@cortexkit/opencode-magic-context 0.41.3 → 0.42.0

package/src/config/index.test.ts

@@ -3,7 +3,10 @@ import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
+import { resolveEpochFloorForPass } from "../features/magic-context/storage-meta-persisted";
+import { buildOpenCodeConfigWarningBanner } from "../shared/config-warning-surface";
 import { resolveHistorianModel } from "../shared/model-resolution";
+import { Database } from "../shared/sqlite";
 import { createTestTempDir } from "../shared/test-temp-dir";
 import {
     getWindowOverlay,
@@ -12,6 +15,8 @@ import {
 } from "../shared/window-geometry";
 import { loadPluginConfig, loadPluginConfigDetailed } from "./index";
 import { resolveConfigProfile } from "./profiles";
+import { getProtectedTokensTierOverrides } from "./project-security";
+import { REMOVED_AGENT_CONFIG_WARNING } from "./removed-agent-config";
 import { DEFAULT_LOCAL_EMBEDDING_MODEL } from "./schema/magic-context";
 import { RUST_COMPACTION_OFF_WARNING } from "./transform-mode";
 
@@ -192,6 +197,49 @@ describe("loadPluginConfig — preload user-config isolation", () => {
     });
 });
 
+describe("loadPluginConfig — parse failure diagnostics", () => {
+    it("recovers the reporter's stray leading character and keeps a loud location warning", () => {
+        const result = loadWithUserConfig('\\{\n  "cache_ttl": "1h"\n}');
+
+        expect(result.cache_ttl).toBe("1h");
+        expect(result.configParseFailures).toHaveLength(1);
+        expect(result.configParseFailures?.[0]).toMatchObject({
+            warningClass: "file-parse",
+            line: 1,
+            column: 1,
+            recovered: true,
+            message: "invalid symbol",
+        });
+        expect(result.configWarnings?.[0]).toContain(":1:1: invalid symbol");
+    });
+
+    it("keeps file parse and invalid-leaf warning classes distinct", () => {
+        const parseResult = loadWithUserConfig('\\{\n  "cache_ttl": "1h"\n}');
+        const leafResult = loadWithUserConfig('{"protected_tokens":"bogus"}');
+
+        expect(parseResult.configWarningDetails?.[0]?.warningClass).toBe("file-parse");
+        expect(
+            leafResult.configWarningDetails?.some(
+                (detail) => detail.warningClass === "invalid-leaf",
+            ),
+        ).toBe(true);
+    });
+
+    it("puts a recovered parse failure first in the OpenCode warning banner", () => {
+        const result = loadWithUserConfig('\\{\n  "cache_ttl": "1h"\n}');
+        const failures = result.configParseFailures ?? [];
+        const banner = buildOpenCodeConfigWarningBanner(
+            result.configWarnings ?? [],
+            failures,
+            failures,
+        );
+
+        expect(banner).toStartWith("## ⚠️ Magic Context Config Warning");
+        expect(banner.indexOf("PARSE FAILED")).toBeLessThan(banner.indexOf("Fix the reported"));
+        expect(banner).toContain(":1:1");
+    });
+});
+
 describe("loadPluginConfig — graduated mural config", () => {
     it("adopts legacy experimental.mural at the top-level and warns once", () => {
         const result = loadWithUserConfig(
@@ -703,18 +751,26 @@ describe("loadPluginConfig — legacy agent enabled migration", () => {
         expect(warnings).not.toContain("dreamer.enabled");
     });
 
-    it("migrates sidekick.enabled=false (loud) and removes sidekick.enabled=true (silent)", () => {
-        const disabled = loadWithUserConfig(JSON.stringify({ sidekick: { enabled: false } }));
-        expect(disabled.sidekick?.disable).toBe(true);
-        expect(disabled.configWarnings?.join("\n")).toContain(
-            'Migrated "sidekick.enabled=false" → "sidekick.disable=true" in-memory (run doctor to persist).',
+    it("ignores the removed agent block with one warning", () => {
+        const removedKey = ["side", "kick"].join("");
+        const result = loadWithUserConfig(
+            JSON.stringify({
+                profile: "work",
+                [removedKey]: { enabled: false, model: "example/model" },
+                profiles: {
+                    work: {
+                        [removedKey]: { model: "example/profile-model" },
+                        historian: { opencode: { model: "example/historian" } },
+                    },
+                },
+            }),
         );
 
