@cortexkit/opencode-magic-context 0.49.28 → 0.49.29

package/src/config/live-run-config.test.ts

@@ -9,10 +9,53 @@ import {
 import { producerInputTokenLimit } from "../hooks/magic-context/producer-window-guard";
 import { resolveDreamerTaskModel, resolveHistorianModel } from "../shared/model-resolution";
 import { createTestTempDirFromPath } from "../shared/test-temp-dir";
+import { isCommitRetentionPaused } from "./commit-retention-recovery";
 import { loadPluginConfigDetailed } from "./index";
-import { dreamerRunConfig, historianRunConfig } from "./live-run-config";
+import { changedLiveKeys, dreamerRunConfig, historianRunConfig } from "./live-run-config";
 import { LiveConfigReader } from "./live-snapshot";
 
+test("dreamer retains the recovered-cap pause through live copies and clears it when the same cap is fixed", () => {
+    const root = createTestTempDirFromPath(join(tmpdir(), "mc-live-retention-"));
+    const previous = process.env.XDG_CONFIG_HOME;
+    process.env.XDG_CONFIG_HOME = root;
+    const directory = join(root, "project");
+    const file = join(root, "cortexkit", "magic-context.jsonc");
+    mkdirSync(join(root, "cortexkit"), { recursive: true });
+    mkdirSync(directory, { recursive: true });
+    const writeCap = (max_commits: number) =>
+        writeFileSync(
+            file,
+            JSON.stringify({ memory: { git_commit_indexing: { enabled: true, max_commits } } }),
+        );
+    try {
+        writeCap(0);
+        const boot = loadPluginConfigDetailed(directory, false).config;
+        const reader = new LiveConfigReader(
+            directory,
+            boot,
+            () => {
+                const loaded = loadPluginConfigDetailed(directory, false);
+                if (loaded.loadOutcome === "schema-recovery") throw new Error("invalid config");
+                return loaded.config;
+            },
+            () => {},
+            changedLiveKeys,
+        );
+        const initial = dreamerRunConfig(boot, reader.poll().effective);
+        expect(initial.memory.git_commit_indexing.max_commits).toBe(2000);
+        expect(isCommitRetentionPaused(initial.memory.git_commit_indexing)).toBe(true);
+        writeCap(2000);
+        const fixed = dreamerRunConfig(boot, reader.poll().effective);
+        expect(fixed.memory.git_commit_indexing.max_commits).toBe(2000);
+        expect(isCommitRetentionPaused(fixed.memory.git_commit_indexing)).toBe(false);
+        expect(isCommitRetentionPaused(initial.memory.git_commit_indexing)).toBe(true);
+    } finally {
+        if (previous === undefined) delete process.env.XDG_CONFIG_HOME;
+        else process.env.XDG_CONFIG_HOME = previous;
+        rmSync(root, { recursive: true, force: true });
+    }
+});
+
 for (const host of ["OC1", "OC2", "Pi", "OMP"] as const) {
     test(`${host} historian samples the next generation while an existing run keeps its model and fallback`, () => {
         const root = createTestTempDirFromPath(join(tmpdir(), "mc-live-historian-"));

package/src/config/live-run-config.ts

@@ -1,4 +1,5 @@
 import { log } from "../shared/logger";
+import { copyCommitRetentionRecovery } from "./commit-retention-recovery";
 import { loadPluginConfigDetailed, type MagicContextPluginConfig } from "./index";
 import { LiveConfigReader } from "./live-snapshot";
 import { LIVE_RELOAD_CONFIG_PATHS, type MagicContextConfig } from "./schema/magic-context";
@@ -32,7 +33,13 @@ export function sampleLiveConfig<T extends MagicContextConfig>(boot: T, fresh: T
         const leaf = parts.at(-1);
         if (leaf !== undefined) target[leaf] = value;
     }
-    return result as T;
+    const sampled = result as T;
+    const freshCommitIndexing = fresh.memory?.git_commit_indexing;
+    const sampledCommitIndexing = sampled.memory?.git_commit_indexing;
+    if (freshCommitIndexing && sampledCommitIndexing) {
+        copyCommitRetentionRecovery(freshCommitIndexing, sampledCommitIndexing);
+    }
+    return sampled;
 }
 
 function removeLeaf(root: Record<string, unknown>, parts: string[]): void {

package/src/config/project-config-trust-boundary.test.ts

@@ -2,7 +2,9 @@ import { describe, expect, it } from "bun:test";
 import { mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { isConfigLoadUntrusted } from "../plugin/embedding-bootstrap-helpers";
 import { createTestTempDirFromPath } from "../shared/test-temp-dir";
+import { isCommitRetentionPaused } from "./commit-retention-recovery";
 import { loadPluginConfigDetailed } from "./index";
 
