@cortexkit/opencode-magic-context 0.41.4 → 0.42.1

package/src/config/protected-tokens.test.ts

@@ -0,0 +1,235 @@
+/// <reference types="bun-types" />
+
+import { describe, expect, it } from "bun:test";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { parsePluginConfig, resetProtectedTagsDeprecationWarningForTest } from "./index";
+import { constrainProjectThresholdOverrides } from "./project-security";
+import { deriveDefaultProtectedTokens, MagicContextConfigSchema } from "./schema/magic-context";
+
+describe("protected_tokens config and derivation", () => {
+    describe("derived-default table asserted by value", () => {
+        it("asserts 100k -> 8,000", () => {
+            expect(deriveDefaultProtectedTokens(100_000)).toBe(8_000);
+        });
+
+        it("asserts 200k -> 16,000", () => {
+            expect(deriveDefaultProtectedTokens(200_000)).toBe(16_000);
+        });
+
+        it("asserts 372k -> 18,600", () => {
+            expect(deriveDefaultProtectedTokens(372_000)).toBe(18_600);
+        });
+
+        it("asserts 872k -> 43,600", () => {
+            expect(deriveDefaultProtectedTokens(872_000)).toBe(43_600);
+        });
+
+        it("asserts 1M -> 50,000", () => {
+            expect(deriveDefaultProtectedTokens(1_000_000)).toBe(50_000);
+        });
+    });
+
+    describe("override range enforced at both ends", () => {
+        it("accepts values within 4_000 .. 1_000_000", () => {
+            expect(
+                MagicContextConfigSchema.parse({ protected_tokens: 4_000 }).protected_tokens,
+            ).toBe(4_000);
+            expect(
+                MagicContextConfigSchema.parse({ protected_tokens: 30_000 }).protected_tokens,
+            ).toBe(30_000);
+            expect(
+                MagicContextConfigSchema.parse({ protected_tokens: 1_000_000 }).protected_tokens,
+            ).toBe(1_000_000);
+        });
+
+        it("rejects values below 4_000", () => {
+            expect(() => MagicContextConfigSchema.parse({ protected_tokens: 3_999 })).toThrow();
+            expect(() => MagicContextConfigSchema.parse({ protected_tokens: 0 })).toThrow();
+            expect(() => MagicContextConfigSchema.parse({ protected_tokens: -100 })).toThrow();
+        });
+
+        it("rejects values above 1_000_000", () => {
+            expect(() => MagicContextConfigSchema.parse({ protected_tokens: 1_000_001 })).toThrow();
+        });
+    });
+
+    describe("config-form parity tests against pinned Ruling 5 shape", () => {
+        // Shared expectation: any non-positive-integer shape is an invalid leaf
+        // (warning emitted, fall back to derived floor, plugin remains enabled).
+        it("(a) object form without default is an invalid leaf and falls back to derived", () => {
+            const raw = { protected_tokens: { "anthropic/claude-3-5-sonnet": 30_000 } };
+            const parsed = MagicContextConfigSchema.safeParse(raw);
+            expect(parsed.success).toBe(false);
+
+            const recovered = parsePluginConfig(raw);
+            expect(recovered.protected_tokens).toBeUndefined();
+            expect(
+                recovered.configWarnings?.some((w) =>
+                    w.includes('"protected_tokens": invalid value'),
+                ),
+            ).toBe(true);
+            const resolvedFloor =
+                recovered.protected_tokens ?? deriveDefaultProtectedTokens(200_000);
+            expect(resolvedFloor).toBe(16_000);
+        });
+
+        it("(b) unmatched model key in object form is an invalid leaf and falls back to derived", () => {
+            const raw = { protected_tokens: { unmatched_model: 25_000 } };
+            const parsed = MagicContextConfigSchema.safeParse(raw);
+            expect(parsed.success).toBe(false);
+
+            const recovered = parsePluginConfig(raw);
+            expect(recovered.protected_tokens).toBeUndefined();
+            expect(
+                recovered.configWarnings?.some((w) =>
+                    w.includes('"protected_tokens": invalid value'),
+                ),
+            ).toBe(true);
+            const resolvedFloor =
+                recovered.protected_tokens ?? deriveDefaultProtectedTokens(200_000);
+            expect(resolvedFloor).toBe(16_000);
+        });
+
+        it("(c) fractional override is an invalid leaf and falls back to derived", () => {
+            const raw = { protected_tokens: 16000.5 };
+            const parsed = MagicContextConfigSchema.safeParse(raw);
+            expect(parsed.success).toBe(false);
+
+            const recovered = parsePluginConfig(raw);
+            expect(recovered.protected_tokens).toBeUndefined();
+            expect(
+                recovered.configWarnings?.some((w) =>
+                    w.includes('"protected_tokens": invalid value'),
+                ),
+            ).toBe(true);
+            const resolvedFloor =
+                recovered.protected_tokens ?? deriveDefaultProtectedTokens(200_000);
+            expect(resolvedFloor).toBe(16_000);
+        });
+    });
+
+    describe("precedence: project (raise-only, only if >= resolved user value) > user > derived", () => {
+        it("project raises user value when >= resolved user value", () => {
+            const mergedRaw: Record<string, unknown> = { protected_tokens: 20_000 };
+            const projectRaw = { protected_tokens: 30_000 };