-        const enabled = loadWithUserConfig(JSON.stringify({ sidekick: { enabled: true } }));
-        expect(enabled.sidekick?.disable).toBeUndefined();
-        expect("enabled" in (enabled.sidekick as Record<string, unknown>)).toBe(false);
-        const enabledWarnings = enabled.configWarnings?.join("\n") ?? "";
-        expect(enabledWarnings).not.toContain("sidekick.enabled");
+        expect(removedKey in result).toBe(false);
+        expect(result.historian?.opencode?.model).toBe("example/historian");
+        expect(result.configWarnings?.filter((warning) => warning.includes(removedKey))).toEqual([
+            `[config] ${REMOVED_AGENT_CONFIG_WARNING}`,
+        ]);
     });
 
     it("removes invalid historian.enabled and applies conflict rules", () => {
@@ -722,13 +778,11 @@ describe("loadPluginConfig — legacy agent enabled migration", () => {
             JSON.stringify({
                 historian: { enabled: false },
                 dreamer: { enabled: false, disable: false },
-                sidekick: { enabled: true, disable: true },
             }),
         );
 
         expect(result.historian).toEqual({ two_pass: false, disallowed_tools: [] });
         expect(result.dreamer?.disable).toBe(true);
-        expect(result.sidekick?.disable).toBe(true);
         expect(result.configWarnings?.join("\n")).toContain(
             'Removed invalid "historian.enabled" in-memory (run doctor to persist).',
         );
@@ -900,6 +954,109 @@ describe("loadPluginConfig — user-only settings", () => {
 });
 
