@cortexkit/pi-magic-context 0.45.0 → 0.46.1

package/dist/{index-ttf0cqq8.js → index-r01b1b78.js}

@@ -1,7 +1,9 @@
 import {
   modelRefLookupOrder,
-  toolTemplateError
-} from "./index-g0xfx1c2.js";
+  toolTemplateError,
+  DEFAULT_PROTECTED_TOOLS,
+  mergeProtectedTools
+} from "./index-phh7e055.js";
 import {
   getHarness,
   getMagicContextStorageDir,
@@ -10,14 +12,18 @@ import {
 } from "./index-7n8gb6j3.js";
 import {
   estimateTokens
-} from "./index-j0mbc5vj.js";
+} from "./index-266qrgss.js";
 import {
-  shouldEnforcePrivateStoragePermissions
-} from "./index-4d3cba70.js";
+  shouldEnforcePrivateStoragePermissions,
+  ensureStorageDirectorySync,
+  writeStorageFileAsync,
+  writeStorageFileHandleAsync,
+  createStorageFileHandleAsync
+} from "./index-vf38qhee.js";
 
 // ../plugin/src/features/magic-context/memory/embedding-local.ts
-import { chmodSync, mkdirSync, readdirSync, statSync } from "node:fs";
-import { open, stat, unlink, writeFile } from "node:fs/promises";
+import { readdirSync, statSync } from "node:fs";
+import { stat, unlink } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { pathToFileURL } from "node:url";
 import { workerData } from "node:worker_threads";
@@ -5287,6 +5293,7 @@ var AgentMetadataSchema = AgentOverrideConfigSchema.pick({
   maxTokens: true
 });
 var DreamerConfigSchema = AgentMetadataSchema.extend({
+  disable: boolean2().optional().describe("Disable this agent"),
   runner: _enum(["broca", "host"]).optional().describe(`Which side runs the dreamer completions the Rust module routes (classify-memories) in Rust transform mode: "host" runs them on this process's carrier, "broca" routes them to the Broca module. When unset, historian.runner applies, and when that is unset too the harness decides the same way it does for the historian. User-level config only.`),
   opencode: DreamerOpenCodeHarnessBlockSchema.optional(),
   pi: DreamerPiHarnessBlockSchema.optional(),
@@ -5435,7 +5442,7 @@ var MagicContextConfigSchema = object({
   smart_notes: object({
     retina_handoff: boolean2().default(false).describe("When true, dreamer skips smart notes whose surface conditions compiled to retina provider configs at authoring time. Default false keeps both paths active until the retina consumer is deployed.")
   }).default({ retina_handoff: false }).describe("Smart-note ownership transition controls."),
-  cache_ttl: union([string2(), object({ default: string2() }).catchall(string2())]).default("5m").describe(`How long Magic Context assumes the provider's cached prefix stays valid. This is MC's own deferral gate — it does not change the provider's actual cache lifetime. String (e.g. "5m", "1h", "30s") or per-model object ({ default: "5m", "provider/model": "1h", "provider/*": "never" }); keys resolve most-specific first (exact provider/model, bare model ID, shorter dash-prefixes, then the provider/* wildcard). Explicit per-model entries win; otherwise GPT-5.6 and later (including gpt-6*, through any provider prefix) use a built-in 30m lifetime before the object default or 5m fallback. An unset or global "5m" opts into built-in defaults; any other global string is an explicit policy and wins. Policy is frozen per session, including across restarts; a model switch resolves against that frozen policy. /ctx-status shows the effective value and source. OpenAI documents at least 30 minutes since the latest write or reuse: https://developers.openai.com/api/docs/guides/prompt-caching (Cache lifetime and Summary of model differences). Set to "never" to mean MC never assumes expiry (for lanes kept warm externally by a cache-keep tool) — disables the idle-TTL heuristic so MC never initiates a rebuild based on elapsed time. Provider-side extended TTL is a separate request-level concern (cache_control: { ttl } in the request body).`),
