@cortexkit/opencode-magic-context 0.33.1 → 0.34.1

package/src/config/index.test.ts

@@ -0,0 +1,936 @@
+import { describe, expect, it } from "bun:test";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { loadPluginConfig, loadPluginConfigDetailed } from "./index";
+import { RUST_COMPACTION_OFF_WARNING } from "./transform-mode";
+
+/**
+ * Writes a magic-context.jsonc file inside a fresh temp XDG_CONFIG_HOME tree
+ * and runs loadPluginConfig against it. Returns warnings + parsed config.
+ *
+ * Scope directory is NOT set — we pass a unique directory that does not
+ * contain a project config so only the user config is loaded.
+ */
+function loadWithUserConfig(configText: string, extraEnv: Record<string, string> = {}) {
+    const xdg = mkdtempSync(join(tmpdir(), "mc-config-test-"));
+    // Hard cutover: the loader reads user config from <XDG>/cortexkit/.
+    const configDir = join(xdg, "cortexkit");
+    const fs = require("node:fs") as typeof import("node:fs");
+    fs.mkdirSync(configDir, { recursive: true });
+    writeFileSync(join(configDir, "magic-context.jsonc"), configText, "utf-8");
+
+    const origXdg = process.env.XDG_CONFIG_HOME;
+    const savedEnv: Record<string, string | undefined> = {};
+    for (const [k, v] of Object.entries(extraEnv)) {
+        savedEnv[k] = process.env[k];
+        process.env[k] = v;
+    }
+    process.env.XDG_CONFIG_HOME = xdg;
+
+    // Use a directory that definitely has no project config so only the
+    // user config feeds the loader. We use a sibling temp directory.
+    const projectDir = mkdtempSync(join(tmpdir(), "mc-config-proj-"));
+    try {
+        return loadPluginConfig(projectDir);
+    } finally {
+        if (origXdg === undefined) {
+            delete process.env.XDG_CONFIG_HOME;
+        } else {
+            process.env.XDG_CONFIG_HOME = origXdg;
+        }
+        for (const [k, v] of Object.entries(savedEnv)) {
+            if (v === undefined) delete process.env[k];
+            else process.env[k] = v;
+        }
+        try {
+            rmSync(xdg, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
+        } catch {
+            /* Ignore EBUSY on Windows */
+        }
+        try {
+            rmSync(projectDir, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
+        } catch {
+            /* Ignore EBUSY on Windows */
+        }
+    }
+}
+
+function loadWithUserAndProjectConfig(
+    userConfigText: string,
+    projectConfigText: string,
+    extraEnv: Record<string, string> = {},
+) {
+    const xdg = mkdtempSync(join(tmpdir(), "mc-config-test-"));
+    const projectDir = mkdtempSync(join(tmpdir(), "mc-config-proj-"));
+    const fs = require("node:fs") as typeof import("node:fs");
+    // Hard cutover: user config at <XDG>/cortexkit/, project at <root>/.cortexkit/.
+    const configDir = join(xdg, "cortexkit");
+    fs.mkdirSync(configDir, { recursive: true });
+    fs.mkdirSync(join(projectDir, ".cortexkit"), { recursive: true });
+    writeFileSync(join(configDir, "magic-context.jsonc"), userConfigText, "utf-8");
+    writeFileSync(
+        join(projectDir, ".cortexkit", "magic-context.jsonc"),
+        projectConfigText,
+        "utf-8",
+    );
+
+    const origXdg = process.env.XDG_CONFIG_HOME;
+    const savedEnv: Record<string, string | undefined> = {};
+    for (const [k, v] of Object.entries(extraEnv)) {
+        savedEnv[k] = process.env[k];
+        process.env[k] = v;
+    }
+    process.env.XDG_CONFIG_HOME = xdg;
+
+    try {
+        return loadPluginConfig(projectDir);
+    } finally {
+        if (origXdg === undefined) {
+            delete process.env.XDG_CONFIG_HOME;
+        } else {
+            process.env.XDG_CONFIG_HOME = origXdg;
+        }
+        for (const [k, v] of Object.entries(savedEnv)) {
+            if (v === undefined) delete process.env[k];
+            else process.env[k] = v;
+        }
+        try {
+            rmSync(xdg, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
+        } catch {
+            /* Ignore EBUSY on Windows */
+        }
+        try {
+            rmSync(projectDir, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
+        } catch {
+            /* Ignore EBUSY on Windows */
+        }
+    }
+}
+
+describe("loadPluginConfig — graduated mural config", () => {
+    it("adopts legacy experimental.mural at the top-level and warns once", () => {
+        const result = loadWithUserConfig(
+            JSON.stringify({
+                experimental: { mural: { enabled: true, model: "provider/cue-model" } },
+            }),
+        );
+
+        expect(result.mural).toEqual({ enabled: true, model: "provider/cue-model" });
