@cortexkit/pi-magic-context 0.22.4 → 0.22.5

package/dist/subagent-entry.js

@@ -142476,6 +142476,7 @@ CREATE INDEX IF NOT EXISTS idx_dream_queue_pending ON dream_queue(started_at, en
   ensureColumn(db, "session_meta", "system_prompt_hash", "TEXT DEFAULT ''");
   ensureColumn(db, "session_meta", "cleared_reasoning_through_tag", "INTEGER DEFAULT 0");
   ensureColumn(db, "session_meta", "stripped_placeholder_ids", "TEXT DEFAULT ''");
+  ensureColumn(db, "session_meta", "stale_reduce_stripped_ids", "TEXT DEFAULT ''");
   ensureColumn(db, "compartments", "start_message_id", "TEXT DEFAULT ''");
   ensureColumn(db, "compartments", "end_message_id", "TEXT DEFAULT ''");
   ensureColumn(db, "memory_embeddings", "model_id", "TEXT");
@@ -142626,6 +142627,7 @@ function healNullTextColumns(db) {
     ["todo_synthetic_state_json", ""],
     ["system_prompt_hash", ""],
     ["stripped_placeholder_ids", ""],
+    ["stale_reduce_stripped_ids", ""],
     ["memory_block_cache", ""],
     ["memory_block_ids", ""],
     ["compaction_marker_state", ""],
@@ -142735,6 +142737,31 @@ function openDatabase(dbPathOrOptions) {
   }
 }
 
+// ../plugin/src/config/prune-config-leaf.ts
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function pruneNestedConfigLeaf(block, relativePath) {
+  if (relativePath.length === 0)
+    return null;
+  const result = { ...block };
+  let cursor = result;
+  for (let i = 0;i < relativePath.length - 1; i++) {
+    const seg = String(relativePath[i]);
+    const child = cursor[seg];
+    if (!isPlainObject(child))
+      return null;
+    const clonedChild = { ...child };
+    cursor[seg] = clonedChild;
+    cursor = clonedChild;
+  }
+  const leaf = String(relativePath[relativePath.length - 1]);
+  if (!(leaf in cursor))
+    return null;
+  delete cursor[leaf];
+  return { block: result, removed: relativePath.map(String).join(".") };
+}
+
 // src/config/index.ts
 import { existsSync as existsSync5, readFileSync as readFileSync3 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
@@ -142876,6 +142903,70 @@ function migrateLegacyExperimental(rawConfig, warnings) {
   return patched;
 }
 
+// ../plugin/src/config/project-security.ts
+var HIDDEN_AGENT_KEYS = ["historian", "dreamer", "sidekick"];
+var AGENT_ESCALATION_FIELDS = ["prompt", "permission", "tools", "system_prompt"];
+function isPlainObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stripUnsafeProjectConfigFields(projectRaw) {
+  const warnings = [];
+  if ("auto_update" in projectRaw) {
+    delete projectRaw.auto_update;
+    warnings.push("Ignoring auto_update from project config (security: this setting only honors user-level config).");
+  }
+  for (const agentKey of HIDDEN_AGENT_KEYS) {
+    const block = projectRaw[agentKey];
+    if (!isPlainObject2(block))
+      continue;
+    const removed = [];
+    for (const field of AGENT_ESCALATION_FIELDS) {
+      if (field in block) {
+        delete block[field];
+        removed.push(field);
+      }
+    }
+    if (removed.length > 0) {
+      warnings.push(`Ignoring ${agentKey}.${removed.join("/")} from project config ` + "(security: a repository cannot reprogram or re-permission hidden agents).");
+    }
+  }
+  return warnings;
+}
+function normalizeEndpoint(value) {
+  if (typeof value !== "string")
+    return;
+  const trimmed = value.trim().replace(/\/+$/, "");
+  return trimmed.length > 0 ? trimmed.toLowerCase() : undefined;
+}
+function dropInheritedEmbeddingKeyOnRedirect(projectRaw, mergedRaw, userRaw) {
+  const projectEmbedding = projectRaw.embedding;
+  if (!isPlainObject2(projectEmbedding))
+    return [];
+  const redirectsEndpoint = "endpoint" in projectEmbedding;
+  if (!redirectsEndpoint)
+    return [];
+  const userEmbedding = userRaw?.embedding;
+  if (isPlainObject2(userEmbedding)) {
+    const projectEndpoint = normalizeEndpoint(projectEmbedding.endpoint);
+    const userEndpoint = normalizeEndpoint(userEmbedding.endpoint);
+    if (projectEndpoint !== undefined && projectEndpoint === userEndpoint) {
+      return [];
+    }
+  }
+  const providesOwnKey = typeof projectEmbedding.api_key === "string" && projectEmbedding.api_key.length > 0;
+  if (providesOwnKey)
+    return [];
+  const mergedEmbedding = mergedRaw.embedding;
+  if (!isPlainObject2(mergedEmbedding))
+    return [];
+  if (!("api_key" in mergedEmbedding))
+    return [];
+  delete mergedEmbedding.api_key;
+  return [
+    "Dropped inherited user embedding api_key because project config redirected " + "embedding.endpoint without supplying its own key (security: prevents key " + "exfiltration to a repository-chosen endpoint)."
