@mxalbert/context-mode 2.0.0

package/build/search/unified.js

@@ -0,0 +1,104 @@
+/**
+ * Unified multi-source search — merges ContentStore, SessionDB, and
+ * auto-memory results into a single ranked or chronological result set.
+ *
+ * Used by ctx_search when sort="timeline" to search across all sources,
+ * or sort="relevance" (default) for ContentStore-only BM25 search.
+ */
+import { searchAutoMemory } from "./auto-memory.js";
+const DEBUG = process.env.DEBUG?.includes("context-mode");
+// ─────────────────────────────────────────────────────────
+// Implementation
+// ─────────────────────────────────────────────────────────
+/**
+ * Search across all available sources.
+ *
+ * - sort="relevance" (default): BM25-ranked results from ContentStore only.
+ * - sort="timeline": chronological merge of ContentStore + SessionDB + auto-memory.
+ *
+ * Errors