@cortexkit/opencode-magic-context 0.49.6 → 0.49.8

package/src/shared/recovery-reasoning-prefix.test.ts

@@ -0,0 +1,34 @@
+import { expect, test } from "bun:test";
+import { recoveryReasoningPrefixes } from "./recovery-reasoning-prefix";
+
+for (const key of ["content", "parts"] as const) {
+    test(`recovery reasoning ${key}: exact preceding messages and same-message parts`, () => {
+        const messages = [
+            { role: "user", [key]: [{ type: "text", text: "original" }] },
+            {
+                role: "assistant",
+                [key]: [
+                    { type: "text", text: "before" },
+                    { type: "thinking", thinkingSignature: "first" },
+                    { type: "text", text: "between" },
+                    { type: "redacted_thinking", data: "opaque" },
+                    { type: "text", text: "after" },
+                ],
+            },
+        ];
+        const original = recoveryReasoningPrefixes(messages, key);
+        expect(original).toHaveLength(2);
+        const edited = structuredClone(messages);
+        edited[0]![key]![0]!.text = "changed";
+        expect(recoveryReasoningPrefixes(edited, key)).not.toEqual(original);
+        const parts = structuredClone(messages);
+        parts[1]![key]![2]!.text = "changed";
+        expect(recoveryReasoningPrefixes(parts, key)[0]).toBe(original[0]);
+        expect(recoveryReasoningPrefixes(parts, key)[1]).not.toBe(original[1]);
+        const suffix = structuredClone(messages);
+        suffix[1]![key]![4]!.text = "changed";
+        expect(recoveryReasoningPrefixes(suffix, key)).toEqual(original);
+        suffix[1]![key]!.splice(3, 1);
+        expect(recoveryReasoningPrefixes(suffix, key)).not.toEqual(original);
+    });
+}

package/src/shared/recovery-reasoning-prefix.ts

@@ -0,0 +1,35 @@
+/**
+ * Serialize each request prefix ending at a thinking/reasoning part, including
+ * earlier messages and earlier parts of that message. Comparing these snapshots
+ * detects edits to bytes authenticated by a kept signature, or missing blocks.
+ * Include reasoning without a visible signature too: a host may carry its
+ * provider signature in fields this helper does not interpret.
+ */
+export function recoveryReasoningPrefixes(
+    messages: readonly unknown[],
+    partsKey: "parts" | "content",
+): string[] {
+    const prefixes: string[] = [];
+    for (let index = 0; index < messages.length; index++) {
+        const message = messages[index] as Record<string, unknown> | null;
+        const parts = message?.[partsKey];
+        if (!Array.isArray(parts)) continue;
+        for (let p = 0; p < parts.length; p++) {
+            const type = (parts[p] as { type?: string } | null)?.type;
+            if (
+                type !== "thinking" &&
+                type !== "reasoning" &&
+                type !== "redactedThinking" &&
+                type !== "redacted_thinking"
+            )
+                continue;
+            prefixes.push(
+                JSON.stringify([
+                    ...messages.slice(0, index),
+                    { ...message, [partsKey]: parts.slice(0, p + 1) },
+                ]),
+            );
+        }
+    }
+    return prefixes;
+}

package/src/shared/redaction.test.ts

@@ -132,3 +132,19 @@ describe("redaction gaps: unambiguous secret key names and header/URL credential
         expect(apiKey).toContain("x-api-key");
     });
 });
+
+describe("public diagnostic credential shapes", () => {
+    test("redacts unquoted colon credentials without removing scalar diagnostics", () => {
+        expect(redactSecretText("password: colonSecret700 token: anotherSecret700")).toBe(
+            "password: <REDACTED:credential> token: <REDACTED:credential>",
+        );
+        expect(redactSecretText("token: 1234567 secret: false")).toBe(
+            "token: 1234567 secret: false",
+        );
+    });
+    test("redacts hyphenated and underscored GitHub token payloads completely", () => {
+        expect(redactSecretText("ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890-extra_payload")).toBe(
+            "<GITHUB_TOKEN_REDACTED>",
+        );
+    });
+});