 describe("loadPluginConfig — project compaction trust boundary", () => {
+    it("keeps protected_tokens scalar-only at both tiers and preserves the user scalar on an invalid project leaf", () => {
+        const vectors = [
+            {
+                name: "user scalar",
+                user: { protected_tokens: 20_000 },
+                project: {},
+                expected: 20_000,
+                warns: false,
+            },
+            {
+                name: "user object",
+                user: { protected_tokens: { default: 20_000 } },
+                project: {},
+                expected: undefined,
+                warns: true,
+            },
+            {
+                name: "project scalar",
+                user: {},
+                project: { protected_tokens: 20_000 },
+                expected: 20_000,
+                warns: false,
+            },
+            {
+                name: "project object",
+                user: {},
+                project: { protected_tokens: { default: 20_000 } },
+                expected: undefined,
+                warns: true,
+            },
+            {
+                name: "invalid project object over user scalar",
+                user: { protected_tokens: 25_000 },
+                project: { protected_tokens: { default: 30_000 } },
+                expected: 25_000,
+                warns: true,
+            },
+        ] as const;
+
+        for (const vector of vectors) {
+            const result = loadWithUserAndProjectConfig(
+                JSON.stringify(vector.user),
+                JSON.stringify(vector.project),
+            );
+            expect(result.protected_tokens, vector.name).toBe(vector.expected);
+            const warned = (result.configWarnings ?? []).some((warning) =>
+                warning.includes("protected_tokens"),
+            );
+            expect(warned, vector.name).toBe(vector.warns);
+        }
+    });
+
+    it("rejects a project protected_tokens floor below the derived floor once geometry is known", () => {
+        const result = loadWithUserAndProjectConfig(
+            JSON.stringify({}),
+            JSON.stringify({ protected_tokens: 4_000 }),
+        );
+        const db = new Database(":memory:");
+        db.exec(`
+            CREATE TABLE session_meta (
+                session_id TEXT PRIMARY KEY,
+                harness TEXT NOT NULL DEFAULT 'opencode',
+                last_response_time INTEGER NOT NULL DEFAULT 0,
+                cache_ttl TEXT NOT NULL DEFAULT '5m',
+                counter INTEGER NOT NULL DEFAULT 0,
+                last_nudge_tokens INTEGER NOT NULL DEFAULT 0,
+                last_nudge_band TEXT NOT NULL DEFAULT '',
+                last_transform_error TEXT NOT NULL DEFAULT '',
+                is_subagent INTEGER NOT NULL DEFAULT 0,
+                last_context_percentage REAL NOT NULL DEFAULT 0,
+                last_input_tokens INTEGER NOT NULL DEFAULT 0,
+                observed_safe_input_tokens INTEGER NOT NULL DEFAULT 0,
+                cache_alert_sent INTEGER NOT NULL DEFAULT 0,
+                times_execute_threshold_reached INTEGER NOT NULL DEFAULT 0,
+                compartment_in_progress INTEGER NOT NULL DEFAULT 0,
+                system_prompt_hash TEXT NOT NULL DEFAULT '',
+                cleared_reasoning_through_tag INTEGER NOT NULL DEFAULT 0,
+                protected_tokens_effective INTEGER,
+                protected_tokens_pre_snapshot TEXT
+            )
+        `);
+        const warnings: string[] = [];
+        const tierOverrides = getProtectedTokensTierOverrides(result);
+
+        const resolved = resolveEpochFloorForPass(db, "loader-derived-floor", {
+            tierOverrides,
+            usableSoft: 200_000,
+            isCacheBustingPass: true,
+            onRejectedProjectOverride: (warning) => warnings.push(warning),
+        });
+        resolveEpochFloorForPass(db, "loader-derived-floor-next", {
+            tierOverrides,
+            usableSoft: 200_000,
+            isCacheBustingPass: true,
+            onRejectedProjectOverride: (warning) => warnings.push(warning),
+        });
+
+        expect(resolved.floor).toBe(16_000);
+        expect(warnings).toHaveLength(1);
+        expect(warnings[0]).toContain("protected_tokens=4000");
+        db.close();
+    });
+
     it("ignores a lower project execute_threshold_percentage with a warning", () => {
         const result = loadWithUserAndProjectConfig(
             JSON.stringify({ execute_threshold_percentage: 60 }),
@@ -1132,7 +1289,6 @@ describe("loadPluginConfig — user-owned model profiles", () => {
                                 ],
                             },
                         },
-                        sidekick: { model: "anthropic/work-sidekick" },
                     },
                     personal: {
                         historian: { opencode: { model: "anthropic/personal-historian" } },
@@ -1156,7 +1312,6 @@ describe("loadPluginConfig — user-owned model profiles", () => {
         expect(result.dreamer?.opencode?.fallback_models).toEqual([
             { model: "openai/work-dreamer-fallback", variant: "medium" },
         ]);
-        expect(result.sidekick?.model).toBe("anthropic/work-sidekick");
     });
 
     it("uses project selection over user selection and falls back to the base on an unknown name", () => {

package/src/config/index.ts

@@ -1,6 +1,15 @@
 import { existsSync } from "node:fs";
 
-import { detectConfigFile, isPrototypePollutionKey, parseJsonc } from "../shared/jsonc-parser";
+import {
+    CONFIG_WARNING_CLASS,
+    type ConfigParseFailure,
+    type ConfigWarningDetail,
+} from "../shared/config-diagnostics";
+import {
+    detectConfigFile,
+    isPrototypePollutionKey,
+    parseJsoncRecovering,
+} from "../shared/jsonc-parser";
 import { setOutputReserveConfig } from "../shared/models-dev-cache";
 import type { PromptSurfaceConfig } from "../shared/prompt-surface";
 import { setWindowOverlayPath } from "../shared/window-geometry";
@@ -16,18 +25,25 @@ import { migrateDreamerV2 } from "./migrate-dreamer-v2";
 import { migrateLegacyExperimental } from "./migrate-experimental";
 import { resolveConfigProfile } from "./profiles";
 import {
+    attachProtectedTokensTierOverrides,
     constrainProjectThresholdOverrides,
     dropInheritedEmbeddingKeyOnRedirect,
     stripUnsafeProjectConfigFields,
 } from "./project-security";
 import { pruneNestedConfigLeaf } from "./prune-config-leaf";
 import { loadRawConfigFile } from "./raw-loader";
+import { stripRemovedAgentConfig } from "./removed-agent-config";
 import { type MagicContextConfig, MagicContextConfigSchema } from "./schema/magic-context";
 import { resolveTransformMode } from "./transform-mode";
 import { substituteConfigVariables } from "./variable";
 
