@compr/opscontext-mcp 2.1.0 → 2.1.3

package/dist/audit.js

@@ -6,26 +6,119 @@
 // ⛔ NEVER catch errors inside appendAudit() — silent failures defeat the
 //    entire compliance story. Use safeAppend() at call sites if you need
 //    failure isolation; appendAudit() must surface problems loudly.
-// WHY: This is the SOC2 CC7.2 / ISO 27001 A.12.4.1 compliance bedrock. The
-//    audit log is the foundation that licence-signature verification,
-//    compliance reporting, and enforcement telemetry all build on. Any
-//    silent break here destroys evidence value across years of records.
+// WHY: This is the bedrock for evidence aligned with SOC 2 CC7.2 (change
+//    monitoring) and ISO 27001 A.12.4.1 (event logging). These are
+//    EVIDENCE ARTIFACTS — OpsContext is NOT itself SOC 2– or ISO 27001–
+//    certified; the chain helps a deploying org's auditor satisfy those
+//    controls. See docs/compliance/cc7.2.md + docs/compliance/a.12.4.1.md.
+//    Any silent break here destroys evidence value across years of
+//    records and invalidates the chain integrity property downstream
+//    code (verifyChain, license signatures, enforcement telemetry)
+//    depends on.
 // FIX: If you need to evolve the record format, version the chain
 //    (add a "v":2 field) and keep verifyChain() backward-compatible by
 //    dispatching on the v field. Don't mutate the v=1 contract.
 //
+// 🔒 LOCKED [AUDIT-001-WRITE-RACE-FIX] — 2026-06-24
+// ⛔ NEVER remove the file-lock acquisition in appendAudit(). The chain
+//    was broken at index 2826 (Sessions 11-13) by concurrent writers
+//    (activation server + main MCP) reading the same prev_hash before
+//    either had flushed. The lock serializes the read-then-write
+//    window across processes.
+// ⛔ NEVER trust cachedLastHash without verifying file size hasn't
+//    grown since cachedSize. Another process may have written between
+//    OUR last write and OUR next read.
+// WHY: audit-001-write-race documented in Session 11 SCORE.md. The
+//    in-process chain cache is a perf optimization, NOT a correctness
+//    guarantee — correctness comes from the lock + the size-mismatch
+//    re-read.
+// FIX: To raise throughput further (if profiling proves the stat() per
+//    append is hot), batch appends within a process behind a single
+//    lock acquisition. Don't remove the lock.
+//
 // Tamper-evident audit log — hash-chained JSONL at ~/.contextengine/audit.log.
 //
-// Compliance basis: SOC2 CC7.2 (audit logging), ISO 27001 A.12.4.1 (event logs).
+// Compliance: produces evidence aligned with SOC 2 CC7.2 + ISO 27001 A.12.4.1
+// (evidence artifacts, not certifications — see docs/compliance/).
 //
 // Records every state-changing operation. Each line carries the SHA-256 hash
 // of the previous line's canonical content, so mutation of any historical
 // record breaks chain verification at that index.
-import { existsSync, mkdirSync, readFileSync, appendFileSync } from "fs";
+import { existsSync, mkdirSync, readFileSync, appendFileSync, openSync, closeSync, unlinkSync, statSync, writeSync, constants, } from "fs";
 import { join } from "path";
 import { homedir } from "os";
 import { createHash } from "crypto";
 const GENESIS_HASH = "0".repeat(64);
+// ─── File lock primitives ───────────────────────────────────────────────────
+// O_EXCL + O_CREAT is atomic across processes on POSIX and on Windows NTFS,
+// so creating the lockfile is the synchronization primitive. Stale-lock
+// recovery: if the lockfile is older than STALE_LOCK_MS, treat it as
+// orphaned (process crashed mid-append) and unlink it.
