@cortexkit/opencode-magic-context 0.43.2 → 0.44.1

package/src/config/misplaced-agent-model.test.ts

@@ -0,0 +1,61 @@
+/// <reference types="bun-types" />
+
+import { describe, expect, it } from "bun:test";
+import { resolveHistorianModel } from "../shared/model-resolution";
+import { misplacedAgentModelWarnings, parsePluginConfig } from "./index";
+
+/**
+ * A bare `historian.model` is schema-valid, reads naturally, and resolves to
+ * nothing. These tests pin both halves: that the resolver really does ignore it,
+ * and that the loader now says so instead of leaving the user with a subsystem
+ * that looks configured and never runs.
+ */
+describe("misplaced agent model warning", () => {
+    it("is what a top-level historian.model actually resolves to", () => {
+        // The premise, asserted rather than assumed: if this ever starts
+        // resolving, the warning below becomes wrong and should be deleted.
+        expect(resolveHistorianModel({ historian: { model: "openai/gpt-5" } }, "opencode")).toEqual(
+            {
+                primary: undefined,
+                fallbacks: [],
+            },
+        );
+    });
+
+    it("warns when the model sits outside every harness block", () => {
+        const warnings = misplacedAgentModelWarnings({ historian: { model: "openai/gpt-5" } });
+        expect(warnings).toHaveLength(1);
+        expect(warnings[0]).toContain("historian.model is not read");
+        expect(warnings[0]).toContain("historian.opencode.model");
+    });
+
+    it("stays quiet when a harness block carries the model", () => {
+        expect(
+            misplacedAgentModelWarnings({
+                historian: { model: "openai/gpt-5", opencode: { model: "openai/gpt-5" } },
+            }),
+        ).toEqual([]);
+        expect(
+            misplacedAgentModelWarnings({ historian: { opencode: { model: "openai/gpt-5" } } }),
+        ).toEqual([]);
+        expect(misplacedAgentModelWarnings({})).toEqual([]);
+        expect(misplacedAgentModelWarnings({ historian: { disable: true } })).toEqual([]);
+    });
+
+    it("covers the dreamer on the same rule", () => {
+        const warnings = misplacedAgentModelWarnings({ dreamer: { model: "openai/gpt-5" } });
+        expect(warnings).toHaveLength(1);
+        expect(warnings[0]).toContain("dreamer.model is not read");
+    });
+
+    it("reaches the pinned config-warning channel", () => {
+        // configWarnings is what /ctx-status, the Pi session-start notice and
+        // doctor read, so landing here is what makes the warning visible.
+        const parsed = parsePluginConfig({ historian: { model: "openai/gpt-5" } });
+        expect(
+            (parsed.configWarnings ?? []).some((warning) =>
+                warning.includes("historian.model is not read"),
+            ),
+        ).toBe(true);
+    });
+});

package/src/config/project-security.test.ts

@@ -225,6 +225,23 @@ describe("stripUnsafeProjectConfigFields", () => {
         expect(warning).toContain("historian.pi.thinking_level");
     });
 
+    it("strips the historian runner from project config so a repo cannot redirect the completion", () => {
+        const raw: Record<string, unknown> = {
+            historian: {
+                runner: "host",
+                opencode: { runner: "host" },
+                temperature: 0.2,
+            },
+        };
+
+        const warnings = stripUnsafeProjectConfigFields(raw);
+
+        expect(raw.historian).toEqual({ opencode: {}, temperature: 0.2 });
+        const warning = warnings.join("\n");
+        expect(warning).toContain("historian.runner");
+        expect(warning).toContain("historian.opencode.runner");
+    });
+
     it("strips mural.model from project config but keeps the feature switch", () => {
         const raw: Record<string, unknown> = {
             mural: { enabled: true, model: "repo-controlled-model" },

