@compr/opscontext-mcp 2.9.1 → 2.11.0

package/dist/install-claude-hook.js

@@ -67,16 +67,95 @@ function backupSettings() {
 //      inputs that [OPSCONTEXT-CC-HOOK] protects.
 // FIX: compare the script path after expanding $HOME, ${HOME} and a leading ~; installing also
 //      removes extra copies of our own commands under the same matcher, and nothing else.
+/** The first shell word of a command, quotes removed ('...', "...", backslash), and the rest. */
+function splitFirstWord(command) {
+    const s = command ?? "";
+    let i = 0;
+    while (i < s.length && /\s/.test(s[i]))
+        i++;
+    let word = "";
+    while (i < s.length && !/\s/.test(s[i])) {
+        const ch = s[i];
+        if (ch === "'") {
+            const j = s.indexOf("'", i + 1);
+            word += j < 0 ? s.slice(i + 1) : s.slice(i + 1, j);
+            i = j < 0 ? s.length : j + 1;
+        }
+        else if (ch === '"') {
+            let j = i + 1;
+            while (j < s.length && s[j] !== '"') {
+                if (s[j] === "\\" && j + 1 < s.length) {
+                    word += s[j + 1];
+                    j += 2;
+                }
+                else {
+                    word += s[j];
+                    j++;
+                }
+            }
+            i = j + 1;
+        }
+        else if (ch === "\\" && i + 1 < s.length) {
+            word += s[i + 1];
+            i += 2;
+        }
+        else {
+            word += ch;
+            i++;
+        }
+    }
+    return { word, rest: s.slice(i).trim() };
+}
 /** The script path of a hook command, with $HOME, ${HOME} or a leading ~ expanded. */
 export function hookScriptPath(command, home = homedir()) {
-    const m = /^\s*(?:"([^"]*)"|'([^']*)'|(\S+))/.exec(command ?? "");
-    const path = m ? (m[1] ?? m[2] ?? m[3]) : "";
-    return path.replace(/^(?:\$HOME|\$\{HOME\}|~)(?=\/)/, home);
+    return splitFirstWord(command).word.replace(/^(?:\$HOME|\$\{HOME\}|~)(?=\/)/, home);
 }
 /** The command with its script path expanded, so two spellings of one call compare equal. */
 function normalizedCommand(command, home) {
-    const args = (command ?? "").trim().replace(/^(?:"[^"]*"|'[^']*'|\S+)/, "").trim();
-    return `${hookScriptPath(command, home)} ${args}`.trim();
+    return `${hookScriptPath(command, home)} ${splitFirstWord(command).rest}`.trim();
+}
+// [LOCKED] [HOOK-PATHS-ARE-SHELL-QUOTED] - 2026-09-25
+// [NEVER] write a script path into a hook command, or into the generated gate script, without
+//         shellQuote(): Claude Code runs every hook command through a shell.
+// WHY: with a home folder named "John Smith" the installer wrote `/Users/John Smith/.claude/...`
+//      unquoted: every hook exited 127, the install's own count found 0 of ours and failed, and
+//      each re-run added four more broken entries (4, then 8). A double quote in the path made the
+//      shell exit 2, which for a Stop hook means "block the turn" (E2E_REVIEW_2026-09 A3-2, A3-4).
+// FIX: shellQuote() leaves a plain path as it is (existing installs compare equal and do not
+//      churn) and single-quotes anything else; splitFirstWord() reads commands the way the shell
+//      does, so a quoted path compares equal to its plain spelling; an unquoted copy of one of our
+//      paths that contains a space is recognised as ours and repaired.
+export function shellQuote(value) {
+    return /^[A-Za-z0-9_./@%+=:,-]+$/.test(value) ? value : scriptQuote(value);
+}
+/** Always single-quoted: for the lines of a generated sh script. */
+function scriptQuote(value) {
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}
+/** An old install's unquoted command for one of our scripts whose path contains whitespace. */
+function isBrokenUnquotedCopy(command, script) {
+    if (!/\s/.test(script))
+        return false;
+    const c = (command ?? "").trim();
+    return c === script || c.startsWith(`${script} `);
+}
+/** True when a hook command runs one of `scripts`, however it is spelled. */
+function runsOneOf(command, scripts, home = homedir()) {
+    return scripts.includes(hookScriptPath(command, home)) || scripts.some((s) => isBrokenUnquotedCopy(command, s));
+}
+/** Rewrites unquoted, broken copies of our commands to their quoted form (then dedup sees them). */
+function repairUnquotedCommands(entries, scripts) {
+    let repaired = 0;
+    for (const e of entries) {