+const LOCK_TIMEOUT_MS = 2000; // total wait before giving up
+const LOCK_RETRY_MS = 5; // poll interval
+const STALE_LOCK_MS = 10_000; // lockfile older than this = orphan
+function lockPath() {
+    return join(auditDir(), "audit.lock");
+}
+/** Synchronous sleep that doesn't burn CPU — uses Atomics.wait on a
+ *  throwaway SharedArrayBuffer. Accurate to ~1ms. */
+function syncSleep(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+/** Acquire an exclusive file lock. Returns a release function. Throws if
+ *  unable to acquire within LOCK_TIMEOUT_MS. */
+function acquireLockSync() {
+    const path = lockPath();
+    const deadline = Date.now() + LOCK_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+        try {
+            // O_EXCL fails atomically if the file already exists.
+            const fd = openSync(path, 
+            // eslint-disable-next-line no-bitwise
+            constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 0o600);
+            // Write PID + ts so a debugger can see who's holding the lock.
+            try {
+                writeSync(fd, `${process.pid}\n${new Date().toISOString()}\n`);
+            }
+            catch {
+                /* lock file is what matters; the contents are nice-to-have */
+            }
+            closeSync(fd);
+            return () => {
+                try {
+                    unlinkSync(path);
+                }
+                catch {
+                    /* already gone — another cleaner won the race */
+                }
+            };
+        }
+        catch (e) {
+            const code = e.code;
+            if (code !== "EEXIST")
+                throw e;
+            // Lockfile exists. Check if it's stale.
+            try {
+                const st = statSync(path);
+                if (Date.now() - st.mtimeMs > STALE_LOCK_MS) {
+                    // Orphaned — force-unlink and retry.
+                    try {
+                        unlinkSync(path);
+                    }
+                    catch {
+                        /* another process just cleaned it; retry */
+                    }
+                    continue;
+                }
+            }
+            catch {
+                /* lockfile vanished between check and stat; just retry */
+            }
+            syncSleep(LOCK_RETRY_MS);
+        }
+    }
+    throw new Error(`Failed to acquire audit lock at ${path} within ${LOCK_TIMEOUT_MS}ms`);
+}
 function auditDir() {
     // CONTEXTENGINE_HOME lets tests run against a temp dir without touching ~/.contextengine
     return process.env.CONTEXTENGINE_HOME || join(homedir(), ".contextengine");
@@ -62,16 +155,41 @@ function computeHash(prevHash, ts, event, actor, payload) {
     return createHash("sha256").update(canonical).digest("hex");
 }
 let cachedLastHash = null;
+/** File size at our last successful write. If statSync(path).size differs
+ *  on the next call, another process wrote in between → invalidate cache. */
+let cachedSize = 0;
 export function appendAudit(event, payload, actor = "system") {
     ensureDir();
-    if (cachedLastHash === null)
-        cachedLastHash = readLastHash();
-    const ts = new Date().toISOString();
-    const hash = computeHash(cachedLastHash, ts, event, actor, payload);
-    const record = { ts, event, actor, payload, prev_hash: cachedLastHash, hash };
-    appendFileSync(auditPath(), JSON.stringify(record) + "\n");
-    cachedLastHash = hash;
-    return record;
+    const release = acquireLockSync();
+    try {
+        const path = auditPath();
+        // Cache validity check: if file size grew since OUR last write, another
+        // process appended → re-read prev hash from disk (the cache is stale).
+        // Also handles first-ever call (cachedLastHash === null).
+        const currentSize = existsSync(path) ? statSync(path).size : 0;
+        if (cachedLastHash === null || currentSize !== cachedSize) {
+            cachedLastHash = readLastHash();
+            cachedSize = currentSize;
+        }
+        const ts = new Date().toISOString();
+        const hash = computeHash(cachedLastHash, ts, event, actor, payload);
+        const record = {
+            ts,
+            event,
+            actor,
+            payload,
+            prev_hash: cachedLastHash,
+            hash,
+        };
+        const line = JSON.stringify(record) + "\n";
+        appendFileSync(path, line);
+        cachedLastHash = hash;
+        cachedSize += Buffer.byteLength(line, "utf-8");
+        return record;
+    }
+    finally {
+        release();
+    }
 }
 export function readAuditLog() {
     const path = auditPath();
@@ -147,6 +265,7 @@ export function toCsv(records) {
 // Test-only — flush in-memory chain cache so a fresh path is re-read.
