fix: CWD-independent test DB-isolation backstop (prevents live-DB migration)

ROOT CAUSE of the live-DB v41 fail-close incident (a re-run of the 2026-06-01
v26 incident): the MAGIC_CONTEXT_TEST_DATA_DIR isolation that keeps `bun test`
off the user's REAL shared DB (~/.local/share/cortexkit/magic-context/context.db)
is set by test-preload.ts, wired ONLY through each package's bunfig.toml
`[test] preload`. Two CWD holes:
  - the monorepo ROOT bunfig.toml had no `[test] preload`, so a bare `bun test`
    from the repo/worktree root recursively ran every package's *.test.ts with
    NO isolation;
  - packages/cli had no bunfig.toml at all.
A D19 mason worktree at LATEST_SUPPORTED_VERSION=41 ran `bun test`; an unisolated
run called bare openDatabase() → resolved to the real DB → ran migration v41 on
it → the user's v40 binaries fail-closed on restart. (v41 only ensureColumn'd one
nullable TEXT column, so the data was safe; user rolled the migrations row back.)

CLASS-ELIMINATION FIX (not a per-CWD patch): Bun sets NODE_ENV=test for EVERY
`bun test` regardless of CWD/bunfig (verified), and it is never "test" in the
plugin runtime. resolveDatabasePath() now has a backstop: when NODE_ENV=test and
neither MAGIC_CONTEXT_TEST_DATA_DIR nor XDG_DATA_HOME is set (the dangerous
window), it redirects the DB into a memoized throwaway temp dir so the real
shared DB is physically unreachable from ANY CWD — even a brand-new package that
forgets its bunfig. Empirically proven: with the preload env deleted mid-test,
resolveDatabasePath returns a mc-test-db-backstop-* path, never ~/.local/share.

Defense in depth: added `[test] preload` to the root bunfig.toml and a new
packages/cli/bunfig.toml (both pointing at the canonical plugin test-preload.ts).
Added a structural guard test asserting (a) the backstop redirects when
unisolated, (b) a test's own XDG_DATA_HOME is still honored, and (c) all four
test packages wire the preload — so a future package that forgets it fails CI.

Gate: plugin 2227/0 (+14), CLI 185/0, Pi 487/0, tsc + biome clean.

Author: ualtinok

bunfig.toml

@@ -9,3 +9,12 @@
 
 [install]
 minimumReleaseAge = 259200
+
+# Test isolation for a bare `bun test` run from the monorepo ROOT (which
+# recursively discovers every package's *.test.ts). Without this, a root-CWD
+# `bun test` runs all suites with NO preload and a bare openDatabase() would hit
+# the user's REAL shared DB — exactly how a worktree at a newer LATEST migrated
+# the live DB (2026-06-01 v26 incident, recurred at v41). resolveDatabasePath()
+# also has a NODE_ENV=test backstop, but this keeps the redirect canonical.
+[test]
+preload = ["./packages/plugin/test-preload.ts"]

packages/cli/bunfig.toml

@@ -0,0 +1,13 @@
+# Supply-chain protection (mirrors the root bunfig): refuse Bun-installed
+# packages published within the last 3 days.
+[install]
+minimumReleaseAge = 259200
+
+# Test isolation: force the shared cortexkit DB onto a throwaway temp dir for the
+# whole test process so NO cli test can read or migrate the user's real shared
+# database (shared with OpenCode + Pi). The CLI imports plugin storage via
+# @magic-context/core, so a bare openDatabase() here would otherwise hit the live
+# DB. resolveDatabasePath() also has a NODE_ENV=test backstop; this keeps the
+# redirect canonical. See packages/plugin/test-preload.ts for the full rationale.
+[test]
+preload = ["../plugin/test-preload.ts"]