package/src/config/project-security.ts

@@ -23,7 +23,17 @@ const HARNESS_KEYS = PER_HARNESS_MODEL_KEYS;
 /** Every historian model-resolution field, including per-harness qualifiers.
  *  Variant and thinking_level merge onto the user's historian model at resolve
  *  time, so leaving them would let a cloned repo force extra spend. */
-const HISTORIAN_USER_ONLY_FIELDS = PER_HARNESS_MIGRATION_INVENTORY.historian.migrated_execution;
+const HISTORIAN_USER_ONLY_FIELDS = [
+    ...PER_HARNESS_MIGRATION_INVENTORY.historian.migrated_execution,
+    // `runner` chooses which process and which provider account runs the hidden
+    // historian completion. A cloned repo redirecting it would move that spend and
+    // that prompt text somewhere the user never agreed to.
+    "runner",
+    // `host_runner` turns this machine's pull loop on and off. A cloned repo
+    // turning it ON would start spending the user's provider account on folds for
+    // every project this process serves, not just its own.
+    "host_runner",
+] as const;
 const PROMPT_SURFACE_USER_ONLY_FIELDS = ["guidance_override_path", "tool_descriptions"] as const;
 
 /**
@@ -348,10 +358,13 @@ function makeProjectThresholdWarning(field: string, reason: string): string {
  *    can opt its own runtime into the experimental Rust pipeline. The resolver
  *    requires trusted user-level `subc` configuration before Rust can activate.
  *  - historian model-resolution fields (model, fallback_models, variant,
- *    thinking_level), including both per-harness blocks — historian model
- *    spend is user-level only. Qualifiers merge onto the user's historian
+ *    thinking_level) and `runner`, including both per-harness blocks — historian
+ *    model spend is user-level only. Qualifiers merge onto the user's historian
  *    model at resolve time, so a cloned repo cannot force extra thinking or
- *    variant cost.
+ *    variant cost, and cannot move the completion to a different process or
+ *    provider account. `host_runner` is stripped for the same reason in the other
+ *    direction: a repo must not switch this machine's pull loop on and start
+ *    spending the user's provider account on folds.
  *  - `mural.model` at the top-level block, the legacy experimental spelling,
  *    and any nested `mural.model` under hidden agents — a cloned repo cannot
  *    choose where project memory is sent.
@@ -579,6 +592,17 @@ export function stripUnsafeProjectConfigFields(projectRaw: Record<string, unknow
         }
     }
 
+    // `dreamer.runner` chooses which process and which provider account runs the
+    // module-routed dreamer completions, for the same reason `historian.runner`
+    // is user-level only.
+    const dreamer = projectRaw.dreamer;
+    if (isPlainObject(dreamer) && "runner" in dreamer) {
+        delete dreamer.runner;
+        warnings.push(
+            "Ignoring dreamer.runner from project config (security: which process and provider account run dreamer completions is a user-level setting).",
+        );
+    }
+
     const mural = projectRaw.mural;
     if (isPlainObject(mural) && "model" in mural) {
         delete mural.model;

package/src/config/schema/magic-context.test.ts

@@ -38,7 +38,7 @@ describe("MagicContextConfigSchema", () => {
                     retrieval_count_promotion_threshold: 3,
                 },
                 todowrite: {
-                    enabled: true,
+                    enabled: false,
                     overlay: true,
                 },
             });
@@ -50,6 +50,21 @@ describe("MagicContextConfigSchema", () => {
         });
     });
 
+    it("defaults todowrite off but honors explicit enablement and disablement", () => {
+        expect(MagicContextConfigSchema.parse({}).todowrite).toEqual({
+            enabled: false,
+            overlay: true,
+        });
+        expect(MagicContextConfigSchema.parse({ todowrite: {} }).todowrite.enabled).toBe(false);
+        expect(MagicContextConfigSchema.parse({ todowrite: { enabled: true } }).todowrite).toEqual({
+            enabled: true,
+            overlay: true,
+        });
+        expect(
+            MagicContextConfigSchema.parse({ todowrite: { enabled: false } }).todowrite.enabled,
+        ).toBe(false);
+    });
+
     describe("budget configuration", () => {
         it("accepts 90% execute thresholds and rejects 91%", () => {
             expect(

package/src/config/schema/magic-context.ts

@@ -624,6 +624,12 @@ const AgentMetadataSchema = AgentOverrideConfigSchema.pick({
 