 export function resetCacheForTest() {
     cachedLastHash = null;
+    cachedSize = 0;
 }
 // Safe wrapper that never throws into hot paths. Use this from production
 // call sites so a failed audit append cannot break a learning save or

package/dist/cli.js

@@ -503,6 +503,12 @@ async function runInit() {
         console.log("  2. Start a Copilot chat — ContextEngine tools are now available");
         console.log("  3. Run `contextengine score` to get your AI-readiness baseline");
         console.log("");
+        // Browser-capture nudge — fires once, never blocks init
+        const extensionSecretPath = join(homedir(), ".contextengine", "extension-secret");
+        if (!existsSync(extensionSecretPath)) {
+            console.log("  💡 Next: run `opscontext init-extension-secret` to enable browser capture from Claude.ai and ChatGPT.");
+            console.log("");
+        }
     }
     finally {
         rl.close();
@@ -520,9 +526,10 @@ import { listProjects, runComplianceAudit, formatProjectList, formatPlan, scoreP
 import { listLearnings, learningsToChunks, learningsStats, formatLearnings, saveLearning, deleteLearning, importLearningsFromFile, autoImportFromSources, LEARNING_CATEGORIES, } from "./learnings.js";
 import { saveSession, loadSession, listSessions, deleteSession, formatSession, formatSessionList, } from "./sessions.js";
 import { activate, deactivate, getActivationStatus, gateCheck, } from "./activation.js";
+import { syncTierA, syncTierB, loadCommunityStore, communityRulesToChunks, mergeWithDedup, STORE_PATH as COMMUNITY_STORE_PATH, } from "./community-sync.js";
 import { readAuditLog, verifyChain, filterByRange, toCsv, } from "./audit.js";
 import { loadRepoPolicy, parsePolicy, formatPolicySummary, formatValidationErrors, repoPolicyPath, } from "./policy.js";
-import { getStagedFiles, runSecretScan, runDocCoverage, formatSecretViolations, formatDocCoverageViolations, formatSecretViolationsJson, formatDocCoverageViolationsJson, } from "./hooks.js";
+import { getStagedFiles, runSecretScan, runDocCoverage, runCommitMessageRequired, formatSecretViolations, formatDocCoverageViolations, formatSecretViolationsJson, formatDocCoverageViolationsJson, formatCommitMessageViolations, formatCommitMessageViolationsJson, } from "./hooks.js";
 import { safeAppend } from "./audit.js";
 import { installSkill, locateBundledSkill, buildManagedBlock, syncClaudeMd, } from "./claude-integration.js";
 import { fileURLToPath } from "url";
@@ -537,7 +544,7 @@ const isNonInteractive = !process.stdin.isTTY || process.argv.includes("--yes")
  */
 async function initEngine() {
     const sources = loadSources();
-    const chunks = ingestSources(sources);
+    let chunks = ingestSources(sources);
     const config = loadConfig();
     const projectDirs = loadProjectDirs();
     // Collect operational data
@@ -567,6 +574,16 @@ async function initEngine() {
     const projectNames = projectDirs.map((d) => d.name);
     const learningChunks = learningsToChunks(projectNames);
     chunks.push(...learningChunks);
+    // Inject community rules (Tier A public + Tier B Pro), deduped against
+    // the local Learnings Store so identical content doesn't double-emit.
+    // Network is NOT touched here — only the cached store at
+    // ~/.contextengine/community-learnings.json is read. Use the
+    // `sync-community-rules` subcommand to refresh the cache.
