mason: align TS config trust tiers

Co-authored-by: Alfonso [Magic Context] <288211368+alfonso-magic-context@users.noreply.github.com>

Author: ualtinok

packages/docs/src/content/docs/reference/configuration.md

@@ -23,7 +23,7 @@ Add the schema line for editor validation and autocomplete:
 ```
 
 :::note
-Project-level configs cannot use `{env:VAR}` / `{file:path}` expansion and cannot set `sqlite.*` or override hidden-agent prompts/permissions — these are security boundaries against untrusted repositories. User-level config has no such restriction.
+Project-level configs cannot use `{env:VAR}` / `{file:path}` expansion. A cloned repository also cannot set `sqlite.*`, hidden-agent prompts/permissions, `historian.model`, or `historian.fallback_models`. Project `execute_threshold_percentage` / `execute_threshold_tokens` may only RAISE thresholds relative to the user's effective settings (a repo may delay compaction, not make it happen earlier). Dreamer model/schedule/task tuning and `memory.enabled` remain allowed project overrides.
 :::
 
 ## Top-level switches

packages/pi-plugin/src/config/index.test.ts

@@ -295,6 +295,42 @@ describe("loadPiConfig", () => {
 		);
 	});
 
+	it("keeps historian model selection user-owned when project config tries to override it", () => {
+		const cwd = makeTempRoot("mc-pi-cwd-");
+		const home = makeTempRoot("mc-pi-home-");
+		withHome(home);
+		writeUserConfig(
+			home,
+			JSON.stringify({
+				historian: {
+					model: "anthropic/user-historian",
+					fallback_models: ["anthropic/user-fallback"],
+				},
+			}),
+		);
+		writeProjectConfig(
+			cwd,
+			JSON.stringify({
+				historian: {
+					model: "anthropic/project-historian",
+					fallback_models: ["anthropic/project-fallback"],
+					temperature: 0.2,
+				},
+			}),
+		);
+
+		const result = loadPiConfig({ cwd });
+
+		expect(result.config.historian?.model).toBe("anthropic/user-historian");
+		expect(result.config.historian?.fallback_models).toEqual([
+			"anthropic/user-fallback",
+		]);
+		expect(result.config.historian?.temperature).toBe(0.2);
+		expect(result.warnings.join("\n")).toContain(
+			"Ignoring historian.model/fallback_models",
+		);
+	});
+
 	it("migrates legacy agent enabled keys before schema parsing", () => {
 		const cwd = makeTempRoot("mc-pi-cwd-");
 		const home = makeTempRoot("mc-pi-home-");

packages/pi-plugin/src/config/index.ts

@@ -12,6 +12,7 @@ import { migrateLegacyAgentEnabledInMemory } from "@magic-context/core/config/ag
 import { migrateDreamerV2 } from "@magic-context/core/config/migrate-dreamer-v2";
 import { migrateLegacyExperimental } from "@magic-context/core/config/migrate-experimental";
 import {
+	constrainProjectThresholdOverrides,
 	dropInheritedEmbeddingKeyOnRedirect,
 	stripUnsafeProjectConfigFields,
 } from "@magic-context/core/config/project-security";
@@ -63,12 +64,11 @@ interface LoadedConfigFile {
 	loadOutcome: LoadOutcome;
 }
 
-// Hard cutover: config is read ONLY from the shared CortexKit location. The
-// legacy Pi paths (~/.pi/agent/, <root>/.pi/) are touched only by the location
-// migrator (migrateMagicContextConfigLocations), which runs at Pi init before
-// the loader and moves them to the CortexKit path. They are never a read
-// fallback. The CortexKit target normalizes to .jsonc; we still detect a
-// pre-existing .json at the target for resilience.