+        expect((result as Record<string, unknown>).experimental).toBeUndefined();
+        expect(
+            result.configWarnings?.some((warning) =>
+                warning.includes('Deprecated "experimental.mural"; use top-level "mural" instead'),
+            ),
+        ).toBe(true);
+    });
+
+    it("keeps the top-level mural values when both spellings exist", () => {
+        const result = loadWithUserConfig(
+            JSON.stringify({
+                mural: { enabled: false, model: "provider/new-model" },
+                experimental: { mural: { enabled: true, model: "provider/old-model" } },
+            }),
+        );
+
+        expect(result.mural).toEqual({ enabled: false, model: "provider/new-model" });
+        expect(result.configWarnings ?? []).not.toContain(
+            expect.stringContaining('Deprecated "experimental.mural"'),
+        );
+    });
+});
+
+describe("loadPluginConfig — transform mode resolution", () => {
+    it("downgrades rust when compaction is off and emits one boot warning", () => {
+        const result = loadWithUserConfig(
+            JSON.stringify({
+                compaction: { enabled: false },
+                transform_mode: "rust",
+                subc: { connection_file: "/tmp/subc.sock" },
+            }),
+        );
+
+        expect(result.transform_mode).toBe("ts");
+        expect(result.configWarnings?.filter((warning) => warning.includes("rust"))).toEqual([
+            `[config] ${RUST_COMPACTION_OFF_WARNING}`,
+        ]);
+    });
+
+    it("keeps rust when compaction is on", () => {
+        const result = loadWithUserConfig(
+            JSON.stringify({
+                compaction: { enabled: true },
+                transform_mode: "rust",
+                subc: { connection_file: "/tmp/subc.sock" },
+            }),
+        );
+
+        expect(result.transform_mode).toBe("rust");
+        expect(result.configWarnings ?? []).not.toContain(
+            expect.stringContaining(RUST_COMPACTION_OFF_WARNING),
+        );
+    });
+});
+
+describe("loadPluginConfig — secret redaction", () => {
+    it("reads an unmigrated legacy project config instead of falling to defaults", () => {
+        const xdg = mkdtempSync(join(tmpdir(), "mc-config-test-"));
+        const home = mkdtempSync(join(tmpdir(), "mc-config-home-"));
+        const projectDir = mkdtempSync(join(tmpdir(), "mc-config-legacy-proj-"));
+        const origXdg = process.env.XDG_CONFIG_HOME;
+        const origHome = process.env.HOME;
+        process.env.XDG_CONFIG_HOME = xdg;
+        process.env.HOME = home;
+        // A real setting the user disabled: it MUST survive the unmigrated window,
+        // not be silently re-enabled by schema defaults (memory defaults to on).
+        writeFileSync(
+            join(projectDir, "magic-context.jsonc"),
+            '{"embedding":{"provider":"off"},"memory":{"enabled":false}}',
+        );
+        try {
+            const result = loadPluginConfigDetailed(projectDir);
+
+            // Read-legacy-on-conflict: the legacy file is the source of truth
+            // until migration completes, so the load is trusted ("ok") and the
+            // real (disabled) setting is honored, not silently defaulted on.
+            // (embedding.* is intentionally stripped from project-scope config for
+            // security, so we assert a non-embedding setting survives.)
+            expect(result.sources.projectConfig).toBe("ok");
+            expect(result.loadOutcome).toBe("ok");
+            expect(result.config.memory.enabled).toBe(false);
+            expect(result.config.configWarnings?.join("\n")).toContain(
+                "reading legacy config from",
+            );
+        } finally {
+            if (origXdg === undefined) delete process.env.XDG_CONFIG_HOME;
+            else process.env.XDG_CONFIG_HOME = origXdg;
+            if (origHome === undefined) delete process.env.HOME;
+            else process.env.HOME = origHome;
+            rmSync(xdg, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
+            rmSync(home, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
+            rmSync(projectDir, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
+        }
+    });
+
+    it("loadPluginConfig (the runtime init path) honors read-legacy, not schema defaults", () => {
+        // The runtime registers via loadPluginConfig (index.ts), NOT the detailed
+        // variant. This locks that the read-legacy fallback applies there too — a
+        // migration refusal must not silently re-enable disabled features at init.
