@cortexkit/opencode-magic-context 0.41.4 → 0.42.1

package/README.md

@@ -96,7 +96,7 @@ irm https://raw.githubusercontent.com/cortexkit/magic-context/master/scripts/ins
 npx @cortexkit/magic-context@latest setup
 ```
 
-The wizard auto-detects which harnesses you have (OpenCode, Pi, OMP, or any combination), adds the plugin, disables built-in compaction, helps you pick models for the historian, dreamer, and sidekick, and resolves conflicts with other context-management plugins. Target one with `--harness opencode`, `--harness pi`, or `--harness omp`.
+The wizard auto-detects which harnesses you have (OpenCode, Pi, OMP, or any combination), adds the plugin, disables built-in compaction, helps you pick models for the historian and dreamer, and resolves conflicts with other context-management plugins. Target one with `--harness opencode`, `--harness pi`, or `--harness omp`.
 
 > **Why disable built-in compaction?** Magic Context manages context itself. The host's compaction would interfere with its cache-aware deferred operations and double-compress.
 
@@ -125,7 +125,7 @@ Then create `magic-context.jsonc` with the OpenCode historian setting:
 ```
 
 - **Required:** `historian.opencode.model` must be a real `provider/model-id`. Without it, the plugin loads but historian runs fail, older history is not summarized, and repeated failures show a `Magic Context — history comparting needs attention` notice.
-- **Optional:** `dreamer` and `sidekick` model/disable blocks. Omit them to leave periodic memory consolidation and `/ctx-aug` off.
+- **Optional:** the `dreamer` model/disable block. Omit it to leave periodic memory consolidation off.
 - **Optional:** `embedding`. Omit it to use the local `Xenova/all-MiniLM-L6-v2`; turning embeddings off removes semantic/embedding-backed search, but keyword search and context management continue.
 
 ### Flat model-config migration (before/after)
@@ -302,7 +302,6 @@ Recall works **across sessions** (a new session inherits everything) and **acros
 | `/ctx-recomp` | Rebuild compartments from raw history (accepts a `start-end` range). Use when stored state seems wrong |
 | `/ctx-wrapup [messages_to_keep]` | Compact older live history while keeping the newest N messages raw; queued compaction materializes on the next model message |
 | `/ctx-session-upgrade` | Upgrade this session to the latest history format: rebuild compartments and migrate project memories |
-| `/ctx-aug` | Run sidekick augmentation on a prompt: retrieve relevant memories via a separate model |
 | `/ctx-dream` | Run dreamer maintenance on demand: maintain memory, docs, smart notes, and user-profile review |
 | `/ctx-embed` | Embedding status, or start/pause history compartment embedding (`start` \| `pause`) |
 
@@ -406,6 +405,25 @@ Dream execution requires a live OpenCode server (the dreamer creates ephemeral c
 
 ---
 
+### Cache-bust sentinel
+
+`packages/plugin/scripts/cache-bust-sentinel.ts` audits recent OpenCode and Pi/OMP provider requests for cache busts that are not explained by Magic Context's fold, refresh, reduction, flush, force-band, or provider/system-prompt contracts. It joins each provider request to MC's nearest pass record from 30 seconds before through five seconds after the request from `transform_decisions`/`scheduler_history` in `context.db` and the rust-mode `mc_pass_trace`/decision mirror in `store.db`; requests without a matching pass are reported as `no_mc_pass_row`. It opens both databases, OpenCode's database, auth-plugin dumps, Pi/OMP JSONL, and `.pi/pi-llm-debugging`/served-array artifacts read-only. Its only local write is the high-water/dedup state file at `~/.local/share/cortexkit/magic-context/cache-bust-sentinel-state.json` (or the resolved `MAGIC_CONTEXT_STORAGE_DIR`).
+
+Run a single dry pass from the repository root; each new unaccounted bust window is printed as one JSON line:
+
+```sh
+bun packages/plugin/scripts/cache-bust-sentinel.ts --once
+```
+
+Omit `--once` for the built-in one-minute loop, or invoke `--once` from cron/launchd every 1–5 minutes. The template at `packages/plugin/scripts/launchd/com.cortexkit.magic-context.cache-bust-sentinel.plist` uses a five-minute cadence, deliberately has `RunAtLoad=false`, and is not installed automatically. Replace its `__BUN_PATH__`, `__REPO_ROOT__`, and `__LOG_DIR__` placeholders before loading it. A cron equivalent is:
+
+```cron
+*/5 * * * * cd /path/to/magic-context && /path/to/bun packages/plugin/scripts/cache-bust-sentinel.ts --once >> /path/to/cache-bust-sentinel.jsonl 2>> /path/to/cache-bust-sentinel.log
+```
+
+`--send` switches from JSON-line dry-run output to the `prefrontal` module's `wake.event_record` subc operation. Do not enable it until that operation is deployed. Known dispositions (`accepted`, `unowned_session`, `dedup`, and `superseded`) are counted and logged; malformed replies fail the run. Use `--connection-file`, `--wake-module-id`, `--state-file`, `--db`, or `--rust-store` only when the corresponding runtime location is non-default.
+
+---
 ## Contributing
 
