@compr/opscontext-mcp 2.9.1 → 2.11.0

package/dist/ce-home.d.ts

@@ -0,0 +1,7 @@
+export declare function ceHome(): string;
+/** Makes `dir` private to this user (0700), creating it if needed. Never throws. */
+export declare function securePrivateDir(dir: string, create: boolean): void;
+/** The CE home (created if missing) and, when CONTEXTENGINE_HOME points elsewhere, the default one
+ *  if it exists: the receiver's secret always lives in ~/.contextengine. */
+export declare function secureCeHome(): void;
+//# sourceMappingURL=ce-home.d.ts.map

package/dist/ce-home.js

@@ -0,0 +1,45 @@
+// [LOCKED] [CE-HOME-IS-PRIVATE] - 2026-09-25
+// [NEVER] leave ~/.contextengine (or CONTEXTENGINE_HOME) readable by other accounts, and never
+//         chmod a folder this user does not own.
+// WHY: every file in it was created with the default modes: the folder 0755, and audit.log with
+//      its 59 archived segments, learnings.json and 20 backups, sessions, the shared index (which
+//      holds dotenv, shell history and crontab chunks), license.json and the daemon log all 0644.
+//      Only extension-secret and keys/ were private. On a Mac whose home folder is 0755, or a
+//      shared Linux box, any other account could read the lot (E2E_REVIEW_2026-09 A7-1, A4-3).
+// FIX: both entry points (the MCP server's main() and the CLI's dispatcher) call secureCeHome()
+//      first: the folder is created 0700, or set to 0700 when it has any group or other bit. A
+//      private folder shields every file inside, whatever its own mode, so no writer has to
+//      remember a mode. A folder owned by someone else is left alone.
+import { chmodSync, existsSync, mkdirSync, statSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+export function ceHome() {
+    return process.env.CONTEXTENGINE_HOME || join(homedir(), ".contextengine");
+}
+/** Makes `dir` private to this user (0700), creating it if needed. Never throws. */
+export function securePrivateDir(dir, create) {
+    try {
+        if (!existsSync(dir)) {
+            if (!create)
+                return;
+            mkdirSync(dir, { recursive: true, mode: 0o700 });
+        }
+        const st = statSync(dir);
+        if (typeof process.getuid === "function" && st.uid !== process.getuid())
+            return;
+        if ((st.mode & 0o077) !== 0)
+            chmodSync(dir, 0o700);
+    }
+    catch {
+        /* permissions are hardening, never a reason to stop */
+    }
+}
+/** The CE home (created if missing) and, when CONTEXTENGINE_HOME points elsewhere, the default one
+ *  if it exists: the receiver's secret always lives in ~/.contextengine. */
+export function secureCeHome() {
+    securePrivateDir(ceHome(), true);
+    const fallback = join(homedir(), ".contextengine");
+    if (fallback !== ceHome())
+        securePrivateDir(fallback, false);
+}
+//# sourceMappingURL=ce-home.js.map

package/dist/cli-commands.js

@@ -44,6 +44,7 @@ export const KNOWN_COMMANDS = [
     "import-learnings",
     "init",
     "init-extension-secret",
+    "trust",
     "install-autostart",
     "install-claude-hook",
     "install-skill",

