@compr/opscontext-mcp 2.9.0 → 2.10.0

package/dist/install-autostart.js

@@ -17,7 +17,7 @@
 import { existsSync, writeFileSync, mkdirSync } from "fs";
 import { join, dirname } from "path";
 import { homedir, platform } from "os";
-import { execSync } from "child_process";
+import { execFileSync } from "child_process";
 import { createRequire } from "module";
 import { fileURLToPath } from "url";
 // 🔒 LOCKED [M2-ESM-FILENAME-FIX] — 2026-06-24
@@ -52,7 +52,7 @@ function detectNodePath() {
 function detectOpscontextEntry() {
     // (1) Try global install via `npm root -g`
     try {
-        const globalRoot = execSync("npm root -g 2>/dev/null", { encoding: "utf-8" }).trim();
+        const globalRoot = execFileSync("npm", ["root", "-g"], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }).trim();
         const candidate = join(globalRoot, "@compr", "opscontext-mcp", "dist", "index.js");
         if (existsSync(candidate))
             return { kind: "global", path: candidate };
@@ -99,6 +99,17 @@ function detectOpscontextEntry() {
 // FIX: Standard priority; the shared-index flag; CONTEXTENGINE_CONFIG passed through from the
 //      installing shell so its corpus id equals the chats'; the memory skip only if the installer
 //      was itself run with it (an explicit choice, not a default).
+// [LOCKED] [AUTOSTART-ARGV-AND-XML-ESCAPED] - 2026-09-25
+// [NEVER] paste a path into a launchctl/lsof/curl command string, or into the plist unescaped.
+// WHY: with a home folder named "John Smith", `launchctl bootstrap gui/501 ${PLIST_FILE}` handed
+//      launchctl the path in two pieces and failed, after `bootout` had already stopped the running
+//      agent; a home named "R&D home" produced a plist launchd refuses ("unknown ampersand-escape
+//      sequence"); only the passthrough env values were escaped (E2E_REVIEW_2026-09 A3-2, A3-3).
+// FIX: execFileSync with an argument list for every command; xml() on every value in the plist;
+//      `plutil -lint` on the written file before anything running is stopped.
+function xml(value) {
+    return value.replace(/&/g, "&amp;").replace(/</g, "&lt;");
+}
 export function buildPlist(nodePath, entryPath, nodeBinDir, env = process.env) {
     // OPSCONTEXT_DAEMON tells the server it has no MCP client on stdin and must stay alive on its
     // own: as a reader it holds no file watchers, and every poller is unref'd, so without this the
@@ -110,7 +121,8 @@ export function buildPlist(nodePath, entryPath, nodeBinDir, env = process.env) {
         passthrough.push(["CONTEXTENGINE_WORKSPACES", env.CONTEXTENGINE_WORKSPACES]);
     if (env.OPSCONTEXT_SKIP_CLAUDE_MEMORY === "1")
         passthrough.push(["OPSCONTEXT_SKIP_CLAUDE_MEMORY", "1"]);
-    const extraEnv = passthrough.map(([k, v]) => `        <key>${k}</key>\n        <string>${v.replace(/&/g, "&amp;").replace(/</g, "&lt;")}</string>`).join("\n");
+    // [LOCK] [AUTOSTART-ARGV-AND-XML-ESCAPED]: every value, not only the passthrough ones.
+    const extraEnv = passthrough.map(([k, v]) => `        <key>${k}</key>\n        <string>${xml(v)}</string>`).join("\n");
     return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -120,21 +132,21 @@ export function buildPlist(nodePath, entryPath, nodeBinDir, env = process.env) {
 
     <key>ProgramArguments</key>
     <array>
-        <string>${nodePath}</string>
-        <string>${entryPath}</string>
+        <string>${xml(nodePath)}</string>
+        <string>${xml(entryPath)}</string>
     </array>
 
     <key>EnvironmentVariables</key>
     <dict>
         <key>PATH</key>
-        <string>${nodeBinDir}:/usr/local/bin:/usr/bin:/bin</string>
+        <string>${xml(nodeBinDir)}:/usr/local/bin:/usr/bin:/bin</string>
         <key>HOME</key>
-        <string>${homedir()}</string>
+        <string>${xml(homedir())}</string>
 ${extraEnv}
     </dict>
 
     <key>WorkingDirectory</key>
-    <string>${homedir()}</string>
+    <string>${xml(homedir())}</string>
 
     <key>RunAtLoad</key>
     <true/>
@@ -146,10 +158,10 @@ ${extraEnv}
     <integer>10</integer>
 
     <key>StandardOutPath</key>
-    <string>${join(LOG_DIR, "mcp-stdout.log")}</string>
+    <string>${xml(join(LOG_DIR, "mcp-stdout.log"))}</string>
 