+        const xdg = mkdtempSync(join(tmpdir(), "mc-config-test-"));
+        const home = mkdtempSync(join(tmpdir(), "mc-config-home-"));
+        const projectDir = mkdtempSync(join(tmpdir(), "mc-config-legacy-proj-"));
+        const origXdg = process.env.XDG_CONFIG_HOME;
+        const origHome = process.env.HOME;
+        process.env.XDG_CONFIG_HOME = xdg;
+        process.env.HOME = home;
+        writeFileSync(join(projectDir, "magic-context.jsonc"), '{"memory":{"enabled":false}}');
+        try {
+            const config = loadPluginConfig(projectDir);
+            expect(config.memory.enabled).toBe(false);
+            expect(config.configWarnings?.join("\n")).toContain("reading legacy config from");
+        } finally {
+            if (origXdg === undefined) delete process.env.XDG_CONFIG_HOME;
+            else process.env.XDG_CONFIG_HOME = origXdg;
+            if (origHome === undefined) delete process.env.HOME;
+            else process.env.HOME = origHome;
+            rmSync(xdg, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
+            rmSync(home, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
+            rmSync(projectDir, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
+        }
+    });
+
+    it("does NOT leak resolved env values through Zod validation warnings", () => {
+        const secret = "sk-live-CARDINAL-SIN-IF-THIS-APPEARS-IN-LOGS";
+        const config = JSON.stringify({
+            // `historian_timeout_ms` has a minimum of 60_000. Feeding the
+            // substituted secret string here causes Zod to reject the field
+            // and route through the warning path we care about.
+            historian_timeout_ms: "{env:MC_TEST_SECRET}",
+        });
+
+        const result = loadWithUserConfig(config, { MC_TEST_SECRET: secret });
+        const warnings = result.configWarnings ?? [];
+
+        // The plugin should still load (enabled: true kept by recovery path).
+        expect(result.enabled).toBe(true);
+
+        // No warning or config field may contain the resolved secret.
+        const allText = JSON.stringify({ config: result, warnings });
+        expect(allText).not.toContain(secret);
+        expect(allText).not.toContain("CARDINAL-SIN");
+
+        // But the warnings should still describe what failed. We expect a
+        // warning mentioning historian_timeout_ms and the safe type summary.
+        const relevantWarning = warnings.find((w) => w.includes("historian_timeout_ms"));
+        expect(relevantWarning).toBeDefined();
+        expect(relevantWarning).toContain("invalid value");
+        // Must show type + length, not the value itself.
+        expect(relevantWarning).toMatch(/string, \d+ chars?/);
+    });
+
+    it("redacts long string values of any source (not just env-substituted)", () => {
+        // Verifies the redaction applies to plain invalid values too — we
+        // don't want to special-case env vs non-env because we can't tell
+        // them apart at the Zod layer.
+        const config = JSON.stringify({
+            historian_timeout_ms: "super-secret-plain-literal-that-should-not-leak",
+        });
+
+        const result = loadWithUserConfig(config);
+        const warnings = result.configWarnings ?? [];
+        const combined = warnings.join("\n");
+
+        expect(combined).not.toContain("super-secret-plain-literal-that-should-not-leak");
+        expect(combined).toMatch(/string, \d+ chars?/);
+    });
+
+    it("redacts nested object values to structural shape only", () => {
+        const config = JSON.stringify({
+            historian_timeout_ms: { nested: "secret-xyz", apiKey: "also-secret" },
+        });
+
+        const result = loadWithUserConfig(config);
+        const warnings = result.configWarnings ?? [];
+        const combined = warnings.join("\n");
+
+        expect(combined).not.toContain("secret-xyz");
+        expect(combined).not.toContain("also-secret");
+        expect(combined).toContain("object with keys");
+        expect(combined).toContain("nested");
+        expect(combined).toContain("apiKey");
+    });
+
+    it("preserves dreamer.enabled=false migration after nested-field recovery", () => {
+        const config = JSON.stringify({
+            dreamer: { enabled: false },
+            memory: { injection_budget_tokens: "not-a-number" },
+        });
+
+        const result = loadWithUserConfig(config);
+
+        expect(result.dreamer?.disable).toBe(true);
+        expect(result.configWarnings?.join("\n")).toContain("dreamer.enabled=false");
+    });
+
+    it("recovers an invalid NESTED field without wiping valid siblings in the same block", () => {
+        // Regression: one bad nested field (memory.injection_budget_tokens as a
+        // string) must NOT delete the whole `memory` block — which would silently
+        // drop valid siblings like memory.auto_search.enabled (and, on the
+        // migration path, the just-graduated memory.git_commit_indexing). Recovery
+        // should prune only the invalid leaf and keep the rest.
+        const config = JSON.stringify({
+            memory: {
+                injection_budget_tokens: "not-a-number", // invalid nested leaf
+                auto_search: { enabled: false }, // valid sibling — must survive
+            },
+        });
+
+        const result = loadWithUserConfig(config);
+        const warnings = result.configWarnings ?? [];
+
+        expect(result.enabled).toBe(true);
+        // The valid sibling the user explicitly set must be preserved, not reset
+        // to the schema default (true).
+        expect(result.memory.auto_search.enabled).toBe(false);
+        // The invalid leaf falls back to its schema default.
+        expect(typeof result.memory.injection_budget_tokens).toBe("number");
+        // A warning should name the pruned nested field.