package/dist/cli.js

@@ -15,11 +15,11 @@
  *   contextengine cost                Multi-agent token/cost/capacity report from transcripts
  *   contextengine help                Show this message
  */
-import { existsSync, readFileSync, writeFileSync, mkdirSync, statSync } from "fs";
+import { existsSync, readFileSync, writeFileSync, mkdirSync, statSync, mkdtempSync } from "fs";
 import { join, basename, resolve } from "path";
 import { createInterface } from "readline";
 import { tmpdir, homedir } from "os";
-import { execSync } from "child_process";
+import { execSync, execFileSync } from "child_process";
 function detectProject(dir) {
     const name = basename(dir);
     const result = {
@@ -649,14 +649,18 @@ import { scanCodeDir } from "./code-chunker.js";
 import { listProjects, runComplianceAudit, formatProjectList, formatPlan, scoreProject, runScoreCanary, formatScoreReport, generateScoreHTML, generateProjectScoreMD, } from "./agents.js";
 import { listLearnings, parseSince, learningsToChunks, learningsStats, formatLearnings, saveLearning, deleteLearning, importLearningsFromFile, autoImportFromSources, LEARNING_CATEGORIES, } from "./learnings.js";
 import { saveSession, loadSession, listSessions, deleteSession, formatSession, formatSessionList, } from "./sessions.js";
-import { activate, deactivate, getActivationStatus, gateCheck, } from "./activation.js";
+import { activate, deactivate, getActivationStatus, gateCheckFresh, } from "./activation.js";
 import { syncTierA, syncTierB, loadCommunityStore, communityRulesToChunks, mergeWithDedup, STORE_PATH as COMMUNITY_STORE_PATH, } from "./community-sync.js";
-import { readAuditLog, verifyChain, filterByRange, toCsv, rotateAuditLog, planRotation, listSegments, acknowledgeRedaction, restoreSegment, scrubAuditLog, } from "./audit.js";
-import { redactPayload } from "./secret-shapes.js";
+import { readAuditLog, verifyChain, filterByRange, toCsv, rotateAuditLog, planRotation, listSegments, acknowledgeRedaction, restoreSegment, scrubAuditLog, recordVerifyState, acquireVerifyLock, } from "./audit.js";
+import { redactPayload, redactChunk } from "./secret-shapes.js";
 import { loadRepoPolicy, parsePolicy, formatPolicySummary, formatValidationErrors, repoPolicyPath, } from "./policy.js";
 import { buildCostReport } from "./cost-report.js";
 import { getStagedFiles, runSecretScan, runDocCoverage, runCommitMessageRequired, runRuleParity, formatSecretViolations, formatDocCoverageViolations, formatSecretViolationsJson, formatDocCoverageViolationsJson, formatCommitMessageViolations, formatCommitMessageViolationsJson, formatRuleParityViolations, formatRuleParityViolationsJson, } from "./hooks.js";
 import { safeAppend } from "./audit.js";
+import { checkCaptureEvent, prepareCapturedPayload } from "./http-server.js";
+import { secureCeHome } from "./ce-home.js";
+import { QUOTED_TEXT_NOTE } from "./framing.js";
+import { trustProjects, untrustProjects, listTrusted } from "./trusted-projects.js";
 import { listServers, formatServers } from "./server-registry.js";
 import { computeFleetHealth, formatFleetHealth } from "./fleet-health.js";
 import { ciStatusForHead, formatCiStatus } from "./ci-status.js";
@@ -713,7 +717,9 @@ async function initEngine() {
         const localChunks = chunks;
         chunks = mergeWithDedup(localChunks, communityChunks);
     }
-    return { sources, chunks };
+    // [LOCK] [INDEX-NEVER-SERVES-A-CREDENTIAL]: the CLI builds its own index; every chunk it can
+    // print goes through the same redaction as the MCP server's.
+    return { sources, chunks: chunks.map(redactChunk) };
 }
 // ---------------------------------------------------------------------------
 // CLI Subcommands
@@ -725,7 +731,7 @@ async function cliSearch(query, topK) {
         console.log(`No results found for: "${query}"`);
         return;
     }
-    console.log(`\n🔍 Search: "${query}" | ${results.length} results (keyword/BM25)\n`);
+    console.log(`\n🔍 Search: "${query}" | ${results.length} results (keyword/BM25)\n${QUOTED_TEXT_NOTE}\n`);
     for (let i = 0; i < results.length; i++) {
         const r = results[i];
         console.log(`--- Result ${i + 1} (score: ${r.score.toFixed(3)}) ---`);
@@ -753,7 +759,7 @@ async function cliListSources() {
     console.log("");
 }
 async function cliListProjects() {
-    const gate = gateCheck("list_projects");
+    const gate = await gateCheckFresh("list_projects");