+        for (const h of e.hooks ?? []) {
+            const s = scripts.find((x) => isBrokenUnquotedCopy(h.command, x));
+            if (!s)
+                continue;
+            h.command = `${shellQuote(s)} ${h.command.trim().slice(s.length).trim()}`.trim();
+            repaired++;
+        }
+    }
+    return repaired;
 }
 function hookAlreadyWired(entries, hookScript, home = homedir()) {
     return (entries ?? []).some((e) => e.hooks?.some((h) => hookScriptPath(h.command, home) === hookScript));
@@ -211,6 +290,10 @@ Run: opscontext install-autostart
         return;
     }
     const simplicityAsked = args.includes("--simplicity");
+    // Parse settings.json before writing anything: a malformed file is refused with nothing changed
+    // (it used to be refused after the emit script had already been copied).
+    const original = existsSync(SETTINGS_FILE) ? readFileSync(SETTINGS_FILE, "utf-8") : null;
+    const settings = readSettings();
     // Step 1: Install / verify the hook script
     mkdirSync(HOOKS_DIR, { recursive: true });
     const src = bundledFile("claude-code-hook.sh");
@@ -223,19 +306,18 @@ Run: opscontext install-autostart
     copyFileSync(src, HOOK_SCRIPT);
     chmodSync(HOOK_SCRIPT, 0o755);
     console.log(`✅ Installed hook script: ${HOOK_SCRIPT}`);
-    // Step 2: Splice into settings.json
-    const settings = readSettings();
-    const backup = backupSettings();
-    if (backup)
-        console.log(`✅ Backed up settings.json → ${backup}`);
+    // Step 2: Splice into settings.json (written, after a backup, only if something changes)
     settings.hooks ??= {};
     const hookCmdPrefix = `${HOOK_SCRIPT}`; // compared by expanded path, [HOOKS-COMPARED-BY-EXPANDED-PATH]
     // [LOCK] [HOOKS-COMPARED-BY-EXPANDED-PATH]: remove extra copies before deciding what to add.
+    // [LOCK] [HOOK-PATHS-ARE-SHELL-QUOTED]: first repair unquoted copies an older install wrote for a
+    // path with a space, so the dedup below sees them as ours.
     let deduped = 0;
     for (const kind of [...EVENT_KINDS, "Stop"]) {
         const entries = settings.hooks[kind];
         if (!entries)
             continue;
+        repairUnquotedCommands(entries, OUR_SCRIPTS);
         const r = dropDuplicateHooks(entries, OUR_SCRIPTS);
         settings.hooks[kind] = r.entries;
         deduped += r.removed;
@@ -252,7 +334,7 @@ Run: opscontext install-autostart
             hooks: [
                 {
                     type: "command",
-                    command: `${HOOK_SCRIPT} ${kind}`,
+                    command: `${shellQuote(HOOK_SCRIPT)} ${kind}`,
                     timeout: 5,
                 },
             ],
@@ -267,14 +349,14 @@ Run: opscontext install-autostart
     // Step 3: the Stop gate. Absolute node + CLI paths: hooks run without the user's shell PATH.
     // Prefer the global install: an npx cache copy can be pruned and the hook would then exit 127.
     const cliPath = globalCliPath() ?? join(__dirname_esm, "cli.js");
-    writeFileSync(GATE_SCRIPT, `#!/bin/sh\n# Generated by \`opscontext install-claude-hook\`: the CE session gate on Claude Code Stop.\n# Exit 2 = the turn may not end yet (reason on stderr). See: contextengine session-gate --help\nexec "${process.execPath}" "${cliPath}" session-gate\n`);
+    writeFileSync(GATE_SCRIPT, `#!/bin/sh\n# Generated by \`opscontext install-claude-hook\`: the CE session gate on Claude Code Stop.\n# Exit 2 = the turn may not end yet (reason on stderr). See: contextengine session-gate --help\nexec ${scriptQuote(process.execPath)} ${scriptQuote(cliPath)} session-gate\n`);
     chmodSync(GATE_SCRIPT, 0o755);
     settings.hooks.Stop ??= [];
     if (hookAlreadyWired(settings.hooks.Stop, GATE_SCRIPT)) {
         skipped++;
     }
     else {
-        settings.hooks.Stop.push({ hooks: [{ type: "command", command: GATE_SCRIPT, timeout: 15 }] });
+        settings.hooks.Stop.push({ hooks: [{ type: "command", command: shellQuote(GATE_SCRIPT), timeout: 15 }] });
         added++;
     }
     console.log(`✅ Installed session gate: ${GATE_SCRIPT}`);
@@ -296,7 +378,7 @@ Run: opscontext install-autostart
         else {
             settings.hooks.PostToolUse.push({
                 matcher: SIMPLICITY_MATCHER,
-                hooks: [{ type: "command", command: SIMPLICITY_SCRIPT, timeout: 30 }],
+                hooks: [{ type: "command", command: shellQuote(SIMPLICITY_SCRIPT), timeout: 30 }],