 Bug reports and pull requests are welcome. For larger changes, open an issue first to discuss the approach. Run `bun run format` before submitting; CI rejects unformatted code.

package/dist/agents/hidden-agent-registrations.d.ts

@@ -38,7 +38,7 @@ export interface HiddenAgentRegistration {
     lockPermissions?: boolean;
 }
 /**
- * Hoisted function declaration: returns the four hidden-agent registrations with
+ * Hoisted function declaration: returns the hidden-agent registrations with
  * INLINE id / allow-list / step-cap literals (see {@link HiddenAgentRegistration}
  * for why these must not come from module-level `var` consts). Prompts and
  * computed overrides are passed in by the caller; the historian disallow filter
@@ -50,10 +50,8 @@ export declare function buildHiddenAgentRegistrations(args: {
     historianPrompt: string | undefined;
     historianRecompPrompt?: string | undefined;
     historianEditorPrompt: string | undefined;
-    sidekickPrompt: string | undefined;
     dreamerOverrides?: Record<string, unknown>;
     historianOverrides?: Record<string, unknown>;
-    sidekickOverrides?: Record<string, unknown>;
     historianDisallowed: readonly string[];
 }): HiddenAgentRegistration[];
 /**

package/dist/agents/hidden-agent-registrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hidden-agent-registrations.d.ts","sourceRoot":"","sources":["../../src/agents/hidden-agent-registrations.ts"],"names":[],"mappings":"AAiCA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,+BAA+B,2BAA2B,CAAC;AAIxE,MAAM,WAAW,uBAAuB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,sFAAsF;IACtF,IAAI,EAAE,SAAS,CAAC;IAChB,mFAAmF;IACnF,MAAM,EAAE,IAAI,CAAC;IACb,6JAA6J;IAC7J,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,0EAA0E;IAC1E,eAAe,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAChD,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,uBAAuB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,qBAAqB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C,GAAG,uBAAuB,EAAE,CA8M5B;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAClC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,UAAU,CAAC,EAAE,MAAM,EACnB,eAAe,UAAQ,EACvB,WAAW,CAAC,EAAE,MAAM;;;;;;;;;;EAgEvB"}
+{"version":3,"file":"hidden-agent-registrations.d.ts","sourceRoot":"","sources":["../../src/agents/hidden-agent-registrations.ts"],"names":[],"mappings":"AAiCA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,+BAA+B,2BAA2B,CAAC;AAIxE,MAAM,WAAW,uBAAuB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,sFAAsF;IACtF,IAAI,EAAE,SAAS,CAAC;IAChB,mFAAmF;IACnF,MAAM,EAAE,IAAI,CAAC;IACb,6JAA6J;IAC7J,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,0EAA0E;IAC1E,eAAe,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAChD,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,uBAAuB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,qBAAqB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C,GAAG,uBAAuB,EAAE,CAoM5B;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAClC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,UAAU,CAAC,EAAE,MAAM,EACnB,eAAe,UAAQ,EACvB,WAAW,CAAC,EAAE,MAAM;;;;;;;;;;EAgEvB"}