+  ];
+}
+
 // ../../node_modules/.bun/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var exports_external = {};
 __export(exports_external, {
@@ -143507,7 +143598,7 @@ __export(exports_util, {
   jsonStringifyReplacer: () => jsonStringifyReplacer,
   joinValues: () => joinValues,
   issue: () => issue,
-  isPlainObject: () => isPlainObject,
+  isPlainObject: () => isPlainObject3,
   isObject: () => isObject,
   hexToUint8Array: () => hexToUint8Array,
   getSizableOrigin: () => getSizableOrigin,
@@ -143689,7 +143780,7 @@ var allowsEval = /* @__PURE__ */ cached(() => {
     return false;
   }
 });
-function isPlainObject(o) {
+function isPlainObject3(o) {
   if (isObject(o) === false)
     return false;
   const ctor = o.constructor;
@@ -143706,7 +143797,7 @@ function isPlainObject(o) {
   return true;
 }
 function shallowClone(o) {
-  if (isPlainObject(o))
+  if (isPlainObject3(o))
     return { ...o };
   if (Array.isArray(o))
     return [...o];
@@ -143910,7 +144001,7 @@ function omit(schema, mask) {
   return clone(schema, def);
 }
 function extend(schema, shape) {
-  if (!isPlainObject(shape)) {
+  if (!isPlainObject3(shape)) {
     throw new Error("Invalid input to extend: expected a plain object");
   }
   const checks = schema._zod.def.checks;
@@ -143933,7 +144024,7 @@ function extend(schema, shape) {
   return clone(schema, def);
 }
 function safeExtend(schema, shape) {
-  if (!isPlainObject(shape)) {
+  if (!isPlainObject3(shape)) {
     throw new Error("Invalid input to safeExtend: expected a plain object");
   }
   const def = mergeDefs(schema._zod.def, {
@@ -146276,7 +146367,7 @@ function mergeValues(a, b) {
   if (a instanceof Date && b instanceof Date && +a === +b) {
     return { valid: true, data: a };
   }
-  if (isPlainObject(a) && isPlainObject(b)) {
+  if (isPlainObject3(a) && isPlainObject3(b)) {
     const bKeys = Object.keys(b);
     const sharedKeys = Object.keys(a).filter((key) => bKeys.indexOf(key) !== -1);
     const newObj = { ...a, ...b };
@@ -146462,7 +146553,7 @@ var $ZodRecord = /* @__PURE__ */ $constructor("$ZodRecord", (inst, def) => {
   $ZodType.init(inst, def);
   inst._zod.parse = (payload, ctx) => {
     const input = payload.value;
-    if (!isPlainObject(input)) {
+    if (!isPlainObject3(input)) {
       payload.issues.push({
         expected: "record",
         code: "invalid_type",
@@ -157416,6 +157507,21 @@ function stripJsonComments(content) {
 // ../plugin/src/config/variable.ts
 var ENV_PATTERN = /\{env:([^}]+)\}/g;
 var FILE_PATTERN = /\{file:([^}]+)\}/g;
+function sensitiveFilePathReason(resolvedPath) {
+  const home = homedir2();
+  const sensitiveDirs = [
+    { dir: resolve2(home, ".ssh"), label: "SSH keys" },
+    { dir: resolve2(home, ".aws"), label: "AWS credentials" },
+    { dir: resolve2(home, ".gnupg"), label: "GnuPG keyring" },
+    { dir: resolve2(home, ".config", "gh"), label: "GitHub CLI auth" }
+  ];
+  for (const { dir, label } of sensitiveDirs) {
+    if (resolvedPath === dir || resolvedPath.startsWith(`${dir}/`)) {
+      return label;
+    }
+  }
+  return null;
+}
 function substituteConfigVariables(input) {
   const warnings = [];
   let text = input.text;
@@ -157469,6 +157575,10 @@ function substituteConfigVariables(input) {
     } else if (!isAbsolute(filePath)) {
       filePath = resolve2(configDir, filePath);
     }
+    const sensitiveReason = sensitiveFilePathReason(filePath);
+    if (sensitiveReason) {
+      warnings.push(`${token} resolves to a sensitive path (${sensitiveReason}: ${filePath}); ` + "inlining its contents into config — make sure this is intentional.");
+    }
     if (!existsSync4(filePath)) {
       warnings.push(`File not found for ${token} (resolved to ${filePath}); using empty string`);
       continue;
@@ -157507,7 +157617,8 @@ function loadConfigFile(path3, scope) {
     const rawText = readFileSync3(path3, "utf-8");
     const substituted = substituteConfigVariables({
       text: rawText,
-      configPath: path3
+      configPath: path3,
+      isProjectConfig: scope === "project"
     });
     return {
       path: path3,
@@ -157549,14 +157660,14 @@ function redactConfigValue(value) {
   }
   return typeof value;
 }
-function isPlainObject2(value) {
+function isPlainObject4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function mergeRawConfigs(base, override) {