packages/plugin/src/features/magic-context/storage-db.test.ts

@@ -1,12 +1,17 @@
 /// <reference types="bun-types" />
 
 import { afterEach, describe, expect, it } from "bun:test";
-import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
 import { Database } from "../../shared/sqlite";
 import { closeQuietly } from "../../shared/sqlite-helpers";
-import { closeDatabase, isDatabasePersisted, openDatabase } from "./storage-db";
+import {
+    closeDatabase,
+    isDatabasePersisted,
+    openDatabase,
+    resolveDatabasePath,
+} from "./storage-db";
 import { clearSession } from "./storage-meta-session";
 
 const tempDirs: string[] = [];
@@ -302,4 +307,59 @@ describe("storage-db", () => {
             expect(() => closeDatabase()).not.toThrow();
         });
     });
+
+    // Regression guard for the 2026-06-01 (v26) / 2026-06-19 (v41) incidents:
+    // a `bun test` run from a CWD whose bunfig lacks `[test] preload` ran the
+    // package suites with NO isolation, so a bare openDatabase() migrated the
+    // user's REAL shared DB. The NODE_ENV=test backstop in resolveDatabasePath
+    // makes that structurally impossible from ANY CWD.
+    describe("#given the test-isolation backstop", () => {
+        const realStorageRoot = join(homedir(), ".local", "share", "cortexkit");
+
+        it("#when NODE_ENV=test and XDG_DATA_HOME unset #then never resolves to the real shared DB", () => {
+            // Simulate an UNISOLATED run: no preload-set vars at all.
+            const savedXdg = process.env.XDG_DATA_HOME;
+            const savedTestDir = process.env.MAGIC_CONTEXT_TEST_DATA_DIR;
+            process.env.NODE_ENV = "test";
+            // biome-ignore lint/performance/noDelete: must be UNSET, not "".
+            delete process.env.XDG_DATA_HOME;
+            // biome-ignore lint/performance/noDelete: must be UNSET, not "".
+            delete process.env.MAGIC_CONTEXT_TEST_DATA_DIR;
+            try {
+                const { dbPath } = resolveDatabasePath();
+                expect(dbPath.startsWith(realStorageRoot)).toBe(false);
+                expect(dbPath.includes("mc-test-db-backstop-")).toBe(true);
+            } finally {
+                if (savedXdg !== undefined) process.env.XDG_DATA_HOME = savedXdg;
+                if (savedTestDir !== undefined)
+                    process.env.MAGIC_CONTEXT_TEST_DATA_DIR = savedTestDir;
+            }
+        });
+
+        it("#when a test sets its own XDG_DATA_HOME #then that controlled dir is honored", () => {
+            const dataHome = useTempDataHome("storage-db-backstop-xdg-");
+            const { dbPath } = resolveDatabasePath();
+            expect(dbPath).toBe(resolveDbPath(dataHome));
+        });
+
+        it("#then every test package wires the isolation preload (root + plugin + pi-plugin + cli)", () => {
+            // Structural guard: a new test package that forgets its bunfig
+            // `[test] preload` is the exact hole that caused both incidents.
+            const repoRoot = join(__dirname, "..", "..", "..", "..", "..");
+            const bunfigs = [
+                "bunfig.toml",
+                "packages/plugin/bunfig.toml",
+                "packages/pi-plugin/bunfig.toml",
+                "packages/cli/bunfig.toml",
+            ];
+            for (const rel of bunfigs) {
+                const full = join(repoRoot, rel);
+                expect(existsSync(full)).toBe(true);
+                const body = readFileSync(full, "utf8");
+                expect(body.includes("[test]")).toBe(true);
+                expect(body.includes("preload")).toBe(true);
+                expect(body.includes("test-preload.ts")).toBe(true);
+            }
+        });
+    });
 });

packages/plugin/src/features/magic-context/storage-db.ts

@@ -1,4 +1,5 @@
-import { copyFileSync, cpSync, existsSync, mkdirSync } from "node:fs";
+import { copyFileSync, cpSync, existsSync, mkdirSync, mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import {
     getLegacyOpenCodeMagicContextStorageDir,
@@ -44,7 +45,9 @@ export interface OpenDatabaseOptions {
     latestSupportedVersion?: number;
 }
 
