@cortexkit/opencode-magic-context 0.39.0 → 0.40.1

package/src/agents/permissions.ts

@@ -123,9 +123,11 @@ function isPermissionMap(value: unknown): value is Record<string, unknown> {
  * Add final `permission.task` denies for Magic Context's internal workers.
  *
  * OpenCode accepts either a whole-permission action or a pattern map for
- * `permission.task`; its evaluator uses the last matching rule. Normalize the
- * whole-permission form, retain every unrelated user rule, then append our
- * exact agent-id denies after both the user's task patterns and any `*` rule.
+ * `permission.task`; its visibility evaluator uses the last matching rule.
+ * Normalize the whole-permission form, retain unrelated user rules, then append
+ * our exact agent-id denies. When the ambient task policy has a wildcard deny,
+ * re-emit that wildcard after the named denies so the Task tool is hidden rather
+ * than shown as a callable-but-refused tool.
  */
 export function denyTaskRoutingToAgents(
     permission: unknown,
@@ -143,8 +145,12 @@ export function denyTaskRoutingToAgents(
           ? task
           : {};
     const internalAgentIdSet = new Set(internalAgentIds);
+    const hasAmbientWildcardDeny = configuredTask["*"] === "deny";
     const retainedTask = Object.fromEntries(
-        Object.entries(configuredTask).filter(([agentId]) => !internalAgentIdSet.has(agentId)),
+        Object.entries(configuredTask).filter(
+            ([agentId]) =>
+                !internalAgentIdSet.has(agentId) && (agentId !== "*" || !hasAmbientWildcardDeny),
+        ),
     );
 
     return {
@@ -152,6 +158,10 @@ export function denyTaskRoutingToAgents(
         task: {
             ...retainedTask,
             ...Object.fromEntries(internalAgentIds.map((agentId) => [agentId, "deny"])),
+            // OpenCode's Permission.disabled uses findLast. Re-inserting the
+            // ambient wildcard after our named routing denies keeps its whole-tool
+            // deny as the final match and makes the Task tool invisible.
+            ...(hasAmbientWildcardDeny ? { "*": "deny" } : {}),
         },
     };
 }

package/src/config/index.test.ts

@@ -1,9 +1,10 @@
 import { describe, expect, it } from "bun:test";
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-
+import { resolveHistorianModel } from "../shared/model-resolution";
 import { loadPluginConfig, loadPluginConfigDetailed } from "./index";
+import { resolveConfigProfile } from "./profiles";
 import { RUST_COMPACTION_OFF_WARNING } from "./transform-mode";
 
 /**
@@ -1014,6 +1015,364 @@ describe("transform_mode resolution", () => {
     });
 });
 