+        const w = warnings.find(
+            (x) => x.includes("memory") && x.includes("injection_budget_tokens"),
+        );
+        expect(w).toBeDefined();
+    });
+
+    it("still shows numeric and boolean invalid values (not secrets by nature)", () => {
+        // Numbers/booleans in config fields are never secrets — they're
+        // plain validation mistakes — so we surface them fully to help
+        // the user diagnose.
+        const config = JSON.stringify({
+            execute_threshold_percentage: 5, // below min (20)
+        });
+
+        const result = loadWithUserConfig(config);
+        const warnings = result.configWarnings ?? [];
+        const combined = warnings.join("\n");
+
+        expect(combined).toContain("execute_threshold_percentage");
+        // `number 5` is the human-friendly safe render.
+        expect(combined).toMatch(/number 5/);
+    });
+
+    it("rejects execute_threshold_percentage > 90 with the cache-safety explanation (issue #111)", () => {
+        const config = JSON.stringify({
+            execute_threshold_percentage: 91, // above cap (90)
+        });
+
+        const result = loadWithUserConfig(config);
+        const warnings = result.configWarnings ?? [];
+        const combined = warnings.join("\n");
+
+        expect(combined).toContain("execute_threshold_percentage");
+        // The custom message explains WHY, not just "too big".
+        expect(combined).toContain("capped at 90% for cache safety");
+    });
+    it("keeps embedding destination fields from trusted user config", () => {
+        const config = JSON.stringify({
+            embedding: {
+                provider: "openai-compatible",
+                endpoint: "https://embeddings.example/v1",
+                model: "text-embedding-3-small",
+            },
+        });
+
+        const result = loadWithUserConfig(config);
+
+        expect(result.embedding.provider).toBe("openai-compatible");
+        expect(result.embedding.endpoint).toBe("https://embeddings.example/v1");
+    });
+
+    it("honors user storage permissions while ignoring a project-tier override", () => {
+        const result = loadWithUserAndProjectConfig(
+            JSON.stringify({ storage: { enforce_private_permissions: false } }),
+            JSON.stringify({ storage: { enforce_private_permissions: true, futureSibling: 1 } }),
+        );
+
+        expect(result.storage.enforce_private_permissions).toBe(false);
+        expect(result.configWarnings?.join("\n")).toContain("storage.enforce_private_permissions");
+    });
+
+    it("ignores embedding destination fields from untrusted project config", () => {
+        const userConfig = JSON.stringify({
+            embedding: {
+                provider: "openai-compatible",
+                endpoint: "https://trusted.example/v1",
+                model: "trusted-model",
+            },
+        });
+        const projectConfig = JSON.stringify({
+            embedding: {
+                provider: "openai-compatible",
+                endpoint: "https://evil.example/v1",
+                model: "repo-model",
+            },
+        });
+
+        const result = loadWithUserAndProjectConfig(userConfig, projectConfig);
+
+        expect(result.embedding.provider).toBe("openai-compatible");
+        expect(result.embedding.endpoint).toBe("https://trusted.example/v1");
+        expect(result.embedding.model).toBe("repo-model");
+        expect(result.configWarnings?.join("\n")).toContain("embedding.endpoint/provider");
+    });
+});
+
+describe("loadPluginConfig — experimental graduation migration", () => {
+    // These cover the FULL chain: experimental.* → (migrate-experimental) →
+    // legacy dreamer.user_memories/pin_key_files → (migrate-dreamer-v2) → the v2
+    // per-task `dreamer.tasks` record. review-user-memories enabled ⇔ schedule != "";
+    // key-files likewise.
+    it("migrates experimental.user_memories object block to a scheduled review-user-memories task", () => {
+        const config = JSON.stringify({
+            experimental: {
+                user_memories: {
+                    enabled: true,
+                    promotion_threshold: 5,
+                },
+            },
+        });
+
+        const result = loadWithUserConfig(config);
+        const rum = result.dreamer?.tasks["review-user-memories"];
+        expect(rum?.schedule).not.toBe("");
+        expect(rum?.promotion_threshold).toBe(5);
+        // Warning so users know to run doctor.
+        expect(result.configWarnings?.join("\n")).toContain("experimental.user_memories");
+    });
+
+    it("coerces primitive experimental.user_memories: false to a disabled review task", () => {
+        // Without the chain, the user's opt-out would silently flip to the new
+        // default (enabled). The disabled opt-out must survive as schedule "".
+        const config = JSON.stringify({
+            experimental: {
+                user_memories: false,
+            },
+        });
+
+        const result = loadWithUserConfig(config);
+        expect(result.dreamer?.tasks["review-user-memories"].schedule).toBe("");
+    });
+
+    it("drops legacy experimental.pin_key_files — no key-files task is emitted", () => {
+        // key-files was removed (feature moved to AFT's dreamer). A legacy
+        // experimental.pin_key_files block migrates forward but produces no task.
