mason: fix cli doctor audit findings

Co-authored-by: Alfonso [Magic Context] <288211368+alfonso-magic-context@users.noreply.github.com>

Author: ualtinok

packages/cli/src/commands/doctor-opencode-cache.ts

@@ -8,6 +8,8 @@ export interface PluginCacheResult {
     action: "cleared" | "up_to_date" | "not_found" | "check_unavailable" | "error";
     path: string;
     paths?: string[];
+    clearedPaths?: string[];
+    failedPaths?: string[];
     cached?: string;
     latest?: string;
     error?: string;
@@ -94,6 +96,8 @@ export async function clearPluginCache(
             action: "error",
             path: firstFailure?.path ?? clearTargets[0]?.path ?? existingRoots[0] ?? "",
             paths: failed.map((entry) => entry.path),
+            clearedPaths: cleared.map((entry) => entry.path),
+            failedPaths: failed.map((entry) => entry.path),
             error: firstFailure?.error,
         };
     }

packages/cli/src/commands/doctor-opencode.test.ts

@@ -14,7 +14,12 @@ import {
     OPENCODE_PLUGIN_NAME,
 } from "../lib/opencode-plugin-cache";
 import { runV22BackfillCommands } from "../lib/v22-backfill-commands";
-import { migrateLegacyAgentEnabledConfigForDoctor } from "./doctor-opencode";
+import {
+    collectNpmReleaseAgeWarnings,
+    getUserNpmrcPath,
+    isPinnedOpenCodePluginSpecifier,
+    migrateLegacyAgentEnabledConfigForDoctor,
+} from "./doctor-opencode";
 import { clearPluginCache } from "./doctor-opencode-cache";
 
 function migrate(input: Record<string, unknown>) {
@@ -77,6 +82,8 @@ describe("doctor OpenCode legacy agent enabled migration", () => {
 const tempDirs: string[] = [];
 const dbs: Database[] = [];
 let originalXdgCacheHome: string | undefined;
+let originalHome: string | undefined;
+let originalNpmUserConfig: string | undefined;
 
 function makeTempDir(prefix = "mc-v22-doctor-"): string {
     const dir = mkdtempSync(join(tmpdir(), prefix));
@@ -132,7 +139,19 @@ afterEach(() => {
     } else {
         process.env.XDG_CACHE_HOME = originalXdgCacheHome;
     }
+    if (originalHome === undefined) {
+        delete process.env.HOME;
+    } else {
+        process.env.HOME = originalHome;
+    }
+    if (originalNpmUserConfig === undefined) {
+        delete process.env.NPM_CONFIG_USERCONFIG;
+    } else {
+        process.env.NPM_CONFIG_USERCONFIG = originalNpmUserConfig;
+    }
     originalXdgCacheHome = undefined;
+    originalHome = undefined;
+    originalNpmUserConfig = undefined;
     for (const db of dbs.splice(0)) {
         db.close();
     }
@@ -285,13 +304,49 @@ describe("doctor OpenCode plugin cache", () => {
             action: "error",
             path: versionlessCachePath,
             paths: [versionlessCachePath],
+            clearedPaths: [latestCachePath],
+            failedPaths: [versionlessCachePath],
             error: "EACCES: permission denied",
         });
         expect(removed).toEqual([latestCachePath]);
         expect(existsSync(latestCachePath)).toBe(false);
     });
 });
 
+describe("doctor OpenCode helper logic", () => {
+    it("treats dist-tags like @next and @beta as pinned plugin entries", () => {
+        expect(isPinnedOpenCodePluginSpecifier("@cortexkit/opencode-magic-context@next")).toBe(
+            true,
+        );
+        expect(isPinnedOpenCodePluginSpecifier("@cortexkit/opencode-magic-context@beta")).toBe(
+            true,
+        );
+        expect(isPinnedOpenCodePluginSpecifier("@cortexkit/opencode-magic-context@0.29.1")).toBe(
+            true,
+        );
+        expect(isPinnedOpenCodePluginSpecifier("@cortexkit/opencode-magic-context")).toBe(false);
+        expect(isPinnedOpenCodePluginSpecifier("@cortexkit/opencode-magic-context@latest")).toBe(
+            false,
+        );
+    });
+
+    it("honors NPM_CONFIG_USERCONFIG before HOME for npmrc release-age warnings", () => {
+        const root = makeTempDir("mc-npmrc-");
+        const home = join(root, "home");
+        const customNpmrc = join(root, "custom.npmrc");
+        originalHome = process.env.HOME;
+        originalNpmUserConfig = process.env.NPM_CONFIG_USERCONFIG;
+        process.env.HOME = home;
+        process.env.NPM_CONFIG_USERCONFIG = customNpmrc;
+        mkdirSync(home, { recursive: true });
+        writeFileSync(join(home, ".npmrc"), "min-release-age=9999\n");
+        writeFileSync(customNpmrc, "before=2026-01-01\n");
+
+        expect(getUserNpmrcPath()).toBe(customNpmrc);
+        expect(collectNpmReleaseAgeWarnings()).toEqual([`${customNpmrc} has 'before=2026-01-01'`]);
+    });
+});
+
 describe("doctor v22 backfill commands", () => {
     it("--check-v22-backfill reports status", async () => {
         const database = makeDb();

