@compr/opscontext-mcp 2.9.0 → 2.10.0

package/dist/http-server.js

@@ -29,6 +29,89 @@ const HOST = "127.0.0.1";
 const SECRET_FILE = join(homedir(), ".contextengine", "extension-secret");
 const MAX_BODY = 64 * 1024; // 64 KB per batch
 const MAX_BATCH = 50;
+// [LOCKED] [RECEIVER-ACCEPTS-ONLY-KNOWN-SENDERS] - 2026-09-25
+// [NEVER] widen the accepted kinds back to a prefix, accept a reserved actor, answer a web page's
+//         origin, or drop the rate cap.
+// WHY: E2E_REVIEW_2026-09 A2-2 to A2-4, measured on a sandbox receiver: any web page could read
+//      /health (Access-Control-Allow-Origin: *, and any Host header answered, the DNS-rebinding
+//      shape), so a site could tell OpsContext was installed; a sender holding the secret could
+//      write `cli.anything`, a bare `vscode.`, and actor "system"; and one local sender wrote
+//      10,000 valid records in 1.36 s (+12.8 MB) with nothing to slow it, noise that verifies as
+//      a valid chain and would bury real events past rotation in seconds.
+// FIX: exactly the capture kinds the hook and the extensions send (CAPTURE_EVENT_KINDS); an actor
+//      is a short slug and never "system" or "cli" (the server's and the CLI's own names); CORS
+//      headers only for browser-extension origins (the extension posts from its service worker,
+//      which needs none); Host must name this machine; a token bucket of BURST records refilled
+//      at RATE per second, the excess refused with 429 (the extension keeps and retries a refused
+//      batch) and counted in one ingest.rate_limited record per minute.
+export const CAPTURE_EVENT_KINDS = [
+    "browser.prompt",
+    "browser.response",
+    "browser.tool_call",
+    "browser.session_start",
+    "browser.session_end",
+    "browser.capture_miss",
+    "vscode.prompt_submit",
+    "vscode.tool_call",
+    "vscode.session_start",
+];
+const RESERVED_ACTORS = new Set(["system", "cli"]);
+const ACTOR_RE = /^[a-z][a-z0-9-]{1,31}$/;
+const RATE_PER_SEC = 200;
+const BURST = 1000;
+/** An event kind and actor the door accepts, or why not. Shared with `contextengine emit-event`. */
+export function checkCaptureEvent(kind, actor, opts = {}) {
+    if (typeof kind !== "string" || !CAPTURE_EVENT_KINDS.includes(kind)) {
+        return `event kind '${String(kind)}' not accepted (one of: ${CAPTURE_EVENT_KINDS.join(", ")})`;
+    }
+    if (actor === undefined)
+        return null;
+    if (typeof actor !== "string" || !ACTOR_RE.test(actor))
+        return `actor must be a short lowercase name`;
+    if (RESERVED_ACTORS.has(actor) && !(opts.allowCliActor && actor === "cli"))
+        return `actor '${actor}' is reserved`;
+    return null;
+}
+/** Origins that may read responses: browser extensions only, never a web page. */
+function corsHeaders(req) {
+    const origin = req.headers.origin;
+    if (typeof origin !== "string" || !/^(?:chrome|moz|safari-web)-extension:\/\/[\w.-]+$/.test(origin))
+        return {};
+    return {
+        "Access-Control-Allow-Origin": origin,
+        Vary: "Origin",
+        "Access-Control-Allow-Methods": "POST, OPTIONS",
+        "Access-Control-Allow-Headers": "Content-Type, X-OpsContext-Secret",
+    };
+}
+/** A Host header that names this machine, or none (not a browser). */
+function hostIsLocal(req, port) {
+    const host = req.headers.host;
+    if (host === undefined)
+        return true;
+    return [`127.0.0.1:${port}`, `localhost:${port}`].includes(host.toLowerCase());
+}
+const bucket = { tokens: BURST, at: Date.now(), dropped: 0, droppedSince: "" };
+/** Takes `n` tokens if there are enough; refills at RATE_PER_SEC up to BURST. */
+function takeTokens(n) {
+    const now = Date.now();
+    bucket.tokens = Math.min(BURST, bucket.tokens + ((now - bucket.at) / 1000) * RATE_PER_SEC);
+    bucket.at = now;
+    if (bucket.tokens < n) {
+        if (bucket.dropped === 0)
+            bucket.droppedSince = new Date(now).toISOString();
+        bucket.dropped += n;
+        return false;
+    }
+    bucket.tokens -= n;
+    return true;
+}
+function flushDroppedCount() {
+    if (bucket.dropped === 0)
+        return;
+    safeAppend("ingest.rate_limited", { dropped: bucket.dropped, since: bucket.droppedSince, rate_per_sec: RATE_PER_SEC, burst: BURST });
+    bucket.dropped = 0;
+}
 let serverInstance = null;
 /** Hot-reload the secret from disk so the CLI can rotate without restarting MCP. */
 function loadSecret() {
@@ -66,13 +149,10 @@ function validateEvent(e, idx) {
         return `events[${idx}]: missing ts`;
     if (typeof e.payload !== "object" || e.payload === null)
         return `events[${idx}]: missing payload object`;
-    // Restrict event kinds to the browser.* + vscode.* + cli.* namespaces.