     <key>StandardErrorPath</key>
-    <string>${join(LOG_DIR, "mcp-stderr.log")}</string>
+    <string>${xml(join(LOG_DIR, "mcp-stderr.log"))}</string>
 
     <key>ProcessType</key>
     <string>Standard</string>
@@ -165,7 +177,7 @@ function userId() {
 }
 function portIsOurs() {
     try {
-        execSync(`lsof -nP -iTCP:${PORT} -sTCP:LISTEN >/dev/null 2>&1`, { stdio: "ignore" });
+        execFileSync("lsof", ["-nP", `-iTCP:${PORT}`, "-sTCP:LISTEN"], { stdio: "ignore" });
         return true;
     }
     catch {
@@ -177,7 +189,7 @@ function waitForPort(timeoutSec = 30) {
     while (Date.now() - start < timeoutSec * 1000) {
         if (portIsOurs())
             return true;
-        execSync("sleep 1");
+        execFileSync("sleep", ["1"]);
     }
     return false;
 }
@@ -263,16 +275,25 @@ To view server logs:        tail -f ~/.contextengine/logs/mcp-stderr.log
     if (portIsOurs()) {
         console.log(`   detected existing process on :${PORT} — relying on launchctl bootout to clean it.`);
     }
+    // [LOCK] [AUTOSTART-ARGV-AND-XML-ESCAPED]: a file launchd would refuse must never cost the user
+    // the agent that is running now, so check it before the bootout.
+    try {
+        execFileSync("plutil", ["-lint", PLIST_FILE], { stdio: ["ignore", "ignore", "pipe"] });
+    }
+    catch (err) {
+        console.error(`❌ The new plist is not valid, nothing was stopped or loaded: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+    }
     // Idempotent bootstrap: bootout (ignore failure) → bootstrap
     const uid = userId();
     try {
-        execSync(`launchctl bootout gui/${uid}/${LABEL}`, { stdio: "ignore" });
+        execFileSync("launchctl", ["bootout", `gui/${uid}/${LABEL}`], { stdio: "ignore" });
     }
     catch {
         /* not loaded — fine */
     }
     try {
-        execSync(`launchctl bootstrap gui/${uid} ${PLIST_FILE}`, { stdio: "inherit" });
+        execFileSync("launchctl", ["bootstrap", `gui/${uid}`, PLIST_FILE], { stdio: "inherit" });
     }
     catch (err) {
         console.error(`❌ launchctl bootstrap failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -309,7 +330,7 @@ You can re-install with: opscontext install-autostart`);
     const uid = userId();
     let removed = false;
     try {
-        execSync(`launchctl bootout gui/${uid}/${LABEL}`, { stdio: "ignore" });
+        execFileSync("launchctl", ["bootout", `gui/${uid}/${LABEL}`], { stdio: "ignore" });
         removed = true;
     }
     catch {
@@ -350,7 +371,7 @@ running entrypoint.`);
     const uid = userId();
     let launchctlState = "not loaded";
     try {
-        const out = execSync(`launchctl print gui/${uid}/${LABEL} 2>/dev/null || true`, { encoding: "utf-8" });
+        const out = execFileSync("launchctl", ["print", `gui/${uid}/${LABEL}`], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] });
         const match = out.match(/state\s*=\s*(\S+)/);
         if (match)
             launchctlState = match[1];
@@ -365,7 +386,7 @@ running entrypoint.`);
     console.log(`  port ${PORT}:   ${portUp ? "✅ listening" : "❌ not listening"}`);
     if (portUp) {
         try {
-            const health = execSync(`curl -sf http://127.0.0.1:${PORT}/health`, { encoding: "utf-8", timeout: 2000 });
+            const health = execFileSync("curl", ["-sf", `http://127.0.0.1:${PORT}/health`], { encoding: "utf-8", timeout: 2000 });
             console.log(`  health:      ${health.trim()}`);
         }
         catch {

package/dist/install-claude-hook.d.ts

@@ -13,6 +13,7 @@ export interface Settings {
 }
 /** The script path of a hook command, with $HOME, ${HOME} or a leading ~ expanded. */
 export declare function hookScriptPath(command: string, home?: string): string;
+export declare function shellQuote(value: string): string;
 /** Removes repeated registrations of our scripts under the same matcher. Keeps the first copy
  *  and every hook that is not ours; drops an entry only when that leaves it empty. */
 export declare function dropDuplicateHooks(entries: HookEntry[], ourScripts: string[], home?: string): {