   const merged = { ...base };
   for (const [key, overrideValue] of Object.entries(override)) {
     const baseValue = merged[key];
-    merged[key] = isPlainObject2(baseValue) && isPlainObject2(overrideValue) ? mergeRawConfigs(baseValue, overrideValue) : overrideValue;
+    merged[key] = isPlainObject4(baseValue) && isPlainObject4(overrideValue) ? mergeRawConfigs(baseValue, overrideValue) : overrideValue;
   }
   return merged;
 }
@@ -157570,10 +157681,15 @@ function parsePiConfig(rawConfig, recoveredTopLevelKeys = []) {
   }
   const defaults = MagicContextConfigSchema.parse({});
   const errorPaths = new Set;
+  const issuePathsByKey = new Map;
   for (const issue2 of parsed.error.issues) {
     const topKey = issue2.path[0];
     if (topKey !== undefined) {
-      errorPaths.add(String(topKey));
+      const key = String(topKey);
+      errorPaths.add(key);
+      const paths = issuePathsByKey.get(key) ?? [];
+      paths.push([...issue2.path]);
+      issuePathsByKey.set(key, paths);
     }
   }
   const patched = { ...migrated };
@@ -157581,11 +157697,32 @@ function parsePiConfig(rawConfig, recoveredTopLevelKeys = []) {
   for (const key of errorPaths) {
     recoveredTopLevelKeys.push(key);
     const isAgentConfig = key === "historian" || key === "dreamer" || key === "sidekick";
-    delete patched[key];
     if (isAgentConfig) {
+      delete patched[key];
       warnings.push(`"${key}": invalid agent configuration, ignoring. Check your magic-context.jsonc.`);
       continue;
     }
+    const issuePaths = issuePathsByKey.get(key) ?? [];
+    const rawValue = migrated[key];
+    const allNested = issuePaths.length > 0 && issuePaths.every((p) => p.length >= 2) && typeof rawValue === "object" && rawValue !== null && !Array.isArray(rawValue);
+    if (allNested) {
+      let prunedBlock = {
+        ...rawValue
+      };
+      const prunedLeaves = [];
+      for (const p of issuePaths) {
+        const relative = p.slice(1);
+        const result = pruneNestedConfigLeaf(prunedBlock, relative);
+        if (result) {
+          prunedBlock = result.block;
+          prunedLeaves.push(result.removed);
+        }
+      }
+      patched[key] = prunedBlock;
+      warnings.push(`"${key}": invalid nested field(s) ${prunedLeaves.map((l) => `"${l}"`).join(", ")}, using defaults for those.`);
+      continue;
+    }
+    delete patched[key];
     const defaultValue = defaults[key];
     warnings.push(`"${key}": invalid value (${redactConfigValue(rawConfig[key])}), using default ${JSON.stringify(defaultValue)}.`);
   }
@@ -157618,10 +157755,22 @@ function loadPiConfig(opts = {}) {
       return 0;
     return a.scope === "user" ? -1 : 1;
   });
+  const userRaw = mergeFiles.find((f) => f.scope === "user")?.config;
   for (const loaded of mergeFiles) {
     const prefix = loaded.scope === "user" ? "[user config]" : "[project config]";
     warnings.push(...loaded.warnings.map((warning) => `${prefix} ${warning}`));
-    rawConfig = mergeRawConfigs(rawConfig, loaded.config);
+    if (loaded.scope === "project") {
+      const projectRaw = { ...loaded.config };
+      for (const warning of stripUnsafeProjectConfigFields(projectRaw)) {
+        warnings.push(`${prefix} ${warning}`);
+      }
+      rawConfig = mergeRawConfigs(rawConfig, projectRaw);
+      for (const warning of dropInheritedEmbeddingKeyOnRedirect(projectRaw, rawConfig, userRaw)) {
+        warnings.push(`${prefix} ${warning}`);
+      }
+    } else {
+      rawConfig = mergeRawConfigs(rawConfig, loaded.config);
+    }
   }
   const parsed = parsePiConfig(rawConfig);
   warnings.push(...parsed.warnings.map((warning) => `[merged config] ${warning}`));
@@ -157696,10 +157845,22 @@ function loadPiConfigDetailed(opts = {}) {
       return 0;
     return a.scope === "user" ? -1 : 1;
   });
+  const userRaw = mergeFiles.find((f) => f.scope === "user")?.config;
   for (const loaded of mergeFiles) {
     const prefix = loaded.scope === "user" ? "[user config]" : "[project config]";
     warnings.push(...loaded.warnings.map((warning) => `${prefix} ${warning}`));
-    rawConfig = mergeRawConfigs(rawConfig, loaded.config);
+    if (loaded.scope === "project") {
+      const projectRaw = { ...loaded.config };
+      for (const warning of stripUnsafeProjectConfigFields(projectRaw)) {