+describe("loadPluginConfig — user-owned model profiles", () => {
+    it("merges user base, selected profile, then project config without losing profile fallback qualifiers", () => {
+        const result = loadWithUserAndProjectConfig(
+            JSON.stringify({
+                profile: "personal",
+                historian: {
+                    two_pass: true,
+                    opencode: {
+                        model: "anthropic/base-historian",
+                        fallback_models: ["anthropic/base-fallback"],
+                    },
+                },
+                dreamer: {
+                    opencode: { model: "anthropic/base-dreamer" },
+                },
+                profiles: {
+                    work: {
+                        historian: {
+                            opencode: {
+                                model: { model: "anthropic/work-historian", variant: "high" },
+                                fallback_models: [
+                                    { model: "openai/work-fallback", variant: "low" },
+                                ],
+                            },
+                        },
+                        dreamer: {
+                            opencode: {
+                                model: "anthropic/work-dreamer",
+                                fallback_models: [
+                                    { model: "openai/work-dreamer-fallback", variant: "medium" },
+                                ],
+                            },
+                        },
+                        sidekick: { model: "anthropic/work-sidekick" },
+                    },
+                    personal: {
+                        historian: { opencode: { model: "anthropic/personal-historian" } },
+                    },
+                },
+            }),
+            JSON.stringify({
+                profile: "work",
+                memory: { enabled: false },
+            }),
+        );
+
+        expect(result.profile).toBe("work");
+        expect(result.memory.enabled).toBe(false);
+        expect(result.historian?.two_pass).toBe(true);
+        expect(result.historian?.opencode).toEqual({
+            model: { model: "anthropic/work-historian", variant: "high" },
+            fallback_models: [{ model: "openai/work-fallback", variant: "low" }],
+        });
+        expect(result.dreamer?.opencode?.model).toBe("anthropic/work-dreamer");
+        expect(result.dreamer?.opencode?.fallback_models).toEqual([
+            { model: "openai/work-dreamer-fallback", variant: "medium" },
+        ]);
+        expect(result.sidekick?.model).toBe("anthropic/work-sidekick");
+    });
+
+    it("uses project selection over user selection and falls back to the base on an unknown name", () => {
+        const userConfig = JSON.stringify({
+            profile: "personal",
+            historian: { opencode: { model: "anthropic/base" } },
+            profiles: {
+                personal: { historian: { opencode: { model: "anthropic/personal" } } },
+                work: { historian: { opencode: { model: "anthropic/work" } } },
+            },
+        });
+
+        const userDefault = loadWithUserAndProjectConfig(userConfig, "{}");
+        const projectOverride = loadWithUserAndProjectConfig(userConfig, '{"profile":"work"}');
+        const unknownProject = loadWithUserAndProjectConfig(userConfig, '{"profile":"missing"}');
+
+        expect(userDefault.profile).toBe("personal");
+        expect(userDefault.historian?.opencode?.model).toBe("anthropic/personal");
+        expect(projectOverride.profile).toBe("work");
+        expect(projectOverride.historian?.opencode?.model).toBe("anthropic/work");
+        expect(unknownProject.profile).toBeUndefined();
+        expect(unknownProject.enabled).toBe(true);
+        expect(unknownProject.historian?.opencode?.model).toBe("anthropic/base");
+        expect(unknownProject.configWarnings?.join("\n")).toContain(
+            'Unknown profile "missing" selected by project config',
+        );
+    });
+
+    it("rejects invalid profile definitions with a warning instead of applying their fields", () => {
+        const result = loadWithUserConfig(
+            JSON.stringify({
+                profile: "unsafe",
+                historian: { opencode: { model: "anthropic/base" } },
+                profiles: {
+                    unsafe: {
+                        embedding: { provider: "off" },
+                    },
+                },
+            }),
+        );
+
+        expect(result.profile).toBeUndefined();
+        expect(result.embedding.provider).toBe("local");
+        expect(result.historian?.opencode?.model).toBe("anthropic/base");
+        expect(result.configWarnings?.join("\n")).toContain("Ignoring profiles from user config");
+    });
+
+    it("strips hostile project profile definitions while allowing only user-owned definitions", () => {
+        const result = loadWithUserAndProjectConfig(
+            JSON.stringify({
+                historian: { opencode: { model: "anthropic/user-base" } },
+            }),
+            JSON.stringify({
+                profile: "work",
+                profiles: {
+                    work: {
+                        historian: { opencode: { model: "attacker/project-profile" } },
+                    },