package/dist/agents/magic-context-prompt.d.ts

@@ -1,4 +1,4 @@
 /** Generic magic context system prompt section shared by all agents. */
 import type { PromptSurfacePreset } from "../shared/prompt-surface";
-export declare function buildMagicContextSection(_agent: string | null, protectedTags: number, ctxReduceCallable?: boolean, dreamerEnabled?: boolean, temporalAwarenessEnabled?: boolean, cavemanTextCompressionEnabled?: boolean, subagentMode?: boolean, language?: string, memoryEnabled?: boolean, preset?: PromptSurfacePreset, primaryOverride?: string): string;
+export declare function buildMagicContextSection(_agent: string | null, _legacyProtectionCount: number, ctxReduceCallable?: boolean, dreamerEnabled?: boolean, temporalAwarenessEnabled?: boolean, cavemanTextCompressionEnabled?: boolean, subagentMode?: boolean, language?: string, memoryEnabled?: boolean, preset?: PromptSurfacePreset, primaryOverride?: string): string;
 //# sourceMappingURL=magic-context-prompt.d.ts.map

package/dist/agents/magic-context-prompt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"magic-context-prompt.d.ts","sourceRoot":"","sources":["../../src/agents/magic-context-prompt.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AA8KpE,wBAAgB,wBAAwB,CACpC,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,aAAa,EAAE,MAAM,EACrB,iBAAiB,UAAO,EACxB,cAAc,UAAQ,EACtB,wBAAwB,UAAQ,EAChC,6BAA6B,UAAQ,EACrC,YAAY,UAAQ,EACpB,QAAQ,CAAC,EAAE,MAAM,EACjB,aAAa,UAAO,EACpB,MAAM,GAAE,mBAA4B,EACpC,eAAe,CAAC,EAAE,MAAM,GACzB,MAAM,CA4CR"}
+{"version":3,"file":"magic-context-prompt.d.ts","sourceRoot":"","sources":["../../src/agents/magic-context-prompt.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAyKpE,wBAAgB,wBAAwB,CACpC,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,sBAAsB,EAAE,MAAM,EAC9B,iBAAiB,UAAO,EACxB,cAAc,UAAQ,EACtB,wBAAwB,UAAQ,EAChC,6BAA6B,UAAQ,EACrC,YAAY,UAAQ,EACpB,QAAQ,CAAC,EAAE,MAAM,EACjB,aAAa,UAAO,EACpB,MAAM,GAAE,mBAA4B,EACpC,eAAe,CAAC,EAAE,MAAM,GACzB,MAAM,CAyCR"}

package/dist/agents/permissions.d.ts

@@ -3,7 +3,7 @@
  *
  * # Why this exists
  *
- * Hidden agents (`historian`, `historian-editor`, `dreamer`, `sidekick`) are
+ * Hidden agents (`historian`, `historian-editor`, `dreamer`) are
  * registered with `mode: "primary"` and `hidden: true`: primary mode keeps
  * them out of OpenCode's general Task candidate list, while hidden keeps them
  * out of the UI picker. Those flags do NOT restrict which tools the spawned
@@ -61,13 +61,6 @@
  *     dreamer task variants. `task` / `edit` / `write` / `webfetch` /
  *     `websearch` remain denied — dreamer must not spawn subagents
  *     or commit changes.
- *
- *   - **sidekick**: `ctx_search`, plus the read-only AFT
- *     navigation tools `aft_outline` and `aft_zoom`. Sidekick's job
- *     is augmenting user prompts via memory retrieval — see
- *     `features/magic-context/sidekick/agent.ts`. AFT navigation lets
- *     it pull symbol-scoped structural context for prompts that
- *     reference a specific file or symbol.
  */
 /**
  * Build a `permission` map suitable for `AgentConfig.permission`. Starts
@@ -123,19 +116,6 @@ export declare const HISTORIAN_ALLOWED_TOOLS: readonly ["read", "aft_outline", "
  * config schema rejects them at parse time, so this is defense-in-depth).
  */
 export declare function applyDisallowedTools(defaults: readonly string[], disallowed: readonly string[]): readonly string[];
-/**
- * Tools the sidekick agent needs. Sidekick is a read-only memory
- * retriever for `/ctx-aug` — it queries the project's memory store
- * through `ctx_search` only. Keep `ctx_memory` out of this list because
- * its OpenCode tool definition is mutation-capable for primary agents.
- *
- * Also allow `aft_outline` and `aft_zoom` so sidekick can pull
- * lightweight structural context about a file or symbol when the
- * user's prompt references it directly — token-efficient navigation
- * without dragging in whole files.
- *
- * Still denied: spawning subagents, edits, bash, web fetches.
- */
 export declare const DREAMER_RETROSPECTIVE_ALLOWED_TOOLS: readonly ["ctx_search"];
 /**
  * The refresh-primers code investigator: read + navigate + search the CURRENT
@@ -150,5 +130,4 @@ export declare const DREAMER_PRIMER_INVESTIGATOR_ALLOWED_TOOLS: readonly ["read"
  * performed only when the compiled check runs through the host capability API.
  */
 export declare const SMART_NOTE_COMPILER_ALLOWED_TOOLS: readonly [];
-export declare const SIDEKICK_ALLOWED_TOOLS: readonly ["ctx_search", "aft_outline", "aft_zoom"];
 //# sourceMappingURL=permissions.d.ts.map