+            const warnings = constrainProjectThresholdOverrides({
+                mergedRaw,
+                projectRaw,
+                trustedBaseConfig: { protected_tokens: 20_000 },
+            });
+            expect(mergedRaw.protected_tokens).toBe(30_000);
+            expect(warnings).toHaveLength(0);
+        });
+
+        it("project lower than user value is rejected with warning and user value stands", () => {
+            const mergedRaw: Record<string, unknown> = { protected_tokens: 25_000 };
+            const projectRaw = { protected_tokens: 10_000 };
+            const warnings = constrainProjectThresholdOverrides({
+                mergedRaw,
+                projectRaw,
+                trustedBaseConfig: { protected_tokens: 25_000 },
+            });
+            expect(mergedRaw.protected_tokens).toBe(25_000);
+            expect(warnings.some((w) => w.includes("protected_tokens"))).toBe(true);
+        });
+
+        it("rejects a project object and preserves the trusted user scalar", () => {
+            const mergedRaw: Record<string, unknown> = {
+                protected_tokens: { default: 35_000 },
+            };
+            const projectRaw = { protected_tokens: { default: 35_000 } };
+            const warnings = constrainProjectThresholdOverrides({
+                mergedRaw,
+                projectRaw,
+                trustedBaseConfig: { protected_tokens: 20_000 },
+            });
+            expect(mergedRaw.protected_tokens).toBe(20_000);
+            expect(warnings.some((w) => w.includes("protected_tokens"))).toBe(true);
+        });
+
+        it("rejects a project object and falls back to derivation when the user omitted the setting", () => {
+            const mergedRaw: Record<string, unknown> = {
+                protected_tokens: { default: 35_000 },
+            };
+            const projectRaw = { protected_tokens: { default: 35_000 } };
+            const warnings = constrainProjectThresholdOverrides({
+                mergedRaw,
+                projectRaw,
+                trustedBaseConfig: {},
+            });
+            expect(mergedRaw.protected_tokens).toBeUndefined();
+            expect(warnings.some((w) => w.includes("protected_tokens"))).toBe(true);
+        });
+
+        it("project override applies when user tier is omitted", () => {
+            const mergedRaw: Record<string, unknown> = {};
+            const projectRaw = { protected_tokens: 32_000 };
+            const warnings = constrainProjectThresholdOverrides({
+                mergedRaw,
+                projectRaw,
+                trustedBaseConfig: {},
+            });
+            expect(mergedRaw.protected_tokens).toBe(32_000);
+            expect(warnings).toHaveLength(0);
+        });
+    });
+
+    describe("root configuration reference", () => {
+        const reference = readFileSync(
+            resolve(import.meta.dir, "../../../../CONFIGURATION.md"),
+            "utf8",
+        );
+
+        it("documents protected_tokens as live and protected_tags only as deprecated and ignored", () => {
+            expect(reference).toContain("| `protected_tokens` |");
+            expect(reference).not.toContain("| `protected_tags` |");
+            expect(reference).toContain("`protected_tags` is deprecated and ignored");
+        });
+    });
+
+    describe("protected_tags deprecation", () => {
+        it("is parsed at any value (including 0 and 101) with parse succeeding and no numeric conversion", () => {
+            resetProtectedTagsDeprecationWarningForTest();
+            const config0 = MagicContextConfigSchema.parse({ protected_tags: 0 });
+            expect(config0.protected_tags).toBe(0);
+
+            const config101 = MagicContextConfigSchema.parse({ protected_tags: 101 });
+            expect(config101.protected_tags).toBe(101);
+
+            const configArbitrary = MagicContextConfigSchema.parse({
+                protected_tags: "legacy-string",
+            });
+            expect(configArbitrary.protected_tags).toBe("legacy-string");
+
+            // Verify no numeric conversion happened
+            expect(typeof configArbitrary.protected_tags).toBe("string");
+        });
+
+        it("emits a once-per-process loud deprecation warning naming the replacement", () => {
+            resetProtectedTagsDeprecationWarningForTest();
+            const warnCalls: string[] = [];
+            const originalWarn = console.warn;
+            console.warn = (...args: unknown[]) => warnCalls.push(args.map(String).join(" "));
+
+            try {
+                const res1 = parsePluginConfig({ protected_tags: 20 });
+                expect(
+                    res1.configWarnings?.some((w) =>
+                        w.includes(
+                            "protected_tags is deprecated and ignored; use protected_tokens instead.",
+                        ),
+                    ),
+                ).toBe(true);
+                expect(warnCalls).toHaveLength(1);
+                expect(warnCalls[0]).toContain("protected_tokens");
+
+                // Second parse in same process must NOT log to console again
+                parsePluginConfig({ protected_tags: 10 });
+                expect(warnCalls).toHaveLength(1);
+            } finally {
+                console.warn = originalWarn;
+            }
+        });
+    });
+});

