@wolfx/opencode-magic-context 0.26.0-patch.1 → 0.27.2-patch.1

package/dist/agents/dreamer.d.ts

@@ -1,2 +1,21 @@
 export declare const DREAMER_AGENT = "dreamer";
+export declare const DREAMER_RETROSPECTIVE_AGENT = "dreamer-retrospective";
+export declare const DREAMER_PRIMER_INVESTIGATOR_AGENT = "dreamer-primer-investigator";
+export declare const DREAMER_MEMORY_MAPPER_AGENT = "dreamer-memory-mapper";
+/** Read-only tool profile shared by the memory-maintenance reader agent.
+ *  No ctx_search (local-source checks only), no write/bash/ctx_memory. */
+export declare const DREAMER_MEMORY_MAPPER_ALLOWED_TOOLS: readonly ["read", "grep", "glob", "aft_outline", "aft_zoom", "aft_search"];
+export declare const DREAMER_CLASSIFIER_AGENT = "dreamer-classifier";
+export declare const DREAMER_DOCS_AGENT = "dreamer-docs";
+/** Codebase-read + doc-write tool profile for the docs maintainer. No memory
+ *  tools (it edits docs, not the memory store). */
+export declare const DREAMER_DOCS_ALLOWED_TOOLS: readonly ["read", "grep", "glob", "bash", "write", "edit", "aft_outline", "aft_zoom", "aft_search"];
+export declare const DREAMER_REVIEWER_AGENT = "dreamer-reviewer";
+/** Tool profile for the base `dreamer` agent, now CURATE-ONLY (memory-pool
+ *  hygiene). Curate edits the memory store through ctx_memory and never reads
+ *  code (a separate verify task owns memory-vs-code correctness), so it needs
+ *  only ctx_memory — not the former bash/write/edit/read/aft/ctx_search/ctx_note
+ *  kitchen sink. Kept on the `dreamer` id so the ctx_memory dreamer-action gate
+ *  (toolContext.agent === DREAMER_AGENT) still recognizes it. */
+export declare const DREAMER_CURATE_ALLOWED_TOOLS: readonly ["ctx_memory"];
 //# sourceMappingURL=dreamer.d.ts.map

package/dist/agents/dreamer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dreamer.d.ts","sourceRoot":"","sources":["../../src/agents/dreamer.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,YAAY,CAAC"}
+{"version":3,"file":"dreamer.d.ts","sourceRoot":"","sources":["../../src/agents/dreamer.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,YAAY,CAAC;AACvC,eAAO,MAAM,2BAA2B,0BAA0B,CAAC;AAOnE,eAAO,MAAM,iCAAiC,gCAAgC,CAAC;AAQ/E,eAAO,MAAM,2BAA2B,0BAA0B,CAAC;AAEnE;0EAC0E;AAC1E,eAAO,MAAM,mCAAmC,4EAOtC,CAAC;AAMX,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAO7D,eAAO,MAAM,kBAAkB,iBAAiB,CAAC;AAEjD;mDACmD;AACnD,eAAO,MAAM,0BAA0B,qGAU7B,CAAC;AAKX,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AAEzD;;;;;iEAKiE;AACjE,eAAO,MAAM,4BAA4B,yBAA0B,CAAC"}