+    const communityChunks = communityRulesToChunks();
+    if (communityChunks.length > 0) {
+        const localChunks = chunks;
+        chunks = mergeWithDedup(localChunks, communityChunks);
+    }
     return { sources, chunks };
 }
 // ---------------------------------------------------------------------------
@@ -828,6 +845,9 @@ async function cliExportLearnings(args) {
     let category;
     let format = "json";
     let universalToo = false;
+    let tier;
+    let outputPath;
+    let review = false;
     for (let i = 0; i < args.length; i++) {
         const a = args[i];
         if ((a === "--project" || a === "-p") && args[i + 1]) {
@@ -851,25 +871,114 @@ async function cliExportLearnings(args) {
             universalToo = true;
             continue;
         }
+        if (a === "--tier" && args[i + 1]) {
+            const t = args[++i];
+            if (t !== "A" && t !== "B") {
+                console.error(`Unknown tier: ${t}. Supported: A, B.`);
+                process.exit(1);
+            }
+            tier = t;
+            continue;
+        }
+        if ((a === "--output" || a === "-o") && args[i + 1]) {
+            outputPath = args[++i];
+            continue;
+        }
+        if (a === "--review") {
+            review = true;
+            continue;
+        }
         if (a === "-h" || a === "--help") {
-            console.log(`Usage: contextengine export-learnings [--project NAME] [--category CAT] [--format json|markdown] [--include-universal]
+            console.log(`Usage: contextengine export-learnings [--tier A|B] [--output PATH] [--review]
+                                       [--project NAME] [--category CAT]
+                                       [--format json|markdown] [--include-universal]
+
+TWO MODES:
+
+  1) Legacy raw export — no --tier flag. Writes the raw, unredacted store
+     filtered by --project / --category. Use only for personal backups or
+     when sharing inside a trusted team. NOT safe for public distribution.
+
+  2) Tier-aware redacted export — pass --tier A or --tier B.
 
-Exports learnings as JSON or Markdown. Use --project to scope to a single
-project's learnings (essential for consultants who share artifacts with
-clients — the universal store mixes all projects together by default).
+       --tier A   MIT-publishable subset. Pipeline:
+                    a) Reuses the secret/PII patterns from
+                       chrome-extension/src/content/shared/redact.ts
+                       (cloud-vendor credential shapes, JWT, bearer
+                       tokens, SSH private-key blocks, generic
+                       credential-assignment patterns).
+                    b) Strips PII: emails → [EMAIL], phone digits →
+                       [PHONE], credit-card-shape → [CC].
+                    c) Strips personal identifiers ("yannick", "yan",
+                       "compr.ch/.fr") and project brand names
+                       (CROWLR / KONIVE / INVOC / PLANK / COMPR / FASTPROD)
+                       → [project]. Local /Users/yan/Projects/* paths
+                       become /workspace/*. api.compr.ch → [SERVER].
+                    d) Filters to allow-list categories
+                       (debugging / tooling / git / frontend / testing /
+                       dependencies / performance / other). Drops
+                       security / deployment / infrastructure / devops
+                       unless the entry is tagged 'safe' (manual vet).
+                    e) Hashes IDs and project names — co-clustering
+                       survives but local UUIDs and brand names do not.
+                  Safety contract enforced by the LOCK comment block at
+                  the top of src/community-export.ts. Do NOT relax the
+                  redactor without re-running the full test suite.
 
-  --project NAME         Only learnings tagged with this project (case-insensitive)
+       --tier B   Full corpus for PRO subscribers (api.compr.ch heartbeat).
+                  Still redacted for secrets + PII (the redactor handles
+                  that), but security/deployment learnings are INCLUDED
+                  and original IDs are preserved (authenticated surface).
+
+       --output PATH   Where to write the JSON. Default:
+                       ./learnings-export-tierA.json / -tierB.json.
+       --review        Open \$EDITOR (or vi) on the export JSON for a
+                       manual trim before final write. Skipped if stdin
+                       is not a TTY.
+
+Legacy flags (no --tier):
+  --project NAME         Only learnings tagged with this project
   --category CAT         Only this category (deployment, security, etc.)