 /** Combined dreamer metadata plus independent strict execution blocks. */
 export const DreamerConfigSchema = AgentMetadataSchema.extend({
+    runner: z
+        .enum(["broca", "host"])
+        .optional()
+        .describe(
+            'Which side runs the dreamer completions the Rust module routes (classify-memories) in Rust transform mode: "host" runs them on this process\'s carrier, "broca" routes them to the Broca module. When unset, historian.runner applies, and when that is unset too the harness decides the same way it does for the historian. User-level config only.',
+        ),
     opencode: DreamerOpenCodeHarnessBlockSchema.optional(),
     pi: DreamerPiHarnessBlockSchema.optional(),
     omp: DreamerOmpHarnessBlockSchema.optional(),
@@ -645,6 +651,25 @@ export const HistorianConfigSchema = AgentMetadataSchema.extend({
     opencode: OpenCodeHarnessBlockSchema.optional(),
     pi: PiHarnessBlockSchema.optional(),
     omp: OmpHarnessBlockSchema.optional(),
+    runner: z
+        .enum(["broca", "host"])
+        .optional()
+        .describe(
+            'Which side runs the historian completion in Rust transform mode: "host" queues it for this process to run on the configured historian model, "broca" routes it to the Broca module. When unset the harness decides: OpenCode 1 and OpenCode 2 use "host", Claude Code (through the Thalamus gateway, which has no host to run a completion) uses "broca". User-level config only — it decides whose provider account pays for the call.',
+        ),
+    host_runner: z
+        .object({
+            enabled: z
+                .boolean()
+                .optional()
+                .describe(
+                    "Whether this process answers historian runs queued for a claimant (default true). Setting it to false stops the pull loop without changing historian.runner, so an operator can take one machine out of the lane and leave the queued runs for another claimant or for the runner setting to be changed deliberately.",
+                ),
+        })
+        .optional()
+        .describe(
+            "Controls for this process's historian pull loop, which answers runs the Rust module queues for the host runner (`historian.runner: \"host\"`, or unset on OpenCode 1 and OpenCode 2). User-level config only — it decides whether this machine's provider account is spent on folds.",
+        ),
     two_pass: z
         .boolean()
         .default(false)
@@ -675,7 +700,7 @@ const BaseEmbeddingConfigSchema = z
             .enum(["local", "openai-compatible", "off", "synapse"])
             .default("local")
             .describe(
-                "Embedding provider. 'local' uses Xenova/all-MiniLM-L6-v2, 'openai-compatible' requires endpoint and model, 'synapse' uses the certified local Synapse lane with an explicit fallback provider, and 'off' disables embeddings.",
+                "Embedding provider. 'local' uses Xenova/all-MiniLM-L6-v2, 'openai-compatible' requires endpoint and model, 'synapse' uses the certified local Synapse lane with an explicit fallback provider, and 'off' disables embeddings. Session history is embedded for semantic ctx_search whenever the provider is not 'off', regardless of memory.enabled; memories are embedded only while memory.enabled is true.",
             ),
         fallback_provider: EmbeddingFallbackProviderSchema.optional().describe(
             "Fallback provider for the Synapse lane. Required when provider is 'synapse'; local, openai-compatible, and off are valid.",
@@ -1131,7 +1156,7 @@ export const MagicContextConfigSchema = z
             .union([z.string(), z.object({ default: z.string() }).catchall(z.string())])
             .default("5m")
             .describe(
-                'How long Magic Context assumes the provider\'s cached prefix stays valid. This is MC\'s own deferral gate — it does not change the provider\'s actual cache lifetime. String (e.g. "5m", "1h", "30s") or per-model object ({ default: "5m", "provider/model": "1h", "provider/*": "never" }); keys resolve most-specific first (exact provider/model, bare model ID, shorter dash-prefixes, then the provider/* wildcard, then default). Set to "never" to mean MC never assumes expiry (for lanes kept warm externally by a cache-keep tool) — disables the idle-TTL heuristic so MC never initiates a rebuild based on elapsed time. Provider-side extended TTL is a separate request-level concern (cache_control: { ttl } in the request body).',