-    // The audit module's own writers use other kinds (learning.save etc.);
-    // those events come from the LOCAL server, not the network surface.
-    if (!/^(browser|vscode|cli)\./.test(e.event)) {
-        return `events[${idx}]: event kind '${e.event}' not allowed via HTTP (only browser.*/vscode.*/cli.*)`;
-    }
-    return null;
+    // Only the capture kinds, never the audit module's own (learning.save, audit.redact, ...), which
+    // come from the LOCAL server. [LOCK] [RECEIVER-ACCEPTS-ONLY-KNOWN-SENDERS]
+    const err = checkCaptureEvent(e.event, e.actor);
+    return err ? `events[${idx}]: ${err}` : null;
 }
 /**
  * The payload as it will be written: every string redacted, and the per-shape counts recorded
@@ -108,24 +188,22 @@ function dropPromptText(payload, event) {
         text_fingerprint: textFingerprint(text),
     };
 }
-function sendJson(res, status, body) {
+function sendJson(req, res, status, body, extra = {}) {
     const json = JSON.stringify(body);
     res.writeHead(status, {
         "Content-Type": "application/json",
         "Content-Length": Buffer.byteLength(json),
-        // Belt-and-braces: even though the manifest's host_permissions already
-        // lets the SW POST without preflight, we set the response header so
-        // future popup-side probe pings work too.
-        "Access-Control-Allow-Origin": "*",
-        "Access-Control-Allow-Methods": "POST, OPTIONS",
-        "Access-Control-Allow-Headers": "Content-Type, X-OpsContext-Secret",
+        // Only a browser extension's origin gets CORS headers; the service worker needs none (its
+        // host_permissions cover the endpoint). [LOCK] [RECEIVER-ACCEPTS-ONLY-KNOWN-SENDERS]
+        ...corsHeaders(req),
+        ...extra,
     });
     res.end(json);
 }
 function handleEvents(req, res) {
     const secret = loadSecret();
     if (!secret) {
-        sendJson(res, 401, {
+        sendJson(req, res, 401, {
             ok: false,
             error: "no_secret_configured",
             hint: "Run: contextengine init-extension-secret",
@@ -134,45 +212,59 @@ function handleEvents(req, res) {
     }
     const provided = req.headers["x-opscontext-secret"];
     if (typeof provided !== "string" || !constantTimeEqual(provided, secret)) {
-        sendJson(res, 401, { ok: false, error: "bad_secret" });
+        sendJson(req, res, 401, { ok: false, error: "bad_secret" });
         return;
     }
     let bytes = 0;
+    let tooLarge = false;
     const chunks = [];
     req.on("data", (chunk) => {
+        if (tooLarge)
+            return;
         bytes += chunk.length;
         if (bytes > MAX_BODY) {
-            req.destroy();
-            sendJson(res, 413, { ok: false, error: "payload_too_large", limit: MAX_BODY });
+            // Answer first, then drop the connection: destroying before the reply sent the client a
+            // bare reset instead of the 413 (E2E_REVIEW_2026-09 A2-5).