   --format json|markdown Output format (default: json)
-  --include-universal    Also include unscoped learnings (project=undefined)
-                         alongside the project-filtered ones
+  --include-universal    Also include unscoped learnings
 
-Cross-client confidentiality: without --project, this exports the FULL store.
-Always use --project NAME when sharing exported learnings with anyone outside
-the owning project's team.`);
+Cross-client confidentiality: without --tier and without --project, this
+exports the FULL raw store. Always use --tier A for public sharing, or
+--project NAME for trusted-team sharing inside one engagement.`);
             return;
         }
     }
+    // Tier-aware sanitized export path.
+    if (tier) {
+        const { exportLearnings, reviewLoop } = await import("./community-export.js");
+        const out = outputPath || join(process.cwd(), `learnings-export-tier${tier}.json`);
+        let result = exportLearnings({ tier, outputPath: out, review });
+        if (review) {
+            const edited = await reviewLoop(result.rules);
+            const payload = {
+                version: 1,
+                tier,
+                generatedAt: new Date().toISOString(),
+                count: edited.length,
+                dropped: result.dropped + (result.count - edited.length),
+                rules: edited,
+            };
+            writeFileSync(out, JSON.stringify(payload, null, 2) + "\n", "utf-8");
+            result = { ...result, count: edited.length, rules: edited };
+        }
+        console.log(`✅ Tier ${tier} export written to ${out}`);
+        console.log(`   Included: ${result.count}`);
+        console.log(`   Dropped:  ${result.dropped}`);
+        if (tier === "A") {
+            console.log(`   Note: Tier A is MIT-publishable. Safety guarantees enforced by`);
+            console.log(`         the LOCK [COMMUNITY-EXPORT-SAFETY] block in src/community-export.ts.`);
+        }
+        else {
+            console.log(`   Note: Tier B is PRO-only. Distribute via the api.compr.ch`);
+            console.log(`         license heartbeat, never via a public mirror.`);
+        }
+        return;
+    }
     let all = listLearnings(category);
     if (project) {
         const lower = project.toLowerCase();
@@ -941,7 +1050,7 @@ async function cliAuditExport(args) {
             continue;
         }
         if (a === "-h" || a === "--help") {
-            console.log(`Usage: contextengine audit-export [--since ISO_DATE] [--until ISO_DATE] [--format jsonl|csv]\n\nExports the hash-chained audit log from ~/.contextengine/audit.log.\nCompliance use: SOC2 CC7.2, ISO 27001 A.12.4.1.`);
+            console.log(`Usage: contextengine audit-export [--since ISO_DATE] [--until ISO_DATE] [--format jsonl|csv]\n\nExports the hash-chained audit log from ~/.contextengine/audit.log.\nCompliance use: produces evidence aligned with SOC 2 CC7.2 + ISO 27001 A.12.4.1\n(evidence artifacts — OpsContext is not itself certified; see docs/compliance/).`);
             return;
         }
     }
@@ -1118,6 +1227,23 @@ Subcommands:
   doc-coverage   For each policy.doc_coverage rule, check whether the
                  commit touches matching source paths AND the required
                  doc section is staged. Exit 1 on blocking violations.
+  commit-message-required [MSG_FILE]
+                 For each policy.commit_message_required rule, check
+                 whether the commit touches matching source paths AND
+                 the commit message matches the required pattern. Exit 1
+                 on blocking violations. Bypass: include
+                 \`--skip-multi-agent-reason: <reason>\` in the commit
+                 body (≥ 20 chars, must contain whitespace, must be at
+                 the start of its own line) — bypass is recorded as a
+                 policy.skipped audit event (no exit-1).
+
+                 MSG_FILE: path to the commit message file. Passed by the
+                 commit-msg git hook as \$1. Lookup order:
+                   1. positional arg (preferred, what commit-msg passes)
+                   2. COMMIT_MSG_FILE env (test injection)
+                   3. .git/COMMIT_EDITMSG (legacy fallback — note this is
+                      UNRELIABLE from pre-commit; use the commit-msg
+                      hook lifecycle).