+                'How long Magic Context assumes the provider\'s cached prefix stays valid. This is MC\'s own deferral gate — it does not change the provider\'s actual cache lifetime. String (e.g. "5m", "1h", "30s") or per-model object ({ default: "5m", "provider/model": "1h", "provider/*": "never" }); keys resolve most-specific first (exact provider/model, bare model ID, shorter dash-prefixes, then the provider/* wildcard). Explicit per-model entries win; otherwise GPT-5.6 and later (including gpt-6*, through any provider prefix) use a built-in 30m lifetime before the object default or 5m fallback. An unset or global "5m" opts into built-in defaults; any other global string is an explicit policy and wins. Policy is frozen per session, including across restarts; a model switch resolves against that frozen policy. /ctx-status shows the effective value and source. OpenAI documents at least 30 minutes since the latest write or reuse: https://developers.openai.com/api/docs/guides/prompt-caching (Cache lifetime and Summary of model differences). Set to "never" to mean MC never assumes expiry (for lanes kept warm externally by a cache-keep tool) — disables the idle-TTL heuristic so MC never initiates a rebuild based on elapsed time. Provider-side extended TTL is a separate request-level concern (cache_control: { ttl } in the request body).',
             ),
         prompt_surface: PromptSurfaceConfigSchema.default({ default: "full" }).describe(
             "Prompt-surface presets: default is full; models use bare model IDs, provider/model, or provider/* routing keys. Guidance and tool-description overrides are user-level only. OpenCode 1.x, Pi, and OMP register tool descriptions once per process (they follow the default preset). OpenCode 2 rewrites the five ctx_* descriptions per request from the draft model.",
@@ -1363,9 +1388,9 @@ export const MagicContextConfigSchema = z
             .object({
                 enabled: z
                     .boolean()
-                    .default(true)
+                    .default(false)
                     .describe(
-                        "Pi only: register Magic Context's todowrite task-list tool. Disable if you use your own todo extension. OpenCode ships its own built-in todowrite; this setting has no effect there.",
+                        "Pi only: off by default. Set todowrite.enabled=true to register Magic Context's todowrite task-list tool and /todos command. OpenCode ships its own built-in todowrite; this setting has no effect there.",
                     ),
                 overlay: z
                     .boolean()
@@ -1374,7 +1399,7 @@ export const MagicContextConfigSchema = z
                         "Pi only: show the persistent todo overlay above the editor while tasks are active.",
                     ),
             })
-            .default({ enabled: true, overlay: true })
+            .default({ enabled: false, overlay: true })
             .describe(
                 "Pi-only todowrite tool and overlay controls. Pi registers tools and widgets at extension boot, so changing this after /cd requires /reload or restart.",
             ),
@@ -1413,7 +1438,9 @@ export const MagicContextConfigSchema = z
                 enabled: z
                     .boolean()
                     .default(true)
-                    .describe("Enable cross-session memory (default: true)"),
+                    .describe(
+                        "Enable cross-session memory (default: true). Does not affect history embedding or semantic ctx_search over session history; set embedding.provider to 'off' to stop all embedding.",
+                    ),
                 injection_budget_tokens: z
                     .number()
                     .min(500)
@@ -1525,10 +1552,12 @@ export const LIVE_RELOAD_CONFIG_PATHS = [
     "historian.omp.fallback_models",
     "historian.omp.thinking_level",
     "historian.two_pass",
+    "historian.maxTokens",
     "historian_timeout_ms",
     "commit_cluster_trigger.enabled",
     "commit_cluster_trigger.min_clusters",
     "memory.auto_promote",
+    "dreamer.maxTokens",
     "dreamer.opencode.model",
     "dreamer.opencode.fallback_models",
     "dreamer.opencode.variant",