+        warnings.push(`${prefix} ${warning}`);
+      }
+      rawConfig = mergeRawConfigs(rawConfig, projectRaw);
+      for (const warning of dropInheritedEmbeddingKeyOnRedirect(projectRaw, rawConfig, userRaw)) {
+        warnings.push(`${prefix} ${warning}`);
+      }
+    } else {
+      rawConfig = mergeRawConfigs(rawConfig, loaded.config);
+    }
   }
   const recoveredTopLevelKeys = [];
   const parsed = parsePiConfig(rawConfig, recoveredTopLevelKeys);
@@ -157754,7 +157915,7 @@ function computeNormalizedHash(content) {
 }
 
 // ../plugin/src/features/magic-context/memory/embedding-identity.ts
-function normalizeEndpoint(endpoint) {
+function normalizeEndpoint2(endpoint) {
   return endpoint?.trim().replace(/\/+$/, "") ?? "";
 }
 function getEmbeddingProviderIdentity(config2) {
@@ -157764,7 +157925,7 @@ function getEmbeddingProviderIdentity(config2) {
   const identityInput = config2.provider === "openai-compatible" ? {
     provider: "openai-compatible",
     model: config2.model.trim(),
-    endpoint: normalizeEndpoint(config2.endpoint),
+    endpoint: normalizeEndpoint2(config2.endpoint),
     apiKeyPresent: Boolean(config2.api_key?.trim()),
     inputType: config2.input_type?.trim() || ""
   } : {
@@ -158115,8 +158276,61 @@ class LocalEmbeddingProvider {
   }
 }
 
+// ../plugin/src/features/magic-context/memory/embedding-ssrf.ts
+var METADATA_HOSTNAMES = new Set(["metadata.google.internal", "metadata.goog"]);
+var IPV6_METADATA_HOSTS = new Set(["fd00:ec2::254"]);
+function isLinkLocalIpv4(host) {
+  return /^169\.254\.\d{1,3}\.\d{1,3}$/.test(host);
+}
+function ipv4FromMappedIpv6(host) {
+  const m = /^::ffff:(.+)$/.exec(host);
+  if (!m)
+    return null;
+  const tail = m[1];
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(tail))
+    return tail;
+  const hex3 = /^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(tail);
+  if (hex3) {
+    const hi = Number.parseInt(hex3[1], 16);
+    const lo = Number.parseInt(hex3[2], 16);
+    if (Number.isNaN(hi) || Number.isNaN(lo))
+      return null;
+    return `${hi >> 8 & 255}.${hi & 255}.${lo >> 8 & 255}.${lo & 255}`;
+  }
+  return null;
+}
+function blockedEmbeddingEndpointReason(endpoint) {
+  const trimmed = endpoint.trim();
+  if (trimmed.length === 0)
+    return null;
+  let url2;
+  try {
+    url2 = new URL(trimmed);
+  } catch {
+    return `embedding endpoint is not a valid URL: ${trimmed}`;
+  }
+  const host = url2.hostname.toLowerCase().replace(/^\[/, "").replace(/\]$/, "");
+  if (METADATA_HOSTNAMES.has(host)) {
+    return `embedding endpoint host ${host} is a cloud metadata service (blocked)`;
+  }
+  if (IPV6_METADATA_HOSTS.has(host)) {
+    return `embedding endpoint host ${host} is the AWS IPv6 metadata service (blocked)`;
+  }
+  if (isLinkLocalIpv4(host)) {
+    return `embedding endpoint host ${host} is link-local / cloud metadata (blocked)`;
+  }
+  const mappedV4 = ipv4FromMappedIpv6(host);
+  if (mappedV4 && isLinkLocalIpv4(mappedV4)) {
+    return `embedding endpoint host ${host} (IPv4-mapped ${mappedV4}) is link-local / cloud metadata (blocked)`;
+  }
+  if (host.startsWith("fe80:")) {
+    return `embedding endpoint host ${host} is link-local / cloud metadata (blocked)`;
+  }
+  return null;
+}
+
 // ../plugin/src/features/magic-context/memory/embedding-openai.ts
-function normalizeEndpoint2(endpoint) {
+function normalizeEndpoint3(endpoint) {
   return endpoint?.trim().replace(/\/+$/, "") ?? "";
 }
 var FAILURE_THRESHOLD = 3;
@@ -158137,7 +158351,7 @@ class OpenAICompatibleEmbeddingProvider {
   openLogged = false;
   halfOpenProbeInFlight = false;
   constructor(options) {
-    this.endpoint = normalizeEndpoint2(options.endpoint);
+    this.endpoint = normalizeEndpoint3(options.endpoint);
     this.model = options.model?.trim() ?? "";
     this.apiKey = options.apiKey?.trim() ?? "";
     this.inputType = options.inputType?.trim() ?? "";
@@ -158157,6 +158371,12 @@ class OpenAICompatibleEmbeddingProvider {
       this.initialized = false;
       return false;
     }
+    const blockedReason = blockedEmbeddingEndpointReason(this.endpoint);
+    if (blockedReason) {
+      log(`[magic-context] embedding endpoint blocked: ${blockedReason}`);
+      this.initialized = false;
+      return false;
+    }