+                },
+            }),
+        );
+
+        expect(result.profile).toBeUndefined();
+        expect(result.historian?.opencode?.model).toBe("anthropic/user-base");
+        expect(result.configWarnings?.join("\n")).toContain(
+            "Ignoring profiles from project config",
+        );
+    });
+
+    it("falls back loudly for inherited profile names without changing the resolved base config", () => {
+        const userConfig = JSON.stringify({
+            historian: { opencode: { model: "anthropic/base", fallback_models: ["openai/base"] } },
+            profiles: { known: { historian: { opencode: { model: "anthropic/known" } } } },
+        });
+        const base = loadWithUserConfig(userConfig);
+        const { configWarnings: _baseWarnings, ...baseWithoutWarnings } = base;
+        const hostileNames = [
+            "__proto__",
+            "constructor",
+            "prototype",
+            "toString",
+            "hasOwnProperty",
+            "valueOf",
+        ];
+
+        for (const name of hostileNames) {
+            const resolved = loadWithUserAndProjectConfig(
+                userConfig,
+                JSON.stringify({ profile: name }),
+            );
+            const { configWarnings: _warnings, ...resolvedWithoutWarnings } = resolved;
+
+            expect(resolved.profile).toBeUndefined();
+            expect(resolved.configWarnings?.join("\n")).toContain(
+                `Unknown profile "${name}" selected by project config`,
+            );
+            expect(resolvedWithoutWarnings).toEqual(baseWithoutWarnings);
+        }
+    });
+
+    it("ignores a profile inherited from a polluted Object prototype", () => {
+        const profileName = "profile_overlay_pollution_canary";
+        const previousDescriptor = Object.getOwnPropertyDescriptor(Object.prototype, profileName);
+        const userBase = { historian: { opencode: { model: "anthropic/base" } } };
+        // Null-prototype input isolates lookup behavior from strict schema validation of inherited data.
+        const profileOpenCode = Object.assign(Object.create(null), {
+            model: "anthropic/known",
+        });
+        const profileHistorian = Object.assign(Object.create(null), {
+            opencode: profileOpenCode,
+        });
+        const knownProfile = Object.assign(Object.create(null), {
+            historian: profileHistorian,
+        });
+        const profiles = Object.assign(Object.create(null), {
+            known: knownProfile,
+        }) as Record<string, unknown>;
+        Object.defineProperty(Object.prototype, profileName, {
+            value: { historian: { opencode: { model: "attacker/inherited-overlay" } } },
+            enumerable: true,
+            configurable: true,
+        });
+
+        try {
+            const resolution = resolveConfigProfile({
+                userRaw: {
+                    ...userBase,
+                    profiles,
+                },
+                projectRaw: { profile: profileName },
+            });
+
+            expect(resolution.activeProfile).toBeUndefined();
+            expect(resolution.overlay).toEqual({});
+            expect(resolution.userBase).toEqual(userBase);
+            expect(resolution.projectBase).toEqual({});
+            expect(resolution.warnings).toEqual([
+                `Unknown profile "${profileName}" selected by project config; using base config without a profile.`,
+            ]);
+        } finally {
+            if (previousDescriptor) {
+                Object.defineProperty(Object.prototype, profileName, previousDescriptor);
+            } else {
+                delete (Object.prototype as Record<string, unknown>)[profileName];
+            }
+        }
+    });
+
+    it("treats empty, null, and non-string project selectors as no selection", () => {
+        const userConfig = JSON.stringify({
+            profile: "personal",
+            historian: { opencode: { model: "anthropic/base" } },
+            profiles: {
+                personal: { historian: { opencode: { model: "anthropic/personal" } } },
+            },
+        });
+        const invalidProjectSelectors = ["", null, { name: "work" }];
+
+        for (const profile of invalidProjectSelectors) {
+            const result = loadWithUserAndProjectConfig(userConfig, JSON.stringify({ profile }));
+
+            expect(result.profile).toBe("personal");
+            expect(result.historian?.opencode?.model).toBe("anthropic/personal");
+            expect(result.configWarnings?.join("\n")).toContain(
+                "Ignoring invalid profile selection from project config",
+            );
+        }
+    });
+
+    it("preserves an untouched historian Pi block when a profile overlays OpenCode", () => {
+        const piBase = {
+            model: { model: "github-copilot/base", thinking_level: "high" },
+            fallback_models: [
+                { model: "openai/base-fallback", thinking_level: "minimal" },
+                { model: "github-copilot/second-base-fallback", thinking_level: "medium" },
+            ],
+            thinking_level: "high",
+        };
+        const result = loadWithUserConfig(
+            JSON.stringify({
+                profile: "work",
+                historian: {
+                    opencode: { model: "anthropic/base-opencode" },