 export interface MagicContextPluginConfig extends MagicContextConfig {
     disabled_hooks?: string[];
+    /** Runtime-only diagnostics; never read from user config. */
+    configParseFailures?: ConfigParseFailure[];
+    configWarningDetails?: ConfigWarningDetail[];
+    /** Whether cache_ttl existed in resolved raw config rather than coming from Zod defaults. */
+    cacheTtlConfigured?: boolean;
     command?: Record<
         string,
         {
@@ -74,6 +90,8 @@ interface LoadedConfigFile {
     config: Record<string, unknown>;
     /** Warnings from {env:} / {file:} substitution, with config-path prefix applied. */
     warnings: string[];
+    parseFailures: ConfigParseFailure[];
+    warningDetails: ConfigWarningDetail[];
 }
 
 export type LoadOutcome =
@@ -95,6 +113,9 @@ export interface LoadResultDetailed {
     };
     substitutionFailures: Array<{ keyPath: string; source: "user" | "project"; message: string }>;
     recoveredTopLevelKeys: string[];
+    configParseFailures: ConfigParseFailure[];
+    warningDetails: ConfigWarningDetail[];
+    cacheTtlConfigured: boolean;
 }
 
 interface LoadedConfigFileDetailed extends LoadedConfigFile {
@@ -118,10 +139,13 @@ function loadConfigFileDetailed(
         rawText = raw.text;
         rawWarnings = raw.warnings;
     } catch (error) {
+        const message = `failed to read config: ${error instanceof Error ? error.message : String(error)}`;
         return {
             config: {},
-            warnings: [
-                `${configPath}: failed to read config: ${error instanceof Error ? error.message : String(error)}`,
+            warnings: [`${configPath}: ${message}`],
+            parseFailures: [],
+            warningDetails: [
+                { warningClass: CONFIG_WARNING_CLASS.FILE_IO, source, path: configPath, message },
             ],
             outcome: "project-file-io-error",
             source,
@@ -135,32 +159,71 @@ function loadConfigFileDetailed(
             isProjectConfig: source === "project",
         });
         const rejectedKeyPaths: string[] = [];
-        const config = parseJsonc<Record<string, unknown>>(substituted.text, {
+        const parsed = parseJsoncRecovering<Record<string, unknown>>(substituted.text, {
             onRejectedKey: (path) => rejectedKeyPaths.push(path.join(".")),
         });
+        const config =
+            parsed.value && typeof parsed.value === "object" && !Array.isArray(parsed.value)
+                ? parsed.value
+                : {};
         const unsafeKeyWarnings = rejectedKeyPaths.map(
             (path) =>
                 `Ignored unsafe config key "${path}" (security: prototype-pollution keys are not allowed).`,
         );
+        const firstIssue = parsed.issues[0];
+        const recovered = firstIssue !== undefined && Object.keys(config).length > 0;
+        const parseFailures: ConfigParseFailure[] = firstIssue
+            ? [
+                  {
+                      warningClass: CONFIG_WARNING_CLASS.FILE_PARSE,
+                      source,
+                      path: configPath,
+                      line: firstIssue.line,
+                      column: firstIssue.column,
+                      message: firstIssue.message,
+                      recovered,
+                      warning: `${configPath}:${firstIssue.line}:${firstIssue.column}: ${firstIssue.message}; ${recovered ? "recovered values were applied, but the file must be fixed." : "using defaults for this file."}`,
+                  },
+              ]
+            : [];
         return {
             config,
-            warnings: [...rawWarnings, ...substituted.warnings, ...unsafeKeyWarnings].map(
-                (warning) => `${configPath}: ${warning}`,
-            ),
+            warnings: [
+                ...parseFailures.map((failure) => failure.warning),
+                ...rawWarnings.map((warning) => `${configPath}: ${warning}`),
+                ...substituted.warnings.map((warning) => `${configPath}: ${warning}`),
+                ...unsafeKeyWarnings.map((warning) => `${configPath}: ${warning}`),
+            ],
+            parseFailures,
+            warningDetails: parseFailures,
             outcome:
-                rejectedKeyPaths.length > 0
-                    ? "schema-recovery"
-                    : substituted.warnings.length > 0
-                      ? "substitution-failure"
-                      : "ok",
+                parseFailures.length > 0
+                    ? "project-file-parse-error"
+                    : rejectedKeyPaths.length > 0
+                      ? "schema-recovery"
+                      : substituted.warnings.length > 0
+                        ? "substitution-failure"
+                        : "ok",
             source,
         };
     } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        const warning = `${configPath}:1:1: ${message}; using defaults for this file.`;
+        const failure: ConfigParseFailure = {
+            warningClass: CONFIG_WARNING_CLASS.FILE_PARSE,
+            source,
+            path: configPath,
+            line: 1,
+            column: 1,
+            message,
+            recovered: false,
+            warning,
+        };
         return {
             config: {},
-            warnings: [
-                `${configPath}: failed to load config: ${error instanceof Error ? error.message : String(error)}`,
-            ],
+            warnings: [warning],
+            parseFailures: [failure],
+            warningDetails: [failure],
             outcome: "project-file-parse-error",
             source,
         };
@@ -258,14 +321,39 @@ function redactConfigValue(value: unknown): string {
     return typeof value;
 }
 