+// Shared CortexKit paths are the primary config location. When that base is
+// absent because migration refused/not-yet-ran, Pi may still READ its own legacy
+// paths as a non-destructive fallback (see resolvePiLegacyFallback) rather than
+// silently using schema defaults. The CortexKit target normalizes to .jsonc; we
+// still detect a pre-existing .json at the target for resilience.
 function getProjectConfigPaths(cwd: string): string[] {
 	const basePath = cortexKitProjectConfigBasePath(cwd);
 	return [`${basePath}.jsonc`, `${basePath}.json`];
@@ -343,6 +343,10 @@ export function loadPiConfig(
 	// The trusted user config (sorted first) — passed to the embedding-redirect
 	// guard so a project repeating the user's own endpoint is not a redirect.
 	const userRaw = mergeFiles.find((f) => f.scope === "user")?.config;
+	// Threshold trust boundary is relative to the USER/default effective config:
+	// a cloned repo may delay compaction, but it may not lower thresholds in a
+	// way that forces extra historian work on the user's account.
+	const trustedBaseConfig = parsePiConfig(userRaw ?? {}).config;
 
 	for (const loaded of mergeFiles) {
 		const prefix =
@@ -364,6 +368,13 @@ export function loadPiConfig(
 			)) {
 				warnings.push(`${prefix} ${warning}`);
 			}
+			for (const warning of constrainProjectThresholdOverrides({
+				mergedRaw: rawConfig,
+				projectRaw,
+				trustedBaseConfig,
+			})) {
+				warnings.push(`${prefix} ${warning}`);
+			}
 		} else {
 			rawConfig = mergeRawConfigs(rawConfig, loaded.config);
 		}
@@ -503,6 +514,10 @@ export function loadPiConfigDetailed(
 		return a.scope === "user" ? -1 : 1;
 	});
 	const userRaw = mergeFiles.find((f) => f.scope === "user")?.config;
+	// Threshold trust boundary is relative to the USER/default effective config:
+	// a cloned repo may delay compaction, but it may not lower thresholds in a
+	// way that forces extra historian work on the user's account.
+	const trustedBaseConfig = parsePiConfig(userRaw ?? {}).config;
 
 	for (const loaded of mergeFiles) {
 		const prefix =
@@ -522,6 +537,13 @@ export function loadPiConfigDetailed(
 			)) {
 				warnings.push(`${prefix} ${warning}`);
 			}
+			for (const warning of constrainProjectThresholdOverrides({
+				mergedRaw: rawConfig,
+				projectRaw,
+				trustedBaseConfig,
+			})) {
+				warnings.push(`${prefix} ${warning}`);
+			}
 		} else {
 			rawConfig = mergeRawConfigs(rawConfig, loaded.config);
 		}

packages/pi-plugin/src/index.test.ts

@@ -0,0 +1,63 @@
+import { afterEach, describe, expect, it, spyOn } from "bun:test";
+
+import * as loggerModule from "@magic-context/core/shared/logger";
+
+import { __test } from "./index";
+
+afterEach(() => {
+	__test.resetLoggedPiConfigDirs();
+});
+
+describe("Pi config load logging", () => {
+	it("dedupes /cd config warnings per directory", () => {
+		const logSpy = spyOn(loggerModule, "log").mockImplementation(
+			() => undefined,
+		);
+		try {
+			__test.logPiConfigLoad({
+				dir: "/tmp/project-a",
+				loadedFromPaths: ["/tmp/project-a/.cortexkit/magic-context.jsonc"],
+				warnings: ["Ignoring historian.model from project config"],
+				dedupe: true,
+			});
+			__test.logPiConfigLoad({
+				dir: "/tmp/project-a",
+				loadedFromPaths: ["/tmp/project-a/.cortexkit/magic-context.jsonc"],
+				warnings: ["Ignoring historian.model from project config"],
+				dedupe: true,
+			});
+			__test.logPiConfigLoad({
+				dir: "/tmp/project-b",
+				loadedFromPaths: [],
+				warnings: ["Ignoring execute_threshold_percentage from project config"],
+				dedupe: true,
+			});
+
+			const messages = logSpy.mock.calls.map(([message]) => String(message));
