@cortexkit/opencode-magic-context 0.22.4 → 0.22.5

package/dist/plugin/embedding-bootstrap-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"embedding-bootstrap-helpers.d.ts","sourceRoot":"","sources":["../../src/plugin/embedding-bootstrap-helpers.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAMtE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,MAAM,WAAW,GACjB,IAAI,GACJ,0BAA0B,GAC1B,uBAAuB,GACvB,iBAAiB,GACjB,sBAAsB,CAAC;AAE7B,MAAM,WAAW,2BAA2B,CAAC,OAAO,SAAS;IAAE,SAAS,EAAE,eAAe,CAAA;CAAE;IACvF,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,WAAW,CAAC;IACzB,OAAO,EAAE;QACL,UAAU,EAAE,WAAW,CAAC;QACxB,aAAa,EAAE,WAAW,CAAC;KAC9B,CAAC;IACF,oBAAoB,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9F,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACnC;AAED,eAAO,MAAM,wBAAwB,aAKnC,CAAC;AAEH,eAAO,MAAM,kCAAkC,aAAmD,CAAC;AAcnG,wBAAgB,qBAAqB,CACjC,QAAQ,EAAE,2BAA2B,CAAC;IAAE,SAAS,EAAE,eAAe,CAAA;CAAE,CAAC,GACtE,OAAO,CA0BT;AAED,wBAAgB,eAAe,CAC3B,QAAQ,EAAE,2BAA2B,CAAC;IAAE,SAAS,EAAE,eAAe,CAAA;CAAE,CAAC,GACtE,MAAM,CAkBR;AAED,wBAAgB,oBAAoB,CAChC,eAAe,EAAE,MAAM,EACvB,QAAQ,EAAE,2BAA2B,CAAC;IAAE,SAAS,EAAE,eAAe,CAAA;CAAE,CAAC,GACtE,IAAI,CAiBN;AAED,wBAAgB,mBAAmB,CAC/B,EAAE,EAAE,QAAQ,EACZ,eAAe,EAAE,MAAM,EACvB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,2BAA2B,CAAC;IAAE,SAAS,EAAE,eAAe,CAAA;CAAE,CAAC,GACtE,OAAO,CAeT;AAED,wBAAgB,wCAAwC,IAAI,IAAI,CAE/D"}
+{"version":3,"file":"embedding-bootstrap-helpers.d.ts","sourceRoot":"","sources":["../../src/plugin/embedding-bootstrap-helpers.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAMtE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,MAAM,WAAW,GACjB,IAAI,GACJ,0BAA0B,GAC1B,uBAAuB,GACvB,iBAAiB,GACjB,sBAAsB,CAAC;AAE7B,MAAM,WAAW,2BAA2B,CAAC,OAAO,SAAS;IAAE,SAAS,EAAE,eAAe,CAAA;CAAE;IACvF,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,WAAW,CAAC;IACzB,OAAO,EAAE;QACL,UAAU,EAAE,WAAW,CAAC;QACxB,aAAa,EAAE,WAAW,CAAC;KAC9B,CAAC;IACF,oBAAoB,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9F,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACnC;AAED,eAAO,MAAM,wBAAwB,aAWnC,CAAC;AAEH,eAAO,MAAM,kCAAkC,aAAmD,CAAC;AAsBnG,wBAAgB,qBAAqB,CACjC,QAAQ,EAAE,2BAA2B,CAAC;IAAE,SAAS,EAAE,eAAe,CAAA;CAAE,CAAC,GACtE,OAAO,CA0BT;AAED,wBAAgB,eAAe,CAC3B,QAAQ,EAAE,2BAA2B,CAAC;IAAE,SAAS,EAAE,eAAe,CAAA;CAAE,CAAC,GACtE,MAAM,CAkBR;AAED,wBAAgB,oBAAoB,CAChC,eAAe,EAAE,MAAM,EACvB,QAAQ,EAAE,2BAA2B,CAAC;IAAE,SAAS,EAAE,eAAe,CAAA;CAAE,CAAC,GACtE,IAAI,CAiBN;AAED,wBAAgB,mBAAmB,CAC/B,EAAE,EAAE,QAAQ,EACZ,eAAe,EAAE,MAAM,EACvB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,2BAA2B,CAAC;IAAE,SAAS,EAAE,eAAe,CAAA;CAAE,CAAC,GACtE,OAAO,CAeT;AAED,wBAAgB,wCAAwC,IAAI,IAAI,CAE/D"}