 
 Env:
   CE_JSON=1      Emit one-line JSON per check instead of human-readable
@@ -1209,6 +1335,69 @@ tamper-evident audit log at ~/.contextengine/audit.log.`);
             process.exit(1);
         return;
     }
+    if (sub === "commit-message-required") {
+        // Locate the commit-message file. Order:
+        //   1. CLI positional arg (`contextengine hook commit-message-required
+        //      <path>`) — this is what the commit-msg git hook passes via $1.
+        //      Verifier P0 fix (2026-06-26): the previous implementation read
+        //      .git/COMMIT_EDITMSG from inside the PRE-COMMIT hook, but git
+        //      does not populate that file until AFTER pre-commit returns.
+        //      The check now runs from commit-msg, which gets the actual
+        //      message file path as its first argument.
+        //   2. COMMIT_MSG_FILE env (for test injection / scripted callers).
+        //   3. .git/COMMIT_EDITMSG in the repo root — backward-compat
+        //      fallback ONLY for legacy invocations. Will be empty / stale
+        //      when called from pre-commit; that's the documented footgun
+        //      this fix retires.
+        const commitMsgFile = args[1] ||
+            process.env.COMMIT_MSG_FILE ||
+            join(repoRoot, ".git", "COMMIT_EDITMSG");
+        let commitMessage = "";
+        if (existsSync(commitMsgFile)) {
+            try {
+                commitMessage = readFileSync(commitMsgFile, "utf-8");
+            }
+            catch {
+                // Fall through — empty message will fail any rule that fires,
+                // surfacing the description to the user.
+            }
+        }
+        const violations = runCommitMessageRequired(policy, stagedFiles, commitMessage);
+        if (jsonMode) {
+            process.stdout.write(formatCommitMessageViolationsJson(violations) + "\n");
+        }
+        else {
+            console.log(formatCommitMessageViolations(violations));
+        }
+        let exitBlock = false;
+        for (const v of violations) {
+            if (v.kind === "bypass") {
+                // Bypass IS the auditable opt-out. Record the reason; let the
+                // commit proceed.
+                safeAppend("policy.skipped", {
+                    check: "commit-message-required",
+                    rule_id: v.ruleId,
+                    matched_files: v.matchedFiles,
+                    pattern: v.pattern,
+                    bypass_reason: v.bypassReason,
+                });
+                continue;
+            }
+            // missing-pattern
+            safeAppend("hook.block", {
+                check: "commit-message-required",
+                rule_id: v.ruleId,
+                matched_files: v.matchedFiles,
+                pattern: v.pattern,
+                reason: "commit-message-pattern-not-matched",
+            });
+            if (v.severity === "block")
+                exitBlock = true;
+        }
+        if (exitBlock)
+            process.exit(1);
+        return;
+    }
     console.error(`Unknown hook subcommand: ${sub}. Try 'contextengine hook --help'.`);
     process.exit(1);
 }
@@ -1716,6 +1905,107 @@ async function cliImportLearnings(args) {
     }
 }
 // ---------------------------------------------------------------------------
+// CLI: sync-community-rules — fetch + cache community learnings
+// ---------------------------------------------------------------------------
+async function cliSyncCommunityRules(args) {
+    let force = false;
+    let tier = "all";
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === "--force" || a === "-f") {
+            force = true;
+            continue;
+        }
+        if (a === "--tier" && args[i + 1]) {
+            const t = args[++i];
+            if (t !== "A" && t !== "B" && t !== "all") {
+                console.error(`Unknown tier: ${t}. Try A | B | all.`);
+                process.exit(1);
+            }
+            tier = t;
+            continue;
+        }
+        if (a === "-h" || a === "--help") {
+            console.log(`Usage: opscontext sync-community-rules [--force] [--tier A|B|all]
+
+Fetches community-contributed learnings into the local cache at
+${COMMUNITY_STORE_PATH}.