package/dist/install-claude-hook.js

@@ -67,16 +67,95 @@ function backupSettings() {
 //      inputs that [OPSCONTEXT-CC-HOOK] protects.
 // FIX: compare the script path after expanding $HOME, ${HOME} and a leading ~; installing also
 //      removes extra copies of our own commands under the same matcher, and nothing else.
+/** The first shell word of a command, quotes removed ('...', "...", backslash), and the rest. */
+function splitFirstWord(command) {
+    const s = command ?? "";
+    let i = 0;
+    while (i < s.length && /\s/.test(s[i]))
+        i++;
+    let word = "";
+    while (i < s.length && !/\s/.test(s[i])) {
+        const ch = s[i];
+        if (ch === "'") {
+            const j = s.indexOf("'", i + 1);
+            word += j < 0 ? s.slice(i + 1) : s.slice(i + 1, j);
+            i = j < 0 ? s.length : j + 1;
+        }
+        else if (ch === '"') {
+            let j = i + 1;
+            while (j < s.length && s[j] !== '"') {
+                if (s[j] === "\\" && j + 1 < s.length) {
+                    word += s[j + 1];
+                    j += 2;
+                }
+                else {
+                    word += s[j];
+                    j++;
+                }
+            }
+            i = j + 1;
+        }
+        else if (ch === "\\" && i + 1 < s.length) {
+            word += s[i + 1];
+            i += 2;
+        }
+        else {
+            word += ch;
+            i++;
+        }
+    }
+    return { word, rest: s.slice(i).trim() };
+}
 /** The script path of a hook command, with $HOME, ${HOME} or a leading ~ expanded. */
 export function hookScriptPath(command, home = homedir()) {
-    const m = /^\s*(?:"([^"]*)"|'([^']*)'|(\S+))/.exec(command ?? "");
-    const path = m ? (m[1] ?? m[2] ?? m[3]) : "";
-    return path.replace(/^(?:\$HOME|\$\{HOME\}|~)(?=\/)/, home);
+    return splitFirstWord(command).word.replace(/^(?:\$HOME|\$\{HOME\}|~)(?=\/)/, home);
 }
 /** The command with its script path expanded, so two spellings of one call compare equal. */
 function normalizedCommand(command, home) {
-    const args = (command ?? "").trim().replace(/^(?:"[^"]*"|'[^']*'|\S+)/, "").trim();
-    return `${hookScriptPath(command, home)} ${args}`.trim();
+    return `${hookScriptPath(command, home)} ${splitFirstWord(command).rest}`.trim();
+}
+// [LOCKED] [HOOK-PATHS-ARE-SHELL-QUOTED] - 2026-09-25
+// [NEVER] write a script path into a hook command, or into the generated gate script, without
+//         shellQuote(): Claude Code runs every hook command through a shell.
+// WHY: with a home folder named "John Smith" the installer wrote `/Users/John Smith/.claude/...`
+//      unquoted: every hook exited 127, the install's own count found 0 of ours and failed, and
+//      each re-run added four more broken entries (4, then 8). A double quote in the path made the
+//      shell exit 2, which for a Stop hook means "block the turn" (E2E_REVIEW_2026-09 A3-2, A3-4).
+// FIX: shellQuote() leaves a plain path as it is (existing installs compare equal and do not
+//      churn) and single-quotes anything else; splitFirstWord() reads commands the way the shell
+//      does, so a quoted path compares equal to its plain spelling; an unquoted copy of one of our
+//      paths that contains a space is recognised as ours and repaired.
+export function shellQuote(value) {
+    return /^[A-Za-z0-9_./@%+=:,-]+$/.test(value) ? value : scriptQuote(value);
+}
+/** Always single-quoted: for the lines of a generated sh script. */
+function scriptQuote(value) {
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}
+/** An old install's unquoted command for one of our scripts whose path contains whitespace. */
+function isBrokenUnquotedCopy(command, script) {
+    if (!/\s/.test(script))
+        return false;
+    const c = (command ?? "").trim();
+    return c === script || c.startsWith(`${script} `);
+}
+/** True when a hook command runs one of `scripts`, however it is spelled. */
+function runsOneOf(command, scripts, home = homedir()) {
+    return scripts.includes(hookScriptPath(command, home)) || scripts.some((s) => isBrokenUnquotedCopy(command, s));
+}
+/** Rewrites unquoted, broken copies of our commands to their quoted form (then dedup sees them). */
+function repairUnquotedCommands(entries, scripts) {
+    let repaired = 0;
+    for (const e of entries) {
+        for (const h of e.hooks ?? []) {