+  cache_ttl: union([string2(), object({ default: string2() }).catchall(string2())]).default("5m").describe(`How long Magic Context assumes the provider's cached prefix stays valid. This is MC's own deferral gate — it does not change the provider's actual cache lifetime. String (e.g. "5m", "1h", "30s") or per-model object ({ default: "5m", "provider/model": "1h", "provider/*": "never" }); keys resolve most-specific first (exact provider/model, bare model ID, shorter dash-prefixes, then the provider/* wildcard, then default). User and project settings, including an explicit "5m" or object default, apply on the next pass. Only built-in defaults are frozen per session, including across restarts: when unset, GPT-5.6 and later (including gpt-6*, through any provider prefix) use 30m, other models use 5m. /ctx-status shows the effective TTL and whether it comes from your config or a frozen built-in default. Editing the TTL does not itself rewrite prompt bytes; a lowered TTL rebuilds only after normal idle expiry. OpenAI documents at least 30 minutes since the latest write or reuse: https://developers.openai.com/api/docs/guides/prompt-caching (Cache lifetime and Summary of model differences). Set to "never" to mean MC never assumes expiry (for lanes kept warm externally by a cache-keep tool) — disables the idle-TTL heuristic so MC never initiates a rebuild based on elapsed time. Provider-side extended TTL is a separate request-level concern (cache_control: { ttl } in the request body).`),
   prompt_surface: PromptSurfaceConfigSchema.default({ default: "full" }).describe("Prompt-surface presets: default is full; models use bare model IDs, provider/model, or provider/* routing keys. Guidance and tool-description overrides are user-level only. OpenCode 1.x, Pi, and OMP register tool descriptions once per process (they follow the default preset). OpenCode 2 rewrites the five ctx_* descriptions per request from the draft model."),
   output_reserve: union([
     number2().min(0),
@@ -5473,8 +5480,8 @@ var MagicContextConfigSchema = object({
     mmap_size_mb: number2().min(0).max(8192).default(0).describe("Memory-mapped I/O size in MiB (PRAGMA mmap_size). 0 disables mmap (SQLite default). Raising it can cut read overhead on large DBs at the cost of address space. (min 0, max 8192, default 0)")
   }).default({ cache_size_mb: 64, mmap_size_mb: 0 }).describe("SQLite connection tuning for Magic Context's own context.db. These are per-connection PRAGMAs applied at open; they do not change the schema or what is stored."),
   storage: object({
-    enforce_private_permissions: boolean2().default(true).describe("When true (default), Magic Context creates and re-tightens its storage directories to owner-only 0700 and storage files to owner-only 0600. Set false only for a deliberate trusted-group deployment whose operator manages directory, database, WAL/SHM, cache, and RPC file permissions externally; Magic Context then never chmods or supplies restrictive creation modes. USER-LEVEL ONLY — ignored in project config for security. On Windows, POSIX chmod modes are already meaningless, so this setting is a no-op.")
-  }).default({ enforce_private_permissions: true }).describe("Storage permission policy. The default keeps session content and memories owner-private. Disabling enforcement is for trusted shared-group storage managed externally; every group member able to read the storage can read all stored session content and memories."),
+    enforce_private_permissions: boolean2().default(true).describe("When true (default), Magic Context creates and re-tightens its TypeScript-mode storage directories to owner-only 0700 and storage files to owner-only 0600. Set false only for a deliberate trusted-group deployment whose operator manages those files externally; in TypeScript mode Magic Context then skips its own creation modes and recursive tightening. In Rust transform mode, ck-mc's store library always keeps the shared data directory owner-only 0700, regardless of this setting. USER-LEVEL ONLY — ignored in project config for security. On Windows, POSIX chmod modes are already meaningless, so this setting is a no-op.")
+  }).default({ enforce_private_permissions: true }).describe("Storage permission policy. The default keeps session content and memories owner-private. Disabling enforcement is for trusted shared-group storage managed externally; TypeScript mode follows that policy, but Rust transform mode always keeps its shared data directory owner-only because ck-mc's store library enforces it."),
   embedding: EmbeddingConfigSchema.default({
     provider: "local",
     model: DEFAULT_LOCAL_EMBEDDING_MODEL,
@@ -5498,7 +5505,8 @@ var MagicContextConfigSchema = object({
     overlay: boolean2().default(true).describe("Pi only: show the persistent todo overlay above the editor while tasks are active.")