 /**
@@ -38,6 +40,61 @@ function loadUserAndProject(user: unknown, project: unknown) {
 }
 
 describe("project config cannot reset user settings with a wrong-typed parent block", () => {
+    it("pauses retention eviction for a recovered commit cap without making memory untrusted", () => {
+        const loaded = loadUserAndProject(
+            { memory: { git_commit_indexing: { enabled: true, max_commits: 0 } } },
+            {},
+        );
+        expect(loaded.config.memory.git_commit_indexing.max_commits).toBe(2000);
+        expect(isCommitRetentionPaused(loaded.config.memory.git_commit_indexing)).toBe(true);
+        expect(isConfigLoadUntrusted(loaded)).toBe(false);
+        expect(
+            loaded.config.configWarnings?.filter((warning) =>
+                warning.includes("retention eviction is paused"),
+            ),
+        ).toHaveLength(1);
+        expect(loaded.config.configWarnings?.join("\n")).toContain(
+            "memory.git_commit_indexing.max_commits",
+        );
+        expect(
+            loaded.warningDetails.filter((warning) =>
+                warning.message.includes("retention eviction is paused"),
+            ),
+        ).toHaveLength(1);
+        const valid = loadUserAndProject(
+            { memory: { git_commit_indexing: { enabled: true, max_commits: 100 } } },
+            {},
+        );
+        expect(isCommitRetentionPaused(valid.config.memory.git_commit_indexing)).toBe(false);
+    });
+
+    it("recovers an out-of-range injection budget without making memory untrusted", () => {
+        const loaded = loadUserAndProject({}, { memory: { injection_budget_tokens: 20001 } });
+        expect(loaded.config.memory.enabled).toBe(true);
+        expect(loaded.config.memory.injection_budget_tokens).toBe(4000);
+        expect(loaded.recoveredFieldPaths).toEqual(["memory.injection_budget_tokens"]);
+        expect(loaded.config.configWarnings?.join("\n")).toContain(
+            "memory.injection_budget_tokens",
+        );
+        expect(isConfigLoadUntrusted(loaded)).toBe(false);
+    });
+
+    it("records the exact restored project leaf without distrusting a plain threshold", () => {
+        const loaded = loadUserAndProject(
+            { memory: { auto_search: { score_threshold: 0.7 } } },
+            { memory: { auto_search: { score_threshold: "invalid" } } },
+        );
+        expect(loaded.config.memory.auto_search.score_threshold).toBe(0.7);
+        expect(loaded.recoveredFieldPaths).toEqual(["memory.auto_search.score_threshold"]);
+        expect(isConfigLoadUntrusted(loaded)).toBe(false);
+    });
+
+    it("keeps an invalid embedding model untrusted after field recovery", () => {
+        const loaded = loadUserAndProject({ embedding: { model: 123 } }, {});
+        expect(loaded.recoveredFieldPaths).toEqual(["embedding.model"]);
+        expect(isConfigLoadUntrusted(loaded)).toBe(true);
+    });
+
     it("keeps the user's compaction block when the project sets compaction:false", () => {
         const loaded = loadUserAndProject(
             { compaction: { enabled: false } },

package/src/config/project-security.ts

@@ -973,7 +973,7 @@ export function restoreTrustedValuesOverInvalidProjectValues(args: {
     trustedRaw: Record<string, unknown>;
     projectRaw: Record<string, unknown>;
     collectIssuePaths: (raw: Record<string, unknown>) => readonly ConfigIssuePath[];
-}): { warnings: string[]; restoredTopLevelKeys: string[] } {
+}): { warnings: string[]; restoredTopLevelKeys: string[]; restoredFieldPaths: string[] } {
     const warnings: string[] = [];
     const restoredTopLevelKeys = new Set<string>();
     const restored = new Set<string>();
@@ -1000,7 +1000,11 @@ export function restoreTrustedValuesOverInvalidProjectValues(args: {
         if (!changed) break;
     }
 