+            const s = scripts.find((x) => isBrokenUnquotedCopy(h.command, x));
+            if (!s)
+                continue;
+            h.command = `${shellQuote(s)} ${h.command.trim().slice(s.length).trim()}`.trim();
+            repaired++;
+        }
+    }
+    return repaired;
 }
 function hookAlreadyWired(entries, hookScript, home = homedir()) {
     return (entries ?? []).some((e) => e.hooks?.some((h) => hookScriptPath(h.command, home) === hookScript));
@@ -211,6 +290,10 @@ Run: opscontext install-autostart
         return;
     }
     const simplicityAsked = args.includes("--simplicity");
+    // Parse settings.json before writing anything: a malformed file is refused with nothing changed
+    // (it used to be refused after the emit script had already been copied).
+    const original = existsSync(SETTINGS_FILE) ? readFileSync(SETTINGS_FILE, "utf-8") : null;
+    const settings = readSettings();
     // Step 1: Install / verify the hook script
     mkdirSync(HOOKS_DIR, { recursive: true });
     const src = bundledFile("claude-code-hook.sh");
@@ -223,19 +306,18 @@ Run: opscontext install-autostart
     copyFileSync(src, HOOK_SCRIPT);
     chmodSync(HOOK_SCRIPT, 0o755);
     console.log(`✅ Installed hook script: ${HOOK_SCRIPT}`);
-    // Step 2: Splice into settings.json
-    const settings = readSettings();
-    const backup = backupSettings();
-    if (backup)
-        console.log(`✅ Backed up settings.json → ${backup}`);
+    // Step 2: Splice into settings.json (written, after a backup, only if something changes)
     settings.hooks ??= {};
     const hookCmdPrefix = `${HOOK_SCRIPT}`; // compared by expanded path, [HOOKS-COMPARED-BY-EXPANDED-PATH]
     // [LOCK] [HOOKS-COMPARED-BY-EXPANDED-PATH]: remove extra copies before deciding what to add.
+    // [LOCK] [HOOK-PATHS-ARE-SHELL-QUOTED]: first repair unquoted copies an older install wrote for a
+    // path with a space, so the dedup below sees them as ours.
     let deduped = 0;
     for (const kind of [...EVENT_KINDS, "Stop"]) {
         const entries = settings.hooks[kind];
         if (!entries)
             continue;
+        repairUnquotedCommands(entries, OUR_SCRIPTS);
         const r = dropDuplicateHooks(entries, OUR_SCRIPTS);
         settings.hooks[kind] = r.entries;
         deduped += r.removed;
@@ -252,7 +334,7 @@ Run: opscontext install-autostart
             hooks: [
                 {
                     type: "command",
-                    command: `${HOOK_SCRIPT} ${kind}`,
+                    command: `${shellQuote(HOOK_SCRIPT)} ${kind}`,
                     timeout: 5,
                 },
             ],
@@ -267,14 +349,14 @@ Run: opscontext install-autostart
     // Step 3: the Stop gate. Absolute node + CLI paths: hooks run without the user's shell PATH.
     // Prefer the global install: an npx cache copy can be pruned and the hook would then exit 127.
     const cliPath = globalCliPath() ?? join(__dirname_esm, "cli.js");
-    writeFileSync(GATE_SCRIPT, `#!/bin/sh\n# Generated by \`opscontext install-claude-hook\`: the CE session gate on Claude Code Stop.\n# Exit 2 = the turn may not end yet (reason on stderr). See: contextengine session-gate --help\nexec "${process.execPath}" "${cliPath}" session-gate\n`);
+    writeFileSync(GATE_SCRIPT, `#!/bin/sh\n# Generated by \`opscontext install-claude-hook\`: the CE session gate on Claude Code Stop.\n# Exit 2 = the turn may not end yet (reason on stderr). See: contextengine session-gate --help\nexec ${scriptQuote(process.execPath)} ${scriptQuote(cliPath)} session-gate\n`);
     chmodSync(GATE_SCRIPT, 0o755);
     settings.hooks.Stop ??= [];
     if (hookAlreadyWired(settings.hooks.Stop, GATE_SCRIPT)) {
         skipped++;
     }
     else {
-        settings.hooks.Stop.push({ hooks: [{ type: "command", command: GATE_SCRIPT, timeout: 15 }] });
+        settings.hooks.Stop.push({ hooks: [{ type: "command", command: shellQuote(GATE_SCRIPT), timeout: 15 }] });
         added++;
     }
     console.log(`✅ Installed session gate: ${GATE_SCRIPT}`);
@@ -296,7 +378,7 @@ Run: opscontext install-autostart
         else {
             settings.hooks.PostToolUse.push({
                 matcher: SIMPLICITY_MATCHER,
-                hooks: [{ type: "command", command: SIMPLICITY_SCRIPT, timeout: 30 }],
+                hooks: [{ type: "command", command: shellQuote(SIMPLICITY_SCRIPT), timeout: 30 }],