package/src/shared/redaction.ts

@@ -152,7 +152,7 @@ const SECRET_TEXT_PATTERNS: Array<{
         replacement: "<GITHUB_PAT_REDACTED>",
     },
     {
-        pattern: /\b(?:gh[opsu]|ghr)_[A-Za-z0-9]{30,}/g,
+        pattern: /\b(?:gh[opsu]|ghr)_[A-Za-z0-9_-]{30,}/g,
         replacement: "<GITHUB_TOKEN_REDACTED>",
     },
     {
@@ -190,6 +190,13 @@ const SECRET_TEXT_PATTERNS: Array<{
         replacement: (full: string, prefix: string, value: string) =>
             isNonSecretScalarValue(value) ? full : `${prefix}<REDACTED:api_key>`,
     },
+    {
+        // Unquoted diagnostic prose also uses colon-delimited credentials.
+        pattern:
+            /\b((?:api[_-]?key|client[_-]?secret|access[_-]?token|token|secret|password|passwd|pwd)\s*:\s*)([^\s'"`,;<>]{6,})/gi,
+        replacement: (full: string, prefix: string, value: string) =>
+            isNonSecretScalarValue(value) ? full : `${prefix}<REDACTED:credential>`,
+    },
     {
         // Credentials embedded in a URL: scheme://user:password@host.
         pattern: /\b([a-z][a-z0-9+.-]*:\/\/[^\s/:@]+:)([^\s/@]+)(@)/gi,

package/src/shared/root-async-context.probe.mjs

@@ -0,0 +1,36 @@
+import assert from "node:assert/strict";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { setTimeout as delay, setImmediate as tick } from "node:timers/promises";
+import { Worker } from "node:worker_threads";
+import { inRootAsyncContext } from "./sqlite";
+
+const scope = new AsyncLocalStorage();
+const gc = globalThis.Bun ? () => Bun.gc(true) : globalThis.gc;
+const references = {};
+const resources = [];
+const timerStores = {};
+const ambientTick = () => { timerStores.ambient = scope.getStore() !== undefined; };
+const rootTick = () => { timerStores.root = scope.getStore() !== undefined; };
+function create(name, root, worker) {
+    const payload = { synthetic: name };
+    references[name] = new WeakRef(payload);
+    scope.run(payload, () => {
+        const make = worker
+            ? () => new Worker(new URL("worker.mjs", import.meta.url))
+            : () => setInterval(root ? rootTick : ambientTick, 5);
+        resources.push(root ? inRootAsyncContext(make) : make());
+        assert.equal(scope.getStore(), payload, "Root execution must restore the caller's store");
+    });
+}
+create("ambientWorker", false, true);
+create("rootWorker", true, true);
+create("ambientTimer", false, false);
+create("rootTimer", true, false);
+await delay(30);
+for (let i = 0; i < 12; i++) { await tick(); gc(); await tick(); }
+const retained = Object.fromEntries(Object.entries(references).map(([key, ref]) => [key, Number(ref.deref() !== undefined)]));
+for (const resource of resources) {
+    if (resource instanceof Worker) await resource.terminate();
+    else clearInterval(resource);
+}
+console.log(JSON.stringify({ runtime: globalThis.Bun ? `Bun ${Bun.version}` : process.version, timerStores, retained }));