package/dist/plugin/hooks/create-session-hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-session-hooks.d.ts","sourceRoot":"","sources":["../../../src/plugin/hooks/create-session-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAU7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAC;AACrF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAE9C,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACrC,GAAG,EAAE,aAAa,CAAC;IACnB,YAAY,EAAE,wBAAwB,CAAC;IACvC,gBAAgB,EAAE,gBAAgB,CAAC;CACtC;;;;;;qBAwDwlK,CAAC;;;;;;;;;;;;qBAA9rD,CAAC;mBAAyB,CAAC;iBAAuB,CAAC;iBAAuB,CAAC;0BAAc,CAAC;uBAAiB,CAAC;;;;;;0BAAmo1B,CAAC;;;;;;EAD3o8B"}
+{"version":3,"file":"create-session-hooks.d.ts","sourceRoot":"","sources":["../../../src/plugin/hooks/create-session-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAU7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAC;AACrF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAE9C,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACrC,GAAG,EAAE,aAAa,CAAC;IACnB,YAAY,EAAE,wBAAwB,CAAC;IACvC,gBAAgB,EAAE,gBAAgB,CAAC;CACtC;;;;;;qBAwDwlK,CAAC;;;;;;;;;;;;qBAA9nD,CAAC;mBAAyB,CAAC;iBAAuB,CAAC;iBAAuB,CAAC;0BAAc,CAAC;uBAAiB,CAAC;;;;;;0BAAmk1B,CAAC;;;;;;EAD3o8B"}

package/dist/shared/rpc-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc-server.d.ts","sourceRoot":"","sources":["../../src/shared/rpc-server.ts"],"names":[],"mappings":"AAcA,KAAK,UAAU,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAExF,qBAAa,qBAAqB;IAC9B,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,IAAI,CAAK;IACjB,OAAO,CAAC,QAAQ,CAAiC;IACjD,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAc;IAK/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAmC;gBAE7C,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;IAKjD,sCAAsC;IACtC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,IAAI;IAIjD,6DAA6D;IACvD,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IA2D9B,OAAO,CAAC,uBAAuB;IAgB/B,8CAA8C;IAC9C,IAAI,IAAI,IAAI;IAYZ,OAAO,CAAC,QAAQ;CA0EnB"}
+{"version":3,"file":"rpc-server.d.ts","sourceRoot":"","sources":["../../src/shared/rpc-server.ts"],"names":[],"mappings":"AAcA,KAAK,UAAU,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAexF,qBAAa,qBAAqB;IAC9B,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,IAAI,CAAK;IACjB,OAAO,CAAC,QAAQ,CAAiC;IACjD,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAc;IAK/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAmC;gBAE7C,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;IAKjD,sCAAsC;IACtC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,IAAI;IAIjD,6DAA6D;IACvD,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IA2D9B,OAAO,CAAC,uBAAuB;IAgB/B,8CAA8C;IAC9C,IAAI,IAAI,IAAI;IAYZ,OAAO,CAAC,QAAQ;CA6EnB"}

package/dist/tools/ctx-memory/tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../../src/tools/ctx-memory/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAQ,MAAM,qBAAqB,CAAC;AA4BhE,OAAO,EAIH,KAAK,iBAAiB,EACzB,MAAM,SAAS,CAAC;AAyjBjB,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAI5F"}
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../../src/tools/ctx-memory/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAQ,MAAM,qBAAqB,CAAC;AA6BhE,OAAO,EAIH,KAAK,iBAAiB,EACzB,MAAM,SAAS,CAAC;AAsjBjB,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAI5F"}

