@compr/opscontext-mcp 2.8.4 → 2.9.1

package/CHANGELOG.md

@@ -4,6 +4,86 @@ All notable changes to OpsContext for AI Agents (previously ContextEngine — MC
 
 > Entries for 2.2.0 through 2.4.0 were not backfilled here; see `docs/sessions/SESSION_19` through `SESSION_21` for those releases.
 
+## [Unreleased]
+
+## [2.9.1] 2026-09-25: a staged file name is data, never shell
+
+### Security
+
+- **A staged file name is data, never shell** (`src/hooks.ts`, LOCK
+  `[STAGED-PATH-IS-AN-ARGUMENT-NEVER-A-SHELL-STRING]`). The pre-commit checkers ran
+  `git diff --cached -- "<name>"` and `git show :"<name>"` through a shell, escaping only the
+  double quote. Proven on 2026-09-25: a staged file named `note$(touch PROOF).md` ran `touch`
+  while `contextengine hook secret-scan` listed the staged files, so a cloned repo or a pull
+  request could run a command on the committer's machine. Names now reach git as arguments,
+  listed with `-z` and matched with a `:(literal)` pathspec; the rule-parity index read, whose
+  names come from `policy.json`, takes the same path.
+- **Every staged file is scanned, whatever its name.** The same line dropped every non-ASCII
+  name (git prints `caf\303\251.md` quoted, the lookup failed, the file was skipped unscanned)
+  and a name containing `*` matched other files too. A planted key in `café.md` passed the
+  scanner before; it is caught now. A diff above 1 MB was skipped silently as well; the buffer
+  is 32 MB.
+
+## [2.9.0] 2026-09-25: credentials and prompt words stay out of the audit log
+
+### Security
+
+- **The public repo is now a release copy** (`scripts/release-public.sh`, LOCK
+  `[PUBLIC_REPO_ONLY_FROM_RELEASE_SCRIPT]`). The working repo goes private; the public one
+  receives only the code, tests, README, licence and change list, checked for forbidden paths
+  and scanned for credential shapes before every push. The licence server code is no longer public.
+
+- **Captured text is redacted before it reaches the audit log** (`src/secret-shapes.ts`,
+  `src/http-server.ts`, LOCK `[CAPTURE-IS-REDACTED-AT-THE-DOOR]`). The Claude Code hook sent the
+  first 4,000 characters of every prompt and 200 of every command unfiltered. Every capture event
+  now passes one set of credential shapes (vendor keys, passwords inside URLs, `sshpass -p`,
+  `mysql -p`, `Bearer`, `curl -u`, `--password`, `name = value`) at the one receiver, from every
+  surface.
+- **`contextengine audit-scrub [--apply --reason "..."]`** removes the same shapes from records
+  written before, and acknowledges every rewrite on the chain, so `audit-verify` still passes
+  (LOCK `[SCRUB-IS-ACKNOWLEDGED-REDACTION]`). Dry run by default, idempotent.
+- **The search index never holds a credential** (LOCK `[INDEX-NEVER-SERVES-A-CREDENTIAL]`): every
+  chunk is redacted as the index is built, including dotenv-derived chunks, whose masking had
+  skipped the password inside a database URL.
+- **Prompts and AI responses are no longer stored as text** (LOCK `[PROMPT-TEXT-IS-NOT-KEPT]`):
+  the audit log keeps their length and a keyed fingerprint, so an exact repeat is still caught;
+  commands keep their redacted text. `OPSCONTEXT_KEEP_PROMPT_TEXT=1` restores the old behaviour.
+- **The Claude Code hook keeps the prompt and the receiver's secret off curl's command line**,
+  where every program on the machine could read them (LOCK `[HOOK-KEEPS-PROMPT-AND-SECRET-OFF-ARGV]`).
+  Existing installs get it with `contextengine install-claude-hook`.
+
+### Fixed
+
+- **`contextengine servers` reported a server as current when only a module other than the entry
+  script had changed** (LOCK `[BUILD-HASH-COVERS-EVERY-MODULE]`): the build fingerprint now covers
+  every `.js` file of the build.
+
+- **Two overlapping rotations could erase archived history** (`src/audit.ts`, LOCKs
+  `[ROTATION-HOLDS-THE-LOCK-BEFORE-IT-PLANS]` and `[SEGMENT-IS-NEVER-OVERWRITTEN]`). Only the
+  automatic rotation took the rotate lock; the manual `audit-rotate` did not. On 2026-09-15 two
+  rotations both wrote `audit-0020.jsonl`, the second replaced the first, and 51,174 records
+  vanished (`audit-verify`: one orphan). Every rotation now takes the lock before it plans,
+  numbers its segment from the highest existing one, puts it in place without ever replacing a
+  file, and stops if the live log changed under it. Replayed in two real processes: the old
+  build erased 200,000 of 300,000 records; the new one lost nothing at any timing, even with its
+  lock broken.
+
+### Added
+
+- **`contextengine audit-restore <file> [--apply --reason "..."]`** (LOCK
+  `[RESTORE-ONLY-CLOSES-A-PROVEN-GAP]`). Puts a lost block of records back from a backup, only
+  into a gap `audit-verify` reports, only at a segment boundary, and only if the block is the
+  original: strictly linear, every hash valid, joined to both sides of the gap. Dry run by
+  default; `--apply` re-verifies, removes its own segment unless the chain improved by exactly
+  that gap, and records an `audit.restore` event. The 51,174 records above were restored from a
+  Time Machine snapshot with it, and the chain verifies again.
+
+### Docs
+
+- **The npm page matches the new behaviour**: Browser Capture and the Claude Code step no longer
+  say prompts are stored as text, the privacy table says what the package version is used for
+  now, and every link points to the public repo `FASTPROD/opscontext-mcp`.
+
 ## [2.8.4] 2026-09-17: a gate on complexity, a watch on doubled hooks
 