+            tooLarge = true;
+            chunks.length = 0;
+            res.on("finish", () => req.destroy());
+            sendJson(req, res, 413, { ok: false, error: "payload_too_large", limit: MAX_BODY }, { Connection: "close" });
             return;
         }
         chunks.push(chunk);
     });
     req.on("end", () => {
+        if (tooLarge)
+            return;
         let batch;
         try {
             batch = JSON.parse(Buffer.concat(chunks).toString("utf-8"));
         }
         catch {
-            sendJson(res, 400, { ok: false, error: "bad_json" });
+            sendJson(req, res, 400, { ok: false, error: "bad_json" });
             return;
         }
         if (!batch || !Array.isArray(batch.events)) {
-            sendJson(res, 400, { ok: false, error: "missing_events_array" });
+            sendJson(req, res, 400, { ok: false, error: "missing_events_array" });
             return;
         }
         if (batch.events.length > MAX_BATCH) {
-            sendJson(res, 400, { ok: false, error: "batch_too_large", limit: MAX_BATCH });
+            sendJson(req, res, 400, { ok: false, error: "batch_too_large", limit: MAX_BATCH });
             return;
         }
         // Validate every event BEFORE writing any of them.
         for (let i = 0; i < batch.events.length; i++) {
             const err = validateEvent(batch.events[i], i);
             if (err) {
-                sendJson(res, 400, { ok: false, error: "invalid_event", detail: err });
+                sendJson(req, res, 400, { ok: false, error: "invalid_event", detail: err });
                 return;
             }
         }
+        // [LOCK] [RECEIVER-ACCEPTS-ONLY-KNOWN-SENDERS]: a brake on any one flood, a runaway hook included.
+        if (!takeTokens(batch.events.length)) {
+            sendJson(req, res, 429, { ok: false, error: "rate_limited", retry_after_ms: 1000 }, { "Retry-After": "1" });
+            return;
+        }
         // All valid — write them to audit log via safeAppend.
         let written = 0;
         for (const ev of batch.events) {
@@ -182,43 +274,33 @@ function handleEvents(req, res) {
             safeAppend(ev.event, prepareCapturedPayload(ev.payload, ev.event), actor);
             written++;
         }
-        sendJson(res, 200, { ok: true, written });
+        sendJson(req, res, 200, { ok: true, written });
     });
 }
-function handleHealth(_req, res) {
-    sendJson(res, 200, {
+function handleHealth(req, res) {
+    sendJson(req, res, 200, {
         ok: true,
         service: "opscontext-event-ingest",
         port: PORT,
         secretConfigured: loadSecret() !== null,
     });
 }
-function handleOptions(_req, res) {
-    // CORS preflight — the SW shouldn't need this thanks to host_permissions,
-    // but answering it cleanly costs nothing and helps popup probes.
-    res.writeHead(204, {
-        "Access-Control-Allow-Origin": "*",
-        "Access-Control-Allow-Methods": "POST, OPTIONS",
-        "Access-Control-Allow-Headers": "Content-Type, X-OpsContext-Secret",
-        "Access-Control-Max-Age": "600",
-    });
+function handleOptions(req, res) {
+    // CORS preflight: answered for a browser extension's origin only.
+    res.writeHead(204, { ...corsHeaders(req), ...(req.headers.origin ? { "Access-Control-Max-Age": "600" } : {}) });
     res.end();
 }
-/**
- * Boot the local event-ingest HTTP server. Returns the listening port or null
- * if the port was already in use (caller may decide whether to retry on
- * another port or surface the error).
- *
- * Safe to call multiple times — second call returns the existing server.
