@cortexkit/opencode-magic-context 0.44.3 → 0.45.0

package/src/config/live-run-config.test.ts

@@ -1,21 +1,21 @@
 import { expect, test } from "bun:test";
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-
 import {
     buildDreamTaskRuntimeConfigs,
     userMemoryCollectionEnabled,
 } from "../features/magic-context/dreamer/task-config";
 import { producerInputTokenLimit } from "../hooks/magic-context/producer-window-guard";
 import { resolveHistorianModel } from "../shared/model-resolution";
+import { createTestTempDirFromPath } from "../shared/test-temp-dir";
 import { loadPluginConfigDetailed } from "./index";
 import { dreamerRunConfig, historianRunConfig } from "./live-run-config";
 import { LiveConfigReader } from "./live-snapshot";
 
 for (const host of ["OC1", "OC2", "Pi", "OMP"] as const) {
     test(`${host} historian samples the next generation while an existing run keeps its model and fallback`, () => {
-        const root = mkdtempSync(join(tmpdir(), "mc-live-historian-"));
+        const root = createTestTempDirFromPath(join(tmpdir(), "mc-live-historian-"));
         const previous = { home: process.env.HOME, config: process.env.XDG_CONFIG_HOME };
         process.env.HOME = root;
         process.env.XDG_CONFIG_HOME = join(root, "config");
@@ -87,7 +87,7 @@ for (const host of ["OC1", "OC2", "Pi", "OMP"] as const) {
 
 for (const host of ["OC1", "OC2", "Pi", "OMP"] as const) {
     test(`${host} dreamer samples the new schedule and model chain without changing a running task`, () => {
-        const root = mkdtempSync(join(tmpdir(), "mc-live-dreamer-"));
+        const root = createTestTempDirFromPath(join(tmpdir(), "mc-live-dreamer-"));
         const previous = { home: process.env.HOME, config: process.env.XDG_CONFIG_HOME };
         process.env.HOME = root;
         process.env.XDG_CONFIG_HOME = join(root, "config");
@@ -171,7 +171,7 @@ for (const host of ["OC1", "OC2", "Pi", "OMP"] as const) {
 }
 
 test("malformed project config retains last good values and deduplicates the warning; project overrides remain tier-safe", () => {
-    const root = mkdtempSync(join(tmpdir(), "mc-live-tiers-"));
+    const root = createTestTempDirFromPath(join(tmpdir(), "mc-live-tiers-"));
     const previous = { home: process.env.HOME, config: process.env.XDG_CONFIG_HOME };
     process.env.HOME = root;
     process.env.XDG_CONFIG_HOME = join(root, "config");

package/src/config/live-snapshot.test.ts

@@ -1,14 +1,14 @@
 import { expect, test } from "bun:test";
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-
 import { parseJsonc } from "../shared/jsonc-parser";
+import { createTestTempDirFromPath } from "../shared/test-temp-dir";
 import { LiveConfigReader } from "./live-snapshot";
 
 test("one snapshot per run survives a malformed tier and adopts both tiers atomically", () => {
     const oldConfigHome = process.env.XDG_CONFIG_HOME;
-    const root = mkdtempSync(join(tmpdir(), "mc-live-config-"));
+    const root = createTestTempDirFromPath(join(tmpdir(), "mc-live-config-"));
     const project = join(root, "project");
     const projectFile = join(project, ".cortexkit", "magic-context.jsonc");
     const userFile = join(root, "config", "cortexkit", "magic-context.jsonc");
@@ -53,7 +53,7 @@ test("one snapshot per run survives a malformed tier and adopts both tiers atomi
 });
 
 test("a write crossing the tier load boundary is not published as a mixed snapshot", () => {
-    const root = mkdtempSync(join(tmpdir(), "mc-live-crossing-"));
+    const root = createTestTempDirFromPath(join(tmpdir(), "mc-live-crossing-"));
     const previous = process.env.XDG_CONFIG_HOME;
     process.env.XDG_CONFIG_HOME = join(root, "config");
     const project = join(root, "project");