     if (gate) {
         console.error(gate);
         process.exit(1);
@@ -872,7 +878,7 @@ async function cliDeleteLearning(id) {
  *      the scan.
  */
 async function cliScore(project, html = false, save = true, all = false) {
-    const gate = gateCheck("score_project");
+    const gate = await gateCheckFresh("score_project");
     if (gate) {
         console.error(gate);
         process.exit(1);
@@ -963,13 +969,15 @@ async function cliScore(project, html = false, save = true, all = false) {
     }
     if (html) {
         const htmlContent = generateScoreHTML(scores);
-        const tmpPath = join(tmpdir(), "contextengine-score.html");
-        writeFileSync(tmpPath, htmlContent, "utf-8");
+        // A private folder of its own, not a fixed name in a shared /tmp, and the path handed to the
+        // opener as an argument, never pasted into a shell string (E2E_REVIEW_2026-09 A1-1).
+        const tmpPath = join(mkdtempSync(join(tmpdir(), "contextengine-score-")), "score.html");
+        writeFileSync(tmpPath, htmlContent, { encoding: "utf-8", mode: 0o600 });
         console.log(`\n📊 HTML report written to: ${tmpPath}`);
         // Open in default browser
-        const openCmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+        const [openCmd, ...openArgs] = process.platform === "darwin" ? ["open"] : process.platform === "win32" ? ["cmd", "/c", "start", '""'] : ["xdg-open"];
         try {
-            execSync(`${openCmd} "${tmpPath}"`);
+            execFileSync(openCmd, [...openArgs, tmpPath], { stdio: "ignore" });
             console.log("🌐 Opened in browser\n");
         }
         catch {
@@ -991,7 +999,7 @@ async function cliScore(project, html = false, save = true, all = false) {
     }
 }
 async function cliAudit() {
-    const gate = gateCheck("run_audit");
+    const gate = await gateCheckFresh("run_audit");
     if (gate) {
         console.error(gate);
         process.exit(1);
@@ -1728,12 +1736,31 @@ safeAppend), visible via 'contextengine audit-verify' and consumed by the
         console.error(`Bad payload JSON: ${e instanceof Error ? e.message : String(e)}`);
         process.exit(1);
     }
-    // Cast — the audit module accepts any string for the event field; the
-    // AuditEvent union is documentation, not enforcement. Validation of
-    // "what's a valid event kind" is the caller's responsibility (the HTTP
-    // server enforces a prefix allow-list; this CLI is trusted).
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    safeAppend(eventKind, payload, actor);
+    // [LOCKED] [EMIT-EVENT-GOES-THROUGH-THE-DOOR] - 2026-09-25
+    // [NEVER] append a captured event here without the receiver's kind check and
+    //         prepareCapturedPayload().
+    // WHY: this command was "trusted" and wrote anything: in a sandbox it kept a mysql password and
+    //      a prompt's full text, and wrote an audit.redact acknowledgement, the record that turns
+    //      "altered" into "redacted" in the verifier. The VS Code extension emits through it, so
+    //      [CAPTURE-IS-REDACTED-AT-THE-DOOR] and [PROMPT-TEXT-IS-NOT-KEPT] had a side entrance
+    //      (E2E_REVIEW_2026-09 A2-6).
+    // FIX: the same checkCaptureEvent() and prepareCapturedPayload() as POST /events; "cli" stays a
+    //      valid actor here, "system" does not.
+    const refused = checkCaptureEvent(eventKind, actor, { allowCliActor: true });
+    if (refused) {
+        console.error(`❌ ${refused}`);
+        process.exit(1);
+    }
+    // [LOCKED] [RECEIVER-SAYS-WHAT-WAS-WRITTEN] - 2026-09-27
+    // [NEVER] report "Appended" or exit 0 for an entry the audit log refused.
+    // WHY: on a stuck log (a record cut short by a full disk) this printed "Appended vscode.tool_call to
+    //      audit log." and exited 0 while nothing landed (E2E_REVIEW_2026-09 B1-1); the VS Code
+    //      extension emits through this command and believed it.
+    // FIX: safeAppend() returns whether it wrote; a refusal exits 1. [LOCK] [A-REFUSED-APPEND-IS-COUNTED-AND-CHAINED]
+    if (!safeAppend(eventKind, prepareCapturedPayload(payload, eventKind), actor)) {
+        console.error(`❌ Not recorded: the audit log refused ${eventKind} (reason above). The refusal is counted and will be noted on the chain.`);
+        process.exit(1);
+    }
     console.log(`✅ Appended ${eventKind} to audit log.`);
 }
 async function cliWatch(args) {