 ### Added

package/README.md

@@ -12,7 +12,7 @@ Claude Code, Cursor, and Copilot write code without seeing your servers — so t
 
 OpsContext is an [MCP](https://modelcontextprotocol.io) server. It runs locally, snapshots your live infra (PM2 processes, nginx config, Docker containers, git status, cron jobs, redacted env), and exposes it via tools your AI coding agents (Claude Code, Cursor, Copilot, Windsurf, OpenClaw) can call in real time. Everything stays on your machine — no telemetry, no code uploads.
 
-> **🌐 Browser Capture (Phase 1, shipped 2026-06):** OpsContext now captures prompts + assistant responses + tool calls from **Claude.ai**, **ChatGPT.com**, *and* your **Claude Code** terminal sessions into the same hash-chained audit log. Cross-surface drift detection becomes possible (e.g. catch when a model says one thing in the browser and another in the terminal). See [Step 3](#3-capture-browser--claude-code-events-optional) below.
+> **🌐 Browser Capture (Phase 1, shipped 2026-06):** OpsContext now records prompts, assistant responses and tool calls from **Claude.ai**, **ChatGPT.com**, *and* your **Claude Code** terminal sessions in the same hash-chained audit log. Since 2.9.0 a prompt or a response is kept as its length and a keyed fingerprint, never its words; commands are kept with credentials redacted. Cross-surface drift detection becomes possible (e.g. catch when a model says one thing in the browser and another in the terminal). See [Step 3](#3-capture-browser--claude-code-events-optional) below.
 
 ## Why
 
@@ -35,8 +35,8 @@ Plus the persistent-memory + search features carried forward from the contexteng
 - ⚡ **Instant startup** — keyword search ready immediately, embeddings load in background
 - 💾 **Session Persistence** — AI agents can save/restore context across conversations
 - 💡 **Learning Store** — permanent operational rules that auto-surface in search results
-- �️ **Protocol Firewall** — progressive enforcement that ensures agents commit, document, and save learnings
-- �🔌 **Plugin Adapters** — extend with custom data sources (Notion, Jira, RSS, etc.)
+- 🛡️ **Protocol Firewall** — progressive enforcement that ensures agents commit, document, and save learnings
+- 🔌 **Plugin Adapters** — extend with custom data sources (Notion, Jira, RSS, etc.)
 - 🧩 **MCP native** — works with any MCP-compatible client (VS Code, Claude, Cursor, OpenClaw)
 
 ### What OpsContext is NOT
@@ -167,7 +167,7 @@ npm i -g @compr/opscontext-mcp && opscontext install-claude-hook
 
 (Prefer the global install here: the hook scripts keep absolute paths to the CLI, and an `npx` cache copy can be pruned.)
 