             });
             added++;
         }
@@ -307,7 +389,16 @@ Run: opscontext install-autostart
         else
             console.log(`⚠️  ruff not found (PATH, /opt/homebrew/bin, /usr/local/bin, ~/.local/bin, ~/.cargo/bin): the gate stays silent until it is installed (brew install ruff, or pipx install ruff).`);
     }
-    writeFileSync(SETTINGS_FILE, JSON.stringify(settings, null, 2) + "\n");
+    // A re-run that changes nothing writes nothing and leaves no backup behind (a copy of
+    // settings.json per run piled up, env values and all).
+    let backup = "";
+    const unchanged = original !== null && JSON.stringify(JSON.parse(original)) === JSON.stringify(settings);
+    if (!unchanged) {
+        backup = backupSettings();
+        if (backup)
+            console.log(`✅ Backed up settings.json → ${backup}`);
+        writeFileSync(SETTINGS_FILE, JSON.stringify(settings, null, 2) + "\n");
+    }
     const removedNote = deduped ? `, ${deduped} duplicate registrations removed` : "";
     console.log(`✅ ${added} hook entries added, ${skipped} already present${removedNote}.`);
     // [LOCKED] [INSTALL-VERIFIES-BY-COUNT] - 2026-09-15
@@ -348,33 +439,50 @@ The hook script files under ~/.claude/hooks/ are left in place — delete
 manually if you want them gone. The audit log is NOT touched.`);
         return;
     }
-    const ourNames = args.includes("--simplicity")
-        ? ["opscontext-simplicity-gate.py"]
-        : ["opscontext-emit.sh", "opscontext-session-gate.sh", "opscontext-simplicity-gate.py"];
+    // [LOCKED] [UNINSTALL-REMOVES-ONLY-OUR-COMMANDS] - 2026-09-25
+    // [NEVER] drop a whole hook entry because one of its commands is ours, or recognise ours by a
+    //         substring of the command text.
+    // WHY: the uninstaller removed every entry whose command text contained one of our file names.
+    //      In a sandbox it deleted a user's company-audit.sh that shared an entry with our emit hook,
+    //      and a user's notify-opscontext-emit.sh.done that merely contained our name
+    //      (E2E_REVIEW_2026-09 A3-1). [CLAUDE-HOOK-INSTALL] asks for the "preserve existing"
+    //      discipline in every code path; this one broke it.
+    // FIX: remove only the commands that run our scripts, compared by expanded path like the
+    //      installer ([HOOKS-COMPARED-BY-EXPANDED-PATH]); drop an entry only when that leaves it
+    //      empty; back up and write only when something was removed.
+    const ours = args.includes("--simplicity") ? [SIMPLICITY_SCRIPT] : OUR_SCRIPTS;
     const settings = readSettings();
     if (!settings.hooks) {
         console.log(`   (no hooks block in settings.json — nothing to remove)`);
         return;
     }
-    const backup = backupSettings();
-    if (backup)
-        console.log(`✅ Backed up settings.json → ${backup}`);
     let removed = 0;
     for (const kind of [...EVENT_KINDS, "Stop"]) {
         const entries = settings.hooks[kind];
         if (!entries)
             continue;
-        const filtered = entries.filter((e) => !e.hooks?.some((h) => ourNames.some((n) => h.command?.includes(n))));
-        removed += entries.length - filtered.length;
-        if (filtered.length === 0) {
+        const kept = [];
+        for (const e of entries) {
+            const before = e.hooks ?? [];
+            const hooks = before.filter((h) => !runsOneOf(h.command, ours));
+            removed += before.length - hooks.length;
+            if (hooks.length > 0 || before.length === 0)
+                kept.push({ ...e, hooks });
+        }
+        if (kept.length === 0) {
             delete settings.hooks[kind];
         }
         else {
-            settings.hooks[kind] = filtered;
+            settings.hooks[kind] = kept;
         }
     }
-    writeFileSync(SETTINGS_FILE, JSON.stringify(settings, null, 2) + "\n");
-    console.log(`✅ Removed ${removed} hook entries.`);
+    if (removed > 0) {
+        const backup = backupSettings();
+        if (backup)
+            console.log(`✅ Backed up settings.json → ${backup}`);
+        writeFileSync(SETTINGS_FILE, JSON.stringify(settings, null, 2) + "\n");
+    }
+    console.log(`✅ Removed ${removed} OpsContext hook command(s); every other hook kept.`);
     console.log(`   Hook script kept at: ${HOOK_SCRIPT}`);
     console.log(`   Audit log untouched.`);
 }