     this.initialized = true;
     return true;
   }
@@ -158202,6 +158422,7 @@ class OpenAICompatibleEmbeddingProvider {
           ...this.inputType ? { input_type: this.inputType } : {},
           ...this.truncate ? { truncate: this.truncate } : {}
         }),
+        redirect: "error",
         signal: internalController.signal
       });
       if (!response.ok) {
@@ -158681,11 +158902,15 @@ function resolveEmbeddingConfig(config2) {
   }
   if (config2.provider === "openai-compatible") {
     const apiKey = config2.api_key?.trim();
+    const inputType = config2.input_type?.trim();
+    const truncate = config2.truncate?.trim();
     return {
       provider: "openai-compatible",
       model: config2.model.trim(),
       endpoint: config2.endpoint.trim(),
-      ...apiKey ? { api_key: apiKey } : {}
+      ...apiKey ? { api_key: apiKey } : {},
+      ...inputType ? { input_type: inputType } : {},
+      ...truncate ? { truncate } : {}
     };
   }
   return { provider: "off" };
@@ -158701,7 +158926,9 @@ function createProvider(config2) {
     return new OpenAICompatibleEmbeddingProvider({
       endpoint: config2.endpoint,
       model: config2.model,
-      apiKey: config2.api_key
+      apiKey: config2.api_key,
+      inputType: config2.input_type,
+      truncate: config2.truncate
     });
   }
   return new LocalEmbeddingProvider(config2.model);
@@ -159140,6 +159367,19 @@ function hasGitDir(canonical) {
     return false;
   }
 }
+function normalizeStoredProjectPath(rawOrStored) {
+  if (rawOrStored.startsWith("git:") || rawOrStored.startsWith("dir:")) {
+    return rawOrStored;
+  }
+  try {
+    return resolveProjectIdentity(rawOrStored);
+  } catch {
+    return directoryFallback(rawOrStored);
+  }
+}
+function storedPathBelongsToIdentity(storedProjectPath, projectIdentity) {
+  return storedProjectPath === projectIdentity || normalizeStoredProjectPath(storedProjectPath) === projectIdentity;
+}
 
 // ../plugin/src/plugin/embedding-bootstrap-helpers.ts
 import { createHash as createHash5 } from "node:crypto";
@@ -159147,10 +159387,20 @@ var EMBEDDING_AFFECTING_KEYS = new Set([
   "embedding.api_key",
   "embedding.endpoint",
   "embedding.model",
-  "embedding.provider"
+  "embedding.provider",
+  "embedding.input_type",
+  "embedding.truncate"
 ]);
 var EMBEDDING_AFFECTING_TOP_LEVEL_KEYS = new Set(["embedding", "memory", "experimental"]);
-var EMBEDDING_WARNING_TERMS = ["api_key", "endpoint", "model", "provider", "embedding"];
+var EMBEDDING_WARNING_TERMS = [
+  "api_key",
+  "endpoint",
+  "model",
+  "provider",
+  "embedding",
+  "input_type",
+  "truncate"
+];
 var loggedFailureSignatures = new Map;
 function sha256Prefix2(value, length = 16) {
   return createHash5("sha256").update(value).digest("hex").slice(0, length);
@@ -159586,12 +159836,6 @@ function isCompartmentRow(row) {
   const candidate = row;
   return typeof candidate.id === "number" && typeof candidate.session_id === "string" && typeof candidate.sequence === "number" && typeof candidate.start_message === "number" && typeof candidate.end_message === "number" && typeof candidate.start_message_id === "string" && typeof candidate.end_message_id === "string" && typeof candidate.title === "string" && typeof candidate.content === "string" && isStringOrNullish(candidate.p1) && isStringOrNullish(candidate.p2) && isStringOrNullish(candidate.p3) && isStringOrNullish(candidate.p4) && isNumberOrNullish(candidate.importance) && isStringOrNullish(candidate.episode_type) && isNumberOrNullish(candidate.legacy) && typeof candidate.created_at === "number";
 }
-function isSessionFactRow(row) {
-  if (row === null || typeof row !== "object")
-    return false;
-  const candidate = row;
-  return typeof candidate.id === "number" && typeof candidate.session_id === "string" && typeof candidate.category === "string" && typeof candidate.content === "string" && typeof candidate.created_at === "number" && typeof candidate.updated_at === "number";
-}
 function insertCompartmentRows(db, sessionId, compartments, now) {
   const stmt = getInsertCompartmentStatement(db);
   for (const compartment of compartments) {
@@ -159620,16 +159864,6 @@ function toCompartment(row) {
     createdAt: row.created_at
   };
 }
-function toSessionFact(row) {
-  return {
-    id: row.id,
-    sessionId: row.session_id,