-function parsePluginConfig(
+let warnedProtectedTagsDeprecation = false;
+
+export function resetProtectedTagsDeprecationWarningForTest(): void {
+    warnedProtectedTagsDeprecation = false;
+}
+
+export function warnProtectedTagsDeprecationOnce(): void {
+    if (!warnedProtectedTagsDeprecation) {
+        warnedProtectedTagsDeprecation = true;
+        console.warn(
+            "[magic-context] protected_tags is deprecated and ignored; use protected_tokens instead.",
+        );
+    }
+}
+
+export function parsePluginConfig(
     rawConfig: Record<string, unknown>,
     recoveredTopLevelKeys: string[] = [],
 ): MagicContextPluginConfig & { configWarnings?: string[] } {
     // Pre-Zod shim: reshape legacy experimental.* graduated keys so the user's
     // opt-in/out state survives upgrades even when they never run `doctor`.
     const preMigrationWarnings: string[] = [];
-    const migratedExperimental = migrateLegacyExperimental(rawConfig, preMigrationWarnings);
+    const configWithoutRemovedAgent = stripRemovedAgentConfig(rawConfig, preMigrationWarnings);
+    if (Object.hasOwn(rawConfig, "protected_tags")) {
+        warnProtectedTagsDeprecationOnce();
+        preMigrationWarnings.push(
+            "protected_tags is deprecated and ignored; use protected_tokens instead.",
+        );
+    }
+    const migratedExperimental = migrateLegacyExperimental(
+        configWithoutRemovedAgent,
+        preMigrationWarnings,
+    );
     // Dreamer v2: convert the legacy v1 dreamer shape (window schedule, tasks
     // array, user_memories/pin_key_files blocks) into the per-task `tasks` record.
     // Runs AFTER migrate-experimental so experimental.user_memories (already
@@ -336,7 +424,7 @@ function parsePluginConfig(
     const patched: Record<string, unknown> = { ...rawConfig };
     for (const key of errorPaths) {
         recoveredTopLevelKeys.push(key);
-        const isAgentConfig = key === "historian" || key === "dreamer" || key === "sidekick";
+        const isAgentConfig = key === "historian" || key === "dreamer";
 
         // For object-valued keys (including agent harness blocks), prune only invalid
         // nested leaves and keep valid siblings, so one bad field does not remove
@@ -549,6 +637,8 @@ export function loadPluginConfigDetailed(directory: string): LoadResultDetailed
               : null;
 
     const allWarnings: string[] = [];
+    const removedConfigWarnings: string[] = [];
+    const userRaw = stripRemovedAgentConfig(userLoaded?.config ?? {}, removedConfigWarnings);
 
     if (userLegacyFallback.source) {
         allWarnings.push(
@@ -577,18 +667,20 @@ export function loadPluginConfigDetailed(directory: string): LoadResultDetailed
     let projectRaw: Record<string, unknown> = {};
     if (projectLoaded) {
         allWarnings.push(...projectLoaded.warnings.map((w) => `[project config] ${w}`));
-        projectRaw = { ...projectLoaded.config };
+        projectRaw = stripRemovedAgentConfig(projectLoaded.config, removedConfigWarnings);
         for (const warning of stripUnsafeProjectConfigFields(projectRaw)) {
             allWarnings.push(`[project config] ${warning}`);
         }
     }
 