-Adds `UserPromptSubmit`, `PostToolUse`, and `SessionStart` hook entries to `~/.claude/settings.json` so every Claude Code prompt + tool call lands in the same audit log as the browser events, plus a `Stop` entry: the **session gate** (2.7.0). A Claude Code turn cannot end while the repo's OpsContext session is older than the last commit; the agent is told which session to save, which session doc to update, and how far the agent docs are behind. No more "did you save the session?" at the end of a day. Details: `npx @compr/opscontext-mcp session-gate --help`.
+Adds `UserPromptSubmit`, `PostToolUse`, and `SessionStart` hook entries to `~/.claude/settings.json` so every Claude Code prompt (kept as a length and a keyed fingerprint, not its words) and tool call (credentials redacted) lands in the same audit log as the browser events, plus a `Stop` entry: the **session gate** (2.7.0). A Claude Code turn cannot end while the repo's OpsContext session is older than the last commit; the agent is told which session to save, which session doc to update, and how far the agent docs are behind. No more "did you save the session?" at the end of a day. Details: `npx @compr/opscontext-mcp session-gate --help`.
 
 Verify:
 ```bash
@@ -539,7 +539,7 @@ Everything happens locally — search, scoring, learnings, sessions, embeddings.
 | License key (`CE-XXXX-...`) | Activation + daily heartbeat | Validate subscription |
 | Machine ID (SHA-256 hash) | Activation + daily heartbeat | Enforce machine limit |
 | Email | Activation only | Tie the licence to an account |
-| Package version | Activation only | Serve a compatible module bundle |
+| Package version | Activation only | Recorded with your activation, so support knows which version a machine runs |
 | Platform/arch (e.g., `darwin/arm64`) | Activation only | Compatibility check |
 | Licence bundle version | Daily heartbeat | Compatibility marker carried in the signed licence |
 
@@ -553,7 +553,7 @@ That is the complete list. The activation request sends exactly six fields and t
 
 One file in the published package is deliberately unreadable: `dist/rubric.js`, which holds the scoring thresholds (what earns which points). Those values are commercial IP under [BSL-1.1](LICENSE), and knowing them exactly makes an AI-readiness score easy to game by padding files to hit a number rather than doing the work.
 
-**What that hides: values. What it does not hide: behaviour.** No code path, network call, file access, or data flow is concealed anywhere in this package. The scoring logic itself, every collector, the search ranker, and both network calls above ship as readable JavaScript — and the full source is public at [FASTPROD/ContextEngine](https://github.com/FASTPROD/ContextEngine). If a privacy claim on this page were false, the code that broke it would be right there to find.
+**What that hides: values. What it does not hide: behaviour.** No code path, network call, file access, or data flow is concealed anywhere in this package. The scoring logic itself, every collector, the search ranker, and both network calls above ship as readable JavaScript — and the full source is public at [FASTPROD/ContextEngine](https://github.com/FASTPROD/opscontext-mcp). If a privacy claim on this page were false, the code that broke it would be right there to find.
 
 ### Why this matters
 
@@ -573,19 +573,19 @@ For commercial licensing: [yannick@compr.ch](mailto:yannick@compr.ch)
 
 ## Publisher
 
-**OpsContext is built by PROD LLC**, an operating brand of **[CSS LLC](https://compr.fr)** — a Swiss company incorporated in 2005.
+**OpsContext is built by PROD LLC**, an operating brand of **CSS LLC** (Cross Stream Solutions Sàrl), a Swiss company incorporated in 2005. The engineering team works under the FASTPROD name, which is also the GitHub organisation hosting this repository.
 
 The VS Code Marketplace lists the extension under the legal-parent publisher ID `css-llc`; the npm package is published under the `@compr` scope. Both belong to the same entity.
 
-PROD LLC also operates these product brands:
+PROD LLC also operates these products. The full, current list is on **[compr.fr](https://compr.fr)**.
 