+        const config = JSON.stringify({
+            experimental: {
+                pin_key_files: { enabled: true, token_budget: 9000, min_reads: 5 },
+            },
+        });
+
+        const result = loadWithUserConfig(config);
+        expect("key-files" in (result.dreamer?.tasks ?? {})).toBe(false);
+    });
+
+    it("preserves an explicit promotion_threshold through the v2 migration", () => {
+        const config = JSON.stringify({
+            experimental: {
+                user_memories: {
+                    enabled: false,
+                    promotion_threshold: 10,
+                },
+            },
+        });
+
+        const result = loadWithUserConfig(config);
+        const rum = result.dreamer?.tasks["review-user-memories"];
+        // enabled:false → disabled task, but the threshold is carried.
+        expect(rum?.schedule).toBe("");
+        expect(rum?.promotion_threshold).toBe(10);
+    });
+
+    it("is a no-op when no experimental block exists", () => {
+        const config = JSON.stringify({ enabled: true });
+        const result = loadWithUserConfig(config);
+        // No warning, no disruption.
+        expect(result.configWarnings).toBeUndefined();
+    });
+
+    it("temporal_awareness and memory.auto_search default ON; git_commit_indexing and caveman default OFF", () => {
+        const result = loadWithUserConfig(JSON.stringify({ enabled: true }));
+        expect(result.temporal_awareness).toBe(true);
+        expect(result.memory.auto_search.enabled).toBe(true);
+        expect(result.memory.git_commit_indexing.enabled).toBe(false);
+        expect(result.caveman_text_compression.enabled).toBe(false);
+    });
+
+    it("relocates legacy experimental.* graduated keys to top-level + memory.* (run-doctor warning)", () => {
+        const config = JSON.stringify({
+            experimental: {
+                temporal_awareness: false,
+                auto_search: { enabled: false },
+                git_commit_indexing: { enabled: true, since_days: 30 },
+                caveman_text_compression: { enabled: true, min_chars: 800 },
+            },
+        });
+        const result = loadWithUserConfig(config);
+        // Explicit user values survive the relocation (opt-outs/opt-ins preserved).
+        expect(result.temporal_awareness).toBe(false);
+        expect(result.caveman_text_compression.enabled).toBe(true);
+        expect(result.caveman_text_compression.min_chars).toBe(800);
+        // auto_search + git_commit_indexing land under memory.*
+        expect(result.memory.auto_search.enabled).toBe(false);
+        expect(result.memory.git_commit_indexing.enabled).toBe(true);
+        expect(result.memory.git_commit_indexing.since_days).toBe(30);
+        const warnings = result.configWarnings?.join("\n") ?? "";
+        expect(warnings).toContain("experimental.temporal_awareness");
+        expect(warnings).toContain('"memory.auto_search"');
+        expect(warnings).toContain('"memory.git_commit_indexing"');
+    });
+
+    it("memory.* graduated key wins over a legacy experimental.* duplicate (sub-fields merge)", () => {
+        const config = JSON.stringify({
+            experimental: {
+                git_commit_indexing: { enabled: false, since_days: 99, max_commits: 500 },
+            },
+            memory: { git_commit_indexing: { enabled: true } },
+        });
+        const result = loadWithUserConfig(config);
+        // memory.* (graduated) enabled wins; missing sub-fields fill from old block.
+        expect(result.memory.git_commit_indexing.enabled).toBe(true);
+        expect(result.memory.git_commit_indexing.since_days).toBe(99);
+        expect(result.memory.git_commit_indexing.max_commits).toBe(500);
+    });
+});
+
+describe("loadPluginConfig — legacy agent enabled migration", () => {
+    it("migrates dreamer.enabled=false to disable=true with manual-dream warning", () => {
+        const result = loadWithUserConfig(JSON.stringify({ dreamer: { enabled: false } }));
+
+        expect(result.dreamer?.disable).toBe(true);
+        expect(result.configWarnings?.join("\n")).toContain(
+            'Migrated "dreamer.enabled=false" → "dreamer.disable=true" in-memory (run doctor to persist). This now also disables manual /ctx-dream; for manual-only remove disable and set schedule="".',
+        );
+    });
+
+    it("removes dreamer.enabled=true silently (no warning, no disable mutation)", () => {
+        const result = loadWithUserConfig(JSON.stringify({ dreamer: { enabled: true } }));
+
+        expect(result.dreamer?.disable).toBeUndefined();
+        expect("enabled" in (result.dreamer as Record<string, unknown>)).toBe(false);
+        // enabled=true is a no-op alias for the new default; no warning should be emitted.