package/src/config/migrate-config-location.test.ts

@@ -1,15 +1,8 @@
 import { describe, expect, it } from "bun:test";
-import {
-    existsSync,
-    mkdirSync,
-    mkdtempSync,
-    readFileSync,
-    rmSync,
-    utimesSync,
-    writeFileSync,
-} from "node:fs";
+import { existsSync, mkdirSync, readFileSync, rmSync, utimesSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { createTestTempDirFromPath } from "../shared/test-temp-dir";
 import {
     type LegacyConfigSource,
     migrateConfigFile,
@@ -17,7 +10,7 @@ import {
 } from "./migrate-config-location";
 
 function tmp(): string {
-    return mkdtempSync(join(tmpdir(), "mc-cfgloc-"));
+    return createTestTempDirFromPath(join(tmpdir(), "mc-cfgloc-"));
 }
 
 function src(path: string, label = "legacy"): LegacyConfigSource {

package/src/config/project-config-trust-boundary.test.ts

@@ -0,0 +1,207 @@
+import { describe, expect, it } from "bun:test";
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { createTestTempDirFromPath } from "../shared/test-temp-dir";
+import { loadPluginConfigDetailed } from "./index";
+
+/**
+ * A repository's project config may only tighten what the user configured. A
+ * wrong-typed or otherwise invalid project value used to replace the user's
+ * value in the raw deep merge; schema recovery then dropped the key and used
+ * the schema DEFAULT, so a cloned repo could reset user-only settings (turn
+ * compaction back on, unset the historian model, force a re-embed) or lower
+ * compaction thresholds. These cases pin that an invalid project value is
+ * ignored and the user's value survives.
+ */
+function loadUserAndProject(user: unknown, project: unknown) {
+    const xdg = createTestTempDirFromPath(join(tmpdir(), "mc-trust-user-"));
+    const projectDir = createTestTempDirFromPath(join(tmpdir(), "mc-trust-proj-"));
+    mkdirSync(join(xdg, "cortexkit"), { recursive: true });
+    mkdirSync(join(projectDir, ".cortexkit"), { recursive: true });
+    writeFileSync(join(xdg, "cortexkit", "magic-context.jsonc"), JSON.stringify(user), "utf-8");
+    writeFileSync(
+        join(projectDir, ".cortexkit", "magic-context.jsonc"),
+        JSON.stringify(project),
+        "utf-8",
+    );
+    const origXdg = process.env.XDG_CONFIG_HOME;
+    process.env.XDG_CONFIG_HOME = xdg;
+    try {
+        return loadPluginConfigDetailed(projectDir, false);
+    } finally {
+        if (origXdg === undefined) delete process.env.XDG_CONFIG_HOME;
+        else process.env.XDG_CONFIG_HOME = origXdg;
+        rmSync(xdg, { recursive: true, force: true });
+        rmSync(projectDir, { recursive: true, force: true });
+    }
+}
+
+describe("project config cannot reset user settings with a wrong-typed parent block", () => {
+    it("keeps the user's compaction block when the project sets compaction:false", () => {
+        const loaded = loadUserAndProject(
+            { compaction: { enabled: false } },
+            { compaction: false },
+        );
+        expect(loaded.config.compaction).toMatchObject({ enabled: false });
+        expect(loaded.config.configWarnings?.join("\n")).toContain("compaction");
+    });
+
+    it("keeps the user's historian model when the project sets historian:1", () => {
+        const loaded = loadUserAndProject(
+            { historian: { opencode: { model: "anthropic/claude-x" } } },
+            { historian: 1 },
+        );
+        expect(loaded.config.historian?.opencode?.model).toBe("anthropic/claude-x");
+    });
+
+    it("keeps the user's embedding provider when the project sets embedding:'x'", () => {
+        const loaded = loadUserAndProject(
+            {
+                embedding: {
+                    provider: "openai-compatible",
+                    endpoint: "https://fixture.example/v1",
+                    model: "fixture-model",
+                },
+            },
+            { embedding: "x" },
+        );
+        expect(loaded.config.embedding).toMatchObject({
+            provider: "openai-compatible",
+            endpoint: "https://fixture.example/v1",
+            model: "fixture-model",
+        });
+    });
+
+    it("keeps storage.enforce_private_permissions:false when the project sets storage:0", () => {
+        const loaded = loadUserAndProject(
+            { storage: { enforce_private_permissions: false } },
+            { storage: 0 },
+        );
+        expect(loaded.config.storage?.enforce_private_permissions).toBe(false);
+    });
+
+    it("keeps the user's prompt_surface override when the project sets prompt_surface:1", () => {
+        const loaded = loadUserAndProject(
+            { prompt_surface: { default: "light" } },
+            { prompt_surface: 1 },
+        );
+        expect(loaded.config.prompt_surface).toMatchObject({ default: "light" });
+    });
+
+    it("keeps the user's nested leaf when the project gives that leaf a wrong type", () => {
+        const loaded = loadUserAndProject(