- */
-export function startEventIngestServer() {
-    if (serverInstance) {
-        const addr = serverInstance.address();
-        return Promise.resolve(typeof addr === "object" && addr ? addr.port : PORT);
-    }
+let retryTimer = null;
+let handoverTimer = null;
+let rateTimer = null;
+let warnedInUse = false;
+/** One bind attempt. Resolves the port, or null when the port is taken or the bind failed. */
+function listenOnce() {
     return new Promise((resolve) => {
         const srv = http.createServer((req, res) => {
             try {
+                if (!hostIsLocal(req, PORT))
+                    return sendJson(req, res, 403, { ok: false, error: "bad_host" });
                 if (req.method === "OPTIONS")
                     return handleOptions(req, res);
                 const url = req.url || "/";
@@ -226,12 +308,12 @@ export function startEventIngestServer() {
                     return handleEvents(req, res);
                 if (req.method === "GET" && url.startsWith("/health"))
                     return handleHealth(req, res);
-                sendJson(res, 404, { ok: false, error: "not_found" });
+                sendJson(req, res, 404, { ok: false, error: "not_found" });
             }
             catch (err) {
                 console.error("[ContextEngine] event-ingest error:", err);
                 try {
-                    sendJson(res, 500, { ok: false, error: "internal" });
+                    sendJson(req, res, 500, { ok: false, error: "internal" });
                 }
                 catch {
                     /* ignore — response may already be closed */
@@ -240,8 +322,11 @@ export function startEventIngestServer() {
         });
         srv.on("error", (err) => {
             if (err.code === "EADDRINUSE") {
-                console.error(`[ContextEngine] ⚠ port ${PORT} already in use — browser-event ingest disabled.\n` +
-                    `  Set OPSCONTEXT_EVENT_PORT=<n> to use a different port (must also update extension options).`);
+                if (!warnedInUse) {
+                    warnedInUse = true;
+                    console.error(`[ContextEngine] ⚠ port ${PORT} already in use — browser-event ingest waits for it (retrying).\n` +
+                        `  Set OPSCONTEXT_EVENT_PORT=<n> to use a different port (must also update extension options).`);
+                }
                 resolve(null);
                 return;
             }
@@ -250,22 +335,116 @@ export function startEventIngestServer() {
         });
         srv.listen(PORT, HOST, () => {
             serverInstance = srv;
+            warnedInUse = false;
             console.error(`[ContextEngine] 🌐 event-ingest on http://${HOST}:${PORT} ` +
                 (loadSecret() ? "(secret loaded)" : "(NO SECRET — run `contextengine init-extension-secret`)"));
             resolve(PORT);
         });
     });
 }
-export function stopEventIngestServer() {
+function closeListener() {
     return new Promise((resolve) => {
         if (!serverInstance)
             return resolve();
-        serverInstance.close(() => {
-            serverInstance = null;
-            resolve();
-        });
+        const srv = serverInstance;
+        serverInstance = null;
+        srv.close(() => resolve());
+        srv.closeAllConnections?.();
     });
 }
+/**
+ * Boot the local event-ingest HTTP server. Resolves the listening port, or null when the port is
+ * taken; in that case it keeps retrying in the background (see below).
+ *
+ * [LOCKED] [EVENT-PORT-BELONGS-TO-THE-DAEMON] - 2026-09-25
+ * [NEVER] give up on the port after one failed bind, or keep it in a chat server while the
+ *         launchd agent is alive.
+ * WHY: [AUTOSTART-IS-THE-STANDING-INDEXER] meant the agent to own the port from boot, but it bound
+ *      once and gave up. On 2026-09-25 the agent (v2.9.1) held nothing while a chat server on a
+ *      stale 2.9.0 build held :7842: the redaction guarding the audit log ran whichever build had
+ *      grabbed the port first, for as long as that chat stayed open, and events were dropped
+ *      silently once it closed. Nothing recorded who held it (E2E_REVIEW_2026-09 A2-1).
+ * FIX: the agent retries every few seconds until it binds; any other server retries only while
+ *      no agent is alive; a chat server that holds the port hands it over as soon as an agent is
+ *      registered; the holder is written into its registry record, and `contextengine servers`
+ *      shows it and warns about a stale or non-agent holder.
+ *
+ * Safe to call multiple times — a second call returns the existing server.