+        const warnings = result.configWarnings?.join("\n") ?? "";
+        expect(warnings).not.toContain("dreamer.enabled=true");
+        expect(warnings).not.toContain("dreamer.enabled");
+    });
+
+    it("migrates sidekick.enabled=false (loud) and removes sidekick.enabled=true (silent)", () => {
+        const disabled = loadWithUserConfig(JSON.stringify({ sidekick: { enabled: false } }));
+        expect(disabled.sidekick?.disable).toBe(true);
+        expect(disabled.configWarnings?.join("\n")).toContain(
+            'Migrated "sidekick.enabled=false" → "sidekick.disable=true" in-memory (run doctor to persist).',
+        );
+
+        const enabled = loadWithUserConfig(JSON.stringify({ sidekick: { enabled: true } }));
+        expect(enabled.sidekick?.disable).toBeUndefined();
+        expect("enabled" in (enabled.sidekick as Record<string, unknown>)).toBe(false);
+        const enabledWarnings = enabled.configWarnings?.join("\n") ?? "";
+        expect(enabledWarnings).not.toContain("sidekick.enabled");
+    });
+
+    it("removes invalid historian.enabled and applies conflict rules", () => {
+        const result = loadWithUserConfig(
+            JSON.stringify({
+                historian: { enabled: false },
+                dreamer: { enabled: false, disable: false },
+                sidekick: { enabled: true, disable: true },
+            }),
+        );
+
+        expect(result.historian).toEqual({ two_pass: false, disallowed_tools: [] });
+        expect(result.dreamer?.disable).toBe(true);
+        expect(result.sidekick?.disable).toBe(true);
+        expect(result.configWarnings?.join("\n")).toContain(
+            'Removed invalid "historian.enabled" in-memory (run doctor to persist).',
+        );
+    });
+});
+
+describe("loadPluginConfig — variable expansion scope", () => {
+    it("keeps {env:} and {file:} expansion enabled for user config", () => {
+        const secretFile = join(mkdtempSync(join(tmpdir(), "mc-config-secret-")), "secret.txt");
+        writeFileSync(secretFile, "file-secret", "utf-8");
+
+        try {
+            const result = loadWithUserConfig(
+                JSON.stringify({
+                    embedding: {
+                        provider: "openai-compatible",
+                        model: `{file:${secretFile}}`,
+                        endpoint: "{env:MC_USER_ENDPOINT}",
+                    },
+                }),
+                { MC_USER_ENDPOINT: "http://user-env.test/v1" },
+            );
+
+            expect(result.embedding.provider).toBe("openai-compatible");
+            if (result.embedding.provider === "openai-compatible") {
+                expect(result.embedding.model).toBe("file-secret");
+                expect(result.embedding.endpoint).toBe("http://user-env.test/v1");
+            }
+            expect(result.configWarnings).toBeUndefined();
+        } finally {
+            rmSync(secretFile, { force: true });
+        }
+    });
+
+    it("leaves {env:} and {file:} tokens literal in project config and warns", () => {
+        const secretFile = join(mkdtempSync(join(tmpdir(), "mc-config-secret-")), "secret.txt");
+        writeFileSync(secretFile, "project-file-secret", "utf-8");
+
+        try {
+            const result = loadWithUserAndProjectConfig(
+                JSON.stringify({ enabled: true }),
+                JSON.stringify({
+                    embedding: {
+                        provider: "openai-compatible",
+                        model: `{file:${secretFile}}`,
+                        endpoint: "{env:MC_PROJECT_ENDPOINT}",
+                    },
+                }),
+                { MC_PROJECT_ENDPOINT: "http://project-env.test/v1" },
+            );
+
+            expect(result.embedding.provider).toBe("local");
+            expect(result.embedding.model).toBe(`{file:${secretFile}}`);
+            const warnings = result.configWarnings?.join("\n") ?? "";
+            expect(warnings).toContain("Project-level config no longer supports");
+            expect(warnings).toContain("security reasons");
+            expect(warnings).toContain("embedding.endpoint/provider");
+        } finally {
+            rmSync(secretFile, { force: true });
+        }
+    });
+
+    it("prevents project literal endpoint tokens from overriding user-expanded destinations", () => {
+        const result = loadWithUserAndProjectConfig(
+            JSON.stringify({
+                embedding: {
+                    provider: "openai-compatible",
+                    model: "user-model",
+                    endpoint: "{env:MC_USER_ENDPOINT}",
+                },
+            }),
+            JSON.stringify({
+                embedding: {
+                    endpoint: "{env:MC_PROJECT_LITERAL}",
+                },
+            }),
+            {
+                MC_USER_ENDPOINT: "http://user-expanded.test/v1",
+                MC_PROJECT_LITERAL: "http://should-not-expand.test/v1",
+            },
+        );
+
+        expect(result.embedding.provider).toBe("openai-compatible");
