];
-    return Boolean(first && SECRET_SEGMENT_PATTERN.test(first));
-  }
-  for (let i2 = 0;i2 < segments.length; i2++) {
-    const seg = segments[i2];
-    if (!seg || !SECRET_SEGMENT_PATTERN.test(seg))
-      continue;
-    let trailingOk = true;
-    for (let j = i2 + 1;j < segments.length; j++) {
-      const tail = segments[j];
-      if (!tail)
-        continue;
-      if (TRAILING_DESCRIPTORS.has(tail))
-        continue;
-      if (SECRET_SEGMENT_PATTERN.test(tail))
-        continue;
-      trailingOk = false;
-      break;
-    }
-    if (!trailingOk)
-      continue;
-    for (let k = i2 - 1;k >= 0; k--) {
-      const lead = segments[k];
-      if (lead && SECRET_QUALIFIERS.has(lead))
-        return true;
-    }
-  }
-  return false;
-}
-function sanitizePathString(value) {
-  const home = homedir12();
-  const username = userInfo().username;
-  let sanitized = value;
-  if (home) {
-    sanitized = sanitized.replace(new RegExp(escapeRegex2(home), "g"), "~");
-  }
-  sanitized = sanitized.replace(/\/Users\/[^/]+\//g, "/Users/<USER>/");
-  sanitized = sanitized.replace(/\/home\/[^/]+\//g, "/home/<USER>/");
-  sanitized = sanitized.replace(/C:\\Users\\[^\\]+\\/g, "C:\\Users\\<USER>\\");
-  if (username) {
-    sanitized = sanitized.replace(new RegExp(escapeRegex2(username), "g"), "<USER>");
-  }
-  return sanitized;
-}
-function redactSecretText(value) {
-  let redacted = value;
-  for (const { pattern, replacement } of SECRET_TEXT_PATTERNS) {
-    if (typeof replacement === "string") {
-      redacted = redacted.replace(pattern, replacement);
-    } else {
-      redacted = redacted.replace(pattern, replacement);
-    }
-  }
-  return redacted;
-}
-function sanitizeDiagnosticText(value) {
-  return redactSecretText(sanitizePathString(value));
-}
-function sanitizeConfigValue(value, keyPath = []) {
-  if (value === null || typeof value === "number" || typeof value === "boolean")
-    return value;
-  const key = keyPath.at(-1) ?? "";
-  if (key && isSecretKey(key)) {
-    return `<REDACTED:${redactionTypeForKey(key)}>`;
-  }
-  if (typeof value === "string")
-    return sanitizeDiagnosticText(value);
-  if (Array.isArray(value)) {
-    return value.map((entry, index) => sanitizeConfigValue(entry, [...keyPath, String(index)]));
-  }
-  if (value && typeof value === "object") {
-    return Object.fromEntries(Object.entries(value).map(([entryKey, entry]) => [
-      entryKey,
-      sanitizeConfigValue(entry, [...keyPath, entryKey])
-    ]));
-  }
-  return value;
-}
-var SECRET_WORDS, SECRET_SEGMENT_PATTERN, TRAILING_DESCRIPTORS, SECRET_QUALIFIERS, SECRET_TEXT_PATTERNS;
-var init_redaction = __esm(() => {
-  SECRET_WORDS = [
-    "key",
-    "token",
-    "secret",
-    "password",
-    "auth",
-    "authorization",
-    "bearer",
-    "credential"
-  ];
-  SECRET_SEGMENT_PATTERN = new RegExp(`^(?:${SECRET_WORDS.map((w) => `${w}s?`).join("|")})$`, "i");
-  TRAILING_DESCRIPTORS = new Set(["id", "ids", "value", "values", "header", "headers"]);
-  SECRET_QUALIFIERS = new Set([
-    "api",
-    "access",
-    "private",
-    "client",
-    "auth",
-    "authorization",
-    "secret",
-    "bearer",
-    "session",
-    "refresh",
-    "service",
-    "x",
-    "openai",
-    "anthropic",
-    "google",
-    "github",
-    "huggingface",
-    "aws",
-    "azure"
-  ]);
-  SECRET_TEXT_PATTERNS = [
-    {
-      pattern: /\bsk-ant-(?:api03-)?[A-Za-z0-9_-]{32,}/g,
-      replacement: "<ANTHROPIC_API_KEY_REDACTED>"
-    },
-    {
-      pattern: /\bsk-(?:proj-)?[A-Za-z0-9_-]{32,}/g,
-      replacement: "<OPENAI_API_KEY_REDACTED>"
-    },
-    {
-      pattern: /\bgithub_pat_[A-Za-z0-9_]{20,}/g,
-      replacement: "<GITHUB_PAT_REDACTED>"
-    },
-    {
-      pattern: /\b(?:gh[opsu]|ghr)_[A-Za-z0-9]{30,}/g,
-      replacement: "<GITHUB_TOKEN_REDACTED>"
-    },
-    {
-      pattern: /\bhf_[A-Za-z0-9]{30,}/g,
-      replacement: "<HUGGINGFACE_TOKEN_REDACTED>"
-    },
-    {
-      pattern: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g,
-      replacement: "<AWS_ACCESS_KEY_ID_REDACTED>"
-    },
-    {
-      pattern: /\bxox[abprsuvc]-[A-Za-z0-9-]{10,}/g,
-      replacement: "<SLACK_TOKEN_REDACTED>"
-    },
-    {
-      pattern: /\bAIza[A-Za-z0-9_-]{35}\b/g,
-      replacement: "<GOOGLE_API_KEY_REDACTED>"
-    },
-    {
-      pattern: /\b(Authorization\s*:\s*Bearer\s+)([A-Za-z0-9._~+/=-]{8,})/gi,
-      replacement: (_full, prefix) => `${prefix}<REDACTED:bearer>`
-    },
-    {
-      pattern: /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
-      replacement: "<JWT_REDACTED>"
-    },
-    {
-      pattern: /(["'])([^"']*(?:key|token|secret|password|auth|bearer|credential)[^"']*)\1(\s*:\s*)(["'])([^"']*)\4/gi,
-      replacement: (full, quote, key, separator, valueQuote, value) => isNonSecretScalarValue(value) ? full : `${quote}${key}${quote}${separator}${valueQuote}<REDACTED:${redactionTypeForKey(key)}>${valueQuote}`
-    },
-    {
-      pattern: /\b([A-Za-z0-9_.-]*(?:key|token|secret|password|auth|bearer|credential)[A-Za-z0-9_.-]*)\s*=\s*([^\s'"`]+)/gi,
-      replacement: (full, key, value) => isNonSecretScalarValue(value) ? full : `${key}=<REDACTED:${redactionTypeForKey(key)}>`
-    }
-  ];
-});
-
 // ../plugin/src/features/magic-context/fail-closed-block.ts
 function attachFailClosedBlockingProcessEvidence(process3, evidence) {
   Object.defineProperties(process3, {
@@ -36043,6 +36294,20 @@ var init_compartment_parser = __esm(() => {
   EVENT_FIELD_REGEX = /<([a-z_]+)\s*>(.*?)<\/\1>/gs;
 });
 
+// ../plugin/src/shared/write-transaction-timing.ts
+function logSlowWriteTransaction(site, startedAt, thresholdMs = SLOW_WRITE_TRANSACTION_THRESHOLD_MS) {
+  try {
+    const durationMs = performance.now() - startedAt;
+    if (durationMs < thresholdMs)
+      return;
+    log3(`[magic-context] slow write transaction: site=${site} held=${durationMs.toFixed(1)}ms`);
+  } catch {}
+}
+var SLOW_WRITE_TRANSACTION_THRESHOLD_MS = 1000;
+var init_write_transaction_timing = __esm(() => {
+  init_logger();
+});
+
 // ../plugin/src/features/magic-context/storage-schema-helpers.ts