+ */
+export function startEventIngestServer(opts = {}) {
+    if (serverInstance) {
+        const addr = serverInstance.address();
+        return Promise.resolve(typeof addr === "object" && addr ? addr.port : PORT);
+    }
+    const liveDaemon = opts.liveDaemon ?? (() => null);
+    const retryMs = opts.retryMs ?? (opts.daemon ? 5_000 : 15_000);
+    const handoverMs = opts.handoverMs ?? 10_000;
+    let attempting = false;
+    const held = (port) => {
+        opts.onPortChange?.(port);
+        if (!rateTimer) {
+            rateTimer = setInterval(flushDroppedCount, 60_000);
+            rateTimer.unref();
+        }
+        if (!opts.daemon && !handoverTimer) {
+            handoverTimer = setInterval(() => {
+                const agent = liveDaemon();
+                if (agent === null || !serverInstance)
+                    return;
+                if (handoverTimer)
+                    clearInterval(handoverTimer);
+                handoverTimer = null;
+                console.error(`[ContextEngine] 🌐 handing the event port :${PORT} to the launchd agent (pid ${agent})`);
+                void closeListener().then(() => {
+                    opts.onPortChange?.(null);
+                    retry();
+                });
+            }, handoverMs);
+            handoverTimer.unref();
+        }
+    };
+    const retry = () => {
+        if (retryTimer)
+            return;
+        retryTimer = setInterval(() => {
+            if (serverInstance || attempting)
+                return;
+            if (!opts.daemon && liveDaemon() !== null)
+                return; // the agent's port: leave it to it
+            attempting = true;
+            void listenOnce().then((port) => {
+                attempting = false;
+                if (port === null)
+                    return;
+                if (retryTimer)
+                    clearInterval(retryTimer);
+                retryTimer = null;
+                held(port);
+            });
+        }, retryMs);
+        retryTimer.unref();
+    };
+    // A chat server does not take the port from under a live agent, not even at start.
+    if (!opts.daemon && liveDaemon() !== null) {
+        retry();
+        return Promise.resolve(null);
+    }
+    return listenOnce().then((port) => {
+        if (port === null)
+            retry();
+        else
+            held(port);
+        return port;
+    });
+}
+export function stopEventIngestServer() {
+    for (const t of [retryTimer, handoverTimer, rateTimer])
+        if (t)
+            clearInterval(t);
+    retryTimer = handoverTimer = rateTimer = null;
+    flushDroppedCount();
+    return closeListener();
+}
 // Test helpers (not exported in dist surface in production use — but the
 // module is small enough that tests can import them directly).
 export const _internal = {

package/dist/index.js

@@ -2,9 +2,9 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
-import { loadSources, loadProjectDirs, loadConfig, resolveProjectDir } from "./config.js";
+import { loadSources, loadProjectDirs, loadConfig, resolveProjectDir, findConfigFileWithOrigin } from "./config.js";
 import { ingestSources } from "./ingest.js";
-import { redactSecrets } from "./secret-shapes.js";
+import { redactChunk } from "./secret-shapes.js";
 import { summarizeSource } from "./source-summary.js";
 import { searchChunks } from "./search.js";
 import { initEmbeddings, embedChunks, embedKeyOf, vectorSearch, isEmbeddingsReady, } from "./embeddings.js";
@@ -14,7 +14,9 @@ import { sharedIndexEnabled, corpusId, electIndexer, writeSharedIndex, readShare
 import { listProjects, checkPorts, runComplianceAudit, formatProjectList, formatPortMap, formatPlan, scoreProject, formatScoreReport, runScoreCanary, } from "./agents.js";
 import { saveSession, loadSession, listSessions, deleteSession, formatSession, formatSessionList, } from "./sessions.js";
 import { verifyChain, readAuditLog, filterByRange, autoRotateAuditLog, safeAppend } from "./audit.js";
-import { registerServer, listServers, formatServers } from "./server-registry.js";
+import { registerServer, listServers, formatServers, liveDaemonPid } from "./server-registry.js";
+import { secureCeHome } from "./ce-home.js";
+import { QUOTED_TEXT_NOTE } from "./framing.js";
 import { computeFleetHealth, writeFleetHealth } from "./fleet-health.js";
 import { startEventIngestServer } from "./http-server.js";
 import { detect } from "./detector.js";
@@ -38,7 +40,7 @@ try {
 }
 catch { /* fallback */ }
 import { loadAdapters, collectFromAdapters, } from "./adapters.js";
-import { gateCheck, activate, getActivationStatus, } from "./activation.js";
+import { gateCheckFresh, licenceCheckState, activate, getActivationStatus, } from "./activation.js";
 import { ProtocolFirewall } from "./firewall.js";
 // ---------------------------------------------------------------------------
 // State
@@ -55,6 +57,8 @@ let role = "indexer";
 let corpus;
 let indexerPid = null;
 let setRegistryRole = null;
+let setRegistryEventPort = null;
+let warnedCwdAdapters = false;
 /** key -> vector, loaded from ~/.contextengine/embeddings.bin and grown by what we embed. */
 let vectorStore = new Map();
 let indexSeq = 0;
@@ -133,6 +137,11 @@ async function buildIndex(opts) {
         if (autoImport.refused) {
             console.error(`[ContextEngine] ⛔ Auto-import write refused: ${autoImport.refused}`);
         }
+        // [LOCK] [AUTO-IMPORT-ONLY-FROM-TRUSTED-PROJECTS]: say what was left out, and how to include it.