package/dist/tools/ctx-search/tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../../src/tools/ctx-search/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAQ,MAAM,qBAAqB,CAAC;AAahE,OAAO,KAAK,EAAkC,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAqKjF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAI5F"}
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../../src/tools/ctx-search/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAQ,MAAM,qBAAqB,CAAC;AAahE,OAAO,KAAK,EAAkC,iBAAiB,EAAE,MAAM,SAAS,CAAC;AA4KjF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAI5F"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@cortexkit/opencode-magic-context",
-	"version": "0.22.4",
+	"version": "0.22.5",
 	"type": "module",
 	"description": "OpenCode plugin for Magic Context — cross-session memory and context management",
 	"main": "dist/index.js",

package/src/shared/rpc-server.ts

@@ -1,4 +1,4 @@
-import { randomBytes } from "node:crypto";
+import { randomBytes, timingSafeEqual } from "node:crypto";
 import {
     mkdirSync,
     readdirSync,
@@ -14,6 +14,19 @@ import { isPidAlive, parseRpcPortFile, rpcPortDir, rpcPortFilePath } from "./rpc
 
 type RpcHandler = (params: Record<string, unknown>) => Promise<Record<string, unknown>>;
 
+/**
+ * Constant-time bearer-token comparison. `timingSafeEqual` throws on
+ * length-mismatched buffers, so guard on length first (the length itself is not
+ * secret — the token bytes are). Avoids leaking the token via response-timing on
+ * the loopback auth check.
+ */
+function tokensMatch(presented: string, expected: string): boolean {
+    const a = Buffer.from(presented, "utf8");
+    const b = Buffer.from(expected, "utf8");
+    if (a.length !== b.length) return false;
+    return timingSafeEqual(a, b);
+}
+
 export class MagicContextRpcServer {
     private server: Server | null = null;
     private port = 0;
@@ -149,9 +162,12 @@ export class MagicContextRpcServer {
         // Require the per-process bearer token on every side-effecting call.
         // The legitimate TUI client reads it from the same port file it used to
         // discover the port; a process that only guessed the port cannot.
+        // Constant-time compare so a local attacker can't byte-probe the token
+        // via response-timing (length-guard first, since timingSafeEqual throws
+        // on length mismatch).
         const auth = req.headers.authorization;
         const presented = typeof auth === "string" ? auth.replace(/^Bearer\s+/i, "") : "";
-        if (presented !== this.token) {
+        if (!tokensMatch(presented, this.token)) {
             res.writeHead(401, { "Content-Type": "application/json" });
             res.end(JSON.stringify({ error: "Unauthorized" }));
             req.resume();

package/src/tui/index.tsx

@@ -532,11 +532,6 @@ function showUpgradeDialog(
                 title={title}
                 message={message}
                 onConfirm={() => {
-                    // Explicit choice → dismiss the fresh reminder durably so it
-                    // won't re-show. (Resume prompts are staging-driven and still
-                    // fire if this run is later interrupted.)
-                    void dismissUpgradeReminder(sessionId)
-                    void requestUpgrade(sessionId)
                     // Start the sidebar's recomp self-poll immediately — the RPC
                     // call fires no message event, so without this the progress
                     // bar wouldn't appear until the upgrade finished.
@@ -548,6 +543,15 @@ function showUpgradeDialog(
                         variant: "info",
                         duration: 5000,
                     })
+                    // Dismiss the durable reminder ONLY after the upgrade request
+                    // actually started. If requestUpgrade() returns false (RPC /
+                    // server / db / auth failure, restart race), the session stays
+                    // legacy — dismissing first would set upgradeRemindedAt and
+                    // suppress all future reminders for a session that never
+                    // upgraded. (Resume prompts are staging-driven and unaffected.)
+                    void requestUpgrade(sessionId).then((started) => {
+                        if (started) void dismissUpgradeReminder(sessionId)
+                    })
                 }}
                 onCancel={() => {
                     // Explicit decline → set the durable stamp so we don't re-prompt