@@ -1824,6 +1851,33 @@ this CLI is for terminal users, CI, and cron.`);
     // helps catch terminal closes.
     process.stdin.resume();
 }
+/** `contextengine trust`: which projects are auto-imported. [LOCK] [AUTO-IMPORT-ONLY-FROM-TRUSTED-PROJECTS] */
+function cliTrust(args) {
+    if (args.includes("-h") || args.includes("--help")) {
+        console.log(`Usage: contextengine trust <project>...        mark projects as yours
+       contextengine trust --list                  show them
+       contextengine trust --remove <project>...   unmark them
+
+Learnings are imported automatically only from projects marked as yours. A project seen for the
+first time (a repository you downloaded, for instance) stays searchable but its learnings are not
+saved until you mark it. The list starts with every project that already had learnings.`);
+        return;
+    }
+    const names = args.filter((a) => !a.startsWith("-"));
+    let list;
+    if (args.includes("--remove")) {
+        list = untrustProjects(names);
+        console.log(`Removed ${names.length} project(s).`);
+    }
+    else if (names.length > 0) {
+        list = trustProjects(names, () => [...new Set(listLearnings().map((l) => l.project).filter((p) => !!p))]);
+        console.log(`Marked as yours: ${names.join(", ")}. Their learnings are imported at the next reindex.`);
+    }
+    else {
+        list = listTrusted();
+    }
+    console.log(`${list.length} trusted project(s)${list.length ? ": " + list.join(", ") : " (none yet: the list is created at the first reindex)"}`);
+}
 async function cliInitExtensionSecret(args) {
     const force = args.includes("--force") || args.includes("-f");
     const help = args.includes("-h") || args.includes("--help");
@@ -2084,11 +2138,35 @@ function cliAuditRedactAck(args) {
     console.log(`   audit-verify now: ${after.ok ? "OK" : "FAILED"}, ${(after.redactedIndices ?? []).length} redacted, ${(after.tamperedIndices ?? []).length} altered.`);
 }
 async function cliAuditVerify() {
+    // [LOCK] [HEALTH-SEES-THE-CHAIN]: every full check leaves its result for fleet health. The
+    // daily one (--scheduled, started by the indexing server) runs one at a time and prints nothing.
+    const scheduled = process.argv.includes("--scheduled");
+    let releaseVerifyLock = null;
+    if (scheduled) {
+        releaseVerifyLock = acquireVerifyLock();
+        if (!releaseVerifyLock)
+            return; // another check is running
+    }
+    const t0 = Date.now();
     const report = verifyChain();
+    recordVerifyState(report, Date.now() - t0, scheduled ? "scheduled" : "cli");
+    if (scheduled) {
+        releaseVerifyLock?.();
+        return;
+    }
     const forks = report.forkIndices ?? [];
     const redacted = report.redactedIndices ?? [];
+    const dups = report.duplicateIndices ?? [];
+    // [LOCK] [VERIFY-FORK-IS-NOT-TAMPER]: a second copy of a record is counted once and named as a copy.
+    const copiesNote = () => {
+        if (dups.length === 0)
+            return;
+        console.log(`\n⚠️  ${dups.length} record(s) appear twice (a second copy of a record already in the log).`);
+        console.log(`   Counted once. Content intact, nothing missing. Usually a log trim that was interrupted or`);
+        console.log(`   ran while entries arrived. At: ${dups.slice(0, 8).join(", ")}${dups.length > 8 ? `, … (+${dups.length - 8} more)` : ""}`);
+    };
     if (report.ok) {
-        console.log(`✅ Audit chain verified — ${report.total} record(s).`);
+        console.log(`✅ Audit chain verified — ${report.total - dups.length} record(s).`);
         console.log(redacted.length === 0
             ? `   No record was altered, and no history is missing.`
             : `   No history is missing. ${redacted.length} record(s) redacted and acknowledged on the chain (indices ${redacted.slice(0, 8).join(", ")}${redacted.length > 8 ? ", …" : ""}), 0 altered.`);
@@ -2101,6 +2179,7 @@ async function cliAuditVerify() {
             console.log(`   property holds. Do NOT rewrite the log to linearise it — that would destroy`);
             console.log(`   the evidence it exists to provide.`);
         }
+        copiesNote();
         return;
     }
     console.error(`❌ Audit chain FAILED — ${report.total} record(s) checked.`);
@@ -2110,12 +2189,24 @@ async function cliAuditVerify() {
         console.error(`\n   Altered records (content does not match its own hash):`);