package/src/shared/root-async-context.test.ts

@@ -0,0 +1,49 @@
+import { expect, test } from "bun:test";
+import { rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { createTestTempDirFromPath } from "./test-temp-dir";
+
+for (const runtime of ["Node", "Bun"] as const) {
+    test(`root resources do not inherit request stores (${runtime})`, async () => {
+        const directory = createTestTempDirFromPath(join(tmpdir(), "root-context-"));
+        try {
+            const entry = join(directory, "probe.mjs");
+            const build = await Bun.build({
+                entrypoints: [new URL("root-async-context.probe.mjs", import.meta.url).pathname],
+                target: "node",
+                format: "esm",
+                external: ["bun:sqlite", "node:sqlite"],
+            });
+            expect(build.success).toBe(true);
+            await writeFile(entry, await build.outputs[0].text());
+            await writeFile(
+                join(directory, "worker.mjs"),
+                `import { parentPort } from 'node:worker_threads'; parentPort.on('message', () => {});`,
+            );
+            const child = Bun.spawn(
+                [...(runtime === "Node" ? ["node", "--expose-gc"] : [process.execPath]), entry],
+                {
+                    stdout: "pipe",
+                    stderr: "pipe",
+                    windowsHide: true,
+                },
+            );
+            const [stdout, stderr, exit] = await Promise.all([
+                new Response(child.stdout).text(),
+                new Response(child.stderr).text(),
+                child.exited,
+            ]);
+            expect(exit, stderr).toBe(0);
+            const result = JSON.parse(stdout);
+            console.log(`${runtime} ALS propagation: ${stdout.trim()}`);
+            expect(result.timerStores).toEqual({ ambient: true, root: false });
+            expect(result.retained.rootWorker).toBe(0);
+            expect(result.retained.rootTimer).toBe(0);
+            expect(result.retained.ambientTimer).toBe(1);
+            if (runtime === "Node") expect(result.retained.ambientWorker).toBe(1);
+        } finally {
+            await rm(directory, { recursive: true, force: true });
+        }
+    });
+}

package/src/shared/rpc-server.ts

@@ -133,31 +133,33 @@ export class MagicContextRpcServer {
         }
         this.startedAt = Date.now();
         const self = this;
-        const server = Bun.serve<WsData>({
-            port: 0,
-            hostname: "127.0.0.1",
-            fetch(req, srv) {
-                return self.handleFetch(req, srv);
-            },
-            websocket: {
-                open(ws) {
-                    // Close the socket if it doesn't authenticate promptly. A
-                    // never-authenticated socket holds no sink and is harmless,
-                    // but we don't want to keep raw connections open forever.
-                    ws.data.authTimer = setTimeout(() => {
-                        if (!ws.data.authed) ws.close(WS_CLOSE_UNAUTHORIZED, "auth timeout");
-                    }, WS_AUTH_TIMEOUT_MS);
+        const server = inRootAsyncContext(() =>
+            Bun.serve<WsData>({
+                port: 0,
+                hostname: "127.0.0.1",
+                fetch(req, srv) {
+                    return self.handleFetch(req, srv);
                 },
-                message(ws, raw) {
-                    self.handleWsMessage(ws, raw);
+                websocket: {
+                    open(ws) {
+                        // Close the socket if it doesn't authenticate promptly. A
+                        // never-authenticated socket holds no sink and is harmless,
+                        // but we don't want to keep raw connections open forever.
+                        ws.data.authTimer = setTimeout(() => {
+                            if (!ws.data.authed) ws.close(WS_CLOSE_UNAUTHORIZED, "auth timeout");
+                        }, WS_AUTH_TIMEOUT_MS);
+                    },
+                    message(ws, raw) {
+                        self.handleWsMessage(ws, raw);
+                    },
+                    close(ws) {
+                        if (ws.data.authTimer) clearTimeout(ws.data.authTimer);
+                        ws.data.unregister?.();
+                        self.sockets.delete(ws);
+                    },
                 },
-                close(ws) {
-                    if (ws.data.authTimer) clearTimeout(ws.data.authTimer);
-                    ws.data.unregister?.();
-                    self.sockets.delete(ws);
-                },
-            },
-        });
+            }),
+        );
 
         this.server = server;
         this.port = server.port ?? 0;
@@ -429,3 +431,5 @@ function json(body: unknown, status = 200): Response {
         headers: { "Content-Type": "application/json" },
     });
 }
+
+import { inRootAsyncContext } from "./sqlite";