package/dist/agents/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/agents/permissions.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAEH;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACpC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAC3C,UAAU,CAAC,EAAE,MAAM,GACpB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAoBlC;AAYD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CACnC,UAAU,EAAE,OAAO,EACnB,gBAAgB,EAAE,SAAS,MAAM,EAAE,GACpC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgCzB;AAgBD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CACzC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACrD,gBAAgB,EAAE,SAAS,MAAM,EAAE,GACpC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAczC;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB,4DAA6D,CAAC;AAElG;;;;GAIG;AACH,wBAAgB,oBAAoB,CAChC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,UAAU,EAAE,SAAS,MAAM,EAAE,GAC9B,SAAS,MAAM,EAAE,CAGnB;AAQD;;;;;;;;;;;;GAYG;AAEH,eAAO,MAAM,mCAAmC,yBAA0B,CAAC;AAE3E;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC,0FAQ5C,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,aAAc,CAAC;AAE7D,eAAO,MAAM,sBAAsB,oDAAqD,CAAC"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/agents/permissions.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACpC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAC3C,UAAU,CAAC,EAAE,MAAM,GACpB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAoBlC;AAYD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CACnC,UAAU,EAAE,OAAO,EACnB,gBAAgB,EAAE,SAAS,MAAM,EAAE,GACpC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgCzB;AAgBD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CACzC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACrD,gBAAgB,EAAE,SAAS,MAAM,EAAE,GACpC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAczC;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB,4DAA6D,CAAC;AAElG;;;;GAIG;AACH,wBAAgB,oBAAoB,CAChC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,UAAU,EAAE,SAAS,MAAM,EAAE,GAC9B,SAAS,MAAM,EAAE,CAGnB;AAQD,eAAO,MAAM,mCAAmC,yBAA0B,CAAC;AAE3E;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC,0FAQ5C,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,aAAc,CAAC"}

package/dist/config/agent-disable.d.ts

@@ -12,11 +12,6 @@ export declare function isDreamerRunnable(config: {
         disable?: boolean;
     } | null;
 }): boolean;
-export declare function isSidekickRunnable(config: {
-    sidekick?: {
-        disable?: boolean;
-    } | null;
-}): boolean;
 export declare function isHistorianRunnable(config: {
     historian?: {
         disable?: boolean;

package/dist/config/agent-disable.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-disable.d.ts","sourceRoot":"","sources":["../../src/config/agent-disable.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,uBAA4B,CAAC;AAEjE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE;IAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAA;CAAE,GAAG,OAAO,CAE7F;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAA;CAAE,GAAG,OAAO,CAE/F;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAAE,SAAS,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAA;CAAE,GAAG,OAAO,CAEjG;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IACxC,UAAU,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;CAC7C,GAAG,OAAO,CAEV;AAmDD,wBAAgB,iCAAiC,CAC7C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,QAAQ,EAAE,MAAM,EAAE,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAiBzB"}
+{"version":3,"file":"agent-disable.d.ts","sourceRoot":"","sources":["../../src/config/agent-disable.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,uBAA4B,CAAC;AAEjE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE;IAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAA;CAAE,GAAG,OAAO,CAE7F;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAAE,SAAS,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAA;CAAE,GAAG,OAAO,CAEjG;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IACxC,UAAU,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;CAC7C,GAAG,OAAO,CAEV;AAuCD,wBAAgB,iCAAiC,CAC7C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,QAAQ,EAAE,MAAM,EAAE,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgBzB"}