+            { memory: { auto_search: { enabled: false } } },
+            { memory: { auto_search: { enabled: "nope" } } },
+        );
+        expect(loaded.config.memory?.auto_search?.enabled).toBe(false);
+    });
+
+    it("still applies a valid project value next to an invalid one", () => {
+        const loaded = loadUserAndProject(
+            { compaction: { enabled: false }, cache_ttl: "5m" },
+            { compaction: false, cache_ttl: "1h" },
+        );
+        expect(loaded.config.compaction).toMatchObject({ enabled: false });
+        expect(loaded.config.cache_ttl).toBe("1h");
+    });
+
+    it("reports the ignored project value as schema recovery", () => {
+        const loaded = loadUserAndProject(
+            { compaction: { enabled: false } },
+            { compaction: false },
+        );
+        expect(loaded.recoveredTopLevelKeys).toContain("compaction");
+        expect(loaded.loadOutcome).toBe("schema-recovery");
+    });
+});
+
+describe("project config cannot lower compaction thresholds", () => {
+    it("does not lower a user threshold of 88 to a project value of 81", () => {
+        const loaded = loadUserAndProject(
+            { execute_threshold_percentage: 88 },
+            { execute_threshold_percentage: 81 },
+        );
+        expect(loaded.config.execute_threshold_percentage).toBe(88);
+    });
+
+    it("does not lower a per-model user threshold of 89 to a project value of 82", () => {
+        const loaded = loadUserAndProject(
+            { execute_threshold_percentage: { default: 70, "a/b": 89 } },
+            { execute_threshold_percentage: { "a/b": 82 } },
+        );
+        expect(loaded.config.execute_threshold_percentage).toEqual({ default: 70, "a/b": 89 });
+    });
+
+    it("still raises the threshold to a valid project value above 80", () => {
+        const loaded = loadUserAndProject(
+            { execute_threshold_percentage: 70 },
+            { execute_threshold_percentage: 85 },
+        );
+        expect(loaded.config.execute_threshold_percentage).toBe(85);
+    });
+
+    it("keeps the user threshold of 80 when the project value 10 is invalid", () => {
+        const loaded = loadUserAndProject(
+            { execute_threshold_percentage: 80 },
+            { execute_threshold_percentage: 10 },
+        );
+        expect(loaded.config.execute_threshold_percentage).toBe(80);
+    });
+
+    it("keeps the user threshold when the project value is a string or an invalid object", () => {
+        for (const projectValue of ["x", { default: 5 }]) {
+            const loaded = loadUserAndProject(
+                { execute_threshold_percentage: 80 },
+                { execute_threshold_percentage: projectValue },
+            );
+            expect(loaded.config.execute_threshold_percentage).toBe(80);
+        }
+    });
+
+    it("keeps the user's execute_threshold_tokens when the project sets a scalar", () => {
+        const loaded = loadUserAndProject(
+            { execute_threshold_tokens: { default: 300_000 } },
+            { execute_threshold_tokens: 5 },
+        );
+        expect(loaded.config.execute_threshold_tokens).toEqual({ default: 300_000 });
+    });
+
+    it("keeps the user's execute_threshold_tokens.default when the project value is out of range", () => {
+        const loaded = loadUserAndProject(
+            { execute_threshold_tokens: { default: 300_000 } },
+            { execute_threshold_tokens: { default: 10 } },
+        );
+        expect(loaded.config.execute_threshold_tokens).toEqual({ default: 300_000 });
+    });
+});
+
+describe("project command block", () => {
+    it("adds well-formed new commands but never replaces user or built-in ones", () => {
+        const loaded = loadUserAndProject(
+            { command: { "my-cmd": { template: "user template" } } },
+            {
+                command: {
+                    "my-cmd": { template: "repository template" },
+                    "ctx-status": { template: "repository status" },
+                    "repo-cmd": { template: "repository command", description: "from the repo" },
+                    "bad-cmd": { template: 5 },
+                    "no-template": { description: "missing template" },
+                },
+            },
+        );
+        expect(loaded.config.command).toEqual({
+            "my-cmd": { template: "user template" },
+            "repo-cmd": { template: "repository command", description: "from the repo" },
+        });
+        expect(loaded.config.configWarnings?.join("\n")).toContain("command.my-cmd");
+    });
+
+    it("ignores a project command block that is not an object", () => {
+        const loaded = loadUserAndProject(
+            { command: { "my-cmd": { template: "user template" } } },
+            { command: "nope" },
+        );
+        expect(loaded.config.command).toEqual({ "my-cmd": { template: "user template" } });
+    });
+});

