@cortexkit/pi-magic-context 0.45.0 → 0.46.0

package/dist/{index-ttf0cqq8.js → index-sg8zbjs0.js}

@@ -1,7 +1,9 @@
 import {
   modelRefLookupOrder,
-  toolTemplateError
-} from "./index-g0xfx1c2.js";
+  toolTemplateError,
+  DEFAULT_PROTECTED_TOOLS,
+  mergeProtectedTools
+} from "./index-phh7e055.js";
 import {
   getHarness,
   getMagicContextStorageDir,
@@ -10,14 +12,18 @@ import {
 } from "./index-7n8gb6j3.js";
 import {
   estimateTokens
-} from "./index-j0mbc5vj.js";
+} from "./index-266qrgss.js";
 import {
-  shouldEnforcePrivateStoragePermissions
-} from "./index-4d3cba70.js";
+  shouldEnforcePrivateStoragePermissions,
+  ensureStorageDirectorySync,
+  writeStorageFileAsync,
+  writeStorageFileHandleAsync,
+  createStorageFileHandleAsync
+} from "./index-vf38qhee.js";
 
 // ../plugin/src/features/magic-context/memory/embedding-local.ts
-import { chmodSync, mkdirSync, readdirSync, statSync } from "node:fs";
-import { open, stat, unlink, writeFile } from "node:fs/promises";
+import { readdirSync, statSync } from "node:fs";
+import { stat, unlink } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { pathToFileURL } from "node:url";
 import { workerData } from "node:worker_threads";
@@ -5435,7 +5441,7 @@ var MagicContextConfigSchema = object({
   smart_notes: object({
     retina_handoff: boolean2().default(false).describe("When true, dreamer skips smart notes whose surface conditions compiled to retina provider configs at authoring time. Default false keeps both paths active until the retina consumer is deployed.")
   }).default({ retina_handoff: false }).describe("Smart-note ownership transition controls."),
-  cache_ttl: union([string2(), object({ default: string2() }).catchall(string2())]).default("5m").describe(`How long Magic Context assumes the provider's cached prefix stays valid. This is MC's own deferral gate — it does not change the provider's actual cache lifetime. String (e.g. "5m", "1h", "30s") or per-model object ({ default: "5m", "provider/model": "1h", "provider/*": "never" }); keys resolve most-specific first (exact provider/model, bare model ID, shorter dash-prefixes, then the provider/* wildcard). Explicit per-model entries win; otherwise GPT-5.6 and later (including gpt-6*, through any provider prefix) use a built-in 30m lifetime before the object default or 5m fallback. An unset or global "5m" opts into built-in defaults; any other global string is an explicit policy and wins. Policy is frozen per session, including across restarts; a model switch resolves against that frozen policy. /ctx-status shows the effective value and source. OpenAI documents at least 30 minutes since the latest write or reuse: https://developers.openai.com/api/docs/guides/prompt-caching (Cache lifetime and Summary of model differences). Set to "never" to mean MC never assumes expiry (for lanes kept warm externally by a cache-keep tool) — disables the idle-TTL heuristic so MC never initiates a rebuild based on elapsed time. Provider-side extended TTL is a separate request-level concern (cache_control: { ttl } in the request body).`),
+  cache_ttl: union([string2(), object({ default: string2() }).catchall(string2())]).default("5m").describe(`How long Magic Context assumes the provider's cached prefix stays valid. This is MC's own deferral gate — it does not change the provider's actual cache lifetime. String (e.g. "5m", "1h", "30s") or per-model object ({ default: "5m", "provider/model": "1h", "provider/*": "never" }); keys resolve most-specific first (exact provider/model, bare model ID, shorter dash-prefixes, then the provider/* wildcard, then default). User and project settings, including an explicit "5m" or object default, apply on the next pass. Only built-in defaults are frozen per session, including across restarts: when unset, GPT-5.6 and later (including gpt-6*, through any provider prefix) use 30m, other models use 5m. /ctx-status shows the effective TTL and whether it comes from your config or