 function ensureColumn(db, table, column, definition) {
   if (!/^[a-z][a-z0-9_]*$/.test(table) || !/^[a-z][a-z0-9_]*$/.test(column) || !/^[A-Z0-9_"'(),[\]\s]+$/i.test(definition)) {
@@ -36374,6 +36639,7 @@ function runMigrations(db) {
     let migration;
     let currentVersion = 0;
     try {
+      const transactionStartedAt = performance.now();
       const applied = db.transaction(() => {
         currentVersion = getCurrentVersion(db);
         migration = MIGRATIONS.find((candidate) => candidate.version > currentVersion && !isMigrationApplied(db, candidate.version));
@@ -36388,6 +36654,7 @@ function runMigrations(db) {
         db.prepare("INSERT INTO schema_migrations (version, description, applied_at) VALUES (?, ?, ?)").run(migration.version, migration.description, Date.now());
         return true;
       }).immediate();
+      logSlowWriteTransaction("migration-runner", transactionStartedAt);
       if (!applied || !migration)
         break;
       if (migration.version <= 61)
@@ -36412,7 +36679,9 @@ function runMigrations(db) {
   }
   if (touchedLegacyAuthorityBatch) {
     try {
+      const transactionStartedAt = performance.now();
       db.transaction(() => installLatestAuthorityTriggers(db)).immediate();
+      logSlowWriteTransaction("migration-runner", transactionStartedAt);
     } catch (error51) {
       throw new Error(`Migration authority-trigger postcondition failed: ${error51 instanceof Error ? error51.message : String(error51)}. Database may need manual repair.`);
     }
@@ -36425,6 +36694,7 @@ var FORK_MIGRATION_VERSION_FLOOR = 1e4, MigrationLockBusyError, MIGRATIONS, LATE
 var init_migrations = __esm(() => {
   init_compartment_parser();
   init_logger();
+  init_write_transaction_timing();
   init_workspaces();
   MigrationLockBusyError = class MigrationLockBusyError extends Error {
     constructor(message) {
@@ -38451,6 +38721,15 @@ var init_migrations = __esm(() => {
                 );
             `);
       }
+    },
+    {
+      version: 82,
+      description: "record the origin of memory file-independent mappings",
+      up(db) {
+        if (!tableExists(db, "memory_verifications"))
+          return;
+        ensureColumn(db, "memory_verifications", "mapping_origin", "TEXT NOT NULL DEFAULT 'mapper'");
+      }
     }
   ];
   LATEST_MIGRATION_VERSION = MIGRATIONS.reduce((max, m3) => Math.max(max, m3.version), 0);
@@ -38484,17 +38763,17 @@ var init_tool_owner_backfill = __esm(() => {
 
 // ../plugin/src/features/magic-context/storage-db.ts
 import {
-  chmodSync as chmodSync2,
+  chmodSync as chmodSync3,
   copyFileSync,
   cpSync,
   existsSync as existsSync19,
   mkdirSync as mkdirSync7,
   readdirSync as readdirSync2,
   readFileSync as readFileSync13,
-  statSync as statSync8,
+  statSync as statSync9,
   unlinkSync as unlinkSync3
 } from "node:fs";
-import { basename as basename4, dirname as dirname11, join as join15, resolve as resolve5 } from "node:path";
+import { basename as basename4, dirname as dirname11, join as join15, resolve as resolve6 } from "node:path";
 function getPersistedSchemaVersion(db) {
   const hasMigrationsTable = db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'schema_migrations'").get();
   if (!hasMigrationsTable) {
@@ -39025,8 +39304,10 @@ function initializeDatabase(db) {
       -- verified_at=0 means "mapped (files known) but not yet content-verified".
       -- map-memories sets mapped_at + verified_at=0; verify sets verified_at=now.
       verified_at  INTEGER NOT NULL,
-      mapped_at    INTEGER NOT NULL DEFAULT 0,
-      PRIMARY KEY (memory_id, file_path)
+       mapped_at    INTEGER NOT NULL DEFAULT 0,
+       -- Distinguishes mapper-authored independence from a host rejection fallback.
+       mapping_origin TEXT NOT NULL DEFAULT 'mapper',
+       PRIMARY KEY (memory_id, file_path)
     );
     CREATE INDEX IF NOT EXISTS idx_memory_verifications_memory ON memory_verifications(memory_id);
 
@@ -39810,7 +40091,7 @@ CREATE INDEX IF NOT EXISTS idx_dream_queue_pending ON dream_queue(started_at, en
     `);
   ensureColumn(db, "workspaces", "share_categories", `TEXT NOT NULL DEFAULT '["CONSTRAINTS"]'`);
 }
-var databases, pendingAsyncOpens, persistenceByDatabase, persistenceErrorByDatabase, pathByDatabase, LATEST_SUPPORTED_VERSION = 81, PERMISSIONS_ENFORCEABLE, RPC_DISCOVERY_PARSE_GRACE_MS, defaultRpcDiscoveryFs, rpcDiscoveryFs, sqlitePragmaConfig, CHANNEL2_CLAIM_TTL_MS;
+var databases, pendingAsyncOpens, persistenceByDatabase, persistenceErrorByDatabase, pathByDatabase, LATEST_SUPPORTED_VERSION = 82, PERMISSIONS_ENFORCEABLE, RPC_DISCOVERY_PARSE_GRACE_MS, defaultRpcDiscoveryFs, rpcDiscoveryFs, sqlitePragmaConfig, CHANNEL2_CLAIM_TTL_MS;
 var init_storage_db = __esm(async () => {
   init_data_path();
   init_logger();
@@ -39833,7 +40114,7 @@ var init_storage_db = __esm(async () => {
   defaultRpcDiscoveryFs = {
     readdirSync: (path4, options) => options?.withFileTypes ? readdirSync2(path4, { withFileTypes: true }) : readdirSync2(path4),
     readFileSync: (path4, encoding) => String(readFileSync13(path4, encoding)),
-    statSync: (path4) => ({ mtimeMs: statSync8(path4).mtimeMs }),
+    statSync: (path4) => ({ mtimeMs: statSync9(path4).mtimeMs }),
     unlinkSync: (path4) => unlinkSync3(path4)
   };
   rpcDiscoveryFs = defaultRpcDiscoveryFs;
@@ -40188,13 +40469,14 @@ function mergeMemoryRow(db, row, fromIdentity, toIdentity, mergedAt) {
               LIMIT 1`).get(toIdentity, row.category, row.normalized_hash, sourceId);
   if (collision && typeof collision.id === "number") {
     const targetId = collision.id;
-    const mergedSeen = Math.max(Number(collision.seen_count ?? 1), Number(row.seen_count ?? 1));
+    const targetSeen = Number(collision.seen_count ?? 1);
+    const mergedSeen = Math.max(targetSeen, Number(row.seen_count ?? 1));
     const sourceClassifiedAt = Number(row.classified_at ?? 0);
     const targetClassifiedAt = Number(collision.classified_at ?? 0);
     if (sourceClassifiedAt > targetClassifiedAt) {
       db.prepare(`UPDATE memories
-                    SET importance = ?, scope = ?, shareable = ?, classified_at = ?