packages/cli/src/commands/doctor-opencode.ts

@@ -5,7 +5,6 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { loadPluginConfig } from "@magic-context/core/config";
 import { substituteConfigVariables } from "@magic-context/core/config/variable";
-
 import {
     type EmbeddingProbeOutcome,
     probeEmbeddingEndpoint,
@@ -17,6 +16,7 @@ import { getMagicContextStorageDir } from "@magic-context/core/shared/data-path"
 import { Database } from "@magic-context/core/shared/sqlite";
 import { ensureTuiPluginEntry } from "@magic-context/core/shared/tui-config";
 import { parse, stringify } from "comment-json";
+
 import { isDevPathPluginEntry, matchesPluginEntry } from "../adapters/opencode";
 import { writeFileAtomic } from "../lib/atomic-write";
 import { migrateConfigLocationsForCli } from "../lib/config-location-migration";
@@ -37,6 +37,11 @@ import {
 } from "../lib/opencode-plugin-cache";
 import { detectConfigPaths, getMagicContextLogPath } from "../lib/paths";
 import { confirm, intro, log, outro, selectOne, spinner, text } from "../lib/prompts";
+import {
+    sanitizeDiagnosticEndpoint,
+    sanitizeDiagnosticText,
+    sanitizePathString,
+} from "../lib/redaction";
 import { runV22BackfillCommands, type V22BackfillCommandArgs } from "../lib/v22-backfill-commands";
 import { clearPluginCache } from "./doctor-opencode-cache";
 
@@ -140,6 +145,40 @@ function getSelfVersion(): string {
     return "0.0.0";
 }
 
+export function isPinnedOpenCodePluginSpecifier(specifier: string): boolean {
+    if (specifier === PLUGIN_NAME || specifier === PLUGIN_ENTRY_WITH_VERSION) return false;
+    return specifier.startsWith(`${PLUGIN_NAME}@`);
+}
+
+export function getUserNpmrcPath(): string {
+    const custom = process.env.NPM_CONFIG_USERCONFIG?.trim();
+    if (custom) return custom;
+    const home = process.env.HOME?.trim();
+    return join(home || homedir(), ".npmrc");
+}
+
+export function collectNpmReleaseAgeWarnings(): string[] {
+    const ageWarnings: string[] = [];
+    const npmrcPath = getUserNpmrcPath();
+    if (!existsSync(npmrcPath)) return ageWarnings;
+    try {
+        const npmrc = readFileSync(npmrcPath, "utf-8");
+        for (const line of npmrc.split("\n")) {
+            const trimmed = line.trim();
+            if (trimmed.startsWith("#") || trimmed.startsWith(";")) continue;
+            const [key] = trimmed.split("=").map((s) => s.trim());
+            if (key === "min-release-age" || key === "before") {
+                ageWarnings.push(
+                    `${sanitizePathString(npmrcPath)} has '${sanitizeDiagnosticText(trimmed)}'`,
+                );
+            }
+        }
+    } catch {
+        // Can't read .npmrc — skip.
+    }
+    return ageWarnings;
+}
+
 /** Compare semver-like strings. Returns -1 if a<b, 0 if equal, 1 if a>b. */
 function compareVersions(a: string, b: string): number {
     const pa = a.split(/[.-]/).map((s) => Number.parseInt(s, 10));
@@ -417,7 +456,9 @@ async function checkEmbeddingConfig(
 
     // Run the live probe.
     const probeSpinner = spinner();
-    probeSpinner.start(`Testing embedding endpoint ${endpoint} (model: ${model})`);
+    probeSpinner.start(
+        `Testing embedding endpoint ${sanitizeDiagnosticEndpoint(endpoint)} (model: ${sanitizeDiagnosticText(model)})`,
+    );
 
     let outcome: EmbeddingProbeOutcome;
     try {
@@ -431,7 +472,9 @@ async function checkEmbeddingConfig(
         });
     } catch (error) {
         probeSpinner.stop("Embedding probe failed unexpectedly");
-        log.error(`Probe threw: ${error instanceof Error ? error.message : String(error)}`);
+        log.error(
+            `Probe threw: ${sanitizeDiagnosticText(error instanceof Error ? error.message : String(error))}`,
+        );
         return { issues: localIssues + 1 };
     }
 