         console.error(`     ${t.slice(0, 10).join(", ")}${t.length > 10 ? `, … (+${t.length - 10} more)` : ""}`);
         console.error(`   This is tampering: the record's bytes were changed after it was written.`);
-        console.error(`   If this was a deliberate redaction of a secret, acknowledge it on the chain:`);
-        console.error(`     contextengine audit-redact-ack --index ${t.slice(0, 3).join(",")} --reason "<what was removed and why>"`);
+        console.error(`   If this was a deliberate redaction of a secret, acknowledge it on the chain`);
+        console.error(`   (every altered index is listed, so the command can be pasted as it is):`);
+        console.error(`     contextengine audit-redact-ack --index ${t.join(",")} --reason "<what was removed and why>"`);
     }
     if (redacted.length > 0) {
         console.error(`\n   Also ${redacted.length} redacted record(s), acknowledged on the chain, not counted above.`);
     }
+    // [LOCK] [VERIFY-READS-PAST-AN-UNREADABLE-LINE]: say where, and that the rest was checked.
+    const unreadable = report.unreadable ?? [];
+    if (unreadable.length > 0) {
+        console.error(`\n   Lines that are not records (every other record was checked):`);
+        for (const u of unreadable.slice(0, 10))
+            console.error(`     ${u.file} line ${u.line}`);
+        if (unreadable.length > 10)
+            console.error(`     … (+${unreadable.length - 10} more)`);
+        console.error(`   A last record cut short by a full disk is set aside by the next append on its own;`);
+        console.error(`   a line like these is damage: keep a copy of the file before touching it.`);
+    }
     if ((report.orphanIndices ?? []).length > 0) {
         const o = report.orphanIndices;
         console.error(`\n   Orphaned records (parent hash absent from the log):`);
@@ -2127,6 +2218,9 @@ async function cliAuditVerify() {
     if (forks.length > 0) {
         console.error(`\n   (Also ${forks.length} concurrent-append fork(s) — benign, see docs.)`);
     }
+    if (dups.length > 0) {
+        console.error(`\n   (Also ${dups.length} second copies of records, counted once, benign.)`);
+    }
     console.error(`\nFor compliance-graded evidence, treat the affected records as unverified.`);
     process.exit(2);
 }
@@ -2284,6 +2378,9 @@ async function cliEndSession() {
         checks.push(`- ⛔ Auto-import write refused: ${autoImport.refused}`);
         failCount++;
     }
+    if (autoImport.untrusted.length > 0) {
+        checks.push(`- ⏸ Not imported, project not marked as yours: ${autoImport.untrusted.join(", ")} (contextengine trust <project>)\n`);
+    }
     // --- Check 3: Learnings Store ---
     checks.push("## 3. Learnings Store\n");
     const stats = learningsStats();
@@ -2575,6 +2672,9 @@ function readPackageVersion() {
 // Main — route to init, CLI subcommand, or MCP server
 // ---------------------------------------------------------------------------
 const command = process.argv[2];
+// [LOCK] [CE-HOME-IS-PRIVATE]: before any command writes into it (not for a version or help line).
+if (command && !["--version", "-v", "--help", "-h", "help"].includes(command))
+    secureCeHome();
 if (command === "init") {
     runInit().catch((err) => {
         console.error("Error:", err);
@@ -2635,6 +2735,8 @@ Usage:
                                        Author + validate the declarative .contextengine/policy.json
   contextengine init-extension-secret [--force]
                                        Generate ~/.contextengine/extension-secret for the browser ext
+  contextengine trust [<project>...] [--list] [--remove <project>...]
+                                       Mark projects as yours: only those are auto-imported into learnings
   contextengine install-autostart [--force]
                                        Install macOS LaunchAgent so MCP server auto-starts at login
                                        (uninstall-autostart / autostart-status — companion commands)
@@ -2895,6 +2997,9 @@ else if (command === "init-extension-secret") {
         process.exit(1);
     });
 }
+else if (command === "trust") {
+    cliTrust(process.argv.slice(3));
+}
 else if (command === "install-autostart") {
     import("./install-autostart.js").then((m) => m.cliInstallAutostart(process.argv.slice(3))).catch((err) => {
         console.error("Error:", err instanceof Error ? err.message : err);