-    category: row.category,
-    content: row.content,
-    createdAt: row.created_at,
-    updatedAt: row.updated_at
-  };
-}
 function getCompartments(db, sessionId) {
   const rows = db.prepare("SELECT * FROM compartments WHERE session_id = ? ORDER BY sequence ASC").all(sessionId).filter(isCompartmentRow);
   return rows.map(toCompartment);
@@ -159650,10 +159884,6 @@ function appendCompartments(db, sessionId, compartments) {
     insertCompartmentRows(db, sessionId, compartments, now);
   })();
 }
-function getSessionFacts(db, sessionId) {
-  const rows = db.prepare("SELECT * FROM session_facts WHERE session_id = ? ORDER BY category ASC, id ASC").all(sessionId).filter(isSessionFactRow);
-  return rows.map(toSessionFact);
-}
 function saveRecompStagingPass(db, sessionId, passNumber, compartments, facts) {
   const now = Date.now();
   db.transaction(() => {
@@ -159697,14 +159927,6 @@ function getRecompStaging(db, sessionId) {
     lastEndMessage: lastEnd
   };
 }
-function invalidateAllMemoryBlockCaches(db) {
-  try {
-    const rows = db.prepare("SELECT session_id FROM session_meta").all();
-    for (const row of rows) {
-      clearCachedM0M1(db, row.session_id);
-    }
-  } catch {}
-}
 function clearRecompStaging(db, sessionId) {
   db.transaction(() => {
     db.prepare("DELETE FROM recomp_compartments WHERE session_id = ?").run(sessionId);
@@ -165394,7 +165616,7 @@ function indexMessagesAfterOrdinal(db, sessionId, messages, lastIndexedOrdinal,
 }
 // ../plugin/src/features/magic-context/project-docs-hash.ts
 import { createHash as createHash6 } from "node:crypto";
-import { readFileSync as readFileSync4, statSync as statSync2 } from "node:fs";
+import { lstatSync, readFileSync as readFileSync4, statSync as statSync2 } from "node:fs";
 import path4 from "node:path";
 var PROJECT_DOC_FILES = ["ARCHITECTURE.md", "STRUCTURE.md"];
 var PROJECT_DOCS_DELIMITER = `
@@ -165402,6 +165624,7 @@ var PROJECT_DOCS_DELIMITER = `
 ---
 
 `;
+var MAX_PROJECT_DOC_BYTES = 256 * 1024;
 var docsCache = new Map;
 function canonicalizeDocContent(raw) {
   return raw.replace(/^\uFEFF/, "").replace(/\r\n/g, `
@@ -165411,9 +165634,10 @@ function canonicalizeDocContent(raw) {
 }
 function fingerprintFile(filePath) {
   try {
-    const stat2 = statSync2(filePath);
+    const stat2 = lstatSync(filePath);
+    const isReadableDoc = stat2.isFile() && stat2.size <= MAX_PROJECT_DOC_BYTES;
     return {
-      exists: stat2.isFile(),
+      exists: isReadableDoc,
       mtimeMs: stat2.mtimeMs,
       size: stat2.size
     };
@@ -165456,6 +165680,16 @@ function readCanonicalPieces(projectDirectory, files) {
     if (!fingerprint?.exists) {
       continue;
     }
+    let safeToRead = false;
+    try {
+      const st = lstatSync(filePath);
+      safeToRead = st.isFile() && st.size <= MAX_PROJECT_DOC_BYTES;
+    } catch {
+      safeToRead = false;
+    }
+    if (!safeToRead) {
+      continue;
+    }
     const canonicalContent = canonicalizeDocContent(readFileSync4(filePath, "utf8"));
     hashPieces.push(`file:${filename}
 ${canonicalContent}`);
@@ -165776,7 +166010,8 @@ function casUpdateJsonArrayColumn(db, sessionId, column, validator, mutate, opti
   }
   for (let attempt = 0;attempt < CAS_RETRY_LIMIT; attempt += 1) {
     const row = db.prepare(`SELECT ${column} FROM session_meta WHERE session_id = ?`).get(sessionId);
-    const currentBlob = row?.[column] ?? "[]";
+    const rawCurrent = row?.[column] ?? null;
+    const currentBlob = rawCurrent ?? "[]";
     const current = parseJsonArray(currentBlob, validator);
     const next = mutate(current);
     if (next === null)
@@ -165784,7 +166019,7 @@ function casUpdateJsonArrayColumn(db, sessionId, column, validator, mutate, opti
     const nextBlob = stableStringify(next);
     if (nextBlob === currentBlob)
       return true;
-    const result = db.prepare(`UPDATE session_meta SET ${column} = ? WHERE session_id = ? AND ${column} = ?`).run(nextBlob, sessionId, currentBlob);
+    const result = db.prepare(`UPDATE session_meta SET ${column} = ? WHERE session_id = ? AND ${column} IS ?`).run(nextBlob, sessionId, rawCurrent);
     if (result.changes > 0)
       return true;
   }
@@ -165913,14 +166148,16 @@ function getHistorianFailureState(db, sessionId) {
   };
 }
 function incrementHistorianFailure(db, sessionId, error51) {