package/dist/agents/hidden-agent-registrations.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Static registration data for one hidden agent. The id / allow-list / step cap
+ * are INLINE LITERALS in {@link buildHiddenAgentRegistrations} rather than
+ * cross-module `const` imports.
+ *
+ * # Why inline
+ *
+ * Belt-and-suspenders, not the load-bearing fix. The load failure was caused by
+ * exporting helpers from the entry module (see the module header) — that is what
+ * the entry-only-`default` rule fixes. Inlining the small id/tool/step values
+ * additionally removes any dependency on cross-module top-level `const` init
+ * timing, so this builder returns a complete, valid registration set the instant
+ * it is called regardless of module-evaluation order. Cheap insurance for a path
+ * that runs once per plugin-instance boot.
+ *
+ * The only value that cannot be inlined is the multi-KB generated system prompt;
+ * it stays a module `var` and is guarded at the call site (skip the agent + log
+ * if undefined, never register a broken/deny-all agent).
+ *
+ * `agent-registration-drift.test.ts` asserts the inline literals here stay
+ * byte-identical to the canonical exported constants so they can't silently
+ * diverge.
+ */
+export interface HiddenAgentRegistration {
+    id: string;
+    prompt: string | undefined;
+    allowedTools: readonly string[];
+    maxSteps: number;
+    overrides?: Record<string, unknown>;
+    /** Drop any user `permission` override (privacy-critical agents only). */
+    lockPermissions?: boolean;
+}
+/**
+ * Hoisted function declaration: returns the four hidden-agent registrations with
+ * INLINE id / allow-list / step-cap literals (see {@link HiddenAgentRegistration}
+ * for why these must not come from module-level `var` consts). Prompts and
+ * computed overrides are passed in by the caller; the historian disallow filter
+ * is applied here against an inline default allow-list.
+ */
+export declare function buildHiddenAgentRegistrations(args: {
+    dreamerPrompt: string | undefined;
+    smartNoteCompilerPrompt?: string | undefined;
+    historianPrompt: string | undefined;
+    historianRecompPrompt?: string | undefined;
+    historianEditorPrompt: string | undefined;
+    sidekickPrompt: string | undefined;
+    dreamerOverrides?: Record<string, unknown>;
+    historianOverrides?: Record<string, unknown>;
+    sidekickOverrides?: Record<string, unknown>;
+    historianDisallowed: readonly string[];
+}): HiddenAgentRegistration[];
+/**
+ * Build a hidden-agent config with a deny-everything-by-default permission
+ * baseline and a hard tool-iteration ceiling. User overrides may lower
+ * `steps`/`maxSteps`, but cannot raise either above the built-in cap.
+ */
+export declare function buildHiddenAgentConfig(prompt: string, allowedTools: readonly string[], maxSteps: number, overrides?: Record<string, unknown>, agentLabel?: string, lockPermissions?: boolean): {
+    steps: number;
+    maxSteps: number;
+    permission: {
+        [x: string]: unknown;
+    };
+    mode: "subagent";
+    hidden: boolean;
+    prompt: string;
+};
+//# sourceMappingURL=hidden-agent-registrations.d.ts.map

package/dist/agents/hidden-agent-registrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hidden-agent-registrations.d.ts","sourceRoot":"","sources":["../../src/agents/hidden-agent-registrations.ts"],"names":[],"mappings":"AAiCA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,uBAAuB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,0EAA0E;IAC1E,eAAe,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAChD,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,uBAAuB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,qBAAqB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C,GAAG,uBAAuB,EAAE,CA0K5B;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAClC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,UAAU,CAAC,EAAE,MAAM,EACnB,eAAe,UAAQ;;;;;;;;;EA+D1B"}

package/dist/agents/historian.d.ts

@@ -1,3 +1,4 @@
 export declare const HISTORIAN_AGENT = "historian";
+export declare const HISTORIAN_RECOMP_AGENT = "historian-recomp";
 export declare const HISTORIAN_EDITOR_AGENT = "historian-editor";
 //# sourceMappingURL=historian.d.ts.map

package/dist/agents/historian.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"historian.d.ts","sourceRoot":"","sources":["../../src/agents/historian.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,cAAc,CAAC;AAC3C,eAAO,MAAM,sBAAsB,qBAAqB,CAAC"}
+{"version":3,"file":"historian.d.ts","sourceRoot":"","sources":["../../src/agents/historian.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,cAAc,CAAC;AAC3C,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AACzD,eAAO,MAAM,sBAAsB,qBAAqB,CAAC"}