+    allWarnings.push(...removedConfigWarnings.map((warning) => `[config] ${warning}`));
+
     // Resolve profiles at the single user→project merge choke point. The profile
     // definition is parsed from the trusted user tier, then its validated model
     // overlay is merged before the untrusted project config. The raw selector is
     // consumed here; only the resolved name remains as status metadata.
     const profileResolution = resolveConfigProfile({
-        userRaw: userLoaded?.config ?? {},
+        userRaw,
         projectRaw,
     });
     allWarnings.push(...profileResolution.warnings.map((warning) => `[config] ${warning}`));
@@ -621,10 +713,16 @@ export function loadPluginConfigDetailed(directory: string): LoadResultDetailed
     }
 
     const recoveredTopLevelKeys: string[] = [];
+    const cacheTtlConfigured = Object.hasOwn(mergedRaw, "cache_ttl");
     const config = parsePluginConfig(mergedRaw, recoveredTopLevelKeys);
+    attachProtectedTokensTierOverrides(config, {
+        trustedUser: trustedBaseConfig.protected_tokens,
+        project: projectLoaded ? profileResolution.projectBase.protected_tokens : undefined,
+    });
     if (profileResolution.activeProfile) config.profile = profileResolution.activeProfile;
     setOutputReserveConfig(config.output_reserve);
     setWindowOverlayPath(config.models?.window_overlay_path);
+    const leafValidationWarnings = [...(config.configWarnings ?? [])];
     if (config.configWarnings?.length) {
         allWarnings.push(
             ...config.configWarnings.map((w) => {
@@ -637,7 +735,7 @@ export function loadPluginConfigDetailed(directory: string): LoadResultDetailed
 
     const resolvedTransformMode = resolveTransformMode({
         configured: config.transform_mode,
-        userTierHasSubc: hasUserTierSubcConfig(userLoaded?.config),
+        userTierHasSubc: hasUserTierSubcConfig(userRaw),
         compactionEnabled: isCompactionEnabled(config),
     });
     config.transform_mode = resolvedTransformMode.mode;
@@ -653,6 +751,21 @@ export function loadPluginConfigDetailed(directory: string): LoadResultDetailed
         ...bindSubstitutionFailures(userLoaded),
         ...bindSubstitutionFailures(projectLoaded),
     ];
+    const configParseFailures = [
+        ...(userLoaded?.parseFailures ?? []),
+        ...(projectLoaded?.parseFailures ?? []),
+    ];
+    const warningDetails: ConfigWarningDetail[] = [
+        ...(userLoaded?.warningDetails ?? []),
+        ...(projectLoaded?.warningDetails ?? []),
+        ...leafValidationWarnings.map((message) => ({
+            warningClass: CONFIG_WARNING_CLASS.INVALID_LEAF,
+            message,
+        })),
+    ];
+    config.configParseFailures = configParseFailures;
+    config.configWarningDetails = warningDetails;
+    config.cacheTtlConfigured = cacheTtlConfigured;
     const sources = {
         userConfig:
             userLoaded?.outcome ??
@@ -669,5 +782,8 @@ export function loadPluginConfigDetailed(directory: string): LoadResultDetailed
         sources,
         substitutionFailures,
         recoveredTopLevelKeys,
+        configParseFailures,
+        warningDetails,
+        cacheTtlConfigured,
     };
 }

package/src/config/latch-permanence-guard.test.ts

@@ -126,6 +126,10 @@ const KNOWN_SLOTS: Record<string, KnownSlot> = {
         classification: "VERDICT",
         reason: "Saved: the promise has a 60-second TTL, including rejections, and discovery is retried after expiry.",
     },
+    "packages/plugin/src/shared/opencode-db-path.ts:lastReadFailure": {
+        classification: "DIAGNOSTIC",
+        reason: "Most-recent OpenCode DB read diagnostic: a successful open clears it, and path discovery re-probes after disappearance.",
+    },
     "packages/plugin/src/shared/models-dev-cache.ts:authRewarmDone": {
         classification: "VERDICT",
         reason: "Saved: refreshModelLimitsAfterAuthOnce resets the latch when its warm fails.",