a frozen built-in default. Editing the TTL does not itself rewrite prompt bytes; a lowered TTL rebuilds only after normal idle expiry. OpenAI documents at least 30 minutes since the latest write or reuse: https://developers.openai.com/api/docs/guides/prompt-caching (Cache lifetime and Summary of model differences). Set to "never" to mean MC never assumes expiry (for lanes kept warm externally by a cache-keep tool) — disables the idle-TTL heuristic so MC never initiates a rebuild based on elapsed time. Provider-side extended TTL is a separate request-level concern (cache_control: { ttl } in the request body).`),
   prompt_surface: PromptSurfaceConfigSchema.default({ default: "full" }).describe("Prompt-surface presets: default is full; models use bare model IDs, provider/model, or provider/* routing keys. Guidance and tool-description overrides are user-level only. OpenCode 1.x, Pi, and OMP register tool descriptions once per process (they follow the default preset). OpenCode 2 rewrites the five ctx_* descriptions per request from the draft model."),
   output_reserve: union([
     number2().min(0),
@@ -5473,8 +5479,8 @@ var MagicContextConfigSchema = object({
     mmap_size_mb: number2().min(0).max(8192).default(0).describe("Memory-mapped I/O size in MiB (PRAGMA mmap_size). 0 disables mmap (SQLite default). Raising it can cut read overhead on large DBs at the cost of address space. (min 0, max 8192, default 0)")
   }).default({ cache_size_mb: 64, mmap_size_mb: 0 }).describe("SQLite connection tuning for Magic Context's own context.db. These are per-connection PRAGMAs applied at open; they do not change the schema or what is stored."),
   storage: object({
-    enforce_private_permissions: boolean2().default(true).describe("When true (default), Magic Context creates and re-tightens its storage directories to owner-only 0700 and storage files to owner-only 0600. Set false only for a deliberate trusted-group deployment whose operator manages directory, database, WAL/SHM, cache, and RPC file permissions externally; Magic Context then never chmods or supplies restrictive creation modes. USER-LEVEL ONLY — ignored in project config for security. On Windows, POSIX chmod modes are already meaningless, so this setting is a no-op.")
-  }).default({ enforce_private_permissions: true }).describe("Storage permission policy. The default keeps session content and memories owner-private. Disabling enforcement is for trusted shared-group storage managed externally; every group member able to read the storage can read all stored session content and memories."),
+    enforce_private_permissions: boolean2().default(true).describe("When true (default), Magic Context creates and re-tightens its TypeScript-mode storage directories to owner-only 0700 and storage files to owner-only 0600. Set false only for a deliberate trusted-group deployment whose operator manages those files externally; in TypeScript mode Magic Context then skips its own creation modes and recursive tightening. In Rust transform mode, ck-mc's store library always keeps the shared data directory owner-only 0700, regardless of this setting. USER-LEVEL ONLY — ignored in project config for security. On Windows, POSIX chmod modes are already meaningless, so this setting is a no-op.")
+  }).default({ enforce_private_permissions: true }).describe("Storage permission policy. The default keeps session content and memories owner-private. Disabling enforcement is for trusted shared-group storage managed externally; TypeScript mode follows that policy, but Rust transform mode always keeps its shared data directory owner-only because ck-mc's store library enforces it."),
   embedding: EmbeddingConfigSchema.default({
     provider: "local",
     model: DEFAULT_LOCAL_EMBEDDING_MODEL,
@@ -5498,7 +5504,8 @@ var MagicContextConfigSchema = object({
     overlay: boolean2().default(true).describe("Pi only: show the persistent todo overlay above the editor while tasks are active.")