+
+Two tiers:
+  Tier A (public)   raw.githubusercontent.com — no license required
+  Tier B (pro)      api.compr.ch — requires an activated Pro license
+
+Behavior:
+  - Daily run recommended. Cron / launchd / periodic CI all fine — the
+    sync is idempotent and ETag-guarded (304 = cheap no-op).
+  - Network failures NEVER crash the search engine. On any HTTP error
+    (timeout, DNS, 5xx, malformed JSON), the cached store is preserved
+    and search continues to work offline.
+  - Tier B is best-effort: with no license loaded (free tier) it is
+    skipped silently with a note on stderr. On HTTP 401 / 403 the
+    error is logged but no exception is thrown — your existing search
+    keeps working.
+  - Tier B responses are Ed25519-signed; an invalid signature causes
+    the fetched payload to be discarded.
+
+Flags:
+  --force, -f         Bypass the ETag cache; always re-fetch.
+  --tier A|B|all      Restrict the sync to one tier. Default: all.
+
+After sync, the new rules are picked up automatically by search_context
+the next time the MCP server (re)indexes. Restart the server or run
+'opscontext reindex' to force an immediate pickup.`);
+            return;
+        }
+    }
+    console.log(`\n🌐 Sync community rules (tier=${tier}, force=${force})\n`);
+    if (tier === "A" || tier === "all") {
+        const r = await syncTierA({ force });
+        if (r.cached) {
+            console.log(`  Tier A — cached (no changes since last fetch)`);
+        }
+        else {
+            console.log(`  Tier A — fetched ${r.fetched} rule(s)`);
+        }
+    }
+    if (tier === "B" || tier === "all") {
+        // Resolve license through the activation module to keep auth shape
+        // identical to /heartbeat — same machineId, same key.
+        const licenseFile = join(homedir(), ".contextengine", "license.json");
+        let token = null;
+        if (existsSync(licenseFile)) {
+            try {
+                const data = JSON.parse(readFileSync(licenseFile, "utf-8"));
+                token = typeof data.key === "string" ? data.key : null;
+            }
+            catch { /* malformed — treat as no license */ }
+        }
+        if (!token) {
+            if (tier === "B") {
+                console.error(`  Tier B — no license loaded. Activate with: opscontext activate <key> <email>`);
+            }
+            else {
+                console.log(`  Tier B — skipped (no license loaded)`);
+            }
+        }
+        else {
+            const r = await syncTierB(token, { force });
+            if (r.cached) {
+                console.log(`  Tier B — cached (no changes since last fetch)`);
+            }
+            else if (r.fetched === 0) {
+                console.log(`  Tier B — 0 rules (auth rejected or empty payload — see stderr)`);
+            }
+            else {
+                console.log(`  Tier B — fetched ${r.fetched} rule(s)`);
+            }
+        }
+    }
+    const store = loadCommunityStore();
+    console.log(`\n  Store now holds ${store.rules.length} total community rule(s).`);
+    console.log(`  Path: ${COMMUNITY_STORE_PATH}\n`);
+}
+// ---------------------------------------------------------------------------
 // CLI: stats — show live session stats from MCP server
 // ---------------------------------------------------------------------------
 function cliStats() {
@@ -1770,20 +2060,28 @@ Usage:
   contextengine save-learning <text> -c <category>  Save a learning
   contextengine delete-learning <id>   Delete a learning by ID
   contextengine import-learnings <file> [-c cat] [-p project]  Bulk-import learnings
-  contextengine export-learnings [--project NAME] [--category CAT] [--format json|markdown] [--include-universal]
-                                       Export learnings (scope to one project for safe sharing)
+  contextengine export-learnings [--tier A|B] [--output PATH] [--review] [--project NAME] [--category CAT] [--format json|markdown] [--include-universal]
+                                       Export learnings. --tier A → MIT-publishable redacted subset (LOCKed safety pipeline).
+                                                         --tier B → full PRO corpus (still redacted; original IDs preserved).