package/dist/learnings.d.ts

@@ -122,6 +122,7 @@ export declare function autoImportFromSources(sources: Array<{
     updated: number;
     ignored: number;
     refused?: string;
+    untrusted: string[];
 };
 /**
  * Get the store stats.

package/dist/learnings.js

@@ -5,6 +5,7 @@ import { join, dirname } from "path";
 import { homedir } from "os";
 import { fileURLToPath } from "url";
 import { safeAppend } from "./audit.js";
+import { trustedProjects, looksLikeMarkedLearnings } from "./trusted-projects.js";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 /**
@@ -1013,6 +1014,10 @@ export function autoImportFromSources(sources) {
     let totalIgnored = 0;
     let processed = 0;
     let refused;
+    // [LOCK] [AUTO-IMPORT-ONLY-FROM-TRUSTED-PROJECTS] (src/trusted-projects.ts): seeded, the first
+    // time, with every project that already has learnings in the store.
+    const trusted = trustedProjects(() => [...new Set(loadStore().learnings.map((l) => l.project).filter((p) => !!p))]);
+    const untrusted = new Set();
     // One load and one save for the whole sweep (~880 files), instead of one full-file
     // rewrite per rule per file. [LOCK] [STORE-NEVER-STARTS-FRESH-OVER-DATA]
     try {
@@ -1025,6 +1030,18 @@ export function autoImportFromSources(sources) {
                     continue;
                 // Extract project name from source name (e.g., "ContextEngine — copilot-instructions.md")
                 const project = source.name.split(" — ")[0]?.trim() || undefined;
+                // A project the owner has not marked as theirs is searchable, never imported automatically.
+                // [LOCK] [AUTO-IMPORT-ONLY-FROM-TRUSTED-PROJECTS]
+                if (project && !trusted.has(project.toLowerCase())) {
+                    try {
+                        if (looksLikeMarkedLearnings(readFileSync(source.path, "utf-8")))
+                            untrusted.add(project);
+                    }
+                    catch {
+                        /* unreadable: nothing to import anyway */
+                    }
+                    continue;
+                }
                 // Strict by construction: only marked learnings. [LOCK] [AUTO-IMPORT-ONLY-MARKED-LEARNINGS]
                 const result = importLearningsFromFile(source.path, "other", project);
                 totalImported += result.imported;
@@ -1043,7 +1060,7 @@ export function autoImportFromSources(sources) {
         totalUpdated = 0;
         processed = 0;
     }
-    return { total: processed, imported: totalImported, updated: totalUpdated, ignored: totalIgnored, refused };
+    return { total: processed, imported: totalImported, updated: totalUpdated, ignored: totalIgnored, refused, untrusted: [...untrusted] };
 }
 /**
  * Get the store stats.