package/dist/config/index.d.ts

@@ -38,6 +38,11 @@ export interface LoadResultDetailed {
     warningDetails: ConfigWarningDetail[];
     cacheTtlConfigured: boolean;
 }
+export declare function resetProtectedTagsDeprecationWarningForTest(): void;
+export declare function warnProtectedTagsDeprecationOnce(): void;
+export declare function parsePluginConfig(rawConfig: Record<string, unknown>, recoveredTopLevelKeys?: string[]): MagicContextPluginConfig & {
+    configWarnings?: string[];
+};
 export declare function loadPluginConfig(directory: string): MagicContextPluginConfig & {
     configWarnings?: string[];
 };

package/dist/config/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAEH,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EAC3B,MAAM,8BAA8B,CAAC;AAOtC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAoBpE,OAAO,EAAE,KAAK,kBAAkB,EAA4B,MAAM,wBAAwB,CAAC;AAI3F,MAAM,WAAW,wBAAyB,SAAQ,kBAAkB;IAChE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,6DAA6D;IAC7D,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC3C,oBAAoB,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAC7C,6FAA6F;IAC7F,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CACZ,MAAM,EACN;QACI,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,OAAO,CAAC;KACrB,CACJ,CAAC;CACL;AAwCD,MAAM,MAAM,WAAW,GACjB,IAAI,GACJ,0BAA0B,GAC1B,uBAAuB,GACvB,0BAA0B,GAC1B,iBAAiB,GACjB,sBAAsB,CAAC;AAE7B,MAAM,WAAW,kBAAkB;IAC/B,MAAM,EAAE,wBAAwB,GAAG;QAAE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACjE,6EAA6E;IAC7E,yBAAyB,EAAE,mBAAmB,CAAC;IAC/C,WAAW,EAAE,WAAW,CAAC;IACzB,OAAO,EAAE;QACL,UAAU,EAAE,WAAW,CAAC;QACxB,aAAa,EAAE,WAAW,CAAC;KAC9B,CAAC;IACF,oBAAoB,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9F,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,mBAAmB,EAAE,kBAAkB,EAAE,CAAC;IAC1C,cAAc,EAAE,mBAAmB,EAAE,CAAC;IACtC,kBAAkB,EAAE,OAAO,CAAC;CAC/B;AAyXD,wBAAgB,gBAAgB,CAC5B,SAAS,EAAE,MAAM,GAClB,wBAAwB,GAAG;IAAE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAY1D;AAwDD,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,CA8L9E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAEH,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EAC3B,MAAM,8BAA8B,CAAC;AAOtC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAsBpE,OAAO,EAAE,KAAK,kBAAkB,EAA4B,MAAM,wBAAwB,CAAC;AAI3F,MAAM,WAAW,wBAAyB,SAAQ,kBAAkB;IAChE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,6DAA6D;IAC7D,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC3C,oBAAoB,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAC7C,6FAA6F;IAC7F,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CACZ,MAAM,EACN;QACI,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,OAAO,CAAC;KACrB,CACJ,CAAC;CACL;AAwCD,MAAM,MAAM,WAAW,GACjB,IAAI,GACJ,0BAA0B,GAC1B,uBAAuB,GACvB,0BAA0B,GAC1B,iBAAiB,GACjB,sBAAsB,CAAC;AAE7B,MAAM,WAAW,kBAAkB;IAC/B,MAAM,EAAE,wBAAwB,GAAG;QAAE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACjE,6EAA6E;IAC7E,yBAAyB,EAAE,mBAAmB,CAAC;IAC/C,WAAW,EAAE,WAAW,CAAC;IACzB,OAAO,EAAE;QACL,UAAU,EAAE,WAAW,CAAC;QACxB,aAAa,EAAE,WAAW,CAAC;KAC9B,CAAC;IACF,oBAAoB,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9F,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,mBAAmB,EAAE,kBAAkB,EAAE,CAAC;IAC1C,cAAc,EAAE,mBAAmB,EAAE,CAAC;IACtC,kBAAkB,EAAE,OAAO,CAAC;CAC/B;AA+MD,wBAAgB,2CAA2C,IAAI,IAAI,CAElE;AAED,wBAAgB,gCAAgC,IAAI,IAAI,CAOvD;AAED,wBAAgB,iBAAiB,CAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,qBAAqB,GAAE,MAAM,EAAO,GACrC,wBAAwB,GAAG;IAAE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAiL1D;AAED,wBAAgB,gBAAgB,CAC5B,SAAS,EAAE,MAAM,GAClB,wBAAwB,GAAG;IAAE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAY1D;AAwDD,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,CAsM9E"}