package/src/config/removed-agent-config.ts

@@ -0,0 +1,45 @@
+const REMOVED_AGENT_CONFIG_KEY = "sidekick";
+
+export const REMOVED_AGENT_CONFIG_WARNING = `The "${REMOVED_AGENT_CONFIG_KEY}" configuration was removed and is ignored.`;
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/**
+ * Remove the retired agent block before profile resolution or schema parsing.
+ * The same warning array may be shared across user and project layers so one
+ * load reports the removal once while preserving every unrelated setting.
+ */
+export function stripRemovedAgentConfig(
+    rawConfig: Record<string, unknown>,
+    warnings: string[],
+): Record<string, unknown> {
+    let removed = false;
+    const patched = { ...rawConfig };
+
+    if (Object.hasOwn(patched, REMOVED_AGENT_CONFIG_KEY)) {
+        delete patched[REMOVED_AGENT_CONFIG_KEY];
+        removed = true;
+    }
+
+    if (isPlainObject(patched.profiles)) {
+        const profiles = { ...patched.profiles };
+        let profilesChanged = false;
+        for (const [name, value] of Object.entries(profiles)) {
+            if (!isPlainObject(value) || !Object.hasOwn(value, REMOVED_AGENT_CONFIG_KEY)) continue;
+            const profile = { ...value };
+            delete profile[REMOVED_AGENT_CONFIG_KEY];
+            profiles[name] = profile;
+            profilesChanged = true;
+            removed = true;
+        }
+        if (profilesChanged) patched.profiles = profiles;
+    }
+
+    if (removed && !warnings.includes(REMOVED_AGENT_CONFIG_WARNING)) {
+        warnings.push(REMOVED_AGENT_CONFIG_WARNING);
+    }
+
+    return removed ? patched : rawConfig;
+}

package/src/config/removed-agent-source-fence.test.ts

@@ -0,0 +1,56 @@
+/// <reference types="bun-types" />
+
+import { describe, expect, it } from "bun:test";
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { join, relative } from "node:path";
+
+const RETIRED_AGENT_NAME = ["side", "kick"].join("");
+const RETIRED_AGENT_PATTERN = new RegExp(RETIRED_AGENT_NAME, "gi");
+const REPO_ROOT = join(__dirname, "..", "..", "..", "..");
+const WARNING_SOURCE = join(
+    REPO_ROOT,
+    "packages",
+    "plugin",
+    "src",
+    "config",
+    "removed-agent-config.ts",
+);
+const SOURCE_ROOTS = [
+    join(REPO_ROOT, "packages", "plugin", "src"),
+    join(REPO_ROOT, "packages", "pi-plugin", "src"),
+    join(REPO_ROOT, "packages", "cli", "src"),
+    join(REPO_ROOT, "packages", "dashboard", "src"),
+    join(REPO_ROOT, "packages", "dashboard", "src-tauri", "src"),
+];
+const SOURCE_EXTENSIONS = new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".rs", ".json"]);
+
+function sourceFiles(directory: string, files: string[] = []): string[] {
+    for (const entry of readdirSync(directory)) {
+        if (entry === "node_modules" || entry === "dist") continue;
+        const path = join(directory, entry);
+        const stat = statSync(path);
+        if (stat.isDirectory()) {
+            sourceFiles(path, files);
+            continue;
+        }
+        const extension = entry.slice(entry.lastIndexOf("."));
+        if (stat.isFile() && SOURCE_EXTENSIONS.has(extension)) files.push(path);
+    }
+    return files;
+}
+
+describe("retired agent source fence", () => {
+    it("keeps only the removed-config warning key literal", () => {
+        const offenses: string[] = [];
+        for (const file of SOURCE_ROOTS.flatMap((root) => sourceFiles(root))) {
+            const matches = readFileSync(file, "utf8").match(RETIRED_AGENT_PATTERN) ?? [];
+            const allowed = file === WARNING_SOURCE && matches.length === 1;
+            if (!allowed && matches.length > 0) {
+                offenses.push(`${relative(REPO_ROOT, file)} (${matches.length})`);
+            }
+        }
+
+        expect(offenses).toEqual([]);
+        expect(readFileSync(WARNING_SOURCE, "utf8").match(RETIRED_AGENT_PATTERN)).toHaveLength(1);
+    });
+});