             });
             added++;
         }
@@ -307,7 +389,16 @@ Run: opscontext install-autostart
         else
             console.log(`⚠️  ruff not found (PATH, /opt/homebrew/bin, /usr/local/bin, ~/.local/bin, ~/.cargo/bin): the gate stays silent until it is installed (brew install ruff, or pipx install ruff).`);
     }
-    writeFileSync(SETTINGS_FILE, JSON.stringify(settings, null, 2) + "\n");
+    // A re-run that changes nothing writes nothing and leaves no backup behind (a copy of
+    // settings.json per run piled up, env values and all).
+    let backup = "";
+    const unchanged = original !== null && JSON.stringify(JSON.parse(original)) === JSON.stringify(settings);
+    if (!unchanged) {
+        backup = backupSettings();
+        if (backup)
+            console.log(`✅ Backed up settings.json → ${backup}`);
+        writeFileSync(SETTINGS_FILE, JSON.stringify(settings, null, 2) + "\n");
+    }
     const removedNote = deduped ? `, ${deduped} duplicate registrations removed` : "";
     console.log(`✅ ${added} hook entries added, ${skipped} already present${removedNote}.`);
     // [LOCKED] [INSTALL-VERIFIES-BY-COUNT] - 2026-09-15
@@ -348,33 +439,50 @@ The hook script files under ~/.claude/hooks/ are left in place — delete
 manually if you want them gone. The audit log is NOT touched.`);
         return;
     }
-    const ourNames = args.includes("--simplicity")
-        ? ["opscontext-simplicity-gate.py"]
-        : ["opscontext-emit.sh", "opscontext-session-gate.sh", "opscontext-simplicity-gate.py"];
+    // [LOCKED] [UNINSTALL-REMOVES-ONLY-OUR-COMMANDS] - 2026-09-25
+    // [NEVER] drop a whole hook entry because one of its commands is ours, or recognise ours by a
+    //         substring of the command text.
+    // WHY: the uninstaller removed every entry whose command text contained one of our file names.
+    //      In a sandbox it deleted a user's company-audit.sh that shared an entry with our emit hook,
+    //      and a user's notify-opscontext-emit.sh.done that merely contained our name
+    //      (E2E_REVIEW_2026-09 A3-1). [CLAUDE-HOOK-INSTALL] asks for the "preserve existing"
+    //      discipline in every code path; this one broke it.
+    // FIX: remove only the commands that run our scripts, compared by expanded path like the
+    //      installer ([HOOKS-COMPARED-BY-EXPANDED-PATH]); drop an entry only when that leaves it
+    //      empty; back up and write only when something was removed.
+    const ours = args.includes("--simplicity") ? [SIMPLICITY_SCRIPT] : OUR_SCRIPTS;
     const settings = readSettings();
     if (!settings.hooks) {
         console.log(`   (no hooks block in settings.json — nothing to remove)`);
         return;
     }
-    const backup = backupSettings();
-    if (backup)
-        console.log(`✅ Backed up settings.json → ${backup}`);
     let removed = 0;
     for (const kind of [...EVENT_KINDS, "Stop"]) {
         const entries = settings.hooks[kind];
         if (!entries)
             continue;
-        const filtered = entries.filter((e) => !e.hooks?.some((h) => ourNames.some((n) => h.command?.includes(n))));
-        removed += entries.length - filtered.length;
-        if (filtered.length === 0) {
+        const kept = [];
+        for (const e of entries) {
+            const before = e.hooks ?? [];
+            const hooks = before.filter((h) => !runsOneOf(h.command, ours));
+            removed += before.length - hooks.length;
+            if (hooks.length > 0 || before.length === 0)
+                kept.push({ ...e, hooks });
+        }
+        if (kept.length === 0) {
             delete settings.hooks[kind];
         }
         else {
-            settings.hooks[kind] = filtered;
+            settings.hooks[kind] = kept;
         }
     }
-    writeFileSync(SETTINGS_FILE, JSON.stringify(settings, null, 2) + "\n");
-    console.log(`✅ Removed ${removed} hook entries.`);
+    if (removed > 0) {
+        const backup = backupSettings();
+        if (backup)
+            console.log(`✅ Backed up settings.json → ${backup}`);
+        writeFileSync(SETTINGS_FILE, JSON.stringify(settings, null, 2) + "\n");
+    }
+    console.log(`✅ Removed ${removed} OpsContext hook command(s); every other hook kept.`);
     console.log(`   Hook script kept at: ${HOOK_SCRIPT}`);
     console.log(`   Audit log untouched.`);
 }