-                  WHERE id = ?`).run(row.importance, row.scope, row.shareable, row.classified_at, targetId);
+                     SET importance = ?, scope = ?, shareable = ?, classified_at = ?, updated_at = ?
+                   WHERE id = ?`).run(row.importance, row.scope, row.shareable, row.classified_at, mergedAt, targetId);
     }
     const sourceHasCue = typeof row.mural_cue === "string" && row.mural_cue.length > 0;
     const targetHasCue = typeof collision.mural_cue === "string" && collision.mural_cue.length > 0;
@@ -40202,19 +40484,27 @@ function mergeMemoryRow(db, row, fromIdentity, toIdentity, mergedAt) {
     const targetCueAt = Number(collision.mural_cue_at ?? 0);
     if (sourceHasCue && (!targetHasCue || sourceCueAt > targetCueAt)) {
       db.prepare(`UPDATE memories
-                    SET mural_cue = ?, mural_cue_hash = ?, mural_cue_at = ?,
-                        mural_cue_rejection_count = ?
-                  WHERE id = ?`).run(row.mural_cue, row.mural_cue_hash, row.mural_cue_at, row.mural_cue_rejection_count, targetId);
-    }
-    db.prepare(`INSERT INTO memory_verifications (memory_id, file_path, verified_at, mapped_at)
-             SELECT ?, file_path, verified_at, mapped_at
-               FROM memory_verifications
-              WHERE memory_id = ?
-             ON CONFLICT(memory_id, file_path) DO UPDATE SET
-                verified_at = MAX(memory_verifications.verified_at, excluded.verified_at),
-                mapped_at = MAX(memory_verifications.mapped_at, excluded.mapped_at)`).run(targetId, sourceId);
+                     SET mural_cue = ?, mural_cue_hash = ?, mural_cue_at = ?,
+                         mural_cue_rejection_count = ?, updated_at = ?
+                   WHERE id = ?`).run(row.mural_cue, row.mural_cue_hash, row.mural_cue_at, row.mural_cue_rejection_count, mergedAt, targetId);
+    }
+    db.prepare(`INSERT INTO memory_verifications
+                 (memory_id, file_path, verified_at, mapped_at, mapping_origin)
+              SELECT ?, file_path, verified_at, mapped_at, mapping_origin
+                FROM memory_verifications
+               WHERE memory_id = ?
+              ON CONFLICT(memory_id, file_path) DO UPDATE SET
+                 verified_at = MAX(memory_verifications.verified_at, excluded.verified_at),
+                 mapped_at = MAX(memory_verifications.mapped_at, excluded.mapped_at),
+                 mapping_origin = CASE
+                     WHEN excluded.mapped_at >= memory_verifications.mapped_at
+                         THEN excluded.mapping_origin
+                     ELSE memory_verifications.mapping_origin
+                 END`).run(targetId, sourceId);
     db.prepare("DELETE FROM memory_verifications WHERE memory_id = ?").run(sourceId);
-    db.prepare("UPDATE memories SET seen_count = ?, status = COALESCE(status, 'active') WHERE id = ?").run(mergedSeen, targetId);
+    if (mergedSeen !== targetSeen || collision.status === null || collision.status === undefined) {
+      db.prepare("UPDATE memories SET seen_count = ?, status = COALESCE(status, 'active'), updated_at = ? WHERE id = ?").run(mergedSeen, mergedAt, targetId);
+    }
     db.prepare(`UPDATE memories
                 SET status = 'archived',
                     superseded_by_memory_id = ?,
@@ -40230,7 +40520,7 @@ function mergeMemoryRow(db, row, fromIdentity, toIdentity, mergedAt) {
     logRow(db, fromIdentity, toIdentity, "memories", String(sourceId), "superseded", String(targetId), mergedAt);
     return true;
   }
-  const result = db.prepare("UPDATE memories SET project_path = ? WHERE id = ? AND project_path = ?").run(toIdentity, sourceId, fromIdentity);
+  const result = db.prepare("UPDATE memories SET project_path = ?, updated_at = ? WHERE id = ? AND project_path = ?").run(toIdentity, mergedAt, sourceId, fromIdentity);
   if ((result.changes ?? 0) === 0)
     return false;
   logRow(db, fromIdentity, toIdentity, "memories", String(sourceId), "rekeyed", null, mergedAt);
@@ -40464,15 +40754,15 @@ __export(exports_doctor_repair_db, {
 });
 import { spawnSync as spawnSync3 } from "node:child_process";
 import {
-  chmodSync as chmodSync3,
-  closeSync as closeSync3,
+  chmodSync as chmodSync4,
+  closeSync as closeSync4,
   constants as constants2,
   copyFileSync as copyFileSync2,
   existsSync as existsSync21,
-  openSync as openSync3,
+  openSync as openSync4,
   renameSync as renameSync4,
   rmSync as rmSync2,
-  statSync as statSync9
+  statSync as statSync10
 } from "node:fs";
 import { dirname as dirname12, join as join17 } from "node:path";
 function defaultInspectHolders(storageDir) {
@@ -40589,13 +40879,13 @@ function isRecoverCapabilityMissing(errorDetail) {
 function runRecoverShell(sqliteExecutable, sourcePath, recoveredPath, dumpPath) {
   let dumpWriteFd = null;
   try {
-    dumpWriteFd = openSync3(dumpPath, "wx", 384);
+    dumpWriteFd = openSync4(dumpPath, "wx", 384);
     const recovered = spawnSync3(sqliteExecutable, [sourcePath, ".recover"], {
       stdio: ["ignore", dumpWriteFd, "pipe"],
       encoding: "utf8",
       windowsHide: true
     });
-    closeSync3(dumpWriteFd);
+    closeSync4(dumpWriteFd);
     dumpWriteFd = null;
     if (recovered.error || recovered.status !== 0) {
       const errorDetail = sqliteError(recovered);
@@ -40607,7 +40897,7 @@ function runRecoverShell(sqliteExecutable, sourcePath, recoveredPath, dumpPath)
         unavailable: attempted && isRecoverCapabilityMissing(errorDetail)
       };
     }
-    const dumpReadFd = openSync3(dumpPath, "r");
+    const dumpReadFd = openSync4(dumpPath, "r");
     try {
       const replayed = spawnSync3(sqliteExecutable, [recoveredPath], {
         stdio: [dumpReadFd, "ignore", "pipe"],
@@ -40623,7 +40913,7 @@ function runRecoverShell(sqliteExecutable, sourcePath, recoveredPath, dumpPath)
         };
       }
     } finally {
-      closeSync3(dumpReadFd);
+      closeSync4(dumpReadFd);
     }
     return { ok: true };
   } catch (error51) {
@@ -40635,7 +40925,7 @@ function runRecoverShell(sqliteExecutable, sourcePath, recoveredPath, dumpPath)
     };
   } finally {