package/src/shared/cache-ttl-display.ts

@@ -1,7 +1,7 @@
 import type { MagicContextConfig } from "../config/schema/magic-context";
-import { resolveModelConfigValue } from "./prompt-surface";
+import { type ResolvedCacheTtl, resolveModelCacheTtl } from "./model-cache-ttl";
 
-export type CacheTtlDisplaySource = "config" | "session" | "default";
+export type CacheTtlDisplaySource = ResolvedCacheTtl["source"] | "session";
 
 export interface CacheTtlDisplay {
     value: string;
@@ -10,6 +10,7 @@ export interface CacheTtlDisplay {
 }
 
 export interface ResolveCacheTtlDisplayArgs {
+    frozen?: ResolvedCacheTtl;
     configured: MagicContextConfig["cache_ttl"];
     configuredExplicitly: boolean;
     modelKey: string | undefined;
@@ -24,6 +25,7 @@ export interface ResolveCacheTtlDisplayArgs {
  * displayed; otherwise use live config because the session value may be for another model.
  */
 export function resolveCacheTtlDisplay(args: ResolveCacheTtlDisplayArgs): CacheTtlDisplay {
+    if (args.frozen) return args.frozen;
     if (
         (args.sessionModelKey && (!args.modelKey || args.sessionModelKey === args.modelKey)) ||
         (!args.modelKey && !args.sessionModelKey && args.sessionValue !== "5m")
@@ -35,27 +37,19 @@ export function resolveCacheTtlDisplay(args: ResolveCacheTtlDisplayArgs): CacheT
         };
     }
 
-    if (typeof args.configured === "string") {
-        return {
-            value: args.configured,
-            source: args.configuredExplicitly ? "config" : "default",
-            modelKey: args.modelKey,
-        };
-    }
-
-    const matched = resolveModelConfigValue(args.configured, args.modelKey);
-    if (matched) {
-        return { value: matched.value, source: "config", modelKey: args.modelKey };
-    }
-
-    return {
-        value: args.configured.default ?? "5m",
-        source: "default",
-        modelKey: args.modelKey,
-    };
+    const resolved = resolveModelCacheTtl(args.configured, args.modelKey);
+    if (
+        resolved.source === "default" &&
+        typeof args.configured === "string" &&
+        args.configuredExplicitly
+    )
+        return { ...resolved, source: "config" };
+    return resolved;
 }
 
 export function formatCacheTtlDisplay(display: CacheTtlDisplay): string {
+    if (display.source === "OpenAI GPT-5.6+ default")
+        return `Cache TTL: ${display.value} (${display.source})`;
     if (display.source === "session") return `Cache TTL: ${display.value} (session)`;
     if (display.source === "config") {
         return `Cache TTL: ${display.value} (config for ${display.modelKey ?? "current model"})`;

package/src/shared/harness.ts

@@ -52,6 +52,20 @@ export function getHarness(): HarnessId {
     return currentHarness;
 }
 
+/**
+ * Whether this process may read OpenCode's own session store (opencode.db).
+ *
+ * Only the OpenCode plugins own that store. A Pi or OMP process keeps its
+ * history in Pi JSONL sessions and shares only Magic Context's context.db with
+ * OpenCode. Any history read in a Pi process for a session with no Pi provider
+ * used to fall through to opencode.db, which let background work load another
+ * project's OpenCode sessions into Pi's heap. Pi therefore treats the OpenCode
+ * store as absent, the same as on a Pi-only install.
+ */
+export function harnessOwnsOpenCodeStore(harness: HarnessId = currentHarness): boolean {
+    return harness === "opencode" || harness === "opencode2";
+}
+
 /**
  * Test-only helper to reset harness state between test cases. Do NOT call
  * from production code paths.

package/src/shared/index.ts

@@ -1,6 +1,7 @@
 export * from "./logger";
 export * from "./model-suggestion-retry";
 export * from "./normalize-sdk-response";
+export * from "./prompt-async-transport";
 export * from "./prompt-surface";
 export * from "./prompt-surface-runtime";
 export * from "./resolve-fallbacks";

package/src/shared/logger.test.ts

@@ -30,6 +30,8 @@ type RotationScenarioResult = {
     files: string[];
 };
 