package/src/shared/sqlite-busy-budget-review.test.ts

@@ -0,0 +1,291 @@
+import { expect, test } from "bun:test";
+import { rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+    Database,
+    guardSqliteTransformPass,
+    SqliteAcquisitionBusyError,
+    withSqliteBackgroundWriter,
+    withSqliteTransformPass,
+} from "./sqlite";
+import { createTestTempDirFromPath } from "./test-temp-dir";
+
+function fixture() {
+    const dir = createTestTempDirFromPath(join(tmpdir(), "mc-busy-review-"));
+    const path = join(dir, "context.db");
+    const db = new Database(path);
+    db.exec("PRAGMA busy_timeout=5000; CREATE TABLE result(id INTEGER PRIMARY KEY, n INTEGER)");
+    db.exec("INSERT INTO result VALUES (1, 0)");
+    return {
+        db,
+        path,
+        close() {
+            db.close();
+            rmSync(dir, { recursive: true, force: true });
+        },
+    };
+}
+
+async function lock(path: string, mode: "read" | "write" | "exclusive", holdMs: number) {
+    const child = Bun.spawn(
+        [
+            "bun",
+            "--eval",
+            `import { Database } from "bun:sqlite";
+        const db = new Database(process.argv[1]);
+        db.exec(process.argv[2] === "read" ? "BEGIN; SELECT * FROM result"
+            : process.argv[2] === "write" ? "BEGIN IMMEDIATE" : "BEGIN EXCLUSIVE");
+        console.log("LOCKED");
+        Bun.sleepSync(Number(process.argv[3]));
+        db.exec("COMMIT");
+        db.close();`,
+            path,
+            mode,
+            String(holdMs),
+        ],
+        { stdout: "pipe", stderr: "pipe", windowsHide: true },
+    );
+    const reader = child.stdout.getReader();
+    let output = "";
+    while (!output.includes("LOCKED\n")) {
+        const chunk = await reader.read();
+        if (chunk.done) {
+            throw new Error(`locker failed: ${await new Response(child.stderr).text()}`);
+        }
+        output += new TextDecoder().decode(chunk.value);
+    }
+    reader.releaseLock();
+    return { exited: child.exited };
+}
+
+for (const method of ["run", "get", "all", "exec"] as const) {
+    test(`a rollback-journal commit BUSY retries ${method} exactly once after the reader leaves`, async () => {
+        const { db, path, close } = fixture();
+        const sql = "UPDATE result SET n = n + 1 WHERE id = 1";
+        const statement = db.prepare(`${sql} RETURNING n`);
+        const { exited } = await lock(path, "read", 150);
+        try {
+            await withSqliteTransformPass(() => {
+                if (method === "exec") db.exec(sql);
+                else statement[method]();
+            });
+            expect(db.prepare("SELECT * FROM result").all()).toEqual([{ id: 1, n: 1 }]);
+            expect(db.inTransaction).toBe(false);
+        } finally {
+            expect(await exited).toBe(0);
+            close();
+        }
+    });
+}
+
+for (const scope of ["foreground", "background", "unscoped"] as const) {
+    test(`exec in ${scope} does not wait on an unrelated attached database schema`, async () => {
+        const main = fixture();
+        const aux = fixture();
+        main.db.prepare("ATTACH DATABASE ? AS aux").run(aux.path);
+        const { exited } = await lock(aux.path, "exclusive", 2500);
+        try {
+            const started = performance.now();
+            const operation = () => main.db.exec("UPDATE main.result SET n = n + 1");
+            if (scope === "foreground") {
+                await withSqliteTransformPass(() => {
+                    guardSqliteTransformPass({ assert() {}, remainingMs: () => 75 });
+                    operation();
+                });
+            } else if (scope === "background") withSqliteBackgroundWriter(operation);
+            else operation();
+            expect(performance.now() - started).toBeLessThan(1500);
+            expect(main.db.prepare("SELECT n FROM main.result").get()).toEqual({ n: 1 });
+        } finally {
+            expect(await exited).toBe(0);
+            main.close();
+            aux.close();
+        }
+    }, 10_000);
+}
+
+for (const location of ["main", "aux"] as const) {