+  let nextCount = 1;
   db.transaction(() => {
     ensureSessionMetaRow(db, sessionId);
     const current = getHistorianFailureState(db, sessionId);
-    const nextCount = current.failureCount + 1;
+    nextCount = current.failureCount + 1;
     db.prepare("UPDATE session_meta SET historian_failure_count = ?, historian_last_error = ?, historian_last_failure_at = ? WHERE session_id = ?").run(nextCount, error51, Date.now(), sessionId);
     const reason = error51.replace(/\s+/g, " ").trim().slice(0, 300);
     sessionLog(sessionId, `historian failure recorded: count=${nextCount} reason="${reason}"`);
   })();
+  return nextCount;
 }
 function clearHistorianFailureState(db, sessionId) {
   db.transaction(() => {
@@ -165989,10 +166226,39 @@ function getStrippedPlaceholderIds(db, sessionId) {
   } catch {}
   return new Set;
 }
-function setStrippedPlaceholderIds(db, sessionId, ids) {
+function applyStrippedPlaceholderDelta(db, sessionId, delta) {
+  const add = delta.add ? [...delta.add] : [];
+  const remove = delta.remove ? [...delta.remove] : [];
+  if (add.length === 0 && remove.length === 0)
+    return true;
   ensureSessionMetaRow(db, sessionId);
-  const json2 = ids.size > 0 ? JSON.stringify([...ids]) : "";
-  db.prepare("UPDATE session_meta SET stripped_placeholder_ids = ? WHERE session_id = ?").run(json2, sessionId);
+  for (let attempt = 0;attempt < CAS_RETRY_LIMIT; attempt += 1) {
+    const row = db.prepare("SELECT stripped_placeholder_ids FROM session_meta WHERE session_id = ?").get(sessionId);
+    const rawStored = row ? row.stripped_placeholder_ids ?? null : null;
+    const current = new Set(parseStrippedBlob(rawStored));
+    for (const id of add)
+      current.add(id);
+    for (const id of remove)
+      current.delete(id);
+    const nextBlob = current.size > 0 ? JSON.stringify([...current]) : "";
+    if (nextBlob === (rawStored ?? ""))
+      return true;
+    const result = db.prepare("UPDATE session_meta SET stripped_placeholder_ids = ? WHERE session_id = ? AND stripped_placeholder_ids IS ?").run(nextBlob, sessionId, rawStored);
+    if (result.changes > 0)
+      return true;
+  }
+  sessionLog(sessionId, `stripped_placeholder_ids CAS: ${CAS_RETRY_LIMIT} retries exhausted`);
+  return false;
+}
+function parseStrippedBlob(raw) {
+  if (!raw || raw.length === 0)
+    return [];
+  try {
+    const parsed = JSON.parse(raw);
+    if (Array.isArray(parsed))
+      return parsed.filter((v) => typeof v === "string");
+  } catch {}
+  return [];
 }
 function isPendingCompactionMarker(value) {
   return typeof value === "object" && value !== null && typeof value.ordinal === "number" && typeof value.endMessageId === "string" && typeof value.publishedAt === "number";
@@ -166897,7 +167163,6 @@ function createCtxMemoryTool(deps) {
           sourceType: dreamerAllowed ? "dreamer" : "agent"
         });
         queueEmbedding({ deps, projectIdentity, memoryId: memory2.id, content });
-        invalidateAllMemoryBlockCaches(deps.db);
         return ok2(`Saved memory [ID: ${memory2.id}] in ${rawCategory}.`);
       }
       if (params.action === "delete") {
@@ -166905,7 +167170,7 @@ function createCtxMemoryTool(deps) {
           return err2("Error: 'id' is required when action is 'delete'.");
         }
         const memory2 = getMemoryById(deps.db, params.id);
-        if (!memory2 || memory2.projectPath !== projectIdentity) {
+        if (!memory2 || !storedPathBelongsToIdentity(memory2.projectPath, projectIdentity)) {
           return err2(`Error: Memory with ID ${params.id} was not found.`);
         }
         deps.db.transaction(() => {
@@ -166934,7 +167199,7 @@ function createCtxMemoryTool(deps) {
           return err2("Error: 'content' is required when action is 'update'.");
         }
         const memory2 = getMemoryById(deps.db, params.id);
-        if (!memory2 || memory2.projectPath !== projectIdentity) {
+        if (!memory2 || !storedPathBelongsToIdentity(memory2.projectPath, projectIdentity)) {
           return err2(`Error: Memory with ID ${params.id} was not found.`);
         }
         const normalizedHash = computeNormalizedHash(content);
@@ -166968,9 +167233,6 @@ function createCtxMemoryTool(deps) {
         if (sourceMemories.length !== ids.length) {