     if (dumpWriteFd !== null)
-      closeSync3(dumpWriteFd);
+      closeSync4(dumpWriteFd);
     rmSync2(dumpPath, { force: true });
   }
 }
@@ -40856,8 +41146,8 @@ async function runRepairDb(options = {}) {
       return reportSafetyRefusal(prompts, dbPath, finalInspection, backup.basePath);
     }
     try {
-      const originalMode = statSync9(dbPath).mode & 511;
-      chmodSync3(recoveredPath, originalMode);
+      const originalMode = statSync10(dbPath).mode & 511;
+      chmodSync4(recoveredPath, originalMode);
       const originalAsidePath = uniqueBase(`${dbPath}.corrupt-original-${stamp}`);
       const moved = activateReplacement(dbPath, recoveredPath, originalAsidePath);
       reportSchemaTransition(prompts, salvageResult);
@@ -40904,8 +41194,8 @@ async function runRepairDb(options = {}) {
     return REPAIR_DB_EXIT.failed;
   }
   try {
-    const originalMode = statSync9(dbPath).mode & 511;
-    chmodSync3(freshPath, originalMode);
+    const originalMode = statSync10(dbPath).mode & 511;
+    chmodSync4(freshPath, originalMode);
     const originalAsidePath = uniqueBase(`${dbPath}.corrupt-original-${stamp}`);
     const moved = activateReplacement(dbPath, freshPath, originalAsidePath);
     reportSchemaTransition(prompts, fresh);
@@ -41036,6 +41326,18 @@ function migrationKeyFor(sourceSessionId, targetHarness) {
   return createHash3("sha256").update(`${sourceSessionId}
 ${targetHarness}`).digest("hex");
 }
+function moduleManagedProjectForSession(db, sessionId) {
+  const tables = db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name IN ('authority_managed', 'session_projects')").all();
+  const names = new Set(tables.flatMap((row2) => typeof row2.name === "string" ? [row2.name] : []));
+  if (!names.has("authority_managed") || !names.has("session_projects"))
+    return null;
+  const row = db.prepare(`SELECT am.project_path
+               FROM authority_managed am
+               JOIN session_projects sp ON sp.project_path = am.project_path
+              WHERE sp.session_id = ? AND sp.harness = 'opencode'
+              LIMIT 1`).get(sessionId);
+  return typeof row?.project_path === "string" ? row.project_path : null;
+}
 function hasMigrationJournal(db) {
   return Boolean(stmt(db, "SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'migration_pending'").get());
 }
@@ -41596,6 +41898,10 @@ function migrateOpenCodeSessionToPi(opts) {
     const cwd = session.directory ?? session.path ?? process.cwd();
     const outputDir = join19(piSessionsRoot, projectPathToPiDirSlug(cwd));
     const targetHarness = opts.targetHarness ?? "pi";
+    const moduleManagedProject = cortexkitDb === null ? null : moduleManagedProjectForSession(cortexkitDb, session.id);
+    if (moduleManagedProject) {
+      throw new Error(`Migration refused: source session ${session.id} belongs to module-managed project ${moduleManagedProject}; context.db may contain only host mirrors, not the Rust engine truth. Drain authority to TypeScript with \`magic-context doctor drain-authority ${cwd}\`, then retry.`);
+    }
     const journalActive = cortexkitDb !== null && !opts.dryRun;
     let recovery;
     let migrationKey;
@@ -43009,7 +43315,7 @@ var init_redaction2 = __esm(() => {
 import { execFileSync as execFileSync5, spawnSync as spawnSync5 } from "node:child_process";
 import { existsSync as existsSync25, mkdirSync as mkdirSync9, readFileSync as readFileSync15 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
-import { dirname as dirname14, join as join21, resolve as resolve6 } from "node:path";
+import { dirname as dirname14, join as join21, resolve as resolve7 } from "node:path";
 function parseSemver(value) {
   const match = value?.match(/(\d+)\.(\d+)\.(\d+)/);
   return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : null;
@@ -43135,8 +43441,8 @@ async function runHealthChecks(options) {
     if (!reportedAgentDir.ok) {
       add(results, "warn", "Could not verify OMP active agent directory");
     } else {
-      const reportedPath = resolve6(reportedAgentDir.stdout);
-      const expectedPath = resolve6(getOmpAgentDir());
+      const reportedPath = resolve7(reportedAgentDir.stdout);
+      const expectedPath = resolve7(getOmpAgentDir());
       if (reportedPath === expectedPath) {
         add(results, "pass", `OMP agent directory resolved to ${getOmpAgentDir()}`);
       } else {
@@ -43161,7 +43467,9 @@ async function runHealthChecks(options) {
   else
     for (const warning of loaded.warnings.slice(0, 5))
       add(results, "warn", warning);
-  const dbPath = join21(getMagicContextStorageDir(), "context.db");
+  const storage = getMagicContextStorageResolution();
+  const dbPath = join21(storage.path, "context.db");
+  add(results, "info", `Shared storage: ${storage.path} (source: ${storage.source})`);
   if (!existsSync25(dbPath))
     add(results, "info", `Shared context DB will be created at ${dbPath}`);
   else {
@@ -43485,12 +43793,12 @@ var DEFAULT_TIMEOUT_MS = 1e4, MAX_PREVIEW_CHARS = 240;
 
 // ../plugin/src/shared/tui-config.ts
 import {
-  chmodSync as chmodSync4,
+  chmodSync as chmodSync5,
   existsSync as existsSync26,
   mkdirSync as mkdirSync10,
   readFileSync as readFileSync16,
   renameSync as renameSync6,
-  statSync as statSync10,
+  statSync as statSync11,
   writeFileSync as writeFileSync7
 } from "node:fs";
 import { dirname as dirname15, join as join22 } from "node:path";
@@ -43526,8 +43834,8 @@ function writeTuiConfigAtomic(configPath, config2) {
   const tmpPath = `${configPath}.tmp`;
   writeFileSync7(tmpPath, body);
   try {
-    if (statSync10(configPath, { throwIfNoEntry: false })?.isFile()) {
-      chmodSync4(tmpPath, statSync10(configPath).mode & 511);
+    if (statSync11(configPath, { throwIfNoEntry: false })?.isFile()) {
+      chmodSync5(tmpPath, statSync11(configPath).mode & 511);
     }
   } catch {}
   renameSync6(tmpPath, configPath);
@@ -43599,7 +43907,7 @@ var init_tui_config = __esm(() => {
 });
 
 // src/lib/diagnostics-opencode.ts
-import { existsSync as existsSync27, readdirSync as readdirSync3, readFileSync as readFileSync17, statSync as statSync11 } from "node:fs";