@@ -447,11 +490,11 @@ async function checkEmbeddingConfig(
             log.error(
                 `Embedding endpoint rejected credentials (${outcome.status}) — check api_key / env var`,
             );
-            if (outcome.preview) log.info(`  ${outcome.preview}`);
+            if (outcome.preview) log.info(`  ${sanitizeDiagnosticText(outcome.preview)}`);
             return { issues: localIssues + 1 };
         case "endpoint_unsupported":
             log.error(`Embedding endpoint does not support embeddings (${outcome.status})`);
-            if (outcome.preview) log.info(`  ${outcome.preview}`);
+            if (outcome.preview) log.info(`  ${sanitizeDiagnosticText(outcome.preview)}`);
             log.info(
                 "  Common causes: endpoint points at a chat-completion route (should be the provider base, e.g. '.../v1'), or the provider doesn't offer an embeddings API",
             );
@@ -461,19 +504,21 @@ async function checkEmbeddingConfig(
             return { issues: localIssues + 1 };
         case "http_error":
             log.error(`Embedding endpoint returned ${outcome.status}`);
-            if (outcome.preview) log.info(`  ${outcome.preview}`);
+            if (outcome.preview) log.info(`  ${sanitizeDiagnosticText(outcome.preview)}`);
             return { issues: localIssues + 1 };
         case "timeout":
             log.warn(
                 `Embedding endpoint did not respond within ${outcome.timeoutMs}ms — check endpoint URL and network`,
             );
             return { issues: localIssues + 1 };
         case "network_error":
-            log.error(`Could not reach embedding endpoint: ${outcome.message}`);
+            log.error(
+                `Could not reach embedding endpoint: ${sanitizeDiagnosticText(outcome.message)}`,
+            );
             return { issues: localIssues + 1 };
         case "invalid_scheme":
             log.error(
-                `Embedding endpoint must start with http:// or https://: ${outcome.endpoint}`,
+                `Embedding endpoint must start with http:// or https://: ${sanitizeDiagnosticEndpoint(outcome.endpoint)}`,
             );
             return { issues: localIssues + 1 };
     }
@@ -873,10 +918,7 @@ export async function runDoctor(
                 if (isDevPathPluginEntry(oldEntry)) {
                     pass(`Plugin registered in ${configName} (dev path: ${oldEntryStr})`);
                 } else {
-                    const isPinned =
-                        oldEntryStr !== PLUGIN_NAME &&
-                        oldEntryStr !== PLUGIN_ENTRY_WITH_VERSION &&
-                        /^@cortexkit\/opencode-magic-context@\d/.test(oldEntryStr);
+                    const isPinned = isPinnedOpenCodePluginSpecifier(oldEntryStr);
 
                     if (isPinned && !options.force) {
                         // Warn but don't change — user intentionally pinned
@@ -967,10 +1009,7 @@ export async function runDoctor(
                 if (isDevPathPluginEntry(tuiEntry)) {
                     pass(`TUI sidebar plugin configured (dev path: ${tuiEntryStr})`);
                 } else {
-                    const tuiPinned =
-                        tuiEntryStr !== PLUGIN_NAME &&
-                        tuiEntryStr !== PLUGIN_ENTRY_WITH_VERSION &&
-                        /^@cortexkit\/opencode-magic-context@\d/.test(tuiEntryStr);
+                    const tuiPinned = isPinnedOpenCodePluginSpecifier(tuiEntryStr);
                     if (tuiPinned && !options.force) {
                         warn(
                             `TUI plugin pinned to ${tuiEntryStr} — use 'doctor --force' to upgrade`,
@@ -1117,7 +1156,14 @@ export async function runDoctor(
         );
     } else if (cacheResult.action === "error") {
         warn(`Could not clear plugin cache: ${cacheResult.error}`);
-        log.info(`  Manually delete: ${cacheResult.path}`);
+        if (cacheResult.clearedPaths && cacheResult.clearedPaths.length > 0) {
+            log.info(`  Cleared roots: ${cacheResult.clearedPaths.join(", ")}`);
+        }
+        if (cacheResult.failedPaths && cacheResult.failedPaths.length > 0) {
+            log.info(`  Failed roots: ${cacheResult.failedPaths.join(", ")}`);
+        } else {
+            log.info(`  Manually delete: ${cacheResult.path}`);
+        }
         issues++;
     } else {
         pass("Plugin cache clean (no cached version found)");
@@ -1129,23 +1175,7 @@ export async function runDoctor(
     // npx and the auto-update checker uses npm install, neither of which read
     // bunfig.
     {
-        const ageWarnings: string[] = [];
-        const npmrcPath = join(homedir(), ".npmrc");
-        if (existsSync(npmrcPath)) {
-            try {
-                const npmrc = readFileSync(npmrcPath, "utf-8");
-                for (const line of npmrc.split("\n")) {
-                    const trimmed = line.trim();
-                    if (trimmed.startsWith("#") || trimmed.startsWith(";")) continue;
-                    const [key] = trimmed.split("=").map((s) => s.trim());
-                    if (key === "min-release-age" || key === "before") {
-                        ageWarnings.push(`~/.npmrc has '${trimmed}'`);
-                    }
-                }
-            } catch {
-                // Can't read .npmrc — skip
-            }
-        }
+        const ageWarnings = collectNpmReleaseAgeWarnings();
 
         if (ageWarnings.length > 0) {
             log.warn(