   }).default({ enabled: false, overlay: true }).describe("Pi-only todowrite tool and overlay controls. Pi registers tools and widgets at extension boot, so changing this after /cd requires /reload or restart."),
   pi: PiConfigSchema.describe("Pi-only child-process extension controls. This setting is user-level only; project configuration cannot choose which extensions a user's subagent children load."),
-  smart_drops: boolean2().default(false).describe("Content-aware reclaim of provably-superseded tool output, layered on the existing execute-pass auto-drop. When on: superseded todowrite (keep newest 1), spent ctx_reduce (keep newest 3), and zero-value meta (bash_status, bash_kill, ctx_note read/dismiss) outputs are dropped; older edits to a file are compressed to a filePath-preserving marker while the newest edit per file stays full. Only acts on passes already busting the cache, so it never originates a cache bust. Honors the protected-tag reserve. Experimental: opt-in, default off until cache stability is proven; when off the wire is byte-identical to the positional-only reclaim. Requires a restart."),
+  smart_drops: unknown().optional().describe("Deprecated: ignored. Content-aware supersession reclaim is always on, only on passes already rebuilding the cache. Remove this key; it no longer does anything.").meta({ deprecated: true }),
+  protected_tools: record(string2(), number2().int().nonnegative()).default({ ...DEFAULT_PROTECTED_TOOLS }).transform((map) => mergeProtectedTools(map)).describe("Keep each tool's newest N still-active results in every automatic drop lane (issue 621). User and project maps merge over defaults {todowrite: 1, ctx_reduce: 3}; 0 turns protection off. Names are case-insensitive and ignore leading mcp_. Holds even at 95% pressure, with no byte cap: large protected outputs can reach refusal sooner. Queued drops, from the agent or historian publication, are held until newer calls displace the result and a later cache-rebuilding pass applies them. The historian's summary is unaffected; the raw result leaves at the next fold. Frozen strips are unaffected. Changes and rotation never originate a bust; dropped results are never restored."),
   caveman_text_compression: object({
     enabled: boolean2().default(false).describe("Apply deterministic caveman-style text compression to old conversation text. Active for primary sessions when enabled; never for subagents. Compresses user/assistant text in oldest-first tiers: ultra (oldest 20%), full, lite, untouched (newest 40%)."),
     min_chars: number2().min(100).max(1e4).default(500).describe("Text parts shorter than this (characters) stay untouched. Min 100, max 10000. Default: 500.")
@@ -5533,6 +5541,7 @@ var MagicContextConfigSchema = object({
   };
 });
 var LIVE_RELOAD_CONFIG_PATHS = [
+  "cache_ttl",
   "mural.model",
   "toast_duration_ms",
   "historian.opencode.model",
@@ -5551,6 +5560,7 @@ var LIVE_RELOAD_CONFIG_PATHS = [
   "commit_cluster_trigger.enabled",
   "commit_cluster_trigger.min_clusters",
   "memory.auto_promote",
+  "dreamer.disable",
   "dreamer.maxTokens",
   "dreamer.opencode.model",
   "dreamer.opencode.fallback_models",
@@ -8280,9 +8290,9 @@ async function acquireModelLoadLock(lockPath) {
   const waitStart = Date.now();
   while (true) {
     try {
-      const handle = await open(lockPath, "wx");
+      const handle = await createStorageFileHandleAsync(lockPath, "wx");
       try {
-        await handle.writeFile(`pid=${process.pid} started=${Date.now()}
+        await writeStorageFileHandleAsync(handle, `pid=${process.pid} started=${Date.now()}
 `);
       } catch {}
       await handle.close();
@@ -8318,7 +8328,7 @@ async function acquireModelLoadLock(lockPath) {
 function startLockHeartbeat(lockPath) {
   const HEARTBEAT_MS = Math.floor(STALE_LOCK_MS / 3);
   const timer = setInterval(() => {
-    writeFile(lockPath, `pid=${process.pid} alive=${Date.now()}
+    writeStorageFileAsync(lockPath, `pid=${process.pid} alive=${Date.now()}
 `).catch(() => {});
   }, HEARTBEAT_MS);
   timer.unref?.();
@@ -8681,16 +8691,7 @@ class LocalEmbeddingProvider {
         }
         const modelCacheDir = modelCacheDirForRuntime();
         try {
-          if (shouldEnforcePrivateStoragePermissions()) {
-            mkdirSync(modelCacheDir, { recursive: true, mode: 448 });
-            if (process.platform !== "win32") {
-              try {
-                chmodSync(modelCacheDir, 448);
-              } catch {}
-            }
-          } else {
-            mkdirSync(modelCacheDir, { recursive: true });
-          }
+          ensureStorageDirectorySync(modelCacheDir);
           env.cacheDir = modelCacheDir;
         } catch {
           log("[magic-context] could not create model cache dir, using library default");