package/src/config/migrate-config-location.test.ts

@@ -186,10 +186,10 @@ describe("migrateConfigFile (location migration)", () => {
         try {
             const target = join(dir, ".cortexkit", "magic-context.jsonc");
             mkdirSync(join(dir, ".cortexkit"), { recursive: true });
-            writeFileSync(target, '{ "protected_tags": 5 }');
+            writeFileSync(target, '{ "cache_ttl": "5m" }');
             const legacy = join(dir, ".opencode", "magic-context.jsonc");
             mkdirSync(join(dir, ".opencode"), { recursive: true });
-            writeFileSync(legacy, '{ "protected_tags": 9 }');
+            writeFileSync(legacy, '{ "cache_ttl": "9m" }');
 
             const r = migrateConfigFile({
                 scope: "project",
@@ -201,8 +201,8 @@ describe("migrateConfigFile (location migration)", () => {
             expect(r.migrated).toBe(false);
             expect(r.warnings.join("\n")).toContain("already exists with different settings");
             // BOTH left as-is for manual reconciliation — never auto-clobbered.
-            expect(readFileSync(target, "utf8")).toContain('"protected_tags": 5');
-            expect(readFileSync(legacy, "utf8")).toContain('"protected_tags": 9');
+            expect(readFileSync(target, "utf8")).toContain('"cache_ttl": "5m"');
+            expect(readFileSync(legacy, "utf8")).toContain('"cache_ttl": "9m"');
             expect(existsSync(`${legacy}.MOVED_READPLEASE`)).toBe(false);
         } finally {
             rmSync(dir, { recursive: true, force: true });
@@ -216,8 +216,8 @@ describe("migrateConfigFile (location migration)", () => {
             const b = join(dir, ".pi", "magic-context.jsonc");
             mkdirSync(join(dir, ".opencode"), { recursive: true });
             mkdirSync(join(dir, ".pi"), { recursive: true });
-            writeFileSync(a, '{ "protected_tags": 5 }');
-            writeFileSync(b, '{ "protected_tags": 9 }');
+            writeFileSync(a, '{ "cache_ttl": "5m" }');
+            writeFileSync(b, '{ "cache_ttl": "9m" }');
             const target = join(dir, ".cortexkit", "magic-context.jsonc");
 
             const r = migrateConfigFile({
@@ -256,12 +256,45 @@ describe("migrateConfigFile (location migration)", () => {
 
             expect(r.migrated).toBe(true);
             expect(existsSync(target)).toBe(true);
+            expect(readFileSync(target, "utf8")).not.toContain("protected_tags");
             expect(existsSync(`${a}.MOVED_READPLEASE`)).toBe(true);
             expect(existsSync(`${b}.MOVED_READPLEASE`)).toBe(true);
         } finally {
             rmSync(dir, { recursive: true, force: true });
         }
     });
+
+    it("strips deprecated protected_tags key during migration to target with notice", () => {
+        const dir = tmp();
+        try {
+            const legacy = join(dir, "magic-context.jsonc");
+            writeFileSync(legacy, '{\n  "protected_tags": 20,\n  "cache_ttl": "15m"\n}\n');
+            const target = join(dir, ".cortexkit", "magic-context.jsonc");
+            const infos: string[] = [];
+            const r = migrateConfigFile({
+                scope: "project",
+                targetPath: target,
+                legacySources: [src(legacy)],
+                logger: {
+                    info: (msg) => infos.push(msg),
+                    warn: () => {},
+                },
+            });
+            expect(r.migrated).toBe(true);
+            const targetContent = readFileSync(target, "utf8");
+            expect(targetContent).not.toContain("protected_tags");
+            expect(targetContent).toContain('"cache_ttl": "15m"');
+            expect(
+                infos.some((msg) =>
+                    msg.includes(
+                        'Stripped deprecated "protected_tags" key during config location migration',
+                    ),
+                ),
+            ).toBe(true);
+        } finally {
+            rmSync(dir, { recursive: true, force: true });
+        }
+    });
 });
 
 describe("resolveLegacyConfigSources", () => {