package/src/config/project-security.hostile-matrix.test.ts

@@ -1,9 +1,9 @@
 import { describe, expect, it } from "bun:test";
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-
 import { CANONICAL_DREAM_TASKS } from "../features/magic-context/dreamer/task-registry";
+import { createTestTempDirFromPath } from "../shared/test-temp-dir";
 import { loadPluginConfig } from "./index";
 import { stripUnsafeProjectConfigFields } from "./project-security";
 import {
@@ -339,8 +339,8 @@ function nestedMuralModelPaths(): string[] {
 }
 
 function loadWithUserAndProjectConfig(userConfigText: string, projectConfigText: string) {
-    const xdg = mkdtempSync(join(tmpdir(), "mc-hostile-user-"));
-    const projectDir = mkdtempSync(join(tmpdir(), "mc-hostile-proj-"));
+    const xdg = createTestTempDirFromPath(join(tmpdir(), "mc-hostile-user-"));
+    const projectDir = createTestTempDirFromPath(join(tmpdir(), "mc-hostile-proj-"));
     const configDir = join(xdg, "cortexkit");
     mkdirSync(configDir, { recursive: true });
     mkdirSync(join(projectDir, ".cortexkit"), { recursive: true });

package/src/config/project-security.ts

@@ -203,8 +203,11 @@ function stripNestedMuralModels(
     }
 }
 
+// Must match the schema's execute_threshold_percentage range (20-90). A narrower
+// range here let a valid project value of 81-90 skip the raise-only clamp and
+// reach the merged config as-is, lowering a higher user threshold.
 function isValidPercentageThreshold(value: unknown): value is number {
-    return typeof value === "number" && Number.isFinite(value) && value >= 20 && value <= 80;
+    return typeof value === "number" && Number.isFinite(value) && value >= 20 && value <= 90;
 }
 