+type RetryScenarioResult = { content: string; failed: number };
+
 type HotPathScenarioResult = {
     statCalls: number;
 };
@@ -49,6 +51,16 @@ if (!root || !loggerModuleUrl || !scenario) {
 const logPath = path.join(root, "nested", "magic-context.log");
 process.env.MAGIC_CONTEXT_LOG_PATH = logPath;
 let statCalls = 0;
+if (scenario === "retry") {
+    let attempts = 0;
+    mock.module("node:fs", () => ({
+        ...fs,
+        appendFileSync: (...args) => {
+            if (attempts++ === 0) throw new Error("injected transient write failure");
+            return fs.appendFileSync(...args);
+        },
+    }));
+}
 if (scenario === "hot-path") {
     mock.module("node:fs", () => ({
         ...fs,
@@ -61,7 +73,28 @@ if (scenario === "hot-path") {
 
 const logger = await import(loggerModuleUrl);
 
-if (scenario === "rotation") {
+if (scenario === "retry") {
+    logger.log("first buffered line");
+    logger.log("second buffered line");
+    logger.flushLogger();
+    const failed = logger.getLoggerDiagnostics().swallowedWriteCount;
+    logger.log("third buffered line");
+    logger.flushLogger();
+    console.log(JSON.stringify({ content: fs.readFileSync(logPath, "utf8"), failed }));
+} else if (scenario === "oversized") {
+    logger.log("x".repeat(2_000_000));
+    logger.flushLogger();
+    console.log(JSON.stringify({ content: fs.readFileSync(logPath, "utf8"), failed: logger.getLoggerDiagnostics().swallowedWriteCount }));
+} else if (scenario === "bounded") {
+    const failedPath = path.join(root, "unwritable-target");
+    fs.mkdirSync(failedPath);
+    process.env.MAGIC_CONTEXT_LOG_PATH = failedPath;
+    for (let i = 0; i < 100; i++) logger.log("line-" + i + "-" + "x".repeat(20_000));
+    logger.flushLogger();
+    process.env.MAGIC_CONTEXT_LOG_PATH = logPath;
+    logger.flushLogger();
+    console.log(JSON.stringify({ content: fs.readFileSync(logPath, "utf8"), failed: logger.getLoggerDiagnostics().swallowedWriteCount }));
+} else if (scenario === "rotation") {
     const maxLogBytes = 32 * 1024 * 1024;
     fs.mkdirSync(path.dirname(logPath), { recursive: true });
     fs.writeFileSync(logPath, Buffer.alloc(maxLogBytes, "o"));
@@ -144,7 +177,14 @@ afterEach(() => {
 });
 
 async function runLoggerScenario<T>(
-    scenario: "recovery" | "diagnostics" | "rotation" | "hot-path",
+    scenario:
+        | "recovery"
+        | "diagnostics"
+        | "rotation"
+        | "hot-path"
+        | "retry"
+        | "bounded"
+        | "oversized",
 ): Promise<T> {
     const root = mkdtempSync(path.join(os.tmpdir(), "magic-context-logger-test-"));
     scenarioRoots.push(root);
@@ -171,6 +211,27 @@ async function runLoggerScenario<T>(
 }
 
 describe("logger", () => {
+    test("retries the whole buffered batch after a transient append failure", async () => {
+        const result = await runLoggerScenario<RetryScenarioResult>("retry");
+        expect(result.failed).toBe(1);
+        expect(result.content).toContain("first buffered line");
+        expect(result.content).toContain("second buffered line");
+        expect(result.content).toContain("third buffered line");
+    });
+    test("reports a single oversized line even if no payload remains buffered", async () => {
+        const result = await runLoggerScenario<RetryScenarioResult>("oversized");
+        expect(result.content).toMatch(/logger dropped 1 line: buffer exceeded/);
+        expect(Buffer.byteLength(result.content)).toBeLessThan(1000);
+    });
+
+    test("bounds failed batches and reports the number of discarded lines", async () => {
+        const result = await runLoggerScenario<RetryScenarioResult>("bounded");
+        expect(result.failed).toBeGreaterThan(0);
+        expect(Buffer.byteLength(result.content)).toBeLessThan(1_100_000);
+        expect(result.content).toMatch(/logger dropped \d+ lines: buffer exceeded/);
+        expect(result.content).toContain("line-99-");
+    });
+
     test("recreates a log directory removed while the process is running", async () => {
         const result = await runLoggerScenario<LoggerScenarioResult>("recovery");
 