package/dist/collectors.d.ts

@@ -1,4 +1,7 @@
 import type { Chunk } from "./ingest.js";
+/** The last `count` lines of a file, read without a shell, from at most its last 256 KB. */
+export declare function readLastLines(path: string, count: number): string;
+export declare function redactSensitive(content: string): string;
 /**
  * Collect recent git history for a project directory.
  * Produces chunks with commit messages, authors, dates — gives AI

package/dist/collectors.js

@@ -1,5 +1,5 @@
 import { execSync } from "child_process";
-import { readFileSync, existsSync, readdirSync, statSync } from "fs";
+import { readFileSync, existsSync, readdirSync, statSync, openSync, fstatSync, readSync, closeSync } from "fs";
 import { resolve, join } from "path";
 import { homedir } from "os";
 /**
@@ -34,13 +34,43 @@ function exec(cmd, cwd) {
         return "";
     }
 }
+/** The last `count` lines of a file, read without a shell, from at most its last 256 KB. */
+export function readLastLines(path, count) {
+    const fd = openSync(path, "r");
+    try {
+        const size = fstatSync(fd).size;
+        const len = Math.min(size, 256 * 1024);
+        const buf = Buffer.alloc(len);
+        readSync(fd, buf, 0, len, size - len);
+        const lines = buf.toString("utf-8").split("\n");
+        if (len < size)
+            lines.shift(); // the first line was cut by the window
+        if (lines.length > 0 && lines[lines.length - 1] === "")
+            lines.pop();
+        return lines.slice(-count).join("\n");
+    }
+    finally {
+        closeSync(fd);
+    }
+}
 /** Check if a command exists */
 function commandExists(cmd) {
     return exec(`command -v ${cmd}`) !== "";
 }
-/** Redact sensitive values in .env content */
-function redactSensitive(content) {
-    const sensitivePatterns = /^(.*(?:PASSWORD|SECRET|KEY|TOKEN|CREDENTIAL|AUTH|PRIVATE|API_KEY|DB_PASSWORD|MAIL_PASSWORD|JWT_SECRET|APP_KEY|ENCRYPT)[^=]*=\s*).+$/gim;
+// [LOCKED] [ENV-MASK-IS-LINE-BOUND] - 2026-09-25
+// [NEVER] let this pattern cross a newline, or look for the secret word anywhere but in the name
+//         (the part before the first "=").
+// WHY: the old pattern `^(.*(?:...KEY|TOKEN...)[^=]*=\s*).+$` let `[^=]*` and `\s*` run over line
+//      ends. A value that itself contained "key", "token", "auth" or "secret" (case-insensitive)
+//      matched there, the match ran on to the next line's "=", and that next line was masked
+//      while the real value stayed in clear. Two FLASK_SECRET_KEY values sat unmasked in the shared
+//      index this way; `SMTP_PASS` was never masked at all (E2E_REVIEW_2026-09 A6-3). An agent's
+//      screen hid the bug: the output guard redacted the value on display, not the tool.
+// FIX: the name is `[^=\r\n]*` on both sides of the secret word, spaces after "=" are `[ \t]*`, and
+//      PASS joins the word list (it also covers PASSWORD). Over-masking a config value in search
+//      costs nothing; under-masking hands a password to every agent.
+export function redactSensitive(content) {
+    const sensitivePatterns = /^([^=\r\n]*(?:PASS|SECRET|KEY|TOKEN|CREDENTIAL|AUTH|PRIVATE|ENCRYPT)[^=\r\n]*=[ \t]*)\S[^\r\n]*$/gim;
     return content.replace(sensitivePatterns, "$1[REDACTED]");
 }
 // ---------------------------------------------------------------------------
@@ -297,8 +327,9 @@ export function collectShellHistory(sourceName) {
     if (!existsSync(histFile))
         return [];
     try {
-        // Read last 200 lines (most recent commands)
-        const raw = exec(`tail -200 ${histFile}`);
+        // Read last 200 lines (most recent commands). Read directly: the path comes from HOME, and a
+        // home folder with a space or a `$(` broke, or ran, the old `tail -200 ${histFile}` (E2E A1-1).
+        const raw = readLastLines(histFile, 200);
         if (!raw)
             return [];
         // Parse zsh extended history format: : timestamp:0;command