 function isValidTokenThreshold(value: unknown): value is number {
@@ -896,3 +899,217 @@ export function dropInheritedEmbeddingKeyOnRedirect(
             "exfiltration to a repository-chosen endpoint).",
     ];
 }
+
+/** Path of a schema issue in the merged raw config, e.g. ["compaction", "enabled"]. */
+export type ConfigIssuePath = readonly PropertyKey[];
+
+/**
+ * Shortest prefix of `issuePath` whose value the PROJECT tier supplied, or
+ * undefined when the invalid value did not come from the project. The raw merge
+ * recurses only into plain objects on both sides, so the project owns the value
+ * at the first prefix where its node is not a plain object (a scalar, array or
+ * null replaces the user's value whole), or at the full issue path.
+ */
+function projectContributionPath(
+    projectRaw: Record<string, unknown>,
+    issuePath: ConfigIssuePath,
+): ConfigIssuePath | undefined {
+    let node: unknown = projectRaw;
+    for (let index = 0; index < issuePath.length; index++) {
+        const segment = String(issuePath[index]);
+        if (!isPlainObject(node) || !Object.hasOwn(node, segment)) return undefined;
+        node = node[segment];
+        if (index === issuePath.length - 1 || !isPlainObject(node)) {
+            return issuePath.slice(0, index + 1);
+        }
+    }
+    return undefined;
+}
+
+/**
+ * The trusted value the project displaced along `contribution`, and where it
+ * sits. Walking down, the first trusted node that is not a plain object was
+ * replaced whole by the project's object (e.g. a user scalar threshold of 80
+ * under a project `{ default: 5 }`), so it is restored at that shorter path.
+ * Undefined when the trusted tier has no value there to protect.
+ */
+function displacedTrustedValue(
+    trustedRaw: Record<string, unknown>,
+    contribution: ConfigIssuePath,
+): { path: ConfigIssuePath; value: unknown } | undefined {
+    let node: unknown = trustedRaw;
+    for (let index = 0; index < contribution.length; index++) {
+        const segment = String(contribution[index]);
+        if (!isPlainObject(node) || !Object.hasOwn(node, segment)) return undefined;
+        node = node[segment];
+        if (index === contribution.length - 1 || !isPlainObject(node)) {
+            return { path: contribution.slice(0, index + 1), value: node };
+        }
+    }
+    return undefined;
+}
+
+function defineOwnValue(target: Record<string, unknown>, key: string, value: unknown): void {
+    Object.defineProperty(target, key, {
+        value,
+        enumerable: true,
+        configurable: true,
+        writable: true,
+    });
+}
+
+/** Put `value` at `path` in `root`, copying each object on the way so objects
+ *  shared with the trusted or project raw configs are never mutated. */
+function writeOwnPath(root: Record<string, unknown>, path: ConfigIssuePath, value: unknown): void {
+    let node = root;
+    for (let index = 0; index < path.length - 1; index++) {
+        const segment = String(path[index]);
+        const child = node[segment];
+        if (!isPlainObject(child)) return;
+        const copy = { ...child };
+        defineOwnValue(node, segment, copy);
+        node = copy;
+    }
+    defineOwnValue(node, String(path[path.length - 1]), value);
+}
+
+/** Most rounds a single load can take; each round restores at least one path. */
+const MAX_PROJECT_RESTORE_ROUNDS = 16;
+
+/**
+ * After the project config is merged over the trusted (user + profile) config,
+ * put back the trusted value wherever an INVALID project value displaced it.
+ *
+ * Without this, a repository could reset user settings by writing a wrong type:
+ * `compaction: false` replaces the user's `compaction` block in the raw merge,
+ * the schema rejects it, and schema recovery drops the key and uses the schema
+ * default, so compaction turns back on, the historian loses its model, or the
+ * embedding provider flips and forces a full re-embed. A repository may only
+ * tighten what the user configured, so an invalid project value is ignored and
+ * the user's value stays. When the user has no value at that path, the project
+ * value is left for normal schema recovery, which already lands on the default
+ * the user would get anyway.
+ *
+ * `collectIssuePaths` runs the caller's own pre-schema migrations and schema
+ * check and returns every issue path (empty when the config is valid), so this
+ * stays aligned with the loader's real parse on every harness. `mergedRaw` is
+ * mutated in place.
+ */
+export function restoreTrustedValuesOverInvalidProjectValues(args: {
+    mergedRaw: Record<string, unknown>;
+    trustedRaw: Record<string, unknown>;
+    projectRaw: Record<string, unknown>;
+    collectIssuePaths: (raw: Record<string, unknown>) => readonly ConfigIssuePath[];
+}): { warnings: string[]; restoredTopLevelKeys: string[] } {
+    const warnings: string[] = [];
+    const restoredTopLevelKeys = new Set<string>();
+    const restored = new Set<string>();