package/src/shared/logger.ts

@@ -9,6 +9,16 @@ let buffer: string[] = [];
 let flushTimer: ReturnType<typeof setTimeout> | null = null;
 const FLUSH_INTERVAL_MS = 500;
 const BUFFER_SIZE_LIMIT = 50;
+const MAX_BUFFERED_BYTES = 1024 * 1024;
+let bufferedBytes = 0;
+let droppedLines = 0;
+
+function boundBuffer(): void {
+    while (bufferedBytes > MAX_BUFFERED_BYTES && buffer.length > 0) {
+        bufferedBytes -= Buffer.byteLength(buffer.shift() ?? "");
+        droppedLines++;
+    }
+}
 const MAX_LOG_FILE_BYTES = 32 * 1024 * 1024;
 const SIZE_CHECK_INTERVAL_FLUSHES = 64;
 
@@ -141,11 +151,12 @@ function flush(): void {
         clearTimeout(flushTimer);
         flushTimer = null;
     }
-    if (buffer.length === 0) return;
-    const bufferedData = buffer.join("");
-    buffer = [];
+    if (buffer.length === 0 && droppedLines === 0) return;
+    const notice = droppedLines
+        ? `[${new Date().toISOString()}] [magic-context][global] logger dropped ${droppedLines} ${droppedLines === 1 ? "line" : "lines"}: buffer exceeded ${MAX_BUFFERED_BYTES} bytes while writes were pending\n`
+        : "";
     try {
-        const data = capLogData(bufferedData);
+        const data = capLogData(notice + buffer.join(""));
         const logFile = getMagicContextLogPath();
         ensureDir(logFile);
         let currentSize = getCurrentLogSize(logFile);
@@ -155,6 +166,9 @@ function flush(): void {
             currentSize = 0;
         }
         fs.appendFileSync(logFile, data, { encoding: "utf8", mode: 0o600 });
+        buffer = [];
+        bufferedBytes = 0;
+        droppedLines = 0;
         activeLogFile = logFile;
         activeLogSize = currentSize + dataSize;
         flushesSinceSizeCheck++;
@@ -163,6 +177,7 @@ function flush(): void {
         activeLogSize = null;
         flushesSinceSizeCheck = 0;
         recordSwallowedWrite(error);
+        boundBuffer();
     }
 }
 
@@ -186,7 +201,10 @@ export function log(message: string, data?: unknown): void {
                         `${data.message}${data.stack ? `\n${data.stack}` : ""}`,
                     )}`
                   : ` ${JSON.stringify(sanitizeConfigValue(data))}`;
-        buffer.push(`[${timestamp}] ${sanitizeDiagnosticText(message)}${serialized}\n`);
+        const line = `[${timestamp}] ${sanitizeDiagnosticText(message)}${serialized}\n`;
+        buffer.push(line);
+        bufferedBytes += Buffer.byteLength(line);
+        boundBuffer();
         if (buffer.length >= BUFFER_SIZE_LIMIT) {
             flush();
         } else {