+import { existsSync as existsSync27, readdirSync as readdirSync3, readFileSync as readFileSync17, statSync as statSync12 } from "node:fs";
 import { createRequire as createRequire3 } from "node:module";
 import { homedir as homedir15 } from "node:os";
 import { join as join23 } from "node:path";
@@ -43632,13 +43940,12 @@ function getPluginCacheInfo() {
   }
   return { path: path6, cached: cached2, latest: getSelfVersion() };
 }
-function getStorageDir() {
-  const dataHome = process.env.XDG_DATA_HOME || join23(homedir15(), ".local", "share");
-  return join23(dataHome, "cortexkit", "magic-context");
+function getStorageResolution() {
+  return getMagicContextStorageResolution();
 }
 function fileSize(path6) {
   try {
-    return existsSync27(path6) ? statSync11(path6).size : 0;
+    return existsSync27(path6) ? statSync12(path6).size : 0;
   } catch {
     return 0;
   }
@@ -43715,7 +44022,7 @@ function listDumpsInDir(dir, limit) {
     return { count: 0, recent: [] };
   try {
     const entries = readdirSync3(dir).filter((name) => name.endsWith(".xml")).map((name) => {
-      const stat = statSync11(join23(dir, name));
+      const stat = statSync12(join23(dir, name));
       return {
         name,
         mtime: stat.mtimeMs,
@@ -43965,10 +44272,11 @@ async function collectDiagnostics() {
   const opencodeConfig = readConfig3(configPaths.opencodeConfig);
   const tuiConfig = readConfig3(configPaths.tuiConfig);
   const magicContextConfig = readConfig3(configPaths.magicContextConfig);
-  const storageDirPath = getStorageDir();
+  const storageResolution = getStorageResolution();
+  const storageDirPath = storageResolution.path;
   const contextDbPath = join23(storageDirPath, "context.db");
   const logPath = getMagicContextLogPath2("opencode");
-  const logFileSize = existsSync27(logPath) ? statSync11(logPath).size : 0;
+  const logFileSize = existsSync27(logPath) ? statSync12(logPath).size : 0;
   let compactionEnabled = false;
   try {
     compactionEnabled = isCompactionEnabled(loadPluginConfig(process.cwd()));
@@ -44003,6 +44311,7 @@ async function collectDiagnostics() {
     pluginCache: getPluginCacheInfo(),
     storageDir: {
       path: storageDirPath,
+      source: storageResolution.source,
       exists: existsSync27(storageDirPath),
       contextDbSizeBytes: fileSize(contextDbPath)
     },
@@ -44049,6 +44358,7 @@ function renderDiagnosticsMarkdown(report) {
   };
   const storage = {
     path: sanitizeString(report.storageDir.path),
+    source: report.storageDir.source ?? "unknown",
     exists: report.storageDir.exists,
     context_db_size: formatBytes(report.storageDir.contextDbSizeBytes)
   };
@@ -44166,6 +44476,66 @@ var init_diagnostics_opencode = __esm(() => {
   import_comment_json10 = __toESM(require_src3(), 1);
 });
 
+// ../plugin/src/features/magic-context/memory/embedding-synapse.ts
+var SYNAPSE_CERTIFICATION_REFUSAL_REASONS, factoryClients;
+var init_embedding_synapse = __esm(() => {
+  init_dist5();
+  init_logger();
+  SYNAPSE_CERTIFICATION_REFUSAL_REASONS = new Set([
+    "not_certified",
+    "probe_required",
+    "migration_required"
+  ]);
+  factoryClients = new WeakMap;
+});
+
+// ../plugin/src/features/magic-context/memory/normalize-hash.ts
+var init_normalize_hash = () => {};
+
+// ../plugin/src/features/magic-context/memory/embedding-identity.ts
+var init_embedding_identity = __esm(() => {
+  init_magic_context();
+  init_embedding_synapse();
+  init_normalize_hash();
+});
+
+// ../plugin/src/features/magic-context/memory/embedding-local.ts
+function currentLocalEmbeddingHost() {
+  const bun = globalThis.Bun;
+  const bunVersion = typeof process !== "undefined" && typeof process.versions?.bun === "string" ? process.versions.bun : undefined;
+  return {
+    isElectron: typeof process !== "undefined" && Boolean(process.versions?.electron),
+    isBun: Boolean(bun) || Boolean(bunVersion),
+    bunVersion
+  };
+}
+function bunHasNapiTeardownFix(version2) {
+  const match = version2?.match(/^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/);
+  if (!match || match[4])
+    return false;
+  const parsed = [Number(match[1]), Number(match[2]), Number(match[3])];
+  return parsed.some((part) => !Number.isSafeInteger(part)) ? false : parsed[0] > BUN_NAPI_TEARDOWN_FIX_VERSION[0] || parsed[0] === BUN_NAPI_TEARDOWN_FIX_VERSION[0] && (parsed[1] > BUN_NAPI_TEARDOWN_FIX_VERSION[1] || parsed[1] === BUN_NAPI_TEARDOWN_FIX_VERSION[1] && parsed[2] >= BUN_NAPI_TEARDOWN_FIX_VERSION[2]);
+}
+function resolveLocalEmbeddingRuntime(preference = "auto", host = currentLocalEmbeddingHost()) {
+  if (preference === "native" || preference === "wasm")
+    return preference;
+  if (host.isElectron)
+    return "electron";
+  if (host.isBun && !bunHasNapiTeardownFix(host.bunVersion))
+    return "wasm";
+  return "native";
+}
+var BUN_NAPI_TEARDOWN_FIX_VERSION, STALE_LOCK_MS, MAX_LOCK_WAIT_MS;
+var init_embedding_local = __esm(() => {
+  init_magic_context();
+  init_data_path();
+  init_logger();
+  init_embedding_identity();
+  BUN_NAPI_TEARDOWN_FIX_VERSION = [1, 4, 0];
+  STALE_LOCK_MS = 3 * 60000;
+  MAX_LOCK_WAIT_MS = 5 * 60000;
+});
+
 // src/lib/embedding-runtime.ts
 import { spawnSync as spawnSync6 } from "node:child_process";
 import { existsSync as existsSync28 } from "node:fs";
@@ -44274,9 +44644,12 @@ function describeNativeFailure(status) {
   return status.state === "package-missing" ? "package is not installed" : status.state === "binary-missing" ? "expected platform binding file is absent" : `binding failed to load: ${status.reason}`;
 }
 function isLocalEmbeddingRuntimeBroken(status) {
-  return status.state === "both-broken" || isNativeLocalEmbeddingRuntimeFailure(status);
+  return status.state === "both-broken" || status.state === "wasm-broken" || isNativeLocalEmbeddingRuntimeFailure(status);
 }
 function formatLocalEmbeddingRuntimeDoctorWarning(status) {
+  if (status.state === "wasm-broken") {
+    return "Embedding provider: local — configured/selected onnxruntime-web (WASM) is unavailable — " + `${status.wasmReason}. Reinstall the plugin package or select embedding.local_runtime: native ` + "only on a host where its native runtime is safe.";