-| Brand | What it does | Site |
+| Product | What it does | Site |
 |---|---|---|
-| **FASTPROD** | DevOps + sysadmin operator (the team behind this project) | [fast-prod.com](https://fast-prod.com) |
-| **CROWLR** | Crawling + monitoring platform | [crowlr.io](https://crowlr.io) · [admin.crowlr.com](https://admin.crowlr.com) |
-| **KONIVE** | (product) | [konive.com](https://konive.com) |
-| **INVOC** | (product) | [invoc.io](https://invoc.io) · [invoc.me](https://invoc.me) |
-| **PLANK** | (product) | [plank.io](https://plank.io) |
-| **compR** | Portfolio + benchmark widget | [compr.fr](https://compr.fr) · [compr.app](https://compr.app) |
-
-Contact: [yannick@compr.ch](mailto:yannick@compr.ch). Full corporate disclosure at [docs/about.md](docs/about.md).
+| **CROWLR** | Recruitment software: applicant tracking for companies, a job app for candidates, live event sensing | [admin.crowlr.com](https://admin.crowlr.com) · [app.crowlr.com](https://app.crowlr.com) · [crowlr.io](https://www.crowlr.io) |
+| **KONIVE** | AI career agent: salary negotiation and job matching | [konive.com](https://konive.com) |
+| **INVOC** | Grocery scanner app for shoppers, brand monitoring for food companies | [invoc.io](https://invoc.io) |
+| **INVOC.me** | Demand forecasting shared by operations, sales and finance | [invoc.me](https://invoc.me) |
+| **PLANK** | Hyperlocal social app for iOS and Android | [plank.io](https://plank.io) |
+| **compR** | Company site, and candidate credibility scoring | [compr.fr](https://compr.fr) · [compr.app](https://compr.app) |
+
+Contact: [yannick@compr.ch](mailto:yannick@compr.ch). Full corporate disclosure at [docs/about.md](https://github.com/FASTPROD/opscontext-mcp/blob/main/docs/about.md).

package/defaults/claude-code-hook.sh

@@ -91,10 +91,18 @@ esac
 [ -n "$PAYLOAD" ] || exit 0
 
 # POST with 1s hard timeout. Any error → silent (curl >/dev/null 2>&1, exit 0).
-curl -sS --max-time 1.0 \
+# [LOCKED] [HOOK-KEEPS-PROMPT-AND-SECRET-OFF-ARGV] - 2026-09-25
+# [NEVER] put $PAYLOAD or $SECRET in curl's arguments (`--data "..."`, `-H "...: $SECRET"`).
+# WHY: a process's arguments are readable by every program on the machine (`ps`), for as long
+#      as curl runs, up to the 1 s timeout. Until 2.8.4 each prompt (up to 4,000 characters)
+#      and the receiver's shared secret rode there.
+# FIX: printf is a shell builtin, so it starts no process: it pipes the body into curl's
+#      standard input (--data-binary @-), and writes the header into a process-substitution
+#      file (-H @file, curl 7.55 and later), which only curl reads.
+printf '%s' "{\"events\":[$PAYLOAD]}" | curl -sS --max-time 1.0 \
   -H "Content-Type: application/json" \
-  -H "X-OpsContext-Secret: $SECRET" \
-  --data "{\"events\":[$PAYLOAD]}" \
+  -H @<(printf 'X-OpsContext-Secret: %s\n' "$SECRET") \
+  --data-binary @- \
   "$ENDPOINT" >/dev/null 2>&1
 
 exit 0

package/dist/audit.d.ts

@@ -1,4 +1,4 @@
-export type AuditEvent = "learning.save" | "learning.delete" | "learning.store_unreadable" | "learning.store_shrink_refused" | "learning.store_growth_refused" | "server.start" | "server.role" | "index.write" | "learning.import" | "learning.export" | "session.save" | "session.delete" | "activation.activate" | "activation.deactivate" | "activation.heartbeat" | "activation.signature_reject" | "activation.legacy_signature" | "firewall.escalate" | "hook.block" | "hook.bypass" | "policy.skipped" | "browser.prompt" | "browser.response" | "browser.tool_call" | "browser.session_start" | "browser.session_end" | "browser.capture_miss" | "vscode.prompt_submit" | "vscode.tool_call" | "vscode.session_start" | "drift.detected" | "notification.fired" | "community.sync_ok" | "community.sync_error" | "audit.rotate" | "audit.redact";