+			expect(
+				messages.filter((message) => message.includes("config loaded from:")),
+			).toHaveLength(1);
+			expect(
+				messages.filter((message) =>
+					message.includes(
+						"config: no magic-context.jsonc found, using schema defaults",
+					),
+				),
+			).toHaveLength(1);
+			expect(
+				messages.filter((message) =>
+					message.includes("Ignoring historian.model from project config"),
+				),
+			).toHaveLength(1);
+			expect(
+				messages.filter((message) =>
+					message.includes(
+						"Ignoring execute_threshold_percentage from project config",
+					),
+				),
+			).toHaveLength(1);
+		} finally {
+			logSpy.mockRestore();
+		}
+	});
+});

packages/pi-plugin/src/index.ts

@@ -21,7 +21,7 @@
  */
 
 import { createRequire } from "node:module";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { isDreamerRunnable } from "@magic-context/core/config/agent-disable";
 import { migrateMagicContextConfigLocations } from "@magic-context/core/config/migrate-config-location";
@@ -297,10 +297,14 @@ function warn(message: string, data?: unknown): void {
 }
 
 // Migrate config from the legacy per-harness locations to the shared CortexKit
-// location BEFORE any loadPiConfig (hard cutover: the loader reads only
-// CortexKit). Memoized per directory so the per-cwd switch sites don't re-run
-// the (idempotent, lock-guarded) migration on every pass. Fails open.
+// location BEFORE any loadPiConfig. The loader prefers the shared CortexKit
+// paths and only falls back to Pi-owned legacy files when that base is absent.
+// Memoized per directory so the per-cwd switch sites don't re-run the
+// (idempotent, lock-guarded) migration on every pass. Fails open.
 const migratedConfigDirs = new Set<string>();
+// Memoized per directory so repeated /cd lookups do not spam the same config
+// summary/warning lines on every hot-path config resolution.
+const loggedPiConfigDirs = new Set<string>();
 function ensureConfigLocationsMigrated(dir: string): void {
 	if (migratedConfigDirs.has(dir)) return;
 	migratedConfigDirs.add(dir);
@@ -310,6 +314,34 @@ function ensureConfigLocationsMigrated(dir: string): void {
 	});
 }
 
+function logPiConfigLoad(args: {
+	dir: string;
+	loadedFromPaths: string[];
+	warnings: string[];
+	dedupe?: boolean;
+}): void {
+	const key = resolve(args.dir);
+	if (args.dedupe && loggedPiConfigDirs.has(key)) return;
+	if (args.dedupe) {
+		loggedPiConfigDirs.add(key);
+	}
+	if (args.loadedFromPaths.length > 0) {
+		info(`config loaded from: ${args.loadedFromPaths.join(", ")}`);
+	} else {
+		info("config: no magic-context.jsonc found, using schema defaults");
+	}
+	for (const warning of args.warnings) {
+		warn(`config: ${warning}`);
+	}
+}
+
+export const __test = {
+	logPiConfigLoad,
+	resetLoggedPiConfigDirs(): void {
+		loggedPiConfigDirs.clear();
+	},
+};
+
 function formatTokens(value: number): string {
 	return value.toLocaleString();
 }
@@ -449,9 +481,10 @@ setHarness("pi");
 // ---------------------------------------------------------------------------
 // Config-driven resolvers
 //
-// Step 5b replaced the env-var stop-gaps with `loadPiConfig()` which reads
-// $cwd/.pi/magic-context.jsonc (project) + ~/.pi/agent/magic-context.jsonc
-// (user) and merges them through the shared Zod schema. The resolvers below
+// Step 5b replaced the env-var stop-gaps with `loadPiConfig()`, which reads
+// the shared CortexKit config paths (project `.cortexkit/`, user `~/.config/`)
+// and falls back to Pi-owned legacy files only until migration completes. The
+// resolvers below
 // adapt the schema-shaped config into the Pi-specific options the various
 // registration helpers expect.