+  }
   if (status.state !== "both-broken") {
     return "Embedding provider: local — onnxruntime-node native binding missing — " + `${describeNativeFailure(status)}; its postinstall likely failed. Embeddings will not work. ` + "Reinstall with network access to the npm registry and GitHub releases, " + "or switch `embedding.provider` to an HTTP endpoint (`openai-compatible`).";
   }
@@ -44316,11 +44689,19 @@ function withWasmFallback(native, probeWasm) {
   }
   return { state: "both-broken", nativeFailure: native, wasmReason: wasm.reason };
 }
+function formatLocalEmbeddingRuntimeWasmSelected(status) {
+  return "Embedding provider: local — onnxruntime-web (WASM) selected by embedding.local_runtime/host at " + `${status.wasmPath}. The native addon was not probed or loaded. WASM inference is slower than native.`;
+}
 function probeWasmRuntimeAt(installRoot) {
   const requireFn = createRequire4(join24(installRoot, "package.json"));
   return probeWasmRuntimeFromRequire(requireFn);
 }
-function checkLocalEmbeddingRuntimeAt(installRoot, platform = process.platform, arch = process.arch) {
+function checkLocalEmbeddingRuntimeAt(installRoot, platform = process.platform, arch = process.arch, runtimePreference = "auto", host) {
+  const selectedRuntime = resolveLocalEmbeddingRuntime(runtimePreference, host);
+  if (selectedRuntime !== "native") {
+    const wasm = probeWasmRuntimeAt(installRoot);
+    return wasm.state === "ok" ? { state: "wasm-selected", wasmPath: wasm.wasmPath } : { state: "wasm-broken", wasmReason: wasm.reason };
+  }
   const packageDir = join24(installRoot, "node_modules", "onnxruntime-node");
   let native;
   if (!existsSync28(join24(packageDir, "package.json"))) {
@@ -44339,7 +44720,7 @@ function checkLocalEmbeddingRuntimeAt(installRoot, platform = process.platform,
   }
   return withWasmFallback(native, () => probeWasmRuntimeAt(installRoot));
 }
-function checkLocalEmbeddingRuntime(installRoots, platform = process.platform, arch = process.arch) {
+function checkLocalEmbeddingRuntime(installRoots, platform = process.platform, arch = process.arch, runtimePreference = "auto", host) {
   const existing = installRoots.filter((root) => existsSync28(root));
   if (existing.length === 0) {
     return {
@@ -44350,7 +44731,7 @@ function checkLocalEmbeddingRuntime(installRoots, platform = process.platform, a
   let firstFallback = null;
   let firstFailure = null;
   for (const root of existing) {
-    const status = checkLocalEmbeddingRuntimeAt(root, platform, arch);
+    const status = checkLocalEmbeddingRuntimeAt(root, platform, arch, runtimePreference, host);
     if (status.state === "ok")
       return status;
     if (status.state === "wasm-fallback") {
@@ -44385,10 +44766,15 @@ function probeWasmRuntimeByResolution(pluginDir) {
     };
   }
 }
-function checkLocalEmbeddingRuntimeByResolution(pluginDir, platform = process.platform, arch = process.arch) {
+function checkLocalEmbeddingRuntimeByResolution(pluginDir, platform = process.platform, arch = process.arch, runtimePreference = "auto", host) {
   if (!existsSync28(join24(pluginDir, "package.json"))) {
     return { state: "unknown", reason: "plugin package dir not found" };
   }
+  const selectedRuntime = resolveLocalEmbeddingRuntime(runtimePreference, host);
+  if (selectedRuntime !== "native") {
+    const wasm = probeWasmRuntimeByResolution(pluginDir);
+    return wasm.state === "ok" ? { state: "wasm-selected", wasmPath: wasm.wasmPath } : { state: "wasm-broken", wasmReason: wasm.reason };
+  }
   let onnxDir = null;
   let resolveError;
   try {
@@ -44429,6 +44815,7 @@ function checkLocalEmbeddingRuntimeByResolution(pluginDir, platform = process.pl
 }
 var ONNX_LOAD_PROBE_TIMEOUT_MS = 1e4, ONNX_LOAD_PROBE_OUTPUT_LIMIT = 800, ONNX_LOAD_PROBE_PACKAGE_DIR_ENV = "MAGIC_CONTEXT_ONNX_RUNTIME_NODE_PACKAGE_DIR", ONNX_RUNTIME_NODE_LOAD_PROBE_SCRIPT, runOnnxRuntimeNodeLoadProbeChildForRuntime;
 var init_embedding_runtime = __esm(() => {
+  init_embedding_local();
   ONNX_RUNTIME_NODE_LOAD_PROBE_SCRIPT = [
     'const { createRequire } = require("node:module");',
     'const { join } = require("node:path");',
@@ -44968,10 +45355,10 @@ import {
   constants as fsConstants,
   readFileSync as readFileSync19,
   renameSync as renameSync7,
-  statSync as statSync12,
+  statSync as statSync13,
   writeFileSync as writeFileSync9
 } from "node:fs";
-import { dirname as dirname17, isAbsolute as isAbsolute4, join as join27, resolve as resolve7 } from "node:path";
+import { dirname as dirname17, isAbsolute as isAbsolute5, join as join27, resolve as resolve8 } from "node:path";
 function warn(message) {
   log3(`WARN: ${message}`);
 }
@@ -45401,7 +45788,7 @@ var init_doctor_opencode_cache = __esm(() => {
 
 // src/commands/doctor-opencode.ts
 import { spawnSync as spawnSync7 } from "node:child_process";
-import { existsSync as existsSync32, readFileSync as readFileSync22, statSync as statSync13 } from "node:fs";
+import { existsSync as existsSync32, readFileSync as readFileSync22, statSync as statSync14 } from "node:fs";
 import { createRequire as createRequire5 } from "node:module";
 import { homedir as homedir17 } from "node:os";
 import { join as join29 } from "node:path";
@@ -45623,8 +46010,12 @@ async function runIssueFlow2() {
     return 1;
   }
 }
-function checkLocalEmbeddingRuntimeForDoctor() {
-  const runtime = checkLocalEmbeddingRuntime(getOpenCodePluginCacheRoots());
+function checkLocalEmbeddingRuntimeForDoctor(runtimePreference = "auto") {
+  const runtime = checkLocalEmbeddingRuntime(getOpenCodePluginCacheRoots(), process.platform, process.arch, runtimePreference);
+  if (runtime.state === "wasm-selected") {
+    log2.info(formatLocalEmbeddingRuntimeWasmSelected(runtime));
+    return { issues: 0 };
+  }
   if (runtime.state === "wasm-fallback") {
     log2.warn(formatLocalEmbeddingRuntimeWasmFallback(runtime));
     return { issues: 0 };
@@ -45637,7 +46028,7 @@ function checkLocalEmbeddingRuntimeForDoctor() {