+                                                         (no --tier) → legacy raw export, NOT safe for public distribution.
   contextengine save-session <name> <key> <value>   Save session context
   contextengine load-session <name>    Restore session context
   contextengine list-sessions          List all saved sessions
   contextengine delete-session <name>  Delete a saved session
   contextengine end-session            Pre-flight checklist (uncommitted changes, doc freshness)
   contextengine audit-export [--since DATE] [--until DATE] [--format jsonl|csv]
-                                       Export hash-chained audit log (SOC2/ISO27001 evidence)
+                                       Export hash-chained audit log (evidence aligned with
+                                       SOC 2 CC7.2 + ISO 27001 A.12.4.1 — not a certification)
   contextengine audit-verify           Verify audit log chain integrity (tamper detection)
   contextengine policy <validate|show> [args]
                                        Author + validate the declarative .contextengine/policy.json
   contextengine init-extension-secret [--force]
                                        Generate ~/.contextengine/extension-secret for the browser ext
+  contextengine install-autostart [--force]
+                                       Install macOS LaunchAgent so MCP server auto-starts at login
+                                       (uninstall-autostart / autostart-status — companion commands)
+  contextengine install-claude-hook    Wire Claude Code terminal sessions into the OpsContext audit log
+                                       (UserPromptSubmit + PostToolUse + SessionStart hook entries)
   contextengine watch [--json] [--severity info|warn|critical] [--once] [--window SECONDS]
                                        Stream drift / loop / stuck-tool / fabrication alerts from the audit log
   contextengine emit-event <kind> <payload-json> [--actor NAME]
@@ -1796,6 +2094,10 @@ Usage:
   contextengine sync-claude-md [--path CLAUDE.md] [--dry-run]
                                        Refresh the OpsContext-managed block in CLAUDE.md
                                        (top learnings + policy summary + recent hook blocks)
+  contextengine sync-community-rules [--force] [--tier A|B|all]
+                                       Fetch community-contributed learnings (Tier A = GitHub
+                                       public, Tier B = api.compr.ch Pro). Daily run recommended.
+                                       Network failures fall back to cached store.
   contextengine score [project] [--html] [--no-save] AI-readiness score (Pro, writes SCORE.md)
   contextengine audit                  Run compliance audit (Pro)
   contextengine activate <key> <email> Activate a Pro license
@@ -2004,6 +2306,42 @@ else if (command === "init-extension-secret") {
         process.exit(1);
     });
 }
+else if (command === "install-autostart") {
+    import("./install-autostart.js").then((m) => m.cliInstallAutostart(process.argv.slice(3))).catch((err) => {
+        console.error("Error:", err instanceof Error ? err.message : err);
+        process.exit(1);
+    });
+}
+else if (command === "uninstall-autostart") {
+    import("./install-autostart.js").then((m) => m.cliUninstallAutostart(process.argv.slice(3))).catch((err) => {
+        console.error("Error:", err instanceof Error ? err.message : err);
+        process.exit(1);
+    });
+}
+else if (command === "autostart-status") {
+    import("./install-autostart.js").then((m) => m.cliAutostartStatus(process.argv.slice(3))).catch((err) => {
+        console.error("Error:", err instanceof Error ? err.message : err);
+        process.exit(1);
+    });
+}
+else if (command === "install-claude-hook") {
+    import("./install-claude-hook.js").then((m) => m.cliInstallClaudeHook(process.argv.slice(3))).catch((err) => {
+        console.error("Error:", err instanceof Error ? err.message : err);
+        process.exit(1);
+    });
+}
+else if (command === "uninstall-claude-hook") {
+    import("./install-claude-hook.js").then((m) => m.cliUninstallClaudeHook(process.argv.slice(3))).catch((err) => {
+        console.error("Error:", err instanceof Error ? err.message : err);
+        process.exit(1);
+    });
+}
+else if (command === "sync-community-rules") {
+    cliSyncCommunityRules(process.argv.slice(3)).catch((err) => {
+        console.error("Error:", err);
+        process.exit(1);
+    });
+}
 else if (command === "stats") {
     cliStats();
 }