+export type AuditEvent = "learning.save" | "learning.delete" | "learning.store_unreadable" | "learning.store_shrink_refused" | "learning.store_growth_refused" | "server.start" | "server.role" | "index.write" | "learning.import" | "learning.export" | "session.save" | "session.delete" | "activation.activate" | "activation.deactivate" | "activation.heartbeat" | "activation.signature_reject" | "activation.legacy_signature" | "firewall.escalate" | "hook.block" | "hook.bypass" | "policy.skipped" | "browser.prompt" | "browser.response" | "browser.tool_call" | "browser.session_start" | "browser.session_end" | "browser.capture_miss" | "vscode.prompt_submit" | "vscode.tool_call" | "vscode.session_start" | "drift.detected" | "notification.fired" | "community.sync_ok" | "community.sync_error" | "audit.rotate" | "audit.redact" | "audit.restore";
 export interface AuditRecord {
     ts: string;
     event: AuditEvent;
@@ -26,11 +26,17 @@ export interface RotationPlan {
     segmentFile: string | null;
     /** Set when the rotation must not run, with the reason. */
     refusedReason: string | null;
+    /** Hash of the first live record and the live record count the plan was computed on. The
+     *  rotation only slices a log that still starts there. [LOCK] [ROTATION-HOLDS-THE-LOCK-BEFORE-IT-PLANS] */
+    firstLiveHash?: string | null;
+    liveCount?: number;
 }
 export interface RotationResult extends RotationPlan {
     rotated: boolean;
     bytesArchived: number;
     bytesRemaining: number;
+    /** True when another rotation held the rotate lock, so nothing was read or written. */
+    inProgress?: boolean;
 }
 export interface RotateOptions {
     /** Archive records older than this many days. Minimum 1. */
@@ -64,6 +70,20 @@ export declare function planRotation(opts?: RotateOptions): RotationPlan;
  * Refuses to run on a chain that does not currently verify: rotating a log with altered
  * or orphaned records would bake the damage into an append-only segment and make the
  * cause unrecoverable. Forks are fine — they are concurrency, not tampering.
+ *
+ * [LOCKED] [ROTATION-HOLDS-THE-LOCK-BEFORE-IT-PLANS] - 2026-09-24
+ * [NEVER] let any caller rotate without the rotate lock, and never plan (choose the segment
+ *         name, count the slice) before holding it.
+ * WHY: on 2026-09-15 at 12:44:46Z and 12:44:51Z two rotations both wrote audit-0020.jsonl. The
+ *      manual `audit-rotate` command called this function directly, and only autoRotateAuditLog()
+ *      took the lock. The second run planned while the first was mid-write (same segment name),
+ *      then applied its old count to the live log the first run had already cut: it archived the
+ *      first run's remainder into the same file name and erased the first run's segment. 51,174
+ *      records vanished; verifyChain() reported an orphan. They were put back on 2026-09-24 from a
+ *      Time Machine local snapshot with restoreSegment().
+ * FIX: this function takes the lock first and plans under it, so the manual command, auto-rotation
+ *      and anything added later all go through one lock. The slice is refused unless the live log
+ *      still starts with the record the plan read. A held lock returns inProgress, untouched.
  */
 export declare function rotateAuditLog(opts?: RotateOptions): RotationResult;
 /**
@@ -81,6 +101,8 @@ export declare function rotateAuditLog(opts?: RotateOptions): RotationResult;
  *      rotation buys ~a day of quiet. A dedicated rotate lock (O_EXCL, stale after 10 min,
  *      long enough to verify a 500k-record chain) makes late starters return "in progress"
  *      without touching the log. Opt out with CONTEXTENGINE_AUTO_ROTATE=0.
+ * 2026-09-24: the lock is now taken inside rotateAuditLog(), not here, because the manual
+ *      command bypassed it. [LOCK] [ROTATION-HOLDS-THE-LOCK-BEFORE-IT-PLANS]
  */
 export declare const AUTO_ROTATE_TRIGGER: number;
 /** Count newline-terminated lines without parsing. The live log is small by construction. */
@@ -162,8 +184,94 @@ export declare function acknowledgeRedaction(indices: number[], reason: string,
     }>;
     record: AuditRecord | null;
 };
+export interface RestorePlan {
+    /** Why the block cannot be restored; null when it fits. */
+    refusedReason: string | null;
+    records: number;
+    firstTs: string | null;
+    lastTs: string | null;
+    /** The segment the block goes right after. */
+    after: string | null;
+    /** The segment, or "audit.log", whose first record the block reconnects. */
+    before: string | null;
+    /** The name the restored segment gets. */