     log2.warn(`Local embedding runtime unverified: ${runtime.reason}`);
     return { issues: 0, unverified: true };
   }
-  log2.success("Embedding provider: local (native runtime OK; Xenova/all-MiniLM-L6-v2 bundled)");
+  log2.success("Embedding provider: local (native runtime selected and OK; Xenova/all-MiniLM-L6-v2 bundled)");
   return { issues: 0 };
 }
 async function checkEmbeddingConfig(magicContextConfigPath) {
@@ -45672,7 +46063,8 @@ async function checkEmbeddingConfig(magicContextConfigPath) {
     return { issues: 0 };
   }
   if (provider === undefined || provider === "local") {
-    return checkLocalEmbeddingRuntimeForDoctor();
+    const runtimePreference = embedding?.local_runtime === "native" || embedding?.local_runtime === "wasm" ? embedding.local_runtime : "auto";
+    return checkLocalEmbeddingRuntimeForDoctor(runtimePreference);
   }
   if (provider !== "openai-compatible") {
     log2.warn(`Unknown embedding provider: ${String(provider)} (expected local | openai-compatible | off)`);
@@ -46164,7 +46556,9 @@ async function runDoctor2(options = {}) {
     warnCount++;
   else
     passCount++;
-  const dbPath = join29(getMagicContextStorageDir(), "context.db");
+  const storage = getMagicContextStorageResolution();
+  const dbPath = join29(storage.path, "context.db");
+  log2.info(`Shared storage: ${storage.path} (source: ${storage.source})`);
   if (!existsSync32(dbPath)) {
     log2.info(`Shared context DB not yet created at ${dbPath} (will be created on first run)`);
   } else {
@@ -46288,7 +46682,7 @@ ${formatDatabaseRepairGuidance(dbPath)}`);
   }
   const logPath = getMagicContextLogPath2("opencode");
   if (existsSync32(logPath)) {
-    const logStat = statSync13(logPath);
+    const logStat = statSync14(logPath);
     const sizeKb = (logStat.size / 1024).toFixed(0);
     log2.info(`Log file: ${logPath} (${sizeKb} KB)`);
   } else {
@@ -46370,10 +46764,8 @@ var init_doctor_opencode = __esm(async () => {
 });
 
 // src/lib/diagnostics-pi.ts
-import { createHash as createHash5 } from "node:crypto";
-import { existsSync as existsSync33, readdirSync as readdirSync5, readFileSync as readFileSync23, statSync as statSync14 } from "node:fs";
+import { existsSync as existsSync33, readdirSync as readdirSync5, readFileSync as readFileSync23, statSync as statSync15 } from "node:fs";
 import { createRequire as createRequire6 } from "node:module";
-import { homedir as homedir18, userInfo as userInfo2 } from "node:os";
 import { join as join30 } from "node:path";
 function getSelfVersion3() {
   const req = createRequire6(import.meta.url);
@@ -46389,56 +46781,16 @@ function getSelfVersion3() {
 }
 function fileSize2(path6) {
   try {
-    return existsSync33(path6) ? statSync14(path6).size : 0;
+    return existsSync33(path6) ? statSync15(path6).size : 0;
   } catch {
     return 0;
   }
 }
-function escapeRegex3(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function currentUserHash() {
-  const username = userInfo2().username || "unknown";
-  return createHash5("sha256").update(username).digest("hex").slice(0, 12);
-}
-function redactSecretString(value) {
-  return redactSecretText(value).replace(/Bearer\s+[A-Za-z0-9._~+\-/=]+/g, "Bearer <REDACTED>").replace(/sk-[A-Za-z0-9_-]{12,}/g, "sk-<REDACTED>").replace(/api[_-]?key=([^\s&]+)/gi, "api_key=<REDACTED>").replace(/token=([^\s&]+)/gi, "token=<REDACTED>");
-}
 function sanitizeString2(value) {
-  const home = process.env.HOME || homedir18();
-  const username = userInfo2().username;
-  const userHash = `<USER:${currentUserHash()}>`;
-  let sanitized = redactSecretString(value);
-  if (home) {
-    sanitized = sanitized.replace(new RegExp(escapeRegex3(home), "g"), "<HOME>");
-  }
-  sanitized = sanitized.replace(/\/Users\/[^/]+\//g, `/Users/${userHash}/`);
-  sanitized = sanitized.replace(/\/home\/[^/]+\//g, `/home/${userHash}/`);
-  sanitized = sanitized.replace(/C:\\Users\\[^\\]+\\/g, `C:\\Users\\${userHash}\\`);
-  if (username) {
-    sanitized = sanitized.replace(new RegExp(escapeRegex3(username), "g"), userHash);
-  }
-  return sanitized;
-}
-function shouldRedactKey(key) {
-  return /api[_-]?key|token|secret|password|authorization|cookie/i.test(key);
+  return sanitizeDiagnosticText(value);
 }
-function sanitizeValue2(value, key = "") {
-  if (value === null || typeof value === "number" || typeof value === "boolean")
-    return value;
-  if (shouldRedactKey(key))
-    return "<REDACTED>";
-  if (typeof value === "string")
-    return sanitizeString2(value);
-  if (Array.isArray(value))
-    return value.map((entry) => sanitizeValue2(entry));
-  if (value && typeof value === "object") {
-    return Object.fromEntries(Object.entries(value).map(([entryKey, entry]) => [
-      entryKey,
-      sanitizeValue2(entry, entryKey)
-    ]));
-  }
-  return value;
+function sanitizeValue2(value) {
+  return sanitizeConfigValue(value);
 }
 function readJsonc(path6) {
   if (!existsSync33(path6))
@@ -46497,7 +46849,7 @@ function collectPiRecentSessions() {
       }
       for (const file2 of files) {
         try {
-          const mtime = statSync14(join30(slugDir, file2)).mtimeMs;
+          const mtime = statSync15(join30(slugDir, file2)).mtimeMs;
           const sessionId = file2.replace(/\.jsonl$/, "");
           candidates.push({ sessionId, directory, mtime });
         } catch {}
@@ -46552,7 +46904,7 @@ function listDumpsInDir2(dir, limit) {
     return { count: 0, recent: [] };
   try {
     const entries = readdirSync5(dir).filter((name) => name.endsWith(".xml")).map((name) => {
-      const stat = statSync14(join30(dir, name));
+      const stat = statSync15(join30(dir, name));
       return {
         name,
         mtime: stat.mtimeMs,
@@ -46623,10 +46975,11 @@ async function collectDiagnostics2(cwd = process.cwd()) {
   const userConfigPath = getPiUserConfigPath();
   const projectConfigPath = getProjectConfigPath(cwd);
   const loaded = loadPiConfig({ cwd });
-  const storageDirPath = getMagicContextStorageDir();
+  const storageResolution = getMagicContextStorageResolution();
+  const storageDirPath = storageResolution.path;