+
+    for (let round = 0; round < MAX_PROJECT_RESTORE_ROUNDS; round++) {
+        let changed = false;
+        for (const issuePath of args.collectIssuePaths(args.mergedRaw)) {
+            const contribution = projectContributionPath(args.projectRaw, issuePath);
+            if (contribution === undefined || contribution.length === 0) continue;
+            const trusted = displacedTrustedValue(args.trustedRaw, contribution);
+            if (trusted === undefined) continue;
+            const key = trusted.path.map(String).join(".");
+            // Already restored: any remaining issue there is in the user's own
+            // value, which normal schema recovery handles.
+            if (restored.has(key)) continue;
+            writeOwnPath(args.mergedRaw, trusted.path, trusted.value);
+            restored.add(key);
+            restoredTopLevelKeys.add(String(trusted.path[0]));
+            changed = true;
+            warnings.push(
+                `Ignoring invalid ${key} from project config and keeping the user-level value (security: a repository cannot reset user settings by supplying an invalid value).`,
+            );
+        }
+        if (!changed) break;
+    }
+
+    return { warnings, restoredTopLevelKeys: [...restoredTopLevelKeys] };
+}
+
+const PROJECT_COMMAND_STRING_FIELDS = ["description", "agent", "model"] as const;
+
+/** A well-formed command entry with only the fields the command config uses. */
+function wellFormedCommand(value: unknown): Record<string, unknown> | undefined {
+    if (!isPlainObject(value)) return undefined;
+    if (typeof value.template !== "string" || value.template.trim().length === 0) return undefined;
+    const command: Record<string, unknown> = { template: value.template };
+    for (const field of PROJECT_COMMAND_STRING_FIELDS) {
+        if (value[field] === undefined) continue;
+        if (typeof value[field] !== "string") return undefined;
+        command[field] = value[field];
+    }
+    if (value.subtask !== undefined) {
+        if (typeof value.subtask !== "boolean") return undefined;
+        command.subtask = value.subtask;
+    }
+    return command;
+}
+
+/**
+ * Rebuild the merged `command` block so a repository may only ADD commands.
+ *
+ * The command block is not part of the schema; it is copied into the host's
+ * command config after Magic Context's built-in commands. Merged as raw
+ * config, a project could replace a command the user defined, shadow a
+ * built-in /ctx-* command, wipe the user's commands with a non-object value,
+ * or pass malformed entries to the host. Now the user's commands are kept as
+ * they are, and a project entry is used only when it is well formed and its
+ * name is neither a user command nor one of `reservedNames`. `mergedRaw` is
+ * mutated in place.
+ */
+export function constrainProjectCommands(args: {
+    mergedRaw: Record<string, unknown>;
+    trustedRaw: Record<string, unknown>;
+    projectRaw: Record<string, unknown>;
+    reservedNames: readonly string[];
+}): string[] {
+    if (!("command" in args.projectRaw)) return [];
+    const warnings: string[] = [];
+    const trustedCommands = isPlainObject(args.trustedRaw.command)
+        ? args.trustedRaw.command
+        : undefined;
+    const merged: Record<string, unknown> = { ...(trustedCommands ?? {}) };
+    const projectCommands = args.projectRaw.command;
+
+    if (!isPlainObject(projectCommands)) {
+        warnings.push(
+            "Ignoring command from project config (it must be an object of named commands).",
+        );
+    } else {
+        for (const [name, value] of Object.entries(projectCommands)) {
+            if (trustedCommands && Object.hasOwn(trustedCommands, name)) {
+                warnings.push(
+                    `Ignoring command.${name} from project config (security: a repository cannot replace a command defined in user config).`,
+                );
+                continue;
+            }
+            if (args.reservedNames.includes(name)) {
+                warnings.push(
+                    `Ignoring command.${name} from project config (security: a repository cannot replace a built-in Magic Context command).`,
+                );
+                continue;
+            }
+            const command = wellFormedCommand(value);
+            if (!command) {
+                warnings.push(
+                    `Ignoring command.${name} from project config (it needs a non-empty string template; description, agent and model must be strings and subtask a boolean).`,
+                );
+                continue;
+            }
+            Object.defineProperty(merged, name, {
+                value: command,
+                enumerable: true,
+                configurable: true,
+                writable: true,
+            });
+        }
+    }
+
+    if (Object.keys(merged).length === 0) delete args.mergedRaw.command;
+    else args.mergedRaw.command = merged;
+    return warnings;
+}