+    test(`BUSY retries leave single-statement effects atomic in ${location}, including AFTER triggers`, async () => {
+        const main = fixture();
+        const aux = fixture();
+        main.db.prepare("ATTACH DATABASE ? AS aux").run(aux.path);
+        main.db.exec("CREATE TABLE audit(n INTEGER)");
+        main.db.exec(`CREATE TEMP TRIGGER audit_insert AFTER INSERT ON ${location}.result
+            BEGIN INSERT INTO audit VALUES (new.n); END`);
+        main.db.exec(`CREATE TEMP TRIGGER audit_update AFTER UPDATE ON ${location}.result
+            BEGIN INSERT INTO audit VALUES (new.n); END`);
+        main.db.exec(`CREATE TEMP TRIGGER audit_delete AFTER DELETE ON ${location}.result
+            BEGIN INSERT INTO audit VALUES (old.n); END`);
+        const forms = [
+            `INSERT INTO ${location}.result VALUES (2, 10)`,
+            `INSERT OR IGNORE INTO ${location}.result VALUES (2, 20)`,
+            `INSERT OR REPLACE INTO ${location}.result VALUES (2, 30)`,
+            `INSERT INTO ${location}.result VALUES (2, 40) ON CONFLICT(id) DO UPDATE SET n=n+1`,
+            `UPDATE ${location}.result SET n=n+1 WHERE id=2`,
+            `DELETE FROM ${location}.result WHERE id=2`,
+        ];
+        try {
+            for (const sql of forms) {
+                const statement = main.db.prepare(`${sql} RETURNING *`);
+                const blocker = new Database(location === "main" ? main.path : aux.path);
+                blocker.exec("BEGIN IMMEDIATE");
+                main.db.exec("PRAGMA busy_timeout=0");
+                const before = main.db
+                    .prepare(`SELECT * FROM ${location}.result ORDER BY id`)
+                    .all();
+                const beforeAudit = main.db.prepare("SELECT * FROM audit").all();
+                try {
+                    expect(() => statement.all()).toThrow("locked");
+                    expect(
+                        main.db.prepare(`SELECT * FROM ${location}.result ORDER BY id`).all(),
+                    ).toEqual(before);
+                    expect(main.db.prepare("SELECT * FROM audit").all()).toEqual(beforeAudit);
+                    expect(main.db.inTransaction).toBe(false);
+                } finally {
+                    blocker.exec("ROLLBACK");
+                    blocker.close();
+                }
+                const { exited } = await lock(
+                    location === "main" ? main.path : aux.path,
+                    "write",
+                    60,
+                );
+                try {
+                    await withSqliteTransformPass(() => statement.all());
+                } finally {
+                    expect(await exited).toBe(0);
+                }
+            }
+            expect(main.db.prepare(`SELECT * FROM ${location}.result ORDER BY id`).all()).toEqual([
+                { id: 1, n: 0 },
+            ]);
+            expect(main.db.prepare("SELECT * FROM audit").all()).toEqual([
+                { n: 10 },
+                { n: 30 },
+                { n: 31 },
+                { n: 32 },
+                { n: 32 },
+            ]);
+        } finally {
+            main.close();
+            aux.close();
+        }
+    }, 10_000);
+}
+
+test("an attached DML-only committed prefix is not replayed after a later BUSY", () => {
+    const main = fixture();
+    const free = fixture();
+    const blocked = fixture();
+    try {
+        main.db.prepare("ATTACH DATABASE ? AS free").run(free.path);
+        main.db.prepare("ATTACH DATABASE ? AS blocked").run(blocked.path);
+        blocked.db.exec("BEGIN IMMEDIATE");
+        withSqliteTransformPass(() => {
+            expect(() =>
+                main.db.exec("UPDATE free.result SET n=n+1; UPDATE blocked.result SET n=n+1"),
+            ).toThrow(SqliteAcquisitionBusyError);
+        });
+        expect(main.db.prepare("SELECT n FROM free.result").get()).toEqual({ n: 1 });
+        expect(main.db.prepare("SELECT n FROM blocked.result").get()).toEqual({ n: 0 });
+    } finally {
+        blocked.db.exec("ROLLBACK");
+        main.close();
+        free.close();
+        blocked.close();
+    }
+});
+
+for (const location of ["main", "free"] as const) {