+        if (autoImport.untrusted.length > 0) {
+            console.error(`[ContextEngine] ⏸ Marked learnings in ${autoImport.untrusted.length} project(s) you have not marked as yours were not imported: ` +
+                `${autoImport.untrusted.join(", ")}. If they are yours: contextengine trust ${autoImport.untrusted.map((p) => JSON.stringify(p)).join(" ")}`);
+        }
     }
     // Inject learnings as searchable chunks (project-scoped to prevent IP leakage)
     const learningChunks = learningsToChunks(activeProjectNames);
@@ -156,9 +165,29 @@ async function buildIndex(opts) {
     // [LOCK] [INDEX-NEVER-SERVES-A-CREDENTIAL]: before the adapters, whose block can return early.
     chunks = chunks.map(redactChunk);
     // Collect from plugin adapters
-    if (config.adapters && config.adapters.length > 0) {
+    // [LOCKED] [ADAPTERS-ONLY-FROM-THE-USERS-OWN-CONFIG] - 2026-09-25
+    // [NEVER] import an adapter module named by a contextengine.json found in the current folder, or
+    //         resolve a relative adapter path from the current folder.
+    // WHY: without CONTEXTENGINE_CONFIG (the README's setup), the server reads ./contextengine.json
+    //      from the folder it starts in, which for Claude Code is the project opened. An adapter entry
+    //      there is import()ed, so a downloaded repository carrying a config and a module ran its own
+    //      code in the user's session when the project was opened; proven in a sandbox on 2026-09-25
+    //      (E2E_REVIEW_2026-09 A6-5). A relative path in the user's own config also resolved from
+    //      that folder, not from the config's.
+    // FIX: adapters load only from the config named by CONTEXTENGINE_CONFIG or ~/.contextengine.json,
+    //      relative paths resolve from that file's folder; a config found in the current folder may
+    //      still list sources, never code.
+    const cfgFile = findConfigFileWithOrigin();
+    if (config.adapters && config.adapters.length > 0 && cfgFile?.origin === "cwd") {
+        if (!warnedCwdAdapters) {
+            warnedCwdAdapters = true;
+            console.error(`[ContextEngine] ⛔ Adapters in ${cfgFile.path} were NOT loaded: a config found in the current folder may not run code. ` +
+                `Point CONTEXTENGINE_CONFIG at it, or move the adapters to ~/.contextengine.json.`);
+        }
+    }
+    else if (config.adapters && config.adapters.length > 0) {
         if (opts.loadAdapters) {
-            const adapterCount = await loadAdapters(config.adapters);
+            const adapterCount = await loadAdapters(config.adapters, cfgFile ? dirname(cfgFile.path) : process.cwd());
             if (adapterCount === 0)
                 return;
         }
@@ -169,22 +198,8 @@ async function buildIndex(opts) {
         }
     }
 }
-/**
- * [LOCKED] [INDEX-NEVER-SERVES-A-CREDENTIAL] - 2026-09-25
- * [NEVER] let a chunk into the index, the shared index file or a search result without passing
- *         its text through redactSecrets().
- * WHY: on 2026-09-25 the shared index held database URLs with their passwords (read from dotenv
- *      files, whose masking skipped the password inside a URL), sshpass and mysql passwords from
- *      runbooks and memory notes, and Google API keys: 55 sources in all. search_context hands
- *      chunks to every AI agent that asks, and the index file rides the weekly backup.
- * FIX: every chunk, whatever collected it (docs, code, ops collectors, learnings, community rules,
- *      adapters), is redacted with the capture shapes (src/secret-shapes.ts) as the index is built.
- *      The source files are not touched: cleaning those is the owner's call, file by file.