package/dist/license-sig.d.ts

@@ -1,3 +1,10 @@
+/** Tests only: verify against another key, in this process. Pass null to restore the pinned key. */
+export declare function __setLicensePublicKeyForTesting(pem: string | null): void;
+/**
+ * True when `signatureB64` is an Ed25519 signature of `bytes` by the pinned key. Used for the
+ * community rules file, which is signed as a whole. [LOCK] [COMMUNITY-TIER-A-IS-SIGNED]
+ */
+export declare function verifyDetachedSignature(bytes: Buffer, signatureB64: string): boolean;
 export declare const LICENSE_PUBLIC_KEY_PEM = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAnWMq7ITUPmC/8yx9XmpYktaWmQtXDOx6R2nqSdibq+Y=\n-----END PUBLIC KEY-----";
 export declare const LICENSE_PUBKEY_FINGERPRINT = "12d0c34c917a47fbed99945d2b7fb439";
 export interface SignableLicensePayload {
@@ -38,8 +45,8 @@ export type VerifyResult = {
  *   - ok=false, reason=<string>           → signature missing / invalid /
  *                                            tampered / wrong keypair
  *
- * Override the public key via CE_LICENSE_PUBLIC_KEY env var (PEM contents)
- * for self-hosters running their own activation server.
+ * The key is the pinned one (tests: __setLicensePublicKeyForTesting). No environment variable
+ * replaces it any more. [LOCK] [LICENSE-SIG]
  */
 export declare function verifyLicenseSignature(license: SignableLicensePayload & {
     signature: string;

package/dist/license-sig.js

@@ -6,8 +6,13 @@
 //    the change.
 // ⛔ NEVER ship the public key as a mutable variable. It's a constant
 //    that pins the client to the production activation server.
-//    Self-hosters override via CE_LICENSE_PUBLIC_KEY env var, which
-//    is the documented escape hatch.
+//    [NEVER] bring back an environment variable that replaces it (2026-09-25).
+//    Self-hosters build from source with their own key in LICENSE_PUBLIC_KEY_PEM.
+//    WHY (2026-09-25, owner's decision after E2E_REVIEW_2026-09 A4-1): the old escape hatch,
+//    CE_LICENSE_PUBLIC_KEY, documented in the shipped CHANGELOG, let anyone generate a key pair,
+//    sign their own licence and unlock every Pro tool with one variable; proven in a sandbox
+//    (`score` ran on a self-signed licence). Tests swap the key in-process only, through
+//    __setLicensePublicKeyForTesting().
 // ⛔ Legacy SHA-256 signatures are NOW REJECTED (flag day reached
 //    2026-06-11 — earlier than the originally scheduled 2026-08-15
 //    because the customer base is effectively empty and no one would
@@ -26,9 +31,32 @@
 // Ed25519 license signature — verify side (client).
 //
 // Pairs with server/src/license-sig.ts (sign side). Public key below is
-// pinned to the production activation server (api.compr.ch). Self-hosters
-// override with CE_LICENSE_PUBLIC_KEY env var.
+// pinned to the production activation server (api.compr.ch). No runtime
+// override: see [LICENSE-SIG] above.
 import { createPublicKey, verify } from "crypto";
+let testPublicKeyPem = null;
+/** Tests only: verify against another key, in this process. Pass null to restore the pinned key. */
+export function __setLicensePublicKeyForTesting(pem) {
+    testPublicKeyPem = pem;
+}
+function activePublicKeyPem() {
+    return testPublicKeyPem ?? LICENSE_PUBLIC_KEY_PEM;
+}
+/**
+ * True when `signatureB64` is an Ed25519 signature of `bytes` by the pinned key. Used for the
+ * community rules file, which is signed as a whole. [LOCK] [COMMUNITY-TIER-A-IS-SIGNED]
+ */
+export function verifyDetachedSignature(bytes, signatureB64) {
+    try {
+        const sig = Buffer.from(signatureB64.trim(), "base64");
+        if (sig.length !== 64)
+            return false;
+        return verify(null, bytes, createPublicKey(activePublicKeyPem()), sig);
+    }
+    catch {
+        return false;
+    }
+}
 // Production Ed25519 public key. Paired private key lives ONLY on the
 // activation server. Public key SHA-256 fingerprint (first 32 hex chars):
 //   12d0c34c917a47fbed99945d2b7fb439
@@ -66,10 +94,10 @@ export function canonicalPayload(license) {
  *   - ok=false, reason=<string>           → signature missing / invalid /
  *                                            tampered / wrong keypair
  *
- * Override the public key via CE_LICENSE_PUBLIC_KEY env var (PEM contents)
- * for self-hosters running their own activation server.
+ * The key is the pinned one (tests: __setLicensePublicKeyForTesting). No environment variable
+ * replaces it any more. [LOCK] [LICENSE-SIG]
  */
-export function verifyLicenseSignature(license, publicKeyPem = process.env.CE_LICENSE_PUBLIC_KEY || LICENSE_PUBLIC_KEY_PEM) {
+export function verifyLicenseSignature(license, publicKeyPem = activePublicKeyPem()) {
     if (!license.signature || license.signature.length === 0) {
         return { ok: false, reason: "signature field missing" };
     }