package/src/config/schema/magic-context.test.ts

@@ -23,7 +23,6 @@ describe("MagicContextConfigSchema", () => {
                 cache_ttl: "5m",
                 prompt_surface: { default: "full" },
                 execute_threshold_percentage: 65,
-                protected_tags: 20,
                 clear_reasoning_age: 50,
                 history_budget_percentage: DEFAULT_HISTORY_BUDGET_PERCENTAGE,
                 historian_timeout_ms: DEFAULT_HISTORIAN_TIMEOUT_MS,
@@ -46,7 +45,6 @@ describe("MagicContextConfigSchema", () => {
             expect(result.historian_timeout_ms).toBeGreaterThanOrEqual(10 * 60_000);
             expect(result.historian).toBeUndefined();
             expect(result.dreamer).toBeUndefined();
-            expect(result.sidekick).toBeUndefined();
             expect(result.pi).toBeUndefined();
             expect(result.mural).toEqual({ enabled: false });
         });
@@ -107,6 +105,7 @@ describe("MagicContextConfigSchema", () => {
                 },
                 temporal_awareness: false,
                 keep_subagents: false,
+                debug_rpc: false,
                 todowrite: {
                     enabled: false,
                     overlay: false,
@@ -145,15 +144,6 @@ describe("MagicContextConfigSchema", () => {
                 pi: {
                     subagent_extensions: ["@example/provider", "./extensions/local.ts"],
                 },
-                sidekick: {
-                    disable: false,
-                    model: "qwen-test",
-                    fallback_models: ["qwen-fallback"],
-                    temperature: 0.1,
-                    variant: "fast",
-                    timeout_ms: 12_000,
-                    system_prompt: "Custom prompt",
-                },
                 compaction: {
                     enabled: true,
                 },
@@ -177,19 +167,6 @@ describe("MagicContextConfigSchema", () => {
             ).toBe(false);
         });
 
-        it("applies sidekick defaults when the object is present", () => {
-            const result = MagicContextConfigSchema.parse({
-                sidekick: {
-                    model: "github-copilot/gpt-5.4",
-                },
-            });
-
-            expect(result.sidekick).toEqual({
-                model: "github-copilot/gpt-5.4",
-                timeout_ms: 30000,
-            });
-        });
-
         it("accepts disable on hidden agents and strips deprecated top-level enabled", () => {
             const result = MagicContextConfigSchema.parse({
                 historian: { disable: true },
@@ -203,14 +180,11 @@ describe("MagicContextConfigSchema", () => {
                         "maintain-docs": { schedule: "0 * * * *" },
                     },
                 },
-                sidekick: { disable: true, enabled: true },
             });
 
             expect(result.historian?.disable).toBe(true);
             expect(result.dreamer?.disable).toBe(true);
-            expect(result.sidekick?.disable).toBe(true);
             expect("enabled" in (result.dreamer as Record<string, unknown>)).toBe(false);
-            expect("enabled" in (result.sidekick as Record<string, unknown>)).toBe(false);
             expect(result.dreamer?.tasks["review-user-memories"].schedule).toBe("");
             expect(result.dreamer?.tasks["maintain-docs"].schedule).toBe("0 * * * *");
             expect(result.dreamer?.tasks["classify-memories"].schedule).toBe("0 6 * * *");
@@ -353,10 +327,6 @@ describe("MagicContextConfigSchema", () => {
                                 thinking_level: "inherit",
                             },
                         },
-                        sidekick: {
-                            model: "anthropic/work-sidekick",
-                            fallback_models: ["openai/work-sidekick-fallback"],
-                        },
                     },
                 },
             });
@@ -376,7 +346,6 @@ describe("MagicContextConfigSchema", () => {
                 { model: "opencode/work-historian-fallback", thinking_level: "inherit" },
             ]);
             expect(result.profiles?.work?.dreamer?.omp?.thinking_level).toBe("inherit");
-            expect(result.profiles?.work?.sidekick?.model).toBe("anthropic/work-sidekick");
         });
 