   const dbPath = join30(storageDirPath, "context.db");
   const logPath = getMagicContextLogPath2("pi");
-  const logFileSize = existsSync33(logPath) ? statSync14(logPath).size : 0;
+  const logFileSize = existsSync33(logPath) ? statSync15(logPath).size : 0;
   const otherPiExtensions = packages.filter((entry) => !isPiMagicContextPackageEntry(entry)).map(describePiPackageEntry);
   const recentSessions = collectPiRecentSessions();
   const historianDumps = collectPiHistorianDumps(recentSessions);
@@ -46657,6 +47010,7 @@ async function collectDiagnostics2(cwd = process.cwd()) {
     loadWarnings: loaded.warnings.map(sanitizeString2),
     storageDir: {
       path: storageDirPath,
+      source: storageResolution.source,
       exists: existsSync33(storageDirPath),
       contextDbSizeBytes: fileSize2(dbPath)
     },
@@ -46687,6 +47041,7 @@ function renderDiagnosticsMarkdown2(report) {
   const settings2 = sanitizeValue2(report.settings);
   const storage = {
     path: sanitizeString2(report.storageDir.path),
+    source: report.storageDir.source ?? "unknown",
     exists: report.storageDir.exists,
     context_db_size: formatBytes2(report.storageDir.contextDbSizeBytes)
   };
@@ -46844,10 +47199,10 @@ var init_logs_pi = __esm(() => {
 
 // src/commands/doctor-pi.ts
 import { execFileSync as execFileSync6, spawnSync as spawnSync8 } from "node:child_process";
-import { existsSync as existsSync34, mkdirSync as mkdirSync11, readdirSync as readdirSync6, readFileSync as readFileSync25, rmSync as rmSync4, statSync as statSync15 } from "node:fs";
+import { existsSync as existsSync34, mkdirSync as mkdirSync11, readdirSync as readdirSync6, readFileSync as readFileSync25, rmSync as rmSync4, statSync as statSync16 } from "node:fs";
 import { createRequire as createRequire7 } from "node:module";
-import { homedir as homedir19 } from "node:os";
-import { dirname as dirname18, isAbsolute as isAbsolute5, join as join32 } from "node:path";
+import { homedir as homedir18 } from "node:os";
+import { dirname as dirname18, isAbsolute as isAbsolute6, join as join32 } from "node:path";
 function depsFrom(options) {
   return {
     ...DEFAULT_DEPS5,
@@ -46969,7 +47324,7 @@ function piPluginDirCandidates(packages, cwd) {
     const spec = typeof entry === "string" ? entry.trim() : "";
     if (!spec || spec.startsWith("npm:"))
       continue;
-    const resolved = isAbsolute5(spec) ? spec : join32(agentDir, spec);
+    const resolved = isAbsolute6(spec) ? spec : join32(agentDir, spec);
     dirs.push(resolved);
   }
   dirs.push(join32(agentDir, "npm", "node_modules", PACKAGE_NAME2));
@@ -47066,7 +47421,7 @@ function pinnedVersionFromPackageSpecifier(specifier) {
 }
 function cacheRoots(cwd) {
   const home = process.env.HOME?.trim();
-  const cacheHome = process.env.XDG_CACHE_HOME || join32(home || homedir19(), ".cache");
+  const cacheHome = process.env.XDG_CACHE_HOME || join32(home || homedir18(), ".cache");
   const piCacheRoot = getPiCacheRoot();
   return [
     join32(piCacheRoot, "extensions"),
@@ -47085,7 +47440,7 @@ function findPiMagicContextCacheDirs(cwd, expectedVersion, force = false) {
       return;
     let stat;
     try {
-      stat = statSync15(path6);
+      stat = statSync16(path6);
     } catch {
       return;
     }
@@ -47221,8 +47576,10 @@ async function runHealthChecks2(options) {
   } else if (historianModel.startsWith("github-copilot/") && historianThinkingLevel) {
     add2(results, "pass", `historian.model "${historianModel}" has thinking_level "${historianThinkingLevel}" configured`);
   }
-  const storageDir = getMagicContextStorageDir();
+  const storage = getMagicContextStorageResolution();
+  const storageDir = storage.path;
   const dbPath = join32(storageDir, "context.db");
+  add2(results, "info", `Shared storage: ${storageDir} (source: ${storage.source})`);
   const existedBeforeOpen = existsSync34(dbPath);
   if (existedBeforeOpen)
     add2(results, "pass", `Shared context DB exists at ${dbPath}`);
@@ -47319,9 +47676,14 @@ ${formatDatabaseRepairGuidance(dbPath)}`);
     let runtimeReported = false;
     let runtimeUnverifiedReason = "no installed plugin tree found to inspect";
     for (const pluginDir of piPluginDirCandidates(packages, options.cwd)) {
-      const runtime = checkLocalEmbeddingRuntimeByResolution(pluginDir);
+      const runtime = checkLocalEmbeddingRuntimeByResolution(pluginDir, process.platform, process.arch, loadedConfig.config.embedding.provider === "local" ? loadedConfig.config.embedding.local_runtime : "auto", { isBun: false, isElectron: false });
+      if (runtime.state === "wasm-selected") {
+        add2(results, "info", formatLocalEmbeddingRuntimeWasmSelected(runtime));
+        runtimeReported = true;
+        break;
+      }
       if (runtime.state === "ok") {
-        add2(results, "pass", `Embedding provider: ${loadedConfig.config.embedding.provider} (native runtime OK)`);
+        add2(results, "pass", `Embedding provider: ${loadedConfig.config.embedding.provider} (native runtime selected and OK)`);
         runtimeReported = true;
         break;
       }
@@ -47339,7 +47701,7 @@ ${formatDatabaseRepairGuidance(dbPath)}`);
         runtimeUnverifiedReason = runtime.reason;
     }
     if (!runtimeReported) {
-      add2(results, "warn", `Embedding provider ${loadedConfig.config.embedding.provider}: native runtime unverified (${runtimeUnverifiedReason})`);
+      add2(results, "warn", `Embedding provider ${loadedConfig.config.embedding.provider}: selected runtime unverified (${runtimeUnverifiedReason})`);
     }
   }
   const piEntries = packages.filter(isPiMagicContextPackageEntry).map(describePiPackageEntry);
@@ -47366,7 +47728,7 @@ ${formatDatabaseRepairGuidance(dbPath)}`);
   }
   const logPath = getMagicContextLogPath2("pi");
   if (existsSync34(logPath)) {
-    const stat = statSync15(logPath);
+    const stat = statSync16(logPath);
     const sizeKb = (stat.size / 1024).toFixed(0);
     const lines = readFileSync25(logPath, "utf-8").split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
     add2(results, "info", `Log file: ${logPath} (${sizeKb} KB)`);