+                    pi: piBase,
+                },
+                profiles: {
+                    work: {
+                        historian: { opencode: { model: "anthropic/work-opencode" } },
+                    },
+                },
+            }),
+        );
+
+        expect(result.historian?.opencode).toEqual({ model: "anthropic/work-opencode" });
+        expect(result.historian?.pi).toEqual(piBase);
+    });
+
+    it("replaces a base fallback_models array wholesale when a profile provides one", () => {
+        const result = loadWithUserConfig(
+            JSON.stringify({
+                profile: "work",
+                historian: {
+                    opencode: {
+                        model: "anthropic/base",
+                        fallback_models: [
+                            { model: "openai/base-first", variant: "low" },
+                            { model: "anthropic/base-second", variant: "high" },
+                        ],
+                    },
+                },
+                profiles: {
+                    work: {
+                        historian: {
+                            opencode: {
+                                fallback_models: [{ model: "google/work-only", variant: "medium" }],
+                            },
+                        },
+                    },
+                },
+            }),
+        );
+
+        expect(result.historian?.opencode?.fallback_models).toEqual([
+            { model: "google/work-only", variant: "medium" },
+        ]);
+    });
+
+    it("resolves profiles independently for two projects in one process", () => {
+        const xdg = mkdtempSync(join(tmpdir(), "mc-profile-isolation-user-"));
+        const projectA = mkdtempSync(join(tmpdir(), "mc-profile-isolation-a-"));
+        const projectB = mkdtempSync(join(tmpdir(), "mc-profile-isolation-b-"));
+        const previousXdg = process.env.XDG_CONFIG_HOME;
+        mkdirSync(join(xdg, "cortexkit"), { recursive: true });
+        mkdirSync(join(projectA, ".cortexkit"), { recursive: true });
+        mkdirSync(join(projectB, ".cortexkit"), { recursive: true });
+        writeFileSync(
+            join(xdg, "cortexkit", "magic-context.jsonc"),
+            JSON.stringify({
+                profiles: {
+                    work: { historian: { opencode: { model: "anthropic/work" } } },
+                    personal: {
+                        historian: { opencode: { model: "anthropic/personal" } },
+                    },
+                },
+            }),
+        );
+        writeFileSync(join(projectA, ".cortexkit", "magic-context.jsonc"), '{"profile":"work"}');
+        writeFileSync(
+            join(projectB, ".cortexkit", "magic-context.jsonc"),
+            '{"profile":"personal"}',
+        );
+        process.env.XDG_CONFIG_HOME = xdg;
+        try {
+            const work = loadPluginConfig(projectA);
+            const personal = loadPluginConfig(projectB);
+            const workAgain = loadPluginConfig(projectA);
+            expect(work.profile).toBe("work");
+            expect(personal.profile).toBe("personal");
+            expect(workAgain.profile).toBe("work");
+            expect(work.historian?.opencode?.model).toBe("anthropic/work");
+            expect(personal.historian?.opencode?.model).toBe("anthropic/personal");
+            expect(workAgain.historian?.opencode?.model).toBe("anthropic/work");
+        } finally {
+            if (previousXdg === undefined) delete process.env.XDG_CONFIG_HOME;
+            else process.env.XDG_CONFIG_HOME = previousXdg;
+            rmSync(xdg, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
+            rmSync(projectA, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
+            rmSync(projectB, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
+        }
+    });
+
+    it("feeds the selected profile through the existing historian model resolver", () => {
+        const config = loadWithUserAndProjectConfig(
+            JSON.stringify({
+                profiles: {
+                    work: {
+                        historian: {
+                            opencode: {
+                                model: { model: "anthropic/work", variant: "high" },
+                                fallback_models: [
+                                    { model: "openai/work-fallback", variant: "low" },
+                                ],
+                            },
+                        },
+                    },
+                },
+            }),
+            '{"profile":"work"}',
+        );
+
+        // Profile selection changes only the normal resolved model input. The
+        // existing model-switch identity path still sees canonical model IDs and
+        // qualifier-distinct fallback attempts; profiles add no separate cache-bust class.
+        expect(resolveHistorianModel(config, "opencode")).toEqual({
+            primary: { model: "anthropic/work", qualifier: "high" },
+            fallbacks: [{ model: "openai/work-fallback", qualifier: "low" }],
+        });
+    });
+});
+
 describe("loadPluginConfigDetailed — prompt-surface registration owner", () => {
     it("captures the user default before project guidance routing is merged", () => {
         const xdg = mkdtempSync(join(tmpdir(), "mc-config-prompt-surface-"));