- */
-function redactChunk(c) {
-    const r = redactSecrets(c.content);
-    return Object.keys(r.counts).length > 0 ? { ...c, content: r.text } : c;
-}
+// [LOCK] [INDEX-NEVER-SERVES-A-CREDENTIAL]: redactChunk lives in src/secret-shapes.ts, shared with
+// the CLI's index builder.
 /** Load the model once; every caller shares the same promise. */
 function ensureModel() {
     if (!modelInit)
@@ -577,6 +592,7 @@ server.tool("search_context", "Search across all indexed project knowledge (copi
     const searchMode = isEmbeddingsReady() ? mode : "keyword (embeddings loading)";
     const text = [
         `Search: "${query}" | Mode: ${searchMode} | ${results.length} results`,
+        QUOTED_TEXT_NOTE, // [LOCK] [QUOTED-TEXT-IS-FRAMED-AS-DATA]
         "",
         ...results.map((r, i) => [
             `--- Result ${i + 1} (${r.label}: ${r.score.toFixed(3)}) ---`,
@@ -603,7 +619,8 @@ server.tool("list_sources", "List all knowledge sources indexed by ContextEngine
         const status = exists
             ? `✅ ${count} chunks${embeddedCount > 0 ? ` (${embeddedCount} embedded)` : ""}`
             : "⚠ file not found";
-        const summary = exists ? summarizeSource(s) : "";
+        // A preview quotes the file: redacted like any chunk. [LOCK] [INDEX-NEVER-SERVES-A-CREDENTIAL]
+        const summary = exists ? redactChunk({ content: summarizeSource(s) }).content : "";
         return `${s.name}: ${status}${summary ? `\n  ${summary}` : ""}\n  ${s.path}`;
     });
     const embStatus = isEmbeddingsReady()
@@ -612,6 +629,7 @@ server.tool("list_sources", "List all knowledge sources indexed by ContextEngine
     const text = [
         `ContextEngine v${PKG_VERSION}`,
         `Sources: ${sources.length} | Chunks: ${chunks.length} | Embeddings: ${embStatus}`,
+        QUOTED_TEXT_NOTE, // [LOCK] [QUOTED-TEXT-IS-FRAMED-AS-DATA]
         "",
         ...lines,
     ].join("\n");
@@ -648,8 +666,10 @@ server.tool("read_source", "Read the full content of a specific knowledge source
             isError: true,
         };
     }
-    const content = readFileSync(source.path, "utf-8");
-    return respond("read_source", `# ${source.name}\n\n${content}`, source_name);
+    // [LOCK] [INDEX-NEVER-SERVES-A-CREDENTIAL]: the whole file goes through the same redaction as a
+    // search result; read_source used to return it raw (E2E_REVIEW_2026-09 A6-6).
+    const content = redactChunk({ content: readFileSync(source.path, "utf-8") }).content;
+    return respond("read_source", `# ${source.name}\n${QUOTED_TEXT_NOTE}\n\n${content}`, source_name);
 });
 // ---------------------------------------------------------------------------
 // Tool: reindex
@@ -666,7 +686,7 @@ server.tool("reindex", "Force a full re-index of all knowledge sources. Use afte
 // Tool: list_projects (Multi-Agent Phase 1)
 // ---------------------------------------------------------------------------
 server.tool("list_projects", "Discover and analyze all projects in the workspace. Shows tech stack (framework, runtime, key dependencies), infrastructure (git, docker, pm2), and git remote status for each project. Requires Pro license.", {}, async () => {
-    const gate = gateCheck("list_projects");
+    const gate = await gateCheckFresh("list_projects");
     if (gate)
         return { content: [{ type: "text", text: gate }] };
     const projectDirs = loadProjectDirs();
@@ -678,7 +698,7 @@ server.tool("list_projects", "Discover and analyze all projects in the workspace
 // Tool: check_ports (Multi-Agent Phase 1)
 // ---------------------------------------------------------------------------
 server.tool("check_ports", "Scan all projects for port declarations (ecosystem.config.js, docker-compose.yml, .env, package.json) and detect port conflicts. Returns a port allocation map with conflict warnings. Requires Pro license.", {}, async () => {
-    const gate = gateCheck("check_ports");
+    const gate = await gateCheckFresh("check_ports");
     if (gate)
         return { content: [{ type: "text", text: gate }] };
     const projectDirs = loadProjectDirs();