package/dist/secret-shapes.d.ts

@@ -19,6 +19,25 @@ export interface RedactionResult {
 }
 /** Replace every credential shape in `input`. Returns the new text and the count per shape. */
 export declare function redactSecrets(input: string): RedactionResult;
+/**
+ * [LOCKED] [INDEX-NEVER-SERVES-A-CREDENTIAL] - 2026-09-25 (moved here from src/index.ts the same day)
+ * [NEVER] let a chunk into the index, the shared index file or a search result without passing
+ *         its text through redactSecrets(), in the MCP server AND in the CLI.
+ * WHY: on 2026-09-25 the shared index held database URLs with their passwords (read from dotenv
+ *      files, whose masking skipped the password inside a URL), sshpass and mysql passwords from
+ *      runbooks and memory notes, and Google API keys: 55 sources in all. search_context hands
+ *      chunks to every AI agent that asks, and the index file rides the weekly backup.
+ *      The same day the fix was found to cover one builder of two: the CLI's initEngine() never
+ *      called it, and `contextengine search` returned 7 of 7 planted fake credentials in clear
+ *      (E2E_REVIEW_2026-09 A6-2). The VS Code extension shells out to that CLI.
+ * FIX: every chunk, whatever collected it (docs, code, ops collectors, learnings, community rules,
+ *      adapters), is redacted with the capture shapes as the index is built, by this one function,
+ *      called by both builders (src/index.ts buildIndex, src/cli.ts initEngine).
+ *      The source files are not touched: cleaning those is the owner's call, file by file.
+ */
+export declare function redactChunk<T extends {
+    content: string;
+}>(c: T): T;
 /** Redact every string inside a JSON-like value, returning a copy and the merged counts. */
 export declare function redactPayload<T>(value: T): {
     value: T;