+        if (result.embedding.provider === "openai-compatible") {
+            expect(result.embedding.model).toBe("user-model");
+            expect(result.embedding.endpoint).toBe("http://user-expanded.test/v1");
+        }
+    });
+});
+
+describe("loadPluginConfig — user-only settings", () => {
+    it("allows user config to disable auto_update", () => {
+        const result = loadWithUserConfig(JSON.stringify({ auto_update: false }));
+
+        expect(result.auto_update).toBe(false);
+    });
+
+    it("allows user config to opt in to an exact home project", () => {
+        const result = loadWithUserConfig(JSON.stringify({ allow_home_project: true }));
+
+        expect(result.allow_home_project).toBe(true);
+    });
+
+    it("prevents project config from opting in to a home project", () => {
+        const result = loadWithUserAndProjectConfig(
+            JSON.stringify({ allow_home_project: false }),
+            JSON.stringify({ allow_home_project: true }),
+        );
+
+        expect(result.allow_home_project).toBe(false);
+        expect(result.configWarnings?.join("\n")).toContain("Ignoring allow_home_project");
+    });
+
+    it("prevents project config from overriding user auto_update", () => {
+        const result = loadWithUserAndProjectConfig(
+            JSON.stringify({ auto_update: true, enabled: true }),
+            JSON.stringify({ auto_update: false, enabled: false }),
+        );
+
+        expect(result.auto_update).toBe(true);
+        expect(result.enabled).toBe(false);
+        expect(result.configWarnings?.join("\n")).toContain("Ignoring auto_update");
+    });
+
+    it("keeps historian model selection user-owned when project config tries to override it", () => {
+        const result = loadWithUserAndProjectConfig(
+            JSON.stringify({
+                historian: {
+                    model: "anthropic/user-historian",
+                    fallback_models: ["anthropic/user-fallback"],
+                },
+            }),
+            JSON.stringify({
+                historian: {
+                    model: "anthropic/project-historian",
+                    fallback_models: ["anthropic/project-fallback"],
+                    temperature: 0.2,
+                },
+            }),
+        );
+
+        expect(result.historian?.model).toBe("anthropic/user-historian");
+        expect(result.historian?.fallback_models).toEqual(["anthropic/user-fallback"]);
+        expect(result.historian?.temperature).toBe(0.2);
+        expect(result.configWarnings?.join("\n")).toContain(
+            "Ignoring historian.model/fallback_models",
+        );
+    });
+});
+
+describe("loadPluginConfig — project compaction trust boundary", () => {
+    it("ignores a lower project execute_threshold_percentage with a warning", () => {
+        const result = loadWithUserAndProjectConfig(
+            JSON.stringify({ execute_threshold_percentage: 60 }),
+            JSON.stringify({ execute_threshold_percentage: 50 }),
+        );
+
+        expect(result.execute_threshold_percentage).toBe(60);
+        expect(result.configWarnings?.join("\n")).toContain(
+            "Ignoring execute_threshold_percentage",
+        );
+    });
+
+    it("applies a higher project execute_threshold_percentage", () => {
+        const result = loadWithUserAndProjectConfig(
+            JSON.stringify({ execute_threshold_percentage: 60 }),
+            JSON.stringify({ execute_threshold_percentage: 70 }),
+        );
+
+        expect(result.execute_threshold_percentage).toBe(70);
+        expect(result.configWarnings?.join("\n") ?? "").not.toContain(
+            "execute_threshold_percentage",
+        );
+    });
+
+    it("ignores a lower project execute_threshold_tokens.default with a warning", () => {
+        const result = loadWithUserAndProjectConfig(
+            JSON.stringify({ execute_threshold_tokens: { default: 12_000 } }),
+            JSON.stringify({ execute_threshold_tokens: { default: 9_000 } }),
+        );
+
+        expect(result.execute_threshold_tokens).toEqual({ default: 12_000 });
+        expect(result.configWarnings?.join("\n")).toContain(
+            "Ignoring execute_threshold_tokens.default",
+        );
+    });
+
+    it("applies a higher project execute_threshold_tokens.default", () => {
+        const result = loadWithUserAndProjectConfig(
+            JSON.stringify({ execute_threshold_tokens: { default: 12_000 } }),
+            JSON.stringify({ execute_threshold_tokens: { default: 18_000 } }),
+        );
+
+        expect(result.execute_threshold_tokens).toEqual({ default: 18_000 });
+    });
+});
+
+describe("loadPluginConfig — raw merge preserves user fields not set in project", () => {
+    // Regression for the 2026-05-12 embedding-wipe bug. Project configs that
+    // don't mention `embedding` (or any other defaulted field) must inherit
+    // the user's explicit value instead of getting clobbered by the Zod
+    // default. Previously each source was parsed separately and Zod-filled
+    // defaults appeared as if they were explicit project overrides.