package/dist/agents/permissions.d.ts

@@ -80,7 +80,7 @@
  * `explore`/`scout`/`general` agents and by Alfonso for its static
  * agent profiles.
  */
-export declare function buildAllowOnlyPermission(allowedTools: readonly string[]): Record<string, "deny" | "allow">;
+export declare function buildAllowOnlyPermission(allowedTools: readonly string[] | undefined, agentLabel?: string): Record<string, "deny" | "allow">;
 /**
  * Tools the historian + historian-editor + compressor agents need.
  *
@@ -103,49 +103,6 @@ export declare const HISTORIAN_ALLOWED_TOOLS: readonly ["read", "aft_outline", "
  * config schema rejects them at parse time, so this is defense-in-depth).
  */
 export declare function applyDisallowedTools(defaults: readonly string[], disallowed: readonly string[]): readonly string[];
-/**
- * Tools the dreamer agent needs. This is the broadest hidden-agent
- * surface because dreamer's tasks legitimately require local-repo
- * exploration plus external command execution:
- *
- *   - `ctx_memory` / `ctx_search` / `ctx_note` — the canonical memory
- *     CRUD and retrieval path for consolidate / verify / archive /
- *     improve and smart-note dismissal.
- *   - `read` / `grep` / `glob` — the verify task prompt
- *     (`task-prompts.ts`) explicitly tells the model to grep schema
- *     files for default values, read source to confirm claimed
- *     behavior, and use glob for project structure inventory.
- *   - `bash` — required for smart-note condition evaluation (the
- *     prompt explicitly mentions `gh` / `git` / `curl` / file reads),
- *     for the verify task's `git log --oneline --since=...` step, and
- *     for the improve task's `find` / `grep` directory inventory. The
- *     live OpenCode DB shows over 100 `bash` invocations across
- *     consolidate / verify / improve / archive-stale / smart-notes
- *     dreamer child sessions, so removing it would regress real,
- *     documented dreamer behavior.
- *   - `write` / `edit` — the maintain-docs task (`task-prompts.ts`)
- *     explicitly instructs the model to "Write or update using the
- *     Write tool" to keep `ARCHITECTURE.md` / `STRUCTURE.md` at the
- *     project root synchronized. Without these tools the dreamer was
- *     forced to emit docs through `bash` heredocs/`sed` — fragile and
- *     hard to review. Granting `write` + `edit` lets it use the proper
- *     file tools (which back up + validate) instead.
- *   - `aft_search` — primary read-only code search for the verify /
- *     improve / maintain-docs tasks; finds the symbols and call sites a
- *     doc/memory rewrite must describe, more precisely than raw `grep`.
- *
- * Deliberately NOT allowed:
- *   - `task` — no subagent fanout from dreamer
- *   - `webfetch` / `websearch` — out of scope; smart-note URL fetches
- *     go through `bash` + `curl` instead
- *
- * Note: `write` / `edit` grant general file-write capability (the
- * permission gate is tool-level, not path-level). Dreamer is a trusted
- * hidden agent whose prompts scope writes to docs + memory; the
- * task-prompts still say "Do not commit changes," so it edits the
- * working tree but never commits.
- */
-export declare const DREAMER_ALLOWED_TOOLS: readonly ["read", "grep", "glob", "bash", "write", "edit", "aft_outline", "aft_zoom", "aft_search", "ctx_memory", "ctx_search", "ctx_note"];
 /**
  * Tools the sidekick agent needs. Sidekick is a read-only memory
  * retriever for `/ctx-aug` — it queries the project's memory store
@@ -159,5 +116,19 @@ export declare const DREAMER_ALLOWED_TOOLS: readonly ["read", "grep", "glob", "b
  *
  * Still denied: spawning subagents, edits, bash, web fetches.
  */
+export declare const DREAMER_RETROSPECTIVE_ALLOWED_TOOLS: readonly ["ctx_search"];
+/**
+ * The refresh-primers code investigator: read + navigate + search the CURRENT
+ * source to answer a primer question. NO write/edit/bash (could corrupt user
+ * source) and NO ctx_memory/ctx_note (a ctx_memory mutation bumps the project
+ * memory epoch → busts m[0], breaking the primers cache-neutral contract).
+ */
+export declare const DREAMER_PRIMER_INVESTIGATOR_ALLOWED_TOOLS: readonly ["read", "grep", "glob", "aft_outline", "aft_zoom", "aft_search", "ctx_search"];
+/**
+ * The smart-note compiler consumes untrusted note text and emits code that will
+ * later run in the QuickJS sandbox. It must not have ambient tools: all I/O is
+ * performed only when the compiled check runs through the host capability API.
+ */
+export declare const SMART_NOTE_COMPILER_ALLOWED_TOOLS: readonly [];
 export declare const SIDEKICK_ALLOWED_TOOLS: readonly ["ctx_search", "aft_outline", "aft_zoom"];
 //# sourceMappingURL=permissions.d.ts.map