         it("rejects timeout_minutes in a dreamer profile", () => {
@@ -432,7 +401,7 @@ describe("MagicContextConfigSchema", () => {
                     },
                 },
                 { work: { dreamer: { tasks: { verify: { schedule: "0 3 * * *" } } } } },
-                { work: { sidekick: { timeout_ms: 60_000 } } },
+                { work: { dreamer: { timeout_ms: 60_000 } } },
             ];
 
             for (const profiles of profilesWithExcludedFields) {
@@ -667,17 +636,27 @@ describe("MagicContextConfigSchema", () => {
             ).toThrow();
         });
 
-        it("rejects protected_tags greater than 100", () => {
-            expect(() => MagicContextConfigSchema.parse({ protected_tags: 101 })).toThrow();
-        });
-
-        it("rejects protected_tags less than 1", () => {
-            expect(() => MagicContextConfigSchema.parse({ protected_tags: 0 })).toThrow();
+        it("accepts protected_tags at any value including 0 and 101 as deprecated inert key", () => {
+            expect(MagicContextConfigSchema.parse({ protected_tags: 101 }).protected_tags).toBe(
+                101,
+            );
+            expect(MagicContextConfigSchema.parse({ protected_tags: 0 }).protected_tags).toBe(0);
+            expect(MagicContextConfigSchema.parse({ protected_tags: 20 }).protected_tags).toBe(20);
         });
 
-        it("accepts protected_tags boundary values", () => {
-            expect(MagicContextConfigSchema.parse({ protected_tags: 1 }).protected_tags).toBe(1);
-            expect(MagicContextConfigSchema.parse({ protected_tags: 20 }).protected_tags).toBe(20);
+        it("enforces protected_tokens override range at both ends", () => {
+            expect(() => MagicContextConfigSchema.parse({ protected_tokens: 3999 })).toThrow();
+            expect(() => MagicContextConfigSchema.parse({ protected_tokens: 1_000_001 })).toThrow();
+            expect(() => MagicContextConfigSchema.parse({ protected_tokens: 30000.5 })).toThrow();
+            expect(
+                MagicContextConfigSchema.parse({ protected_tokens: 4000 }).protected_tokens,
+            ).toBe(4000);
+            expect(
+                MagicContextConfigSchema.parse({ protected_tokens: 1_000_000 }).protected_tokens,
+            ).toBe(1_000_000);
+            expect(
+                MagicContextConfigSchema.parse({ protected_tokens: 30000 }).protected_tokens,
+            ).toBe(30000);
         });
 
         it("rejects clear_reasoning_age below minimum", () => {
@@ -719,6 +698,35 @@ describe("MagicContextConfigSchema", () => {
             ).toThrow();
         });
 
+        it("preserves embedding instruction prefixes byte-for-byte and accepts false", () => {
+            const queryInstruction = "Instruct: custom task\nQuery: ";
+            const documentPrefix = "search_document: ";
+            const parsed = MagicContextConfigSchema.parse({
+                embedding: {
+                    provider: "openai-compatible",
+                    endpoint: "http://localhost:1234/v1",
+                    model: "custom/model",
+                    query_instruction: queryInstruction,
+                    document_prefix: documentPrefix,
+                },
+            }).embedding;
+
+            expect(parsed).toMatchObject({
+                query_instruction: queryInstruction,
+                document_prefix: documentPrefix,
+            });
+            expect(
+                MagicContextConfigSchema.parse({
+                    embedding: {
+                        provider: "openai-compatible",
+                        endpoint: "http://localhost:1234/v1",
+                        model: "custom/model",
+                        query_instruction: false,
+                    },
+                }).embedding,
+            ).toMatchObject({ query_instruction: false });
+        });
+
         it("defaults local embedding runtime to auto and accepts explicit overrides", () => {
             expect(
                 MagicContextConfigSchema.parse({ embedding: { provider: "local" } }).embedding,