package/dist/learnings.d.ts

@@ -122,6 +122,7 @@ export declare function autoImportFromSources(sources: Array<{
     updated: number;
     ignored: number;
     refused?: string;
+    untrusted: string[];
 };
 /**
  * Get the store stats.

package/dist/learnings.js

@@ -5,6 +5,7 @@ import { join, dirname } from "path";
 import { homedir } from "os";
 import { fileURLToPath } from "url";
 import { safeAppend } from "./audit.js";
+import { trustedProjects, looksLikeMarkedLearnings } from "./trusted-projects.js";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 /**
@@ -1013,6 +1014,10 @@ export function autoImportFromSources(sources) {
     let totalIgnored = 0;
     let processed = 0;
     let refused;
+    // [LOCK] [AUTO-IMPORT-ONLY-FROM-TRUSTED-PROJECTS] (src/trusted-projects.ts): seeded, the first
+    // time, with every project that already has learnings in the store.
+    const trusted = trustedProjects(() => [...new Set(loadStore().learnings.map((l) => l.project).filter((p) => !!p))]);
+    const untrusted = new Set();
     // One load and one save for the whole sweep (~880 files), instead of one full-file
     // rewrite per rule per file. [LOCK] [STORE-NEVER-STARTS-FRESH-OVER-DATA]
     try {
@@ -1025,6 +1030,18 @@ export function autoImportFromSources(sources) {
                     continue;
                 // Extract project name from source name (e.g., "ContextEngine — copilot-instructions.md")
                 const project = source.name.split(" — ")[0]?.trim() || undefined;
+                // A project the owner has not marked as theirs is searchable, never imported automatically.
+                // [LOCK] [AUTO-IMPORT-ONLY-FROM-TRUSTED-PROJECTS]
+                if (project && !trusted.has(project.toLowerCase())) {
+                    try {
+                        if (looksLikeMarkedLearnings(readFileSync(source.path, "utf-8")))
+                            untrusted.add(project);
+                    }
+                    catch {
+                        /* unreadable: nothing to import anyway */
+                    }
+                    continue;
+                }
                 // Strict by construction: only marked learnings. [LOCK] [AUTO-IMPORT-ONLY-MARKED-LEARNINGS]
                 const result = importLearningsFromFile(source.path, "other", project);
                 totalImported += result.imported;
@@ -1043,7 +1060,7 @@ export function autoImportFromSources(sources) {
         totalUpdated = 0;
         processed = 0;
     }
-    return { total: processed, imported: totalImported, updated: totalUpdated, ignored: totalIgnored, refused };
+    return { total: processed, imported: totalImported, updated: totalUpdated, ignored: totalIgnored, refused, untrusted: [...untrusted] };
 }
 /**
  * Get the store stats.

package/dist/license-sig.d.ts

@@ -1,3 +1,10 @@
+/** Tests only: verify against another key, in this process. Pass null to restore the pinned key. */
+export declare function __setLicensePublicKeyForTesting(pem: string | null): void;
+/**
+ * True when `signatureB64` is an Ed25519 signature of `bytes` by the pinned key. Used for the
+ * community rules file, which is signed as a whole. [LOCK] [COMMUNITY-TIER-A-IS-SIGNED]
+ */
+export declare function verifyDetachedSignature(bytes: Buffer, signatureB64: string): boolean;
 export declare const LICENSE_PUBLIC_KEY_PEM = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAnWMq7ITUPmC/8yx9XmpYktaWmQtXDOx6R2nqSdibq+Y=\n-----END PUBLIC KEY-----";
 export declare const LICENSE_PUBKEY_FINGERPRINT = "12d0c34c917a47fbed99945d2b7fb439";
 export interface SignableLicensePayload {
@@ -38,8 +45,8 @@ export type VerifyResult = {
  *   - ok=false, reason=<string>           → signature missing / invalid /
  *                                            tampered / wrong keypair
  *
- * Override the public key via CE_LICENSE_PUBLIC_KEY env var (PEM contents)
- * for self-hosters running their own activation server.
+ * The key is the pinned one (tests: __setLicensePublicKeyForTesting). No environment variable
+ * replaces it any more. [LOCK] [LICENSE-SIG]
  */
 export declare function verifyLicenseSignature(license: SignableLicensePayload & {
     signature: string;