package/dist/secret-shapes.js

@@ -36,7 +36,9 @@ export const SECRET_SHAPES = [
     { id: "telegram_bot_token", re: /\b\d{8,10}:AA[0-9A-Za-z_-]{33}\b/g },
     { id: "jwt", re: /\beyJ[0-9A-Za-z_-]{10,}\.eyJ[0-9A-Za-z_-]{10,}\.[0-9A-Za-z_-]{10,}/g },
     // scheme://user:SECRET@host, the shape of every database URL found on 2026-09-24.
-    { id: "url_password", re: /(\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@'"`]+:)[^\s@/'"`]+(?=@)/gi, keepPrefix: true },
+    // The user part may be empty: redis://:secret@host is how Redis spells a password-only URL
+    // (E2E_REVIEW_2026-09 A6-3: it came back raw from search and from the receiver).
+    { id: "url_password", re: /(\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@'"`]*:)[^\s@/'"`]+(?=@)/gi, keepPrefix: true },
     { id: "sshpass_password", re: new RegExp(String.raw `(\bsshpass\s+-p\s*)${QUOTED_OR_BARE}`, "g"), keepPrefix: true },
     { id: "sshpass_env", re: new RegExp(String.raw `(\bSSHPASS=)${QUOTED_OR_BARE}`, "g"), keepPrefix: true },
     // mysql -pSECRET (the value is glued to the flag; a bare -p prompts and is left alone).
@@ -48,10 +50,16 @@ export const SECRET_SHAPES = [
     { id: "api_key_header", re: /(\bx-api-key:\s*)[^\s'"]{8,}/gi, keepPrefix: true },
     // name = value, the long tail. Skips variables, env lookups, paths, placeholders already
     // redacted, type names and function calls.
+    // A name that ends in a separator plus PASS (SMTP_PASS, DB_PASS, db.pass) counts too: a real mail
+    // password sat in the shared index under SMTP_PASS (E2E_REVIEW_2026-09 A6-3). The separator keeps
+    // bypass and compass out. A bare `pass` counts only before an equals sign, or before a quoted value
+    // after a colon (nodemailer's auth block): as first shipped in 2.10.0 it also took prose (a README's
+    // "PII pass" list) and code (a count of passing checks in agents.ts), which the public-release scan
+    // refused.
     {
         id: "credential_assignment",
         // A backtick opens a value too: "password: `...`" in Markdown, found in the real log.
-        re: /(\b[\w.-]*(?:password|passwd|pwd|secret|token|api[_-]?key|apikey|access[_-]?key|private[_-]?key|client[_-]?secret)["'`]?\s*[:=]\s*["'`]?)(?![$<{*/~.[]|process\.env|os\.environ|getenv)[^\s'"`,;)}\]]{6,}/gi,
+        re: /(\b(?:[\w.-]*(?:password|passwd|pwd|secret|token|api[_-]?key|apikey|access[_-]?key|private[_-]?key|client[_-]?secret)|[\w.-]*[_.-]pass|pass(?=["'`]?\s*=|["'`]?\s*:\s*["'`]))["'`]?\s*[:=]\s*["'`]?)(?![$<{*/~.[]|process\.env|os\.environ|getenv)[^\s'"`,;)}\]]{6,}/gi,
         keepPrefix: true,
         skip: (value, after) => after.startsWith("(") ||
             (/^[A-Za-z_$][\w$.]*\(/.test(value) && after.startsWith(")")) || // getToken(user), not a value
@@ -106,6 +114,26 @@ export function redactSecrets(input) {
     }
     return { text, counts };
 }
+/**
+ * [LOCKED] [INDEX-NEVER-SERVES-A-CREDENTIAL] - 2026-09-25 (moved here from src/index.ts the same day)
+ * [NEVER] let a chunk into the index, the shared index file or a search result without passing
+ *         its text through redactSecrets(), in the MCP server AND in the CLI.
+ * WHY: on 2026-09-25 the shared index held database URLs with their passwords (read from dotenv
+ *      files, whose masking skipped the password inside a URL), sshpass and mysql passwords from
+ *      runbooks and memory notes, and Google API keys: 55 sources in all. search_context hands
+ *      chunks to every AI agent that asks, and the index file rides the weekly backup.
+ *      The same day the fix was found to cover one builder of two: the CLI's initEngine() never
+ *      called it, and `contextengine search` returned 7 of 7 planted fake credentials in clear
+ *      (E2E_REVIEW_2026-09 A6-2). The VS Code extension shells out to that CLI.
+ * FIX: every chunk, whatever collected it (docs, code, ops collectors, learnings, community rules,
+ *      adapters), is redacted with the capture shapes as the index is built, by this one function,
+ *      called by both builders (src/index.ts buildIndex, src/cli.ts initEngine).
+ *      The source files are not touched: cleaning those is the owner's call, file by file.
+ */
+export function redactChunk(c) {
+    const r = redactSecrets(c.content);
+    return Object.keys(r.counts).length > 0 ? { ...c, content: r.text } : c;
+}
 /** Redact every string inside a JSON-like value, returning a copy and the merged counts. */
 export function redactPayload(value) {
     const counts = {};

package/dist/server-registry.d.ts

@@ -13,6 +13,10 @@ export interface ServerRecord {
      *  the one writing the shared index for it, or a reader of it. Absent on older builds. */
     corpus?: string;
     role?: "indexer" | "reader";
+    /** Since 2.10.0: started as the launchd agent (OPSCONTEXT_DAEMON=1). [LOCK] [EVENT-PORT-BELONGS-TO-THE-DAEMON] */
+    daemon?: boolean;
+    /** Since 2.10.0: the event-ingest port this server holds right now; absent when it holds none. */
+    eventPort?: number;
 }
 export interface ServerReport {
     servers: Array<ServerRecord & {
@@ -46,11 +50,15 @@ export declare function registerServer(opts: {
     script: string;
     corpus?: string;
     role?: "indexer" | "reader";
+    daemon?: boolean;
 }): {
     record: ServerRecord;
     stop: () => void;
     setRole: (role: "indexer" | "reader") => void;
+    setEventPort: (port: number | null) => void;
 };
+/** The pid of a live launchd agent other than `exceptPid`, or null. Cheap: no build hashing. */
+export declare function liveDaemonPid(exceptPid?: number): number | null;
 /** Read every record, drop the dead ones, compare builds with the files on disk now. */
 export declare function listServers(): ServerReport;
 /** CPU seconds consumed and resident memory of a live pid, from ps (hardcoded argv, no shell). */