package/dist/community-export.js

@@ -18,10 +18,10 @@
 // SEE ALSO: chrome-extension/src/content/shared/redact.ts (the same patterns,
 //   independently mirrored — keep both in sync; if you patch one, patch the
 //   other in the same commit).
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs";
+import { existsSync, readFileSync, writeFileSync, mkdirSync, mkdtempSync, rmSync } from "fs";
 import { dirname } from "path";
 import { createHash } from "crypto";
-import { execSync, spawnSync } from "child_process";
+import { spawnSync } from "child_process";
 import { tmpdir } from "os";
 import { join } from "path";
 import { listLearnings } from "./learnings.js";
@@ -359,32 +359,29 @@ export async function reviewLoop(rules) {
     if (!process.stdin.isTTY)
         return rules;
     const editor = process.env.EDITOR || "vi";
-    const tmpPath = join(tmpdir(), `opscontext-export-review-${process.pid}.json`);
-    writeFileSync(tmpPath, JSON.stringify(rules, null, 2), "utf-8");
-    const result = spawnSync(editor, [tmpPath], { stdio: "inherit" });
-    if (result.status !== 0) {
-        // Editor exited non-zero — keep the original list rather than risk a
-        // half-edited file.
-        return rules;
-    }
+    // A private folder, the file readable by the user only (it holds the learnings being exported),
+    // removed on every path. E2E_REVIEW_2026-09 A1-1: the old cleanup pasted the path into
+    // `rm -f "..."`, where a TMPDIR holding `$(` would run, and a failed edit left the file behind.
+    const dir = mkdtempSync(join(tmpdir(), "opscontext-export-review-"));
+    const tmpPath = join(dir, "review.json");
     try {
-        const edited = readFileSync(tmpPath, "utf-8");
-        const parsed = JSON.parse(edited);
-        if (Array.isArray(parsed))
-            return parsed;
-        return rules;
+        writeFileSync(tmpPath, JSON.stringify(rules, null, 2), { encoding: "utf-8", mode: 0o600 });
+        // EDITOR is a shell command by convention ("code --wait"), as git treats it; the file path goes
+        // in as "$1", an argument, never as text in the command.
+        const result = spawnSync("/bin/sh", ["-c", `${editor} "$1"`, "opscontext-editor", tmpPath], { stdio: "inherit" });
+        if (result.status !== 0) {
+            // Editor exited non-zero — keep the original list rather than risk a
+            // half-edited file.
+            return rules;
+        }
+        const parsed = JSON.parse(readFileSync(tmpPath, "utf-8"));
+        return Array.isArray(parsed) ? parsed : rules;
     }
     catch {
         return rules;
     }
     finally {
-        try {
-            // Best-effort cleanup; not a correctness issue if it lingers in $TMPDIR.
-            execSync(`rm -f ${JSON.stringify(tmpPath)}`);
-        }
-        catch {
-            /* ignore */
-        }
+        rmSync(dir, { recursive: true, force: true });
     }
 }
 // ---------------------------------------------------------------------------

package/dist/community-sync.d.ts

@@ -24,6 +24,9 @@
 import * as https from "https";
 import { Chunk } from "./ingest.js";
 export declare const TIER_A_URL = "https://raw.githubusercontent.com/FASTPROD/opscontext-community-rules/main/rules.json";
+/** Ed25519 signature of rules.json's exact bytes, base64, by the pinned licence key.
+ *  [LOCK] [COMMUNITY-TIER-A-IS-SIGNED] */
+export declare const TIER_A_SIG_URL = "https://raw.githubusercontent.com/FASTPROD/opscontext-community-rules/main/rules.json.sig";
 export declare const TIER_B_URL = "https://api.compr.ch/contextengine/community-rules/fetch";
 export declare const STORE_PATH: string;
 export type CommunitySource = "tier-A-public" | "tier-B-pro";