package/dist/license-sig.js

@@ -6,8 +6,13 @@
 //    the change.
 // ⛔ NEVER ship the public key as a mutable variable. It's a constant
 //    that pins the client to the production activation server.
-//    Self-hosters override via CE_LICENSE_PUBLIC_KEY env var, which
-//    is the documented escape hatch.
+//    [NEVER] bring back an environment variable that replaces it (2026-09-25).
+//    Self-hosters build from source with their own key in LICENSE_PUBLIC_KEY_PEM.
+//    WHY (2026-09-25, owner's decision after E2E_REVIEW_2026-09 A4-1): the old escape hatch,
+//    CE_LICENSE_PUBLIC_KEY, documented in the shipped CHANGELOG, let anyone generate a key pair,
+//    sign their own licence and unlock every Pro tool with one variable; proven in a sandbox
+//    (`score` ran on a self-signed licence). Tests swap the key in-process only, through
+//    __setLicensePublicKeyForTesting().
 // ⛔ Legacy SHA-256 signatures are NOW REJECTED (flag day reached
 //    2026-06-11 — earlier than the originally scheduled 2026-08-15
 //    because the customer base is effectively empty and no one would
@@ -26,9 +31,32 @@
 // Ed25519 license signature — verify side (client).
 //
 // Pairs with server/src/license-sig.ts (sign side). Public key below is
-// pinned to the production activation server (api.compr.ch). Self-hosters
-// override with CE_LICENSE_PUBLIC_KEY env var.
+// pinned to the production activation server (api.compr.ch). No runtime
+// override: see [LICENSE-SIG] above.
 import { createPublicKey, verify } from "crypto";
+let testPublicKeyPem = null;
+/** Tests only: verify against another key, in this process. Pass null to restore the pinned key. */
+export function __setLicensePublicKeyForTesting(pem) {
+    testPublicKeyPem = pem;
+}
+function activePublicKeyPem() {
+    return testPublicKeyPem ?? LICENSE_PUBLIC_KEY_PEM;
+}
+/**
+ * True when `signatureB64` is an Ed25519 signature of `bytes` by the pinned key. Used for the
+ * community rules file, which is signed as a whole. [LOCK] [COMMUNITY-TIER-A-IS-SIGNED]
+ */
+export function verifyDetachedSignature(bytes, signatureB64) {
+    try {
+        const sig = Buffer.from(signatureB64.trim(), "base64");
+        if (sig.length !== 64)
+            return false;
+        return verify(null, bytes, createPublicKey(activePublicKeyPem()), sig);
+    }
+    catch {
+        return false;
+    }
+}
 // Production Ed25519 public key. Paired private key lives ONLY on the
 // activation server. Public key SHA-256 fingerprint (first 32 hex chars):
 //   12d0c34c917a47fbed99945d2b7fb439
@@ -66,10 +94,10 @@ export function canonicalPayload(license) {
  *   - ok=false, reason=<string>           → signature missing / invalid /
  *                                            tampered / wrong keypair
  *
- * Override the public key via CE_LICENSE_PUBLIC_KEY env var (PEM contents)
- * for self-hosters running their own activation server.
+ * The key is the pinned one (tests: __setLicensePublicKeyForTesting). No environment variable
+ * replaces it any more. [LOCK] [LICENSE-SIG]
  */
-export function verifyLicenseSignature(license, publicKeyPem = process.env.CE_LICENSE_PUBLIC_KEY || LICENSE_PUBLIC_KEY_PEM) {
+export function verifyLicenseSignature(license, publicKeyPem = activePublicKeyPem()) {
     if (!license.signature || license.signature.length === 0) {
         return { ok: false, reason: "signature field missing" };
     }

package/dist/secret-shapes.d.ts

@@ -19,6 +19,25 @@ export interface RedactionResult {
 }
 /** Replace every credential shape in `input`. Returns the new text and the count per shape. */
 export declare function redactSecrets(input: string): RedactionResult;
+/**
+ * [LOCKED] [INDEX-NEVER-SERVES-A-CREDENTIAL] - 2026-09-25 (moved here from src/index.ts the same day)
+ * [NEVER] let a chunk into the index, the shared index file or a search result without passing
+ *         its text through redactSecrets(), in the MCP server AND in the CLI.
+ * WHY: on 2026-09-25 the shared index held database URLs with their passwords (read from dotenv
+ *      files, whose masking skipped the password inside a URL), sshpass and mysql passwords from
+ *      runbooks and memory notes, and Google API keys: 55 sources in all. search_context hands
+ *      chunks to every AI agent that asks, and the index file rides the weekly backup.
+ *      The same day the fix was found to cover one builder of two: the CLI's initEngine() never
+ *      called it, and `contextengine search` returned 7 of 7 planted fake credentials in clear
+ *      (E2E_REVIEW_2026-09 A6-2). The VS Code extension shells out to that CLI.
+ * FIX: every chunk, whatever collected it (docs, code, ops collectors, learnings, community rules,
+ *      adapters), is redacted with the capture shapes as the index is built, by this one function,
+ *      called by both builders (src/index.ts buildIndex, src/cli.ts initEngine).
+ *      The source files are not touched: cleaning those is the owner's call, file by file.
+ */
+export declare function redactChunk<T extends {
+    content: string;
+}>(c: T): T;
 /** Redact every string inside a JSON-like value, returning a copy and the merged counts. */
 export declare function redactPayload<T>(value: T): {
     value: T;