   }).default({ enabled: false, overlay: true }).describe("Pi-only todowrite tool and overlay controls. Pi registers tools and widgets at extension boot, so changing this after /cd requires /reload or restart."),
   pi: PiConfigSchema.describe("Pi-only child-process extension controls. This setting is user-level only; project configuration cannot choose which extensions a user's subagent children load."),
-  smart_drops: boolean2().default(false).describe("Content-aware reclaim of provably-superseded tool output, layered on the existing execute-pass auto-drop. When on: superseded todowrite (keep newest 1), spent ctx_reduce (keep newest 3), and zero-value meta (bash_status, bash_kill, ctx_note read/dismiss) outputs are dropped; older edits to a file are compressed to a filePath-preserving marker while the newest edit per file stays full. Only acts on passes already busting the cache, so it never originates a cache bust. Honors the protected-tag reserve. Experimental: opt-in, default off until cache stability is proven; when off the wire is byte-identical to the positional-only reclaim. Requires a restart."),
+  smart_drops: unknown().optional().describe("Deprecated: ignored. Content-aware supersession reclaim is always on, only on passes already rebuilding the cache. Remove this key; it no longer does anything.").meta({ deprecated: true }),
+  protected_tools: record(string2(), number2().int().nonnegative()).default({ ...DEFAULT_PROTECTED_TOOLS }).transform((map) => mergeProtectedTools(map)).describe("Keep each tool's newest N still-active results in every automatic drop lane (issue 621). User and project maps merge over defaults {todowrite: 1, ctx_reduce: 3}; 0 turns protection off. Names are case-insensitive and ignore leading mcp_. Holds even at 95% pressure, with no byte cap: large protected outputs can reach refusal sooner. Queued drops, from the agent or historian publication, are held until newer calls displace the result and a later cache-rebuilding pass applies them. The historian's summary is unaffected; the raw result leaves at the next fold. Frozen strips are unaffected. Changes and rotation never originate a bust; dropped results are never restored."),
   caveman_text_compression: object({
     enabled: boolean2().default(false).describe("Apply deterministic caveman-style text compression to old conversation text. Active for primary sessions when enabled; never for subagents. Compresses user/assistant text in oldest-first tiers: ultra (oldest 20%), full, lite, untouched (newest 40%)."),
     min_chars: number2().min(100).max(1e4).default(500).describe("Text parts shorter than this (characters) stay untouched. Min 100, max 10000. Default: 500.")
@@ -5533,6 +5540,7 @@ var MagicContextConfigSchema = object({
   };
 });
 var LIVE_RELOAD_CONFIG_PATHS = [
+  "cache_ttl",
   "mural.model",
   "toast_duration_ms",
   "historian.opencode.model",
@@ -8280,9 +8288,9 @@ async function acquireModelLoadLock(lockPath) {
   const waitStart = Date.now();
   while (true) {
     try {
-      const handle = await open(lockPath, "wx");
+      const handle = await createStorageFileHandleAsync(lockPath, "wx");
       try {
-        await handle.writeFile(`pid=${process.pid} started=${Date.now()}
+        await writeStorageFileHandleAsync(handle, `pid=${process.pid} started=${Date.now()}
 `);
       } catch {}
       await handle.close();
@@ -8318,7 +8326,7 @@ async function acquireModelLoadLock(lockPath) {
 function startLockHeartbeat(lockPath) {
   const HEARTBEAT_MS = Math.floor(STALE_LOCK_MS / 3);
   const timer = setInterval(() => {
-    writeFile(lockPath, `pid=${process.pid} alive=${Date.now()}
+    writeStorageFileAsync(lockPath, `pid=${process.pid} alive=${Date.now()}
 `).catch(() => {});
   }, HEARTBEAT_MS);
   timer.unref?.();
@@ -8681,16 +8689,7 @@ class LocalEmbeddingProvider {
         }
         const modelCacheDir = modelCacheDirForRuntime();
         try {
-          if (shouldEnforcePrivateStoragePermissions()) {
-            mkdirSync(modelCacheDir, { recursive: true, mode: 448 });
-            if (process.platform !== "win32") {
-              try {
-                chmodSync(modelCacheDir, 448);
-              } catch {}
-            }
-          } else {
-            mkdirSync(modelCacheDir, { recursive: true });
-          }
+          ensureStorageDirectorySync(modelCacheDir);
           env.cacheDir = modelCacheDir;
         } catch {
           log("[magic-context] could not create model cache dir, using library default");