-    return { warnings, restoredTopLevelKeys: [...restoredTopLevelKeys] };
+    return {
+        warnings,
+        restoredTopLevelKeys: [...restoredTopLevelKeys],
+        restoredFieldPaths: [...restored],
+    };
 }
 
 const PROJECT_COMMAND_STRING_FIELDS = ["description", "agent", "model"] as const;

package/src/shared/windows-hidden-spawns.test.ts

@@ -30,21 +30,28 @@ function sourceFiles(dir: string): string[] {
 function missingHiddenOptions(path: string, text = readFileSync(path, "utf8")): string[] {
     if (!/node:child_process|Bun\.spawn/.test(text)) return [];
     const source = ts.createSourceFile(path, text, ts.ScriptTarget.Latest, true);
-    const imports = new Set<string>();
+    const imports = new Map<string, string>();
+    const promisifyImports = new Set<string>();
+    const utilImports = new Set<string>();
     const variables = new Map<string, ts.Expression>();
     for (const statement of source.statements) {
-        if (
-            ts.isImportDeclaration(statement) &&
-            statement.moduleSpecifier.getText(source).includes("node:child_process")
-        ) {
-            const bindings = statement.importClause?.namedBindings;
-            if (bindings && ts.isNamedImports(bindings)) {
-                for (const element of bindings.elements) {
-                    if (subprocessNames.has(element.propertyName?.text ?? element.name.text))
-                        imports.add(element.name.text);
-                }
+        if (!ts.isImportDeclaration(statement) || !ts.isStringLiteral(statement.moduleSpecifier))
+            continue;
+        const module = statement.moduleSpecifier.text;
+        const bindings = statement.importClause?.namedBindings;
+        if (bindings && ts.isNamedImports(bindings)) {
+            for (const element of bindings.elements) {
+                const imported = element.propertyName?.text ?? element.name.text;
+                if (module === "node:child_process" && subprocessNames.has(imported))
+                    imports.set(element.name.text, imported);
+                if ((module === "node:util" || module === "util") && imported === "promisify")
+                    promisifyImports.add(element.name.text);
             }
         }
+        if (module === "node:util" || module === "util") {
+            if (bindings && ts.isNamespaceImport(bindings)) utilImports.add(bindings.name.text);
+            if (statement.importClause?.name) utilImports.add(statement.importClause.name.text);
+        }
     }
     function collect(node: ts.Node): void {
         if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.initializer)
@@ -52,6 +59,44 @@ function missingHiddenOptions(path: string, text = readFileSync(path, "utf8")):
         ts.forEachChild(node, collect);
     }
     collect(source);
+    function isUtil(node: ts.Expression, seen = new Set<string>()): boolean {
+        if (ts.isParenthesizedExpression(node)) return isUtil(node.expression, seen);
+        if (!ts.isIdentifier(node)) return false;
+        if (utilImports.has(node.text)) return true;
+        if (seen.has(node.text)) return false;
+        seen.add(node.text);
+        const initializer = variables.get(node.text);
+        return initializer ? isUtil(initializer, seen) : false;
+    }
+    function isPromisify(node: ts.Expression, seen = new Set<string>()): boolean {
+        if (ts.isParenthesizedExpression(node)) return isPromisify(node.expression, seen);
+        if (ts.isIdentifier(node)) {
+            if (promisifyImports.has(node.text)) return true;
+            if (seen.has(node.text)) return false;
+            seen.add(node.text);
+            const initializer = variables.get(node.text);
+            return initializer ? isPromisify(initializer, seen) : false;
+        }
+        return (
+            ts.isPropertyAccessExpression(node) &&
+            isUtil(node.expression) &&
+            node.name.text === "promisify"
+        );
+    }
+    function subprocess(node: ts.Expression, seen = new Set<string>()): string | undefined {
+        if (ts.isParenthesizedExpression(node)) return subprocess(node.expression, seen);
+        if (ts.isIdentifier(node)) {
+            const imported = imports.get(node.text);
+            if (imported) return imported;
+            if (seen.has(node.text)) return undefined;
+            seen.add(node.text);
+            const initializer = variables.get(node.text);
+            return initializer ? subprocess(initializer, seen) : undefined;
+        }
+        if (ts.isCallExpression(node) && isPromisify(node.expression) && node.arguments[0])
+            return subprocess(node.arguments[0], seen);
+        return undefined;
+    }
     function hidden(node: ts.Expression | undefined, seen = new Set<string>()): boolean {
         if (!node) return false;
         if (ts.isIdentifier(node)) {
@@ -90,39 +135,49 @@ function missingHiddenOptions(path: string, text = readFileSync(path, "utf8")):
         if (ts.isCallExpression(node)) {
             const expression = node.expression;
             let name: string | undefined;
+            // Track the original API, not the alias name: exec takes options at index 1,
+            // while execFile and spawn take them at index 2, even after promisify.
+            let kind = subprocess(expression);
+            if (kind) name = expression.getText(source);
             if (
+                !kind &&
                 ts.isIdentifier(expression) &&
-                (imports.has(expression.text) ||
-                    [
-                        "execFileAsync",
-                        "execFileSyncForIdentity",
-                        "rpcIdentityExecFileSync",
-                        "execFileForVerificationPaths",
-                    ].includes(expression.text) ||
+                ([
+                    "execFileAsync",
+                    "execFileSyncForIdentity",
+                    "rpcIdentityExecFileSync",
+                    "execFileForVerificationPaths",
+                ].includes(expression.text) ||
                     (expression.text === "exec" && path.endsWith("rpc-utils.ts")))
-            )
+            ) {
                 name = expression.text;
+                kind = "execFile";
+            }
             if (ts.isPropertyAccessExpression(expression)) {
                 const owner = expression.expression.getText(source);
                 if (
                     owner === "Bun" &&
                     (expression.name.text === "spawn" || expression.name.text === "spawnSync")
-                )
+                ) {
                     name = "Bun.spawn";
+                    kind = "Bun.spawn";
+                }
                 if (
                     (owner === "deps" || owner === "this") &&
                     (subprocessNames.has(expression.name.text) ||
                         expression.name.text === "spawnImpl")
-                )
+                ) {
                     name = expression.name.text;
+                    kind = expression.name.text;
+                }
             }
             if (name) {
                 const index =
-                    name === "Bun.spawn"
+                    kind === "Bun.spawn"
                         ? node.arguments.length === 1
                             ? 0
                             : 1
-                        : name === "execSync" || (name === "exec" && !path.endsWith("rpc-utils.ts"))
+                        : kind === "execSync" || kind === "exec"
                           ? 1
                           : 2;
                 // A single-argument Bun.spawnSync({cmd, ...}) passes options as its first argument.
@@ -158,6 +213,61 @@ describe("Windows child processes", () => {
         expect(failures).toEqual([]);
     });
 