package/dist/secret-shapes.js

@@ -36,7 +36,9 @@ export const SECRET_SHAPES = [
     { id: "telegram_bot_token", re: /\b\d{8,10}:AA[0-9A-Za-z_-]{33}\b/g },
     { id: "jwt", re: /\beyJ[0-9A-Za-z_-]{10,}\.eyJ[0-9A-Za-z_-]{10,}\.[0-9A-Za-z_-]{10,}/g },
     // scheme://user:SECRET@host, the shape of every database URL found on 2026-09-24.
-    { id: "url_password", re: /(\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@'"`]+:)[^\s@/'"`]+(?=@)/gi, keepPrefix: true },
+    // The user part may be empty: redis://:secret@host is how Redis spells a password-only URL
+    // (E2E_REVIEW_2026-09 A6-3: it came back raw from search and from the receiver).
+    { id: "url_password", re: /(\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@'"`]*:)[^\s@/'"`]+(?=@)/gi, keepPrefix: true },
     { id: "sshpass_password", re: new RegExp(String.raw `(\bsshpass\s+-p\s*)${QUOTED_OR_BARE}`, "g"), keepPrefix: true },
     { id: "sshpass_env", re: new RegExp(String.raw `(\bSSHPASS=)${QUOTED_OR_BARE}`, "g"), keepPrefix: true },
     // mysql -pSECRET (the value is glued to the flag; a bare -p prompts and is left alone).
@@ -48,10 +50,13 @@ export const SECRET_SHAPES = [
     { id: "api_key_header", re: /(\bx-api-key:\s*)[^\s'"]{8,}/gi, keepPrefix: true },
     // name = value, the long tail. Skips variables, env lookups, paths, placeholders already
     // redacted, type names and function calls.
+    // A name that is PASS alone or ends in a separator plus PASS (SMTP_PASS, DB_PASS, db.pass) counts
+    // too: a real mail password sat in the shared index under SMTP_PASS (E2E_REVIEW_2026-09 A6-3).
+    // The separator keeps bypass and compass out.
     {
         id: "credential_assignment",
         // A backtick opens a value too: "password: `...`" in Markdown, found in the real log.
-        re: /(\b[\w.-]*(?:password|passwd|pwd|secret|token|api[_-]?key|apikey|access[_-]?key|private[_-]?key|client[_-]?secret)["'`]?\s*[:=]\s*["'`]?)(?![$<{*/~.[]|process\.env|os\.environ|getenv)[^\s'"`,;)}\]]{6,}/gi,
+        re: /(\b(?:[\w.-]*(?:password|passwd|pwd|secret|token|api[_-]?key|apikey|access[_-]?key|private[_-]?key|client[_-]?secret)|(?:[\w.-]*[_.-])?pass)["'`]?\s*[:=]\s*["'`]?)(?![$<{*/~.[]|process\.env|os\.environ|getenv)[^\s'"`,;)}\]]{6,}/gi,
         keepPrefix: true,
         skip: (value, after) => after.startsWith("(") ||
             (/^[A-Za-z_$][\w$.]*\(/.test(value) && after.startsWith(")")) || // getToken(user), not a value
@@ -106,6 +111,26 @@ export function redactSecrets(input) {
     }
     return { text, counts };
 }
+/**
+ * [LOCKED] [INDEX-NEVER-SERVES-A-CREDENTIAL] - 2026-09-25 (moved here from src/index.ts the same day)
+ * [NEVER] let a chunk into the index, the shared index file or a search result without passing
+ *         its text through redactSecrets(), in the MCP server AND in the CLI.
+ * WHY: on 2026-09-25 the shared index held database URLs with their passwords (read from dotenv
+ *      files, whose masking skipped the password inside a URL), sshpass and mysql passwords from
+ *      runbooks and memory notes, and Google API keys: 55 sources in all. search_context hands
+ *      chunks to every AI agent that asks, and the index file rides the weekly backup.
+ *      The same day the fix was found to cover one builder of two: the CLI's initEngine() never
+ *      called it, and `contextengine search` returned 7 of 7 planted fake credentials in clear
+ *      (E2E_REVIEW_2026-09 A6-2). The VS Code extension shells out to that CLI.
+ * FIX: every chunk, whatever collected it (docs, code, ops collectors, learnings, community rules,
+ *      adapters), is redacted with the capture shapes as the index is built, by this one function,
+ *      called by both builders (src/index.ts buildIndex, src/cli.ts initEngine).
+ *      The source files are not touched: cleaning those is the owner's call, file by file.
+ */
+export function redactChunk(c) {
+    const r = redactSecrets(c.content);
+    return Object.keys(r.counts).length > 0 ? { ...c, content: r.text } : c;
+}
 /** Redact every string inside a JSON-like value, returning a copy and the merged counts. */
 export function redactPayload(value) {
     const counts = {};