+    segmentFile: string | null;
+    /** History index, before the restore, of the orphan the block closes. */
+    orphanIndex: number | null;
+}
+export interface RestoreResult extends RestorePlan {
+    restored: boolean;
+    record: AuditRecord | null;
+}
+/**
+ * Put a lost block of records back into the archive, from a backup.
+ *
+ * [LOCKED] [RESTORE-ONLY-CLOSES-A-PROVEN-GAP] - 2026-09-24
+ * [NEVER] put records into the archive unless every record hashes correctly, each names the one
+ *         before it as its parent, the block's first parent is the last record of the segment it
+ *         follows, the record after the gap names the block's last record as its parent, and none
+ *         of the block's records is already in the log. Together these admit only the original
+ *         records: a substitute block would need a SHA-256 preimage.
+ * WHY: the archive is evidence. A restore that accepted any block would be a sanctioned way to
+ *      rewrite history, the one thing the chain exists to make visible. First real use: the
+ *      51,174 records erased on 2026-09-15 (see [SEGMENT-IS-NEVER-OVERWRITTEN]), found whole in a
+ *      Time Machine local snapshot on 2026-09-24.
+ * FIX: only a hole the verifier already reports can be filled, and only at a segment boundary.
+ *      Dry run by default. Apply takes the rotate lock before it plans, never overwrites a file,
+ *      re-verifies, removes its own segment unless the chain has exactly one orphan fewer and no
+ *      new damage, and records itself as an `audit.restore` event with a reason.
+ */
+export declare function restoreSegment(file: string, opts?: {
+    apply?: boolean;
+    reason?: string;
+    actor?: string;
+}): RestoreResult;
+export interface ScrubFileReport {
+    name: string;
+    records: number;
+    redacted: number;
+}
+export interface ScrubReport {
+    applied: boolean;
+    refusedReason: string | null;
+    files: ScrubFileReport[];
+    redactedRecords: number;
+    counts: Record<string, number>;
+    /** The audit.redact records appended to acknowledge the rewrite. */
+    acknowledgements: AuditRecord[];
+}
+type Redactor = (payload: Record<string, unknown>) => {
+    value: Record<string, unknown>;
+    counts: Record<string, number>;
+    changed: boolean;
+};
+/**
+ * Remove credentials from records already written, and acknowledge each rewrite on the chain.
+ *
+ * [LOCKED] [SCRUB-IS-ACKNOWLEDGED-REDACTION] - 2026-09-25
+ * [NEVER] rewrite a record's content without appending the audit.redact acknowledgement that
+ *         binds its original hash to its new content, and never touch a record that is not a
+ *         capture record or a line the redactor left unchanged.
+ * WHY: the credentials found on 2026-09-24 sat in 45 archived segments and the live log. Segments
+ *      are never overwritten ([SEGMENT-IS-NEVER-OVERWRITTEN]); this is the one sanctioned
+ *      exception, because leaving a live Stripe key or a database password in an evidence
+ *      archive forever is worse than an acknowledged edit. Without the acknowledgement the
+ *      verifier would, truthfully, call every scrubbed record altered.
+ * FIX: dry run by default. With apply: under the rotate lock (no rotation moves records while we
+ *      rewrite), each segment is rewritten via temp file and rename only where a line changed,
+ *      the live log under the append lock (appends wait, none is lost), then one audit.redact
+ *      record per 100 rewrites names each original hash and its new content hash
+ *      ([REDACTION-IS-A-CHAINED-RECORD]). Running it again changes nothing.
+ */
+export declare function scrubAuditLog(opts: {
+    apply?: boolean;
+    reason?: string;
+    redact: Redactor;
+    actor?: string;
+}): ScrubReport;
 export declare function filterByRange(records: AuditRecord[], since?: string, until?: string): AuditRecord[];
 export declare function toCsv(records: AuditRecord[]): string;
 export declare function resetCacheForTest(): void;
 export declare function safeAppend(event: AuditEvent, payload: Record<string, unknown>, actor?: string): void;
+export {};
 //# sourceMappingURL=audit.d.ts.map