package/src/config/index.ts

@@ -14,6 +14,7 @@ import {
 } from "./migrate-config-location";
 import { migrateDreamerV2 } from "./migrate-dreamer-v2";
 import { migrateLegacyExperimental } from "./migrate-experimental";
+import { resolveConfigProfile } from "./profiles";
 import {
     constrainProjectThresholdOverrides,
     dropInheritedEmbeddingKeyOnRedirect,
@@ -548,11 +549,6 @@ export function loadPluginConfigDetailed(directory: string): LoadResultDetailed
               : null;
 
     const allWarnings: string[] = [];
-    let mergedRaw: Record<string, unknown> = {};
-    // Threshold trust boundary is relative to the USER/default effective config:
-    // a cloned repo may delay compaction, but it may not lower thresholds in a
-    // way that forces extra historian work on the user's account.
-    const trustedBaseConfig = parsePluginConfig(userLoaded?.config ?? {});
 
     if (userLegacyFallback.source) {
         allWarnings.push(
@@ -576,26 +572,48 @@ export function loadPluginConfigDetailed(directory: string): LoadResultDetailed
 
     if (userLoaded) {
         allWarnings.push(...userLoaded.warnings.map((w) => `[user config] ${w}`));
-        mergedRaw = deepMergeRawConfig(mergedRaw, userLoaded.config);
     }
 
+    let projectRaw: Record<string, unknown> = {};
     if (projectLoaded) {
         allWarnings.push(...projectLoaded.warnings.map((w) => `[project config] ${w}`));
-        const projectRaw = { ...projectLoaded.config };
+        projectRaw = { ...projectLoaded.config };
         for (const warning of stripUnsafeProjectConfigFields(projectRaw)) {
             allWarnings.push(`[project config] ${warning}`);
         }
-        mergedRaw = deepMergeRawConfig(mergedRaw, projectRaw);
+    }
+
+    // Resolve profiles at the single user→project merge choke point. The profile
+    // definition is parsed from the trusted user tier, then its validated model
+    // overlay is merged before the untrusted project config. The raw selector is
+    // consumed here; only the resolved name remains as status metadata.
+    const profileResolution = resolveConfigProfile({
+        userRaw: userLoaded?.config ?? {},
+        projectRaw,
+    });
+    allWarnings.push(...profileResolution.warnings.map((warning) => `[config] ${warning}`));
+    const trustedProfiledRaw = deepMergeRawConfig(
+        profileResolution.userBase,
+        profileResolution.overlay,
+    );
+    let mergedRaw = trustedProfiledRaw;
+    // Threshold trust boundary is relative to the USER/default effective config:
+    // a cloned repo may delay compaction, but it may not lower thresholds in a
+    // way that forces extra historian work on the user's account.
+    const trustedBaseConfig = parsePluginConfig(trustedProfiledRaw);
+
+    if (projectLoaded) {
+        mergedRaw = deepMergeRawConfig(mergedRaw, profileResolution.projectBase);
         for (const warning of dropInheritedEmbeddingKeyOnRedirect(
             projectRaw,
             mergedRaw,
-            userLoaded?.config,
+            profileResolution.userBase,
         )) {
             allWarnings.push(`[project config] ${warning}`);
         }
         for (const warning of constrainProjectThresholdOverrides({
             mergedRaw,
-            projectRaw,
+            projectRaw: profileResolution.projectBase,
             trustedBaseConfig,
         })) {
             allWarnings.push(`[project config] ${warning}`);
@@ -604,6 +622,7 @@ export function loadPluginConfigDetailed(directory: string): LoadResultDetailed
 