package/dist/config/migrate-config-location.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate-config-location.d.ts","sourceRoot":"","sources":["../../src/config/migrate-config-location.ts"],"names":[],"mappings":"AAeA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,WAAW,kBAAkB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IAClC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,0BAA0B;IACvC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC7C,MAAM,CAAC,EAAE,qBAAqB,CAAC;CAClC;AAED,MAAM,WAAW,yBAAyB;IACtC,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACtB;AAoBD,iFAAiF;AACjF,wBAAgB,2BAA2B,IAAI,MAAM,CAEpD;AAED,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAExE;AAED,2DAA2D;AAC3D,wBAAgB,8BAA8B,IAAI,MAAM,CAEvD;AAED,2DAA2D;AAC3D,wBAAgB,iCAAiC,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE3E;AA4BD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG;IAC3D,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAC3B,OAAO,EAAE,kBAAkB,EAAE,CAAC;CACjC,CAsBA;AAED,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,IAAI,CAAC;AAE9C;;;;;;;;;GASG;AACH,wBAAgB,oCAAoC,CAChD,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,GACvB;IAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAAC,OAAO,EAAE,kBAAkB,EAAE,CAAA;CAAE,CA0B/D;AAmSD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,0BAA0B,GAAG,yBAAyB,CA0F7F;AAED;;;;;GAKG;AACH,wBAAgB,kCAAkC,CAC9C,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,qBAAqB,GAC/B,MAAM,EAAE,CA6BV"}
+{"version":3,"file":"migrate-config-location.d.ts","sourceRoot":"","sources":["../../src/config/migrate-config-location.ts"],"names":[],"mappings":"AAgBA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,WAAW,kBAAkB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IAClC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,0BAA0B;IACvC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC7C,MAAM,CAAC,EAAE,qBAAqB,CAAC;CAClC;AAED,MAAM,WAAW,yBAAyB;IACtC,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACtB;AAoBD,iFAAiF;AACjF,wBAAgB,2BAA2B,IAAI,MAAM,CAEpD;AAED,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAExE;AAED,2DAA2D;AAC3D,wBAAgB,8BAA8B,IAAI,MAAM,CAEvD;AAED,2DAA2D;AAC3D,wBAAgB,iCAAiC,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE3E;AA4BD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG;IAC3D,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAC3B,OAAO,EAAE,kBAAkB,EAAE,CAAC;CACjC,CAsBA;AAED,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,IAAI,CAAC;AAE9C;;;;;;;;;GASG;AACH,wBAAgB,oCAAoC,CAChD,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,GACvB;IAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAAC,OAAO,EAAE,kBAAkB,EAAE,CAAA;CAAE,CA0B/D;AAsQD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,0BAA0B,GAAG,yBAAyB,CAyG7F;AAED;;;;;GAKG;AACH,wBAAgB,kCAAkC,CAC9C,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,qBAAqB,GAC/B,MAAM,EAAE,CA6BV"}