package/src/shared/model-cache-ttl.test.ts

@@ -0,0 +1,40 @@
+import { describe, expect, it } from "bun:test";
+import { MagicContextConfigSchema } from "../config/schema/magic-context";
+import { resolveCacheTtl } from "../hooks/magic-context/event-resolvers";
+
+describe("known model cache TTL", () => {
+    it("matches canonical model versions through provider prefixes", () => {
+        for (const prefix of ["", "openai/", "openai-codex/", "openrouter/openai/", "azure/"]) {
+            for (const model of [
+                "gpt-5.6",
+                "gpt-5.6-sol",
+                "gpt-5.7",
+                "gpt-5.10",
+                "gpt-6",
+                "gpt-6.1",
+                "gpt-6-mini",
+                "gpt-7",
+            ]) {
+                expect(resolveCacheTtl("5m", prefix + model), prefix + model).toBe("30m");
+            }
+            for (const model of ["gpt-5.5", "gpt-5.1", "gpt-5", "gpt-4o", "unknown", "not-gpt-6"]) {
+                expect(resolveCacheTtl("5m", prefix + model), prefix + model).toBe("5m");
+            }
+        }
+    });
+    it("uses built-ins for unset and global 5m, but honors global 10m", () => {
+        expect(resolveCacheTtl(MagicContextConfigSchema.parse({}).cache_ttl, "openai/gpt-6")).toBe(
+            "30m",
+        );
+        expect(resolveCacheTtl("5m", "openai/gpt-6")).toBe("30m");
+        expect(resolveCacheTtl("10m", "openai/gpt-6")).toBe("10m");
+    });
+    it("honors per-model entries before built-ins and built-ins before object defaults", () => {
+        expect(resolveCacheTtl({ default: "10m" }, "openai/gpt-6")).toBe("30m");
+        expect(resolveCacheTtl({ default: "10m", "gpt-6": "5m" }, "openai/gpt-6")).toBe("5m");
+        expect(resolveCacheTtl({ default: "10m", "openai/*": "never" }, "openai/gpt-6")).toBe(
+            "never",
+        );
+        expect(resolveCacheTtl({ default: "10m" }, "other/model")).toBe("10m");
+    });
+});

package/src/shared/model-cache-ttl.ts

@@ -0,0 +1,58 @@
+import { canonicalModelIdentity } from "./harness-provider-map";
+import { resolveModelConfigValue } from "./prompt-surface";
+
+export type CacheTtlConfig = string | Record<string, string>;
+export type CacheTtlSource = "config" | "default" | "OpenAI GPT-5.6+ default";
+export interface ResolvedCacheTtl {
+    value: string;
+    source: CacheTtlSource;
+    modelKey: string | undefined;
+}
+
+// Provider documentation: https://developers.openai.com/api/docs/guides/prompt-caching
+// Cache lifetime / Summary of model differences: at least 30 minutes since write or reuse.
+const MODEL_CACHE_LIFETIMES = [
+    {
+        source: "OpenAI GPT-5.6+ default" as const,
+        value: "30m",
+        matches(model: string): boolean {
+            const version = /^gpt-(\d+)(?:\.(\d+))?(?:$|[^\d.])/.exec(model);
+            if (!version) return false;
+            const major = Number(version[1]);
+            const minor = Number(version[2] ?? 0);
+            return major > 5 || (major === 5 && minor >= 6);
+        },
+    },
+];
+
+export function resolveModelCacheTtl(
+    config: CacheTtlConfig | undefined,
+    modelKey: string | undefined,
+): ResolvedCacheTtl {
+    if (config && typeof config !== "string") {
+        const match =
+            modelKey &&
+            !modelKey.includes("/") &&
+            Object.hasOwn(config, modelKey) &&
+            modelKey !== "default"
+                ? config[modelKey]
+                : resolveModelConfigValue(config, modelKey)?.value;
+        if (match !== undefined) return { value: match, source: "config", modelKey };
+    }
+    // A non-5m global string is an explicit policy. The generic 5m default is
+    // not evidence of provider eviction: documented lifetimes avoid paid rewrites.
+    if (typeof config === "string" && config !== "5m")
+        return { value: config, source: "config", modelKey };
+    const model =
+        canonicalModelIdentity(modelKey ?? "")
+            .toLowerCase()
+            .split("/")
+            .at(-1) ?? "";
+    const known = MODEL_CACHE_LIFETIMES.find((entry) => entry.matches(model));
+    if (known) return { value: known.value, source: known.source, modelKey };
+    return {
+        value: (typeof config === "object" ? config.default : config) ?? "5m",
+        source: "default",
+        modelKey,
+    };
+}