 //
@@ -655,10 +688,10 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 	);
 
 	// Step 5b: load the user's full magic-context.jsonc config. The loader
-	// reads $cwd/.pi/magic-context.jsonc and ~/.pi/agent/magic-context.jsonc
-	// (Pi convention), validates them through the shared Zod schema, falls
-	// back to defaults for invalid fields per-key, and returns merged
-	// config + warnings.
+	// reads the shared CortexKit project/user paths, validates them through the
+	// shared Zod schema, falls back to Pi-owned legacy files only while migration
+	// is incomplete, and uses defaults for invalid fields per-key. It returns
+	// the merged config plus warnings.
 	//
 	// We surface warnings via the standard `warn()` channel so users see
 	// them in the magic-context log. Loading never throws — bad config
@@ -667,14 +700,12 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 	const { config, warnings, loadedFromPaths } = loadPiConfig({
 		cwd: projectDir,
 	});
-	if (loadedFromPaths.length > 0) {
-		info(`config loaded from: ${loadedFromPaths.join(", ")}`);
-	} else {
-		info("config: no magic-context.jsonc found, using schema defaults");
-	}
-	for (const w of warnings) {
-		warn(`config: ${w}`);
-	}
+	logPiConfigLoad({
+		dir: projectDir,
+		loadedFromPaths,
+		warnings,
+		dedupe: true,
+	});
 
 	// Pi opens the shared DB before config is available (above), so apply the
 	// configured SQLite tuning to the already-open connection now. cache_size /
@@ -809,7 +840,14 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 		const cached = projectDepsByDir.get(dir);
 		if (cached) return cached;
 		ensureConfigLocationsMigrated(dir);
-		const switchedConfig = loadPiConfig({ cwd: dir }).config;
+		const switchedLoad = loadPiConfig({ cwd: dir });
+		logPiConfigLoad({
+			dir,
+			loadedFromPaths: switchedLoad.loadedFromPaths,
+			warnings: switchedLoad.warnings,
+			dedupe: true,
+		});
+		const switchedConfig = switchedLoad.config;
 		const switchedIdentity =
 			identityOverride ?? resolveProjectIdentityOrFallback(dir);
 		const built = buildProjectDeps(dir, switchedIdentity, switchedConfig);
@@ -1338,7 +1376,7 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 
 			// Use effectiveConfig (re-resolved from the CURRENT checkout's cwd on
 			// a project switch) for every system-prompt decision below — a
-			// switched-into project may carry its own .pi/magic-context.jsonc
+			// switched-into project may carry its own .cortexkit/magic-context.jsonc
 			// (memory/docs/key-files/injection toggles). Reusing boot `config`
 			// would render the launch project's adjuncts in the new checkout.
 			if (effectiveConfig.system_prompt_injection?.enabled === false) {

packages/plugin/scripts/build-config-docs.ts

@@ -233,7 +233,7 @@ Add the schema line for editor validation and autocomplete:
 \`\`\`
 
 :::note
-Project-level configs cannot use \`{env:VAR}\` / \`{file:path}\` expansion and cannot set \`sqlite.*\` or override hidden-agent prompts/permissions — these are security boundaries against untrusted repositories. User-level config has no such restriction.
+Project-level configs cannot use \`{env:VAR}\` / \`{file:path}\` expansion. A cloned repository also cannot set \`sqlite.*\`, hidden-agent prompts/permissions, \`historian.model\`, or \`historian.fallback_models\`. Project \`execute_threshold_percentage\` / \`execute_threshold_tokens\` may only RAISE thresholds relative to the user's effective settings (a repo may delay compaction, not make it happen earlier). Dreamer model/schedule/task tuning and \`memory.enabled\` remain allowed project overrides.
 :::
 
 ${sections.join("\n\n")}