package/dist/config/project-security.d.ts

@@ -1,3 +1,18 @@
+export declare function resolveProtectedTokensScalar(value: unknown): number | undefined;
+export interface ProtectedTokensTierOverrides {
+    readonly user?: number;
+    readonly project?: number;
+}
+/**
+ * Retain trusted user and project values outside the public config schema until
+ * live context geometry is available. The symbol is non-enumerable so runtime
+ * provenance cannot leak into saved JSON or generated schema surfaces.
+ */
+export declare function attachProtectedTokensTierOverrides<T extends object>(config: T, args: {
+    trustedUser: unknown;
+    project: unknown;
+}): T;
+export declare function getProtectedTokensTierOverrides(config: object): ProtectedTokensTierOverrides | undefined;
 /**
  * Strip unsafe fields from a raw PROJECT config IN PLACE, before it is merged
  * over the user config. Returns warnings describing what was ignored.
@@ -10,6 +25,7 @@
  *    carry security fixes).
  *  - `fail_closed_blocking` — a repo must not un-block (or force-block) the
  *    loud inoperability gate; only the user may restore silent degrade.
+ *  - `debug_rpc` — a repo must not enable process heap capture or memory diagnostics.
  *  - `allow_home_project` — only the user may opt a home-directory session
  *    into a durable project identity.
  *  - `output_reserve` / `models.window_overlay_path` — only the user may change
@@ -25,8 +41,9 @@
  *    confidentiality. Only the machine operator's user config may opt into an
  *    externally managed trusted-group deployment.
  *  - `embedding.endpoint` / `embedding.provider` — a repo must not choose
- *    where private memory/search/commit text is embedded. User-level config is
- *    the trust boundary for embedding destinations.
+ *    where private memory/search/commit text is embedded. Query/document prefix
+ *    overrides also remain user-owned so a repository cannot alter the text sent
+ *    to that destination or silently force a corpus re-embed.
  *  - `transform_mode` is intentionally allowed at project tier so a repository
  *    can opt its own runtime into the experimental Rust pipeline. The resolver
  *    requires trusted user-level `subc` configuration before Rust can activate.
@@ -60,6 +77,7 @@ export declare function constrainProjectThresholdOverrides(args: {
     trustedBaseConfig: {
         execute_threshold_percentage?: unknown;
         execute_threshold_tokens?: unknown;
+        protected_tokens?: unknown;
     };
 }): string[];
 export declare function dropInheritedEmbeddingKeyOnRedirect(projectRaw: Record<string, unknown>, mergedRaw: Record<string, unknown>, userRaw?: Record<string, unknown>): string[];

package/dist/config/project-security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-security.d.ts","sourceRoot":"","sources":["../../src/config/project-security.ts"],"names":[],"mappings":"AA8PA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAkP5F;AAED;;;;;GAKG;AACH,wBAAgB,kCAAkC,CAAC,IAAI,EAAE;IACrD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,iBAAiB,EAAE;QACf,4BAA4B,CAAC,EAAE,OAAO,CAAC;QACvC,wBAAwB,CAAC,EAAE,OAAO,CAAC;KACtC,CAAC;CACL,GAAG,MAAM,EAAE,CA+IX;AA2BD,wBAAgB,mCAAmC,CAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAClC,MAAM,EAAE,CAsCV"}
+{"version":3,"file":"project-security.d.ts","sourceRoot":"","sources":["../../src/config/project-security.ts"],"names":[],"mappings":"AA2EA,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAU/E;AAED,MAAM,WAAW,4BAA4B;IACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC7B;AAUD;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,CAAC,SAAS,MAAM,EAC/D,MAAM,EAAE,CAAC,EACT,IAAI,EAAE;IAAE,WAAW,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GACjD,CAAC,CAmBH;AAED,wBAAgB,+BAA+B,CAC3C,MAAM,EAAE,MAAM,GACf,4BAA4B,GAAG,SAAS,CAE1C;AAsLD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAyP5F;AAED;;;;;GAKG;AACH,wBAAgB,kCAAkC,CAAC,IAAI,EAAE;IACrD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,iBAAiB,EAAE;QACf,4BAA4B,CAAC,EAAE,OAAO,CAAC;QACvC,wBAAwB,CAAC,EAAE,OAAO,CAAC;QACnC,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC9B,CAAC;CACL,GAAG,MAAM,EAAE,CA6KX;AA2BD,wBAAgB,mCAAmC,CAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAClC,MAAM,EAAE,CAsCV"}

package/dist/config/removed-agent-config.d.ts

@@ -0,0 +1,8 @@
+export declare const REMOVED_AGENT_CONFIG_WARNING = "The \"sidekick\" configuration was removed and is ignored.";
+/**
+ * Remove the retired agent block before profile resolution or schema parsing.
+ * The same warning array may be shared across user and project layers so one
+ * load reports the removal once while preserving every unrelated setting.
+ */
+export declare function stripRemovedAgentConfig(rawConfig: Record<string, unknown>, warnings: string[]): Record<string, unknown>;
+//# sourceMappingURL=removed-agent-config.d.ts.map

package/dist/config/removed-agent-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"removed-agent-config.d.ts","sourceRoot":"","sources":["../../src/config/removed-agent-config.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,4BAA4B,+DAAgF,CAAC;AAM1H;;;;GAIG;AACH,wBAAgB,uBAAuB,CACnC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,QAAQ,EAAE,MAAM,EAAE,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA4BzB"}