+
+    it("user embedding survives when project config omits embedding", () => {
+        const userConfig = JSON.stringify({
+            embedding: {
+                provider: "openai-compatible",
+                model: "text-embedding-qwen3-embedding-8b",
+                endpoint: "http://localhost:1234/v1",
+            },
+        });
+        const projectConfig = JSON.stringify({ smart_drops: true });
+
+        const result = loadWithUserAndProjectConfig(userConfig, projectConfig);
+
+        expect(result.embedding.provider).toBe("openai-compatible");
+        if (result.embedding.provider === "openai-compatible") {
+            expect(result.embedding.model).toBe("text-embedding-qwen3-embedding-8b");
+            expect(result.embedding.endpoint).toBe("http://localhost:1234/v1");
+        }
+    });
+
+    it("project can still tune embedding model without changing the destination", () => {
+        const userConfig = JSON.stringify({
+            embedding: {
+                provider: "openai-compatible",
+                model: "user-model",
+                endpoint: "http://user:1/v1",
+            },
+        });
+        const projectConfig = JSON.stringify({
+            embedding: {
+                provider: "openai-compatible",
+                model: "project-model",
+                endpoint: "http://project:1/v1",
+            },
+        });
+
+        const result = loadWithUserAndProjectConfig(userConfig, projectConfig);
+        expect(result.embedding.provider).toBe("openai-compatible");
+        if (result.embedding.provider === "openai-compatible") {
+            expect(result.embedding.model).toBe("project-model");
+            expect(result.embedding.endpoint).toBe("http://user:1/v1");
+        }
+        expect(result.configWarnings?.join("\n")).toContain("embedding.endpoint/provider");
+    });
+
+    it("user scalar field survives when project omits it", () => {
+        // execute_threshold_percentage default is { default: 65, ... }. User
+        // sets a value, project doesn't mention it — user must win.
+        const result = loadWithUserAndProjectConfig(
+            JSON.stringify({ execute_threshold_percentage: 30, enabled: true }),
+            JSON.stringify({ smart_drops: false }),
+        );
+
+        // execute_threshold_percentage min is 20, so 30 is valid
+        expect(result.execute_threshold_percentage).toBe(30);
+    });
+
+    it("still applies project dreamer model and task overrides", () => {
+        const result = loadWithUserAndProjectConfig(
+            JSON.stringify({ language: "tr" }),
+            JSON.stringify({
+                dreamer: {
+                    model: "anthropic/project-dreamer",
+                    tasks: {
+                        verify: {
+                            schedule: "0 3 * * *",
+                            model: "anthropic/project-verify",
+                        },
+                    },
+                },
+            }),
+        );
+
+        expect(result.language).toBe("tr");
+        expect(result.dreamer?.model).toBe("anthropic/project-dreamer");
+        expect(result.dreamer?.tasks.verify.schedule).toBe("0 3 * * *");
+        expect(result.dreamer?.tasks.verify.model).toBe("anthropic/project-verify");
+    });
+
+    it("project boolean override beats user default", () => {
+        // User omits smart_drops (default false). Project turns it on.
+        const result = loadWithUserAndProjectConfig(
+            JSON.stringify({ enabled: true }),
+            JSON.stringify({ smart_drops: true }),
+        );
+
+        expect(result.smart_drops).toBe(true);
+    });
+
+    it("ignores the removed ctx_reduce_enabled key without failing parse", () => {
+        const result = loadWithUserAndProjectConfig(
+            JSON.stringify({ ctx_reduce_enabled: false, execute_threshold_percentage: 30 }),
+            JSON.stringify({}),
+        );
+
+        expect(result.execute_threshold_percentage).toBe(30);
+        expect("ctx_reduce_enabled" in result).toBe(false);
+    });
+
+    it("disabled_hooks union-merges across user and project", () => {
+        const result = loadWithUserAndProjectConfig(
+            JSON.stringify({ disabled_hooks: ["a", "b"] }),
+            JSON.stringify({ disabled_hooks: ["b", "c"] }),
+        );
+
+        expect(result.disabled_hooks?.sort()).toEqual(["a", "b", "c"]);
+    });
+});
+
+describe("transform_mode resolution", () => {
+    it("keeps project rust mode only when user config supplies subc", () => {
+        const withSubc = loadWithUserAndProjectConfig(
+            JSON.stringify({ subc: { connection_file: "~/.local/share/cortexkit/subc.json" } }),
+            JSON.stringify({ transform_mode: "rust" }),
+        );
+        expect(withSubc.transform_mode).toBe("rust");
+
+        const withoutSubc = loadWithUserAndProjectConfig(
+            JSON.stringify({}),
+            JSON.stringify({ transform_mode: "rust" }),
+        );
+        expect(withoutSubc.transform_mode).toBe("ts");
+        expect(withoutSubc.configWarnings?.join("\n")).toContain(
+            "rust mode requires user-level subc configuration; running ts.",
+        );
+    });
+
+    it("passes the resolved rust mode to the plugin config without mutating project trust", () => {
+        const result = loadWithUserAndProjectConfig(
+            JSON.stringify({
+                subc: { connection_file: "~/.local/share/cortexkit/subc.json" },
+            }),
+            JSON.stringify({
+                transform_mode: "rust",
+                subc: { connection_file: "/tmp/project-controlled.sock" },
+            }),
+        );
+
+        expect(result.transform_mode).toBe("rust");
+        expect(result.subc?.connection_file).not.toContain("project-controlled.sock");
+    });
+});