+    test(`an ignored AUTOINCREMENT prefix in ${location} is committed only once before a later BUSY`, () => {
+        const main = fixture();
+        const free = fixture();
+        const blocked = fixture();
+        try {
+            main.db.prepare("ATTACH DATABASE ? AS free").run(free.path);
+            main.db.exec(`CREATE TABLE ${location}.numbered(id INTEGER PRIMARY KEY AUTOINCREMENT, value TEXT UNIQUE);
+            INSERT INTO ${location}.numbered(value) VALUES ('existing')`);
+            main.db.prepare("ATTACH DATABASE ? AS blocked").run(blocked.path);
+            blocked.db.exec("BEGIN IMMEDIATE");
+            const before = main.db.prepare("SELECT total_changes() AS n").get();
+            withSqliteTransformPass(() => {
+                guardSqliteTransformPass({ assert() {}, remainingMs: () => 50 });
+                expect(() =>
+                    main.db.exec(
+                        `INSERT OR IGNORE INTO ${location}.numbered(value) VALUES ('existing'); UPDATE blocked.result SET n=n+1`,
+                    ),
+                ).toThrow(SqliteAcquisitionBusyError);
+            });
+            expect(main.db.prepare("SELECT total_changes() AS n").get()).toEqual(before);
+            expect(
+                main.db
+                    .prepare(`SELECT seq FROM ${location}.sqlite_sequence WHERE name='numbered'`)
+                    .get(),
+            ).toEqual({ seq: 2 });
+            expect(main.db.prepare(`SELECT * FROM ${location}.numbered`).all()).toEqual([
+                { id: 1, value: "existing" },
+            ]);
+        } finally {
+            blocked.db.exec("ROLLBACK");
+            main.close();
+            free.close();
+            blocked.close();
+        }
+    });
+}
+
+test("a WAL BUSY_SNAPSHOT in an explicit read transaction is not retried", () => {
+    const { db, path, close } = fixture();
+    db.exec("PRAGMA journal_mode=WAL");
+    const other = new Database(path);
+    try {
+        db.exec("BEGIN; SELECT * FROM result");
+        other.exec("UPDATE result SET n=n+1");
+        withSqliteTransformPass(() => {
+            expect(() => db.prepare("UPDATE result SET n=n+10").run()).toThrow("locked");
+        });
+        expect(db.inTransaction).toBe(true);
+        db.exec("ROLLBACK");
+        expect(db.prepare("SELECT n FROM result").get()).toEqual({ n: 1 });
+    } finally {
+        if (db.inTransaction) db.exec("ROLLBACK");
+        other.close();
+        close();
+    }
+});
+
+test("a BUSY from an AFTER trigger writing an attached database rolls back the outer statement", async () => {
+    const main = fixture();
+    const aux = fixture();
+    main.db.prepare("ATTACH DATABASE ? AS aux").run(aux.path);
+    // The TEMP trigger resolves an unqualified table in main first; give the
+    // attached target its own name so the trigger must write the other file.
+    main.db.exec("ALTER TABLE aux.result RENAME TO attached_result");
+    main.db.exec(`CREATE TEMP TRIGGER update_aux AFTER UPDATE ON main.result
+        BEGIN UPDATE attached_result SET n=n+1 WHERE id=1; END`);
+    const statement = main.db.prepare("UPDATE main.result SET n=n+1 RETURNING n");
+    const blocker = new Database(aux.path);
+    try {
+        blocker.exec("BEGIN IMMEDIATE");
+        main.db.exec("PRAGMA busy_timeout=0");
+        expect(() => statement.all()).toThrow("locked");
+        expect(main.db.prepare("SELECT n FROM main.result").get()).toEqual({ n: 0 });
+        expect(main.db.prepare("SELECT n FROM aux.attached_result").get()).toEqual({ n: 0 });
+        expect(main.db.inTransaction).toBe(false);
+        blocker.exec("ROLLBACK");
+        const { exited } = await lock(aux.path, "write", 100);
+        try {
+            await withSqliteTransformPass(() => statement.all());
+        } finally {
+            expect(await exited).toBe(0);
+        }
+        expect(main.db.prepare("SELECT n FROM main.result").get()).toEqual({ n: 1 });
+        expect(main.db.prepare("SELECT n FROM aux.attached_result").get()).toEqual({ n: 1 });
+    } finally {
+        if (blocker.inTransaction) blocker.exec("ROLLBACK");
+        blocker.close();
+        main.close();
+        aux.close();
+    }
+});