           return err2("Error: One or more source memories were not found.");
         }
-        if (sourceMemories.some((memory2) => memory2.projectPath !== projectIdentity)) {
-          return err2("Error: All memories to merge must belong to the current project.");
-        }
         const requestedCategory = params.category?.trim();
         if (requestedCategory && !isMemoryCategory2(requestedCategory)) {
           return err2(`Error: Unknown memory category '${requestedCategory}'. Valid: ${CATEGORY_PRIORITY.join(", ")}`);
@@ -167029,7 +167291,7 @@ function createCtxMemoryTool(deps) {
             }
             supersededMemory(deps.db, memory2.id, canonicalMemory.id);
             queueMemoryMutation(deps.db, {
-              projectPath: memory2.projectPath,
+              projectPath: normalizeStoredProjectPath(memory2.projectPath),
               mutationType: "superseded",
               targetMemoryId: memory2.id,
               supersededById: canonicalMemory.id
@@ -167037,7 +167299,7 @@ function createCtxMemoryTool(deps) {
           }
           if (canonicalExisting && canonicalContentChanged) {
             queueMemoryMutation(deps.db, {
-              projectPath: canonicalMemory.projectPath,
+              projectPath: normalizeStoredProjectPath(canonicalMemory.projectPath),
               mutationType: "update",
               targetMemoryId: canonicalMemory.id,
               category,
@@ -167059,7 +167321,7 @@ function createCtxMemoryTool(deps) {
           return err2("Error: 'id' is required when action is 'archive'.");
         }
         const memory2 = getMemoryById(deps.db, params.id);
-        if (!memory2 || memory2.projectPath !== projectIdentity) {
+        if (!memory2 || !storedPathBelongsToIdentity(memory2.projectPath, projectIdentity)) {
           return err2(`Error: Memory with ID ${params.id} was not found.`);
         }
         deps.db.transaction(() => {
@@ -167321,7 +167583,7 @@ ${smartNotes.map(formatNoteLine).join(`
 // ../plugin/src/features/magic-context/range-parser.ts
 function parseRangeString(input) {
   const maxRangeElements = 1000;
-  const trimmed = input.trim();
+  const trimmed = input.replace(/§/g, "").trim();
   if (trimmed === "") {
     throw new Error("Range string must not be empty");
   }
@@ -168499,6 +168761,9 @@ function escapeXmlAttr2(s) {
 function escapeXmlContent2(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
+function isTieredRow(c) {
+  return typeof c.p1 === "string" && c.p1.length > 0;
+}
 function tierBody(c, tier2) {
   const tiers = [c.p1, c.p2, c.p3, c.p4];
   const requested = tiers[tier2 - 1];
@@ -168528,12 +168793,13 @@ function renderOneCompartment(c, tier2) {
   const baseAttrs = `start="${c.startMessage}" end="${c.endMessage}" title="${escapeXmlAttr2(c.title)}"`;
   if (tier2 >= 5)
     return "";
-  if (c.legacy === 1) {
-    if (tier2 >= 4)
+  if (c.legacy === 1 || !isTieredRow(c)) {
+    const flat = (c.content ?? "").trim();
+    if (tier2 >= 4 || flat.length === 0)
       return `<compartment ${baseAttrs} />`;
     return [
       `<compartment ${baseAttrs}>`,
-      escapeXmlContent2(legacyBodyForTier(c.content, tier2)),
+      escapeXmlContent2(legacyBodyForTier(flat, tier2)),
       "</compartment>"
     ].join(`
 `);
@@ -169080,6 +169346,7 @@ function createCtxSearchTool(deps) {
       const embeddingEnabled = snapshot ? snapshot.enabled || snapshot.gitCommitEnabled : deps.embeddingEnabled;
       const gitCommitsEnabled = snapshot?.gitCommitEnabled ?? deps.gitCommitsEnabled ?? false;
       const lastCompartmentEnd = getLastCompartmentEndMessage(deps.db, sessionId);
+      const messageOrdinalCutoff = lastCompartmentEnd >= 0 ? lastCompartmentEnd : 0;
       const visibleMemoryIds = getVisibleMemoryIds(deps.db, sessionId);
       const results = await unifiedSearch(deps.db, sessionId, projectIdentity, query, {
         limit: normalizeLimit3(params.limit),
@@ -169090,7 +169357,7 @@ function createCtxSearchTool(deps) {
           return result?.vector ?? null;
         },
         isEmbeddingRuntimeEnabled: () => embeddingEnabled === true,
-        maxMessageOrdinal: lastCompartmentEnd >= 0 ? lastCompartmentEnd : undefined,
+        maxMessageOrdinal: messageOrdinalCutoff,
         gitCommitsEnabled,
         sources: params.sources,
         visibleMemoryIds,