package/src/config/protected-tokens.test.ts

@@ -1,8 +1,9 @@
 /// <reference types="bun-types" />
 
-import { describe, expect, it } from "bun:test";
+import { describe, expect, it, spyOn } from "bun:test";
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
+import * as logger from "../shared/logger";
 import { parsePluginConfig, resetProtectedTagsDeprecationWarningForTest } from "./index";
 import { constrainProjectThresholdOverrides } from "./project-security";
 import { deriveDefaultProtectedTokens, MagicContextConfigSchema } from "./schema/magic-context";
@@ -248,9 +249,13 @@ describe("protected_tokens config and derivation", () => {
 
         it("emits a once-per-process loud deprecation warning naming the replacement", () => {
             resetProtectedTagsDeprecationWarningForTest();
-            const warnCalls: string[] = [];
-            const originalWarn = console.warn;
-            console.warn = (...args: unknown[]) => warnCalls.push(args.map(String).join(" "));
+            // The once-per-process line goes to the plugin log; the host passes
+            // console output straight to the operator's terminal.
+            const logged = spyOn(logger, "log");
+            const warnCalls = () =>
+                logged.mock.calls
+                    .map(([message]) => message)
+                    .filter((message) => message.includes("protected_tags is deprecated"));
 
             try {
                 const res1 = parsePluginConfig({ protected_tags: 20 });
@@ -261,14 +266,14 @@ describe("protected_tokens config and derivation", () => {
                         ),
                     ),
                 ).toBe(true);
-                expect(warnCalls).toHaveLength(1);
-                expect(warnCalls[0]).toContain("protected_tokens");
+                expect(warnCalls()).toHaveLength(1);
+                expect(warnCalls()[0]).toContain("protected_tokens");
 
-                // Second parse in same process must NOT log to console again
+                // Second parse in same process must NOT log again
                 parsePluginConfig({ protected_tags: 10 });
-                expect(warnCalls).toHaveLength(1);
+                expect(warnCalls()).toHaveLength(1);
             } finally {
-                console.warn = originalWarn;
+                logged.mockRestore();
             }
         });
     });

package/src/config/raw-loader.test.ts

@@ -1,24 +1,26 @@
 import { afterEach, describe, expect, it } from "bun:test";
 import {
     chmodSync,
-    mkdtempSync,
+    lstatSync,
     readdirSync,
     readFileSync,
+    readlinkSync,
     rmSync,
     statSync,
+    symlinkSync,
     writeFileSync,
 } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-
 import { parseJsonc } from "../shared/jsonc-parser";
+import { createTestTempDirFromPath } from "../shared/test-temp-dir";
 import { hasFlatKeys, loadRawConfigFile, migrateFlatDetailed } from "./raw-loader";
 import { PER_HARNESS_MIGRATION_INVENTORY } from "./schema/magic-context";
 
 const temporaryDirectories: string[] = [];
 
 function temporaryDirectory(): string {
-    const directory = mkdtempSync(join(tmpdir(), "mc-per-harness-"));
+    const directory = createTestTempDirFromPath(join(tmpdir(), "mc-per-harness-"));
     temporaryDirectories.push(directory);
     return directory;
 }
@@ -373,6 +375,32 @@ describe("per-harness raw config migration", () => {
         expect(statSync(backupPath).ino).toBe(backupInode);
     });
 
+    // stow, chezmoi and home-manager link the user config into a dotfiles repo.
+    // Replacing the link with a regular file would silently stop later edits
+    // from reaching that repo, so the migration writes through to the target.
+    it("keeps a symlinked user config a symlink and migrates its target", () => {
+        const directory = temporaryDirectory();
+        const dotfiles = temporaryDirectory();
+        const targetPath = join(dotfiles, "magic-context.jsonc");
+        const configPath = join(directory, "magic-context.jsonc");
+        const original = Buffer.from('{ "historian": { "model": "provider/model" } }\n');
+        writeFileSync(targetPath, original);
+        chmodSync(targetPath, 0o600);
+        symlinkSync(targetPath, configPath);
+
+        const loaded = loadRawConfigFile({ configPath, tier: "user" });
+
+        expect(loaded?.migrated).toBe(true);
+        expect(lstatSync(configPath).isSymbolicLink()).toBe(true);
+        expect(readlinkSync(configPath)).toBe(targetPath);
+        expect(readFileSync(targetPath)).toEqual(loaded?.bytes);
+        expect(hasFlatKeys(readFileSync(targetPath))).toBe(false);
+        expect(statSync(targetPath).mode & 0o777).toBe(0o600);
+        expect(readFileSync(`${configPath}.pre-per-harness.bak`)).toEqual(original);
+        expect(readdirSync(dotfiles).filter((name) => name.endsWith(".tmp"))).toEqual([]);
+        expect(readdirSync(directory).filter((name) => name.endsWith(".tmp"))).toEqual([]);
+    });
+
     it("reloads the winning candidate when a concurrent loader replaces the target", () => {
         const directory = temporaryDirectory();
         const configPath = join(directory, "magic-context.jsonc");