@@ -695,7 +715,7 @@ server.tool("run_audit", "Run the Compliance Agent audit across all projects. Ch
         .default("all")
         .describe("Audit scope: all checks, compliance only, version checks only, or port conflicts only"),
 }, async ({ scope }) => {
-    const gate = gateCheck("run_audit");
+    const gate = await gateCheckFresh("run_audit");
     if (gate)
         return { content: [{ type: "text", text: gate }] };
     const projectDirs = loadProjectDirs();
@@ -712,7 +732,7 @@ server.tool("score_project", "Score one or all projects on AI-readiness (0-100%)
         .optional()
         .describe("Project name OR absolute directory path to score. Omit to score all projects."),
 }, async ({ project }) => {
-    const gate = gateCheck("score_project");
+    const gate = await gateCheckFresh("score_project");
     if (gate)
         return { content: [{ type: "text", text: gate }] };
     // 🔒 LOCKED [SCORE-CANARY-COVERS-EVERY-SCORER] — 2026-08-19
@@ -1169,7 +1189,8 @@ server.tool("list_learnings", "List all permanent learnings, optionally filtered
     }
     const learnings = listLearnings(category, activeProjectNames);
     const text = formatLearnings(learnings, { since: sinceDate, sinceSpec: since });
-    return respond("list_learnings", text);
+    // Redacted like every chunk: a learning can quote a command with its password. [LOCK] [INDEX-NEVER-SERVES-A-CREDENTIAL]
+    return respond("list_learnings", redactChunk({ content: text }).content);
 });
 // ---------------------------------------------------------------------------
 // Tool: delete_learning (Permanent Learning Store)
@@ -1265,6 +1286,7 @@ server.tool("activation_status", "Check current ContextEngine license status, pl
         `- **Expires**: ${status.expiresAt}`,
         `- **Delta version**: ${status.deltaVersion}`,
         `- **Machine ID**: ${status.machineId}`,
+        `- **Licence check**: ${licenceCheckState()}`, // [LOCK] [LICENSE-IS-CHECKED-DAILY]
         ``,
     ];
     if (status.premiumTools.length > 0) {
@@ -1319,6 +1341,9 @@ function registerResources() {
 // Start
 // ---------------------------------------------------------------------------
 async function main() {
+    // [LOCK] [CE-HOME-IS-PRIVATE]: the folder is 0700 before the registry, the index or the log write
+    // into it.
+    secureCeHome();
     // 0. Inventory this server FIRST, before indexing takes minutes: a server exists the moment it
     //    starts. [LOCK] [SERVERS-ARE-INVENTORIED]. With the shared index on, the registry is also
     //    the electorate: the record carries the corpus and the role. [LOCK] [ONE-INDEXER-MANY-READERS]
@@ -1331,8 +1356,9 @@ async function main() {
         }
     }
     try {
-        const reg = registerServer({ version: PKG_VERSION, script: fileURLToPath(import.meta.url), corpus, role: corpus ? "reader" : undefined });
+        const reg = registerServer({ version: PKG_VERSION, script: fileURLToPath(import.meta.url), corpus, role: corpus ? "reader" : undefined, daemon: process.env.OPSCONTEXT_DAEMON === "1" });
         setRegistryRole = reg.setRole;
+        setRegistryEventPort = reg.setEventPort;
         const fleet = listServers();
         if (corpus) {
             const e = electIndexer(corpus, fleet.servers, process.pid);
@@ -1466,7 +1492,13 @@ async function main() {
     // No-op if secret is missing; the endpoint will refuse with 401 until
     // a secret is configured. Failure to bind (port collision) logs and
     // continues — the MCP server stays usable without browser capture.
-    startEventIngestServer().catch((err) => {
+    // [LOCK] [EVENT-PORT-BELONGS-TO-THE-DAEMON]: the launchd agent keeps trying until it holds the
+    // port; a chat server takes it only while no agent is alive, and hands it over when one is.
+    startEventIngestServer({
+        daemon: process.env.OPSCONTEXT_DAEMON === "1",
+        onPortChange: (port) => setRegistryEventPort?.(port),
+        liveDaemon: () => liveDaemonPid(),
+    }).catch((err) => {
         console.error("[ContextEngine] event-ingest start failed:", err);
     });
 }