     const recoveredTopLevelKeys: string[] = [];
     const config = parsePluginConfig(mergedRaw, recoveredTopLevelKeys);
+    if (profileResolution.activeProfile) config.profile = profileResolution.activeProfile;
     setOutputReserveConfig(config.output_reserve);
     setWindowOverlayPath(config.models?.window_overlay_path);
     if (config.configWarnings?.length) {

package/src/config/profiles.ts

@@ -0,0 +1,106 @@
+import { ConfigProfilesSchema } from "./schema/magic-context";
+
+export interface ProfileResolution {
+    /** User config minus the profile declarations and selector. */
+    userBase: Record<string, unknown>;
+    /** Project config minus the profile declarations and selector. */
+    projectBase: Record<string, unknown>;
+    /** The validated user-owned overlay for the active profile, if any. */
+    overlay: Record<string, unknown>;
+    /** The selected profile name, absent when no valid profile is active. */
+    activeProfile?: string;
+    warnings: string[];
+}
+
+interface ProfileSelection {
+    declared: boolean;
+    name?: string;
+}
+
+function withoutProfileFields(raw: Record<string, unknown>): Record<string, unknown> {
+    const copy = { ...raw };
+    delete copy.profile;
+    delete copy.profiles;
+    return copy;
+}
+
+function readProfileSelection(raw: Record<string, unknown>): ProfileSelection {
+    if (!Object.hasOwn(raw, "profile")) return { declared: false };
+    const value = raw.profile;
+    if (typeof value !== "string") return { declared: true };
+    const name = value.trim();
+    return name.length > 0 ? { declared: true, name } : { declared: true };
+}
+
+/**
+ * Resolve the user-owned profile overlay without retaining any process-global
+ * selection state. Callers merge `userBase`, `overlay`, then `projectBase` for
+ * every project load, so a Pi /cd or OpenCode multi-root session cannot borrow
+ * another repository's selected profile.
+ */
+export function resolveConfigProfile(args: {
+    userRaw: Record<string, unknown>;
+    projectRaw: Record<string, unknown>;
+}): ProfileResolution {
+    const warnings: string[] = [];
+    const userSelection = readProfileSelection(args.userRaw);
+    const projectSelection = readProfileSelection(args.projectRaw);
+    const selection = projectSelection.name
+        ? { name: projectSelection.name, source: "project" }
+        : userSelection.name
+          ? { name: userSelection.name, source: "user" }
+          : undefined;
+
+    if (projectSelection.declared && !projectSelection.name) {
+        warnings.push(
+            "Ignoring invalid profile selection from project config; expected a non-empty string.",
+        );
+    }
+    if (!projectSelection.declared && userSelection.declared && !userSelection.name) {
+        warnings.push(
+            "Ignoring invalid profile selection from user config; expected a non-empty string.",
+        );
+    }
+
+    let profiles: Record<string, Record<string, unknown>> = {};
+    if (Object.hasOwn(args.userRaw, "profiles")) {
+        const parsed = ConfigProfilesSchema.safeParse(args.userRaw.profiles);
+        if (parsed.success) {
+            profiles = parsed.data as Record<string, Record<string, unknown>>;
+        } else {
+            warnings.push(
+                "Ignoring profiles from user config: invalid profile configuration; profiles may contain only historian/dreamer harness model blocks and sidekick model-selection fields.",
+            );
+        }
+    }
+
+    if (!selection) {
+        return {
+            userBase: withoutProfileFields(args.userRaw),
+            projectBase: withoutProfileFields(args.projectRaw),
+            overlay: {},
+            warnings,
+        };
+    }
+
+    if (!Object.hasOwn(profiles, selection.name)) {
+        warnings.push(
+            `Unknown profile "${selection.name}" selected by ${selection.source} config; using base config without a profile.`,
+        );
+        return {
+            userBase: withoutProfileFields(args.userRaw),
+            projectBase: withoutProfileFields(args.projectRaw),
+            overlay: {},
+            warnings,
+        };
+    }
+
+    const overlay = profiles[selection.name];
+    return {
+        userBase: withoutProfileFields(args.userRaw),
+        projectBase: withoutProfileFields(args.projectRaw),
+        overlay,
+        activeProfile: selection.name,
+        warnings,
+    };
+}