+    test.each([
+        ["execFile", "[],"],
+        ["exec", ""],
+        ["spawn", "[],"],
+    ])("follows promisified %s aliases and checks the original options position", (api, args) => {
+        const path = join(root, "packages/plugin/src/shared/promisified-fixture.ts");
+        const text = `import { ${api} as childProcess } from "node:child_process";
+            import { promisify as toPromise } from "node:util";
+            const rawAlias = childProcess;
+            const promiseAlias = toPromise;
+            const exec = promiseAlias(rawAlias);
+            const run = exec;
+            run("git", ${args} { windowsHide: true });
+            run("git", ${args} { windowsHide: false });
+            run("git", ${args} {});`;
+        expect(missingHiddenOptions(path, text)).toEqual([
+            "packages/plugin/src/shared/promisified-fixture.ts:8 run",
+            "packages/plugin/src/shared/promisified-fixture.ts:9 run",
+        ]);
+    });
+
+    test.each([
+        'import { promisify } from "node:util";',
+        'import * as util from "node:util"; const promisify = util.promisify;',
+        'import util from "util"; const promisify = util.promisify;',
+        'import * as util from "node:util"; const u = util; const promisify = u.promisify;',
+    ])("recognizes promisify bindings: %s", (utilImport) => {
+        const path = join(root, "packages/plugin/src/shared/promisified-fixture.ts");
+        const text = `import { execFile } from "node:child_process";
+            ${utilImport}
+            const exec = promisify(execFile);
+            exec("git", [], { windowsHide: true });
+            exec("git", [], {});`;
+        expect(missingHiddenOptions(path, text)).toEqual([
+            "packages/plugin/src/shared/promisified-fixture.ts:5 exec",
+        ]);
+    });
+
+    test("recognizes direct util.promisify calls and does not trust options in the wrong slot", () => {
+        const path = join(root, "packages/plugin/src/shared/promisified-fixture.ts");
+        const text = `import { execFile, exec, spawn } from "node:child_process";
+            import * as util from "node:util";
+            const file = util.promisify(execFile);
+            const shell = util.promisify(exec);
+            const child = util.promisify(spawn);
+            file("git", { windowsHide: true }, {});
+            shell("git", {}, { windowsHide: true });
+            child("git", { windowsHide: true }, {});`;
+        expect(missingHiddenOptions(path, text)).toEqual([
+            "packages/plugin/src/shared/promisified-fixture.ts:6 file",
+            "packages/plugin/src/shared/promisified-fixture.ts:7 shell",
+            "packages/plugin/src/shared/promisified-fixture.ts:8 child",
+        ]);
+    });
+
     test("another dashboard subprocess still requires windowsHide true", () => {
         const path = join(root, "packages/cli/src/lib/dashboard-install.ts");
         const text = `import { execFile } from "node:child_process";