package/dist/agents/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/agents/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AAEH;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACpC,YAAY,EAAE,SAAS,MAAM,EAAE,GAChC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAMlC;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB,4DAA6D,CAAC;AAElG;;;;GAIG;AACH,wBAAgB,oBAAoB,CAChC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,UAAU,EAAE,SAAS,MAAM,EAAE,GAC9B,SAAS,MAAM,EAAE,CAGnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,eAAO,MAAM,qBAAqB,6IAaxB,CAAC;AAEX;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB,oDAAqD,CAAC"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/agents/permissions.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AAEH;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACpC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAC3C,UAAU,CAAC,EAAE,MAAM,GACpB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAoBlC;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB,4DAA6D,CAAC;AAElG;;;;GAIG;AACH,wBAAgB,oBAAoB,CAChC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,UAAU,EAAE,SAAS,MAAM,EAAE,GAC9B,SAAS,MAAM,EAAE,CAGnB;AAQD;;;;;;;;;;;;GAYG;AAEH,eAAO,MAAM,mCAAmC,yBAA0B,CAAC;AAE3E;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC,0FAQ5C,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,aAAc,CAAC;AAE7D,eAAO,MAAM,sBAAsB,oDAAqD,CAAC"}

package/dist/agents/smart-note-compiler.d.ts

@@ -0,0 +1,2 @@
+export declare const SMART_NOTE_COMPILER_AGENT = "smart-note-compiler";
+//# sourceMappingURL=smart-note-compiler.d.ts.map

package/dist/agents/smart-note-compiler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"smart-note-compiler.d.ts","sourceRoot":"","sources":["../../src/agents/smart-note-compiler.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,yBAAyB,wBAAwB,CAAC"}

package/dist/config/index.d.ts

@@ -9,7 +9,7 @@ export interface MagicContextPluginConfig extends MagicContextConfig {
         subtask?: boolean;
     }>;
 }
-export type LoadOutcome = "ok" | "project-file-parse-error" | "project-file-io-error" | "schema-recovery" | "substitution-failure";
+export type LoadOutcome = "ok" | "project-file-parse-error" | "project-file-io-error" | "legacy-config-unmigrated" | "schema-recovery" | "substitution-failure";
 export interface LoadResultDetailed {
     config: MagicContextPluginConfig & {
         configWarnings?: string[];

package/dist/config/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,KAAK,kBAAkB,EAA4B,MAAM,wBAAwB,CAAC;AAG3F,MAAM,WAAW,wBAAyB,SAAQ,kBAAkB;IAChE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CACZ,MAAM,EACN;QACI,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,OAAO,CAAC;KACrB,CACJ,CAAC;CACL;AAmBD,MAAM,MAAM,WAAW,GACjB,IAAI,GACJ,0BAA0B,GAC1B,uBAAuB,GACvB,iBAAiB,GACjB,sBAAsB,CAAC;AAE7B,MAAM,WAAW,kBAAkB;IAC/B,MAAM,EAAE,wBAAwB,GAAG;QAAE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACjE,WAAW,EAAE,WAAW,CAAC;IACzB,OAAO,EAAE;QACL,UAAU,EAAE,WAAW,CAAC;QACxB,aAAa,EAAE,WAAW,CAAC;KAC9B,CAAC;IACF,oBAAoB,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9F,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACnC;AAkTD,wBAAgB,gBAAgB,CAC5B,SAAS,EAAE,MAAM,GAClB,wBAAwB,GAAG;IAAE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CA8E1D;AAgDD,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,CAsE9E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,KAAK,kBAAkB,EAA4B,MAAM,wBAAwB,CAAC;AAG3F,MAAM,WAAW,wBAAyB,SAAQ,kBAAkB;IAChE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CACZ,MAAM,EACN;QACI,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,OAAO,CAAC;KACrB,CACJ,CAAC;CACL;AAsCD,MAAM,MAAM,WAAW,GACjB,IAAI,GACJ,0BAA0B,GAC1B,uBAAuB,GACvB,0BAA0B,GAC1B,iBAAiB,GACjB,sBAAsB,CAAC;AAE7B,MAAM,WAAW,kBAAkB;IAC/B,MAAM,EAAE,wBAAwB,GAAG;QAAE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACjE,WAAW,EAAE,WAAW,CAAC;IACzB,OAAO,EAAE;QACL,UAAU,EAAE,WAAW,CAAC;QACxB,aAAa,EAAE,WAAW,CAAC;KAC9B,CAAC;IACF,oBAAoB,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9F,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACnC;AAiSD,wBAAgB,gBAAgB,CAC5B,SAAS,EAAE,MAAM,GAClB,wBAAwB,GAAG;IAAE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAY1D;AAiDD,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,CAiI9E"}

package/dist/config/migrate-config-location.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Config-LOCATION migration: move Magic Context config from the per-harness
+ * legacy locations to one shared CortexKit location, mirroring AFT's proven
+ * move-and-marker design (NOT copy-in-place, which is a silent stale-edit trap).
+ *
+ * Legacy (read by old builds):
+ *   user:    ~/.config/opencode/magic-context.{jsonc,json}
+ *            ~/.pi/agent/magic-context.{jsonc,json}
+ *   project: <root>/magic-context.{jsonc,json}            (bare root)
+ *            <root>/.opencode/magic-context.{jsonc,json}
+ *            <root>/.pi/magic-context.{jsonc,json}
+ *
+ * Target (the only thing new builds read — HARD CUTOVER, harness-agnostic):
+ *   user:    ~/.config/cortexkit/magic-context.jsonc
+ *   project: <root>/.cortexkit/magic-context.jsonc
+ *
+ * The migrator runs at plugin init before the loader. Idempotency comes from
+ * the legacy file being renamed away (not from a sentinel): once a source is
+ * moved aside to `<name>.MOVED_READPLEASE`, later runs find no legacy source
+ * and no-op. The marker is a pure human breadcrumb — the loader never reads it.
+ *
+ * NB: this is config-LOCATION migration. It is unrelated to the schema/key
+ * migrations (migrate-dreamer-v2, migrate-experimental) that rewrite keys
+ * INSIDE an already-located config file.
+ */
+export interface LegacyConfigSource {
+    path: string;
+    label: string;
+}
+export interface ConfigMigrationLogger {
+    warn?: (msg: string) => void;
+    info?: (msg: string) => void;
+    log?: (msg: string) => void;
+}
+export interface ConfigFileMigrationOptions {
+    scope: "user" | "project";
+    targetPath: string;
+    legacySources: readonly LegacyConfigSource[];
+    logger?: ConfigMigrationLogger;
+}
+export interface ConfigFileMigrationResult {
+    migrated: boolean;
+    conflict: boolean;
+    sourcePath?: string;
+    targetPath: string;
+    warnings: string[];
+}
+/** `~/.config/cortexkit/magic-context` (no extension — for detectConfigFile). */
+export declare function cortexKitUserConfigBasePath(): string;
+/** `<root>/.cortexkit/magic-context` (no extension — for detectConfigFile). */
+export declare function cortexKitProjectConfigBasePath(directory: string): string;
+/** The migration target: always normalized to `.jsonc`. */
+export declare function resolveCortexKitUserConfigPath(): string;
+/** The migration target: always normalized to `.jsonc`. */
+export declare function resolveCortexKitProjectConfigPath(directory: string): string;
+/**
+ * The legacy config locations to migrate FROM, by scope. Each base produces a
+ * `.jsonc` and a `.json` candidate; whichever exists migrates, target is always
+ * `.jsonc`. The bare-root project source (`<root>/magic-context.*`) is unique to
+ * Magic Context (AFT never had it) — omitting it would orphan repo-root configs.
+ *
+ * Project sources are filtered against the user-scope path set: when a session's
+ * project directory IS the user config home (e.g. opencode opened in
+ * `~/.config/cortexkit`), the bare-root project source `<root>/magic-context.jsonc`
+ * resolves to the USER config path. Without this guard the project migration
+ * would "migrate" the user's own config into `<root>/.cortexkit/` and rename the
+ * original aside, leaving the user on schema defaults (the config-eats-itself
+ * bug). A project migration must never touch a user-scope file.
+ */
+export declare function resolveLegacyConfigSources(directory: string): {
+    user: LegacyConfigSource[];
+    project: LegacyConfigSource[];
+};
+export type ConfigHarness = "opencode" | "pi";
+/**
+ * Legacy sources owned by ONE harness, most-specific first. Used by the loaders
+ * as a NON-DESTRUCTIVE read fallback: when the shared CortexKit base is absent
+ * (migration not yet run, or refused because OpenCode and Pi legacy configs
+ * differ), the running harness reads its OWN legacy config rather than silently
+ * falling back to schema defaults — which would re-enable features the legacy
+ * config disabled. Each harness reads only its own files, so a differing pair
+ * stays correct per-harness until the user consolidates. The bare project-root
+ * `<root>/magic-context.*` was OpenCode-only historically.
+ */
+export declare function resolveLegacyConfigSourcesForHarness(directory: string, harness: ConfigHarness): {
+    user: LegacyConfigSource[];
+    project: LegacyConfigSource[];
+};
+export declare function migrateConfigFile(opts: ConfigFileMigrationOptions): ConfigFileMigrationResult;
+/**
+ * Run both the user-scope and project-scope config-location migrations for a
+ * project directory. Idempotent and cheap when nothing to migrate (a few
+ * existsSync calls). Call once at plugin init, before loading config. Returns
+ * any warnings (conflicts / partial failures) for the host to surface + log.
+ */
+export declare function migrateMagicContextConfigLocations(directory: string, logger?: ConfigMigrationLogger): string[];
+//# sourceMappingURL=migrate-config-location.d.ts.map

package/dist/config/migrate-config-location.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-config-location.d.ts","sourceRoot":"","sources":["../../src/config/migrate-config-location.ts"],"names":[],"mappings":"AAeA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,WAAW,kBAAkB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IAClC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,0BAA0B;IACvC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC7C,MAAM,CAAC,EAAE,qBAAqB,CAAC;CAClC;AAED,MAAM,WAAW,yBAAyB;IACtC,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACtB;AAoBD,iFAAiF;AACjF,wBAAgB,2BAA2B,IAAI,MAAM,CAEpD;AAED,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAExE;AAED,2DAA2D;AAC3D,wBAAgB,8BAA8B,IAAI,MAAM,CAEvD;AAED,2DAA2D;AAC3D,wBAAgB,iCAAiC,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE3E;AA4BD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG;IAC3D,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAC3B,OAAO,EAAE,kBAAkB,EAAE,CAAC;CACjC,CAsBA;AAED,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,IAAI,CAAC;AAE9C;;;;;;;;;GASG;AACH,wBAAgB,oCAAoC,CAChD,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,GACvB;IAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAAC,OAAO,EAAE,kBAAkB,EAAE,CAAA;CAAE,CA0B/D;AAmSD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,0BAA0B,GAAG,yBAAyB,CA0F7F;AAED;;;;;GAKG;AACH,wBAAgB,kCAAkC,CAC9C,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,qBAAqB,GAC/B,MAAM,EAAE,CA6BV"}

package/dist/config/migrate-dreamer-v2.d.ts

@@ -0,0 +1,37 @@
+/**
+ * In-memory migration of the legacy v1 dreamer config shape to the Dreamer v2
+ * per-task shape (shared OpenCode + Pi; runs on every config load, like
+ * migrate-experimental). Doctor performs the on-disk equivalent.
+ *
+ * v1 shape (any subset):
+ *   dreamer: {
+ *     schedule: "02:00-06:00",            // a TIME WINDOW
+ *     tasks: ["consolidate","verify"],    // an ARRAY of agentic task names
+ *     task_timeout_minutes: 20,
+ *     max_runtime_minutes: 120,
+ *     user_memories: { enabled, promotion_threshold },
+ *     pin_key_files: { enabled, token_budget, min_reads },
+ *   }
+ *
+ * v2 shape:
+ *   dreamer: {
+ *     tasks: { <task>: { schedule: "<cron>"|"", model?, timeout_minutes?, ... } }
+ *   }
+ *
+ * Rules (see dreamer-v2-AB-spec.md):
+ *  - Base cron derived from the WINDOW START: "02:00-06:00" → "0 2 * * *".
+ *  - Legacy `tasks` array PRESENT → it is the user's deliberate selection: each
+ *    LISTED agentic task gets the base cron; each OMITTED canonical task gets ""
+ *    (disabled). Built-in defaults are used ONLY when `tasks` is absent.
+ *  - user_memories.enabled false → review-user-memories "" ; true → base cron
+ *    (promotion_threshold carried). A legacy pin_key_files block is dropped
+ *    (key-files pinning moved out of Magic Context).
+ *  - classify-memories is NEW in v2 and defaults ON daily at 06:00, unless the
+ *    whole dreamer block is disabled.
+ *  - evaluate-smart-notes → base cron (it always ran on pending notes).
+ *  - task_timeout_minutes → each task's timeout_minutes default; max_runtime_minutes dropped.
+ *  - Object-shaped A+B configs carrying retired memory task keys are folded into
+ *    verify + curate before schema parsing strips unknown keys.
+ */
+export declare function migrateDreamerV2(rawConfig: Record<string, unknown>, warnings: string[]): Record<string, unknown>;
+//# sourceMappingURL=migrate-dreamer-v2.d.ts.map

package/dist/config/migrate-dreamer-v2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-dreamer-v2.d.ts","sourceRoot":"","sources":["../../src/config/migrate-dreamer-v2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAsGH,wBAAgB,gBAAgB,CAC5B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,QAAQ,EAAE,MAAM,EAAE,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoMzB"}

package/dist/config/migrate-experimental.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate-experimental.d.ts","sourceRoot":"","sources":["../../src/config/migrate-experimental.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,yBAAyB,CACrC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,QAAQ,EAAE,MAAM,EAAE,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkIzB"}
+{"version":3,"file":"migrate-experimental.d.ts","sourceRoot":"","sources":["../../src/config/migrate-experimental.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,yBAAyB,CACrC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,QAAQ,EAAE,MAAM,EAAE,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoIzB"}

package/dist/config/project-security.d.ts

@@ -22,6 +22,9 @@
  *    process). A cloned repo could set a huge value to exhaust host memory /
  *    address space — a resource-exhaustion vector with no legitimate per-repo
  *    use. Honor user-level config only.
+ *  - `embedding.endpoint` / `embedding.provider` — a repo must not choose
+ *    where private memory/search/commit text is embedded. User-level config is
+ *    the trust boundary for embedding destinations.
  *  - hidden-agent `prompt`/`permission`/`tools` — a repo must not reprogram or
  *    re-permission the historian/dreamer/sidekick.
  */

package/dist/config/project-security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-security.d.ts","sourceRoot":"","sources":["../../src/config/project-security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAiCH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAqC5F;AA2BD,wBAAgB,mCAAmC,CAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAClC,MAAM,EAAE,CAsCV"}
+{"version":3,"file":"project-security.d.ts","sourceRoot":"","sources":["../../src/config/project-security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAkCH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAsD5F;AA2BD,wBAAgB,mCAAmC,CAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAClC,MAAM,EAAE,CAsCV"}

package/dist/config/prune-config-leaf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prune-config-leaf.d.ts","sourceRoot":"","sources":["../../src/config/prune-config-leaf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACjC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,YAAY,EAAE,SAAS,WAAW,EAAE,GACrC;IAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAqB5D"}
+{"version":3,"file":"prune-config-leaf.d.ts","sourceRoot":"","sources":["../../src/config/prune-config-leaf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACjC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,YAAY,EAAE,SAAS,WAAW,EAAE,GACrC;IAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAqC5D"}