package/src/config/project-security.hostile-matrix.test.ts

@@ -143,6 +143,12 @@ function buildHostileProjectConfig(): Record<string, unknown> {
     }
 
     return {
+        profile: "work",
+        profiles: {
+            work: {
+                historian: { opencode: { model: "hostile/profile-historian" } },
+            },
+        },
         mural: { enabled: true, model: "hostile/top-mural" },
         experimental: { mural: { enabled: true, model: "hostile/experimental-mural" } },
         historian: {
@@ -379,6 +385,9 @@ describe("hostile-config stripping matrix", () => {
         }
 
         expect(survived).toEqual([]);
+        expect(hasOwnPath(raw, "profiles")).toBe(false);
+        expect(readPath(raw, "profile")).toBe("work");
+        expect(warningText).toContain("Ignoring profiles from project config");
         expect(removed.sort()).toEqual(
             [
                 ...historianUserOnlyPaths(),

package/src/config/project-security.test.ts

@@ -7,6 +7,23 @@ import {
 } from "./project-security";
 
 describe("stripUnsafeProjectConfigFields", () => {
+    it("strips profile definitions from project config but leaves profile selection", () => {
+        const raw: Record<string, unknown> = {
+            profile: "work",
+            profiles: {
+                work: {
+                    historian: { opencode: { model: "attacker/model" } },
+                },
+            },
+        };
+
+        const warnings = stripUnsafeProjectConfigFields(raw);
+
+        expect(raw.profile).toBe("work");
+        expect(raw.profiles).toBeUndefined();
+        expect(warnings.join("\n")).toContain("Ignoring profiles from project config");
+    });
+
     it("strips auto_update from project config", () => {
         const raw: Record<string, unknown> = { auto_update: false, dreamer: { model: "x" } };
         const warnings = stripUnsafeProjectConfigFields(raw);

package/src/config/project-security.ts

@@ -256,6 +256,9 @@ function makeProjectThresholdWarning(field: string, reason: string): string {
  * over the user config. Returns warnings describing what was ignored.
  *
  * Closes:
+ *  - `profiles` — profile definitions choose hidden-agent models and must stay
+ *    in trusted user config; a repository may select a named profile but cannot
+ *    supply its contents.
  *  - `auto_update` — a repo must not suppress plugin self-updates (which can
  *    carry security fixes).
  *  - `fail_closed_blocking` — a repo must not un-block (or force-block) the
@@ -300,6 +303,13 @@ function makeProjectThresholdWarning(field: string, reason: string): string {
 export function stripUnsafeProjectConfigFields(projectRaw: Record<string, unknown>): string[] {
     const warnings: string[] = [];
 
+    if ("profiles" in projectRaw) {
+        delete projectRaw.profiles;
+        warnings.push(
+            "Ignoring profiles from project config (security: profile definitions are user-level only; a repository may select a named user profile with profile).",
+        );
+    }
+
     if ("auto_update" in projectRaw) {
         delete projectRaw.auto_update;
         warnings.push(