package/dist/server-registry.js

@@ -96,6 +96,7 @@ export function registerServer(opts) {
         node: process.version,
         ...(opts.corpus ? { corpus: opts.corpus } : {}),
         ...(opts.role ? { role: opts.role } : {}),
+        ...(opts.daemon ? { daemon: true } : {}),
     };
     const file = join(dir, `${process.pid}.json`);
     const write = () => { try {
@@ -121,7 +122,33 @@ export function registerServer(opts) {
         process.on(sig, () => { stop(); process.exit(0); });
     }
     const setRole = (role) => { record.role = role; write(); };
-    return { record, stop, setRole };
+    const setEventPort = (port) => {
+        if (port === null)
+            delete record.eventPort;
+        else
+            record.eventPort = port;
+        write();
+    };
+    return { record, stop, setRole, setEventPort };
+}
+/** The pid of a live launchd agent other than `exceptPid`, or null. Cheap: no build hashing. */
+export function liveDaemonPid(exceptPid = process.pid) {
+    const dir = registryDir();
+    if (!existsSync(dir))
+        return null;
+    for (const f of readdirSync(dir)) {
+        if (!f.endsWith(".json"))
+            continue;
+        try {
+            const rec = JSON.parse(readFileSync(join(dir, f), "utf8"));
+            if (rec.daemon && rec.pid !== exceptPid && isAlive(rec.pid))
+                return rec.pid;
+        }
+        catch {
+            /* a record being rewritten: the next tick reads it */
+        }
+    }
+    return null;
 }
 /** Read every record, drop the dead ones, compare builds with the files on disk now. */
 export function listServers() {
@@ -164,6 +191,15 @@ export function listServers() {
     }
     // Only servers that index on their own cost a re-index per doc change; readers of a shared
     // index do not. [LOCK] [ONE-INDEXER-MANY-READERS]
+    // [LOCK] [EVENT-PORT-BELONGS-TO-THE-DAEMON]: say who receives Claude Code and browser events.
+    const holder = report.servers.find((s) => typeof s.eventPort === "number");
+    const daemon = report.servers.find((s) => s.daemon);
+    if (holder?.staleBuild) {
+        report.warnings.push(`pid ${holder.pid} holds the event port :${holder.eventPort} on an old build: the redaction that guards the audit log runs that build (restart it, or let the launchd agent take the port)`);
+    }
+    if (holder && daemon && holder.pid !== daemon.pid) {
+        report.warnings.push(`the event port :${holder.eventPort} is held by pid ${holder.pid}, not by the launchd agent pid ${daemon.pid}; it hands over within seconds on 2.10.0 and later`);
+    }
     const indexing = report.servers.filter((s) => s.role !== "reader");
     if (indexing.length > SERVER_COUNT_WARN) {
         report.warnings.push(`${indexing.length} of ${report.servers.length} servers index on their own; every doc change makes each of them re-index the corpus (${SERVER_COUNT_WARN} is the comfortable ceiling; CONTEXTENGINE_SHARED_INDEX=1 makes all but one per corpus readers)`);
@@ -205,7 +241,7 @@ export function formatServers(report, home = homedir(), opts = {}) {
     for (const s of report.servers) {
         const t = s.started.slice(11, 19) + "Z";
         const flag = s.staleBuild ? `STALE BUILD (disk ${s.currentBuild})` : s.currentBuild === null ? "script missing on disk" : "current";
-        const role = s.role ? `  ${s.role.padEnd(7)} corpus ${s.corpus ?? "?"}` : "";
+        const role = (s.role ? `  ${s.role.padEnd(7)} corpus ${s.corpus ?? "?"}` : "") + (s.daemon ? "  launchd agent" : "") + (s.eventPort ? `  holds :${s.eventPort}` : "");
         let cost = "";
         if (opts.cost) {
             const c = processCost(s.pid);

package/dist/trusted-projects.d.ts

@@ -0,0 +1,10 @@
+/** The trusted project names, lowercased. Seeds the file from `seed()` the first time. */
+export declare function trustedProjects(seed: () => string[]): Set<string>;
+export declare function listTrusted(): string[];
+/** Adds projects; returns the resulting list. */
+export declare function trustProjects(names: string[], seed?: () => string[]): string[];
+/** Removes projects (case-insensitive); returns the resulting list. */
+export declare function untrustProjects(names: string[]): string[];
+/** Cheap check: does this doc look like it holds marked learnings (for the "not imported" hint)? */
+export declare function looksLikeMarkedLearnings(content: string): boolean;
+//# sourceMappingURL=trusted-projects.d.ts.map