package/dist/community-sync.js

@@ -28,11 +28,19 @@ import { createHash } from "crypto";
 import * as https from "https";
 import { URL } from "url";
 import { safeAppend } from "./audit.js";
-import { verifyLicenseSignature, } from "./license-sig.js";
+import { verifyLicenseSignature, verifyDetachedSignature, } from "./license-sig.js";
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
 export const TIER_A_URL = "https://raw.githubusercontent.com/FASTPROD/opscontext-community-rules/main/rules.json";
+/** Ed25519 signature of rules.json's exact bytes, base64, by the pinned licence key.
+ *  [LOCK] [COMMUNITY-TIER-A-IS-SIGNED] */
+export const TIER_A_SIG_URL = `${TIER_A_URL}.sig`;
+// Caps on what any tier can put into every user's search results. [LOCK] [COMMUNITY-TIER-A-IS-SIGNED]
+const MAX_RULES_PER_SOURCE = 500;
+const MAX_RULE_CHARS = 500;
+const MAX_CONTEXT_CHARS = 2000;
+const MAX_TAGS = 10;
 export const TIER_B_URL = "https://api.compr.ch/contextengine/community-rules/fetch";
 export const STORE_PATH = join(homedir(), ".contextengine", "community-learnings.json");
 const STORE_DIR = join(homedir(), ".contextengine");
@@ -156,16 +164,20 @@ function normalizeIncoming(source, rawRules) {
     const now = new Date().toISOString();
     const out = [];
     for (const r of rawRules) {
+        if (out.length >= MAX_RULES_PER_SOURCE)
+            break;
         if (!isValidRuleShape(r))
             continue;
         const rec = r;
+        if (rec.rule.length > MAX_RULE_CHARS)
+            continue;
         out.push({
             id: rec.id,
             source,
             category: rec.category,
             rule: rec.rule,
-            context: rec.context,
-            tags: rec.tags,
+            context: rec.context.slice(0, MAX_CONTEXT_CHARS),
+            tags: rec.tags.slice(0, MAX_TAGS).map((t) => t.slice(0, 40)),
             project_cluster: typeof rec.project_cluster === "string"
                 ? rec.project_cluster
                 : undefined,
@@ -222,6 +234,32 @@ export async function syncTierA(opts = {}) {
         });
         return { fetched: 0, cached: true };
     }
+    // [LOCKED] [COMMUNITY-TIER-A-IS-SIGNED] - 2026-09-25
+    // [NEVER] accept tier A rules without a valid signature, or drop the caps in normalizeIncoming().
+    // WHY: tier A was plain JSON from a public GitHub repository, verified by nothing but TLS: whoever
+    //      could write to that repository wrote into every user's search results. In a sandbox 5,001
+    //      unsigned rules were accepted, one of 200 KB (E2E_REVIEW_2026-09 A6-4). Tier B was already
+    //      signed and bound to the request ([COMMUNITY-SYNC-REPLAY-GUARD]).
+    // FIX: rules.json must come with rules.json.sig, an Ed25519 signature of its exact bytes by the
+    //      pinned licence key (server/scripts/sign-community-rules.mjs, run where the private key
+    //      lives); unsigned or mismatched rules are discarded and the cache kept. Every tier is capped
+    //      (count, rule and context length, tags). The repository did not exist on 2026-09-25, so
+    //      nothing was cut off.
+    let sigRes;
+    try {
+        sigRes = await http(TIER_A_SIG_URL, { method: "GET", headers: { "User-Agent": headers["User-Agent"], Accept: "text/plain" } });
+    }
+    catch (e) {
+        process.stderr.write(`[community-sync] Tier A signature fetch failed (${e instanceof Error ? e.message : String(e)}); using cached store.\n`);
+        safeAppend("community.sync_error", { tier: "A", reason: "signature_fetch_failed" });
+        return { fetched: 0, cached: true };
+    }
+    if (sigRes.statusCode !== 200 || !verifyDetachedSignature(Buffer.from(res.body, "utf8"), sigRes.body)) {
+        const reason = sigRes.statusCode === 200 ? "signature_invalid" : "unsigned";
+        process.stderr.write(`[community-sync] Tier A rules discarded (${reason}): they must be signed with the pinned key; using cached store.\n`);
+        safeAppend("community.sync_error", { tier: "A", reason });
+        return { fetched: 0, cached: true };
+    }
     let parsed;
     try {
         parsed = JSON.parse(res.body);

package/dist/config.d.ts

@@ -54,6 +54,12 @@ export interface ContextEngineConfig {
  * Priority: env var > CWD > home dir
  */
 export declare function findConfigFile(): string | null;
+/** Where the config came from: the env var, the current folder, or the home folder. A config in
+ *  the current folder may belong to a downloaded repository. [LOCK] [ADAPTERS-ONLY-FROM-THE-USERS-OWN-CONFIG] */
+export declare function findConfigFileWithOrigin(): {
+    path: string;
+    origin: "env" | "cwd" | "home";
+} | null;
 /**
  * Load knowledge sources.
  *

package/dist/config.js

@@ -29,14 +29,19 @@ const DEFAULT_PATTERNS = [
  * Priority: env var > CWD > home dir
  */
 export function findConfigFile() {
+    return findConfigFileWithOrigin()?.path ?? null;
+}
+/** Where the config came from: the env var, the current folder, or the home folder. A config in
+ *  the current folder may belong to a downloaded repository. [LOCK] [ADAPTERS-ONLY-FROM-THE-USERS-OWN-CONFIG] */
+export function findConfigFileWithOrigin() {
     const candidates = [];
     const envPath = process.env.CONTEXTENGINE_CONFIG;
     if (envPath) {
-        candidates.push(resolve(envPath));
+        candidates.push({ path: resolve(envPath), origin: "env" });
     }
-    candidates.push(resolve(process.cwd(), "contextengine.json"), resolve(homedir(), ".contextengine.json"));
+    candidates.push({ path: resolve(process.cwd(), "contextengine.json"), origin: "cwd" }, { path: resolve(homedir(), ".contextengine.json"), origin: "home" });
     for (const c of candidates) {
-        if (existsSync(c))
+        if (existsSync(c.path))
             return c;
     }
     return null;