-function resolveDatabasePath(dbPathOverride?: string): { dbDir: string; dbPath: string } {
+// Exported for the test-isolation guard test. Returns a PATH only — opens no DB —
+// so a regression assertion is safe even if the resolution is wrong.
+export function resolveDatabasePath(dbPathOverride?: string): { dbDir: string; dbPath: string } {
     if (dbPathOverride) {
         return { dbDir: dirname(dbPathOverride), dbPath: dbPathOverride };
     }
@@ -67,10 +70,60 @@ function resolveDatabasePath(dbPathOverride?: string): { dbDir: string; dbPath:
         const dbDir = join(testDataDir, "cortexkit", "magic-context");
         return { dbDir, dbPath: join(dbDir, "context.db") };
     }
+    // CWD-INDEPENDENT TEST BACKSTOP. The MAGIC_CONTEXT_TEST_DATA_DIR / XDG guard
+    // above only fires when the bunfig `[test] preload` ran — which depends on
+    // `bun test`'s CWD having a bunfig with `[test] preload`. A `bun test` from a
+    // dir WITHOUT that wiring (monorepo root, a package missing its bunfig, or a
+    // brand-new package) recursively runs every *.test.ts with NO preload, so a
+    // bare openDatabase() would resolve to the user's REAL shared DB and run
+    // migrations on it. That is exactly how the live DB was migrated to v41 by a
+    // worktree whose LATEST was 41 (a re-run of the 2026-06-01 v26 incident).
+    //
+    // Bun sets NODE_ENV=test for EVERY `bun test` regardless of CWD/bunfig (and
+    // it is never "test" in the plugin runtime — production never sets it). So if
+    // we are under the test runner with neither the test data dir nor an explicit
+    // override, we MUST NOT touch real storage: redirect into a throwaway temp dir
+    // so the live DB is physically unreachable. This makes it structurally
+    // impossible for ANY test, from ANY CWD, to read or migrate production data.
+    // Fire ONLY when XDG_DATA_HOME is unset: that is the dangerous window where
+    // getMagicContextStorageDir() below would otherwise resolve to the REAL
+    // ~/.local/share shared DB. When a test sets its own XDG_DATA_HOME (a
+    // per-test temp dir, e.g. to exercise path fallbacks or share a DB across
+    // helper calls), getMagicContextStorageDir() already points inside that
+    // controlled dir — honor it, do not override.
+    if (process.env.NODE_ENV === "test" && !process.env.XDG_DATA_HOME) {
+        // Memoized per-process so repeated openDatabase() calls in the same
+        // unisolated test resolve to the SAME path (openDatabase caches by path;
+        // a fresh temp dir per call would defeat the cache and hand back
+        // different DB handles).
+        const dbDir = getTestBackstopDbDir();
+        if (!testBackstopWarned) {
+            testBackstopWarned = true;
+            log(
+                "[magic-context] TEST BACKSTOP: NODE_ENV=test with no MAGIC_CONTEXT_TEST_DATA_DIR " +
+                    `— redirecting DB to a throwaway temp dir (${dbDir}) so no test can touch the ` +
+                    "user's real shared database. Wire `[test] preload` in this package's bunfig.toml.",
+            );
+        }
+        return { dbDir, dbPath: join(dbDir, "context.db") };
+    }
     const dbDir = getMagicContextStorageDir();
     return { dbDir, dbPath: join(dbDir, "context.db") };
 }
 
+let testBackstopDbDir: string | null = null;
+let testBackstopWarned = false;
+function getTestBackstopDbDir(): string {
+    if (!testBackstopDbDir) {
+        testBackstopDbDir = join(
+            mkdtempSync(join(tmpdir(), "mc-test-db-backstop-")),
+            "cortexkit",
+            "magic-context",
+        );
+    }
+    return testBackstopDbDir;
+}
+
 export function getDatabasePath(db: Database): string | null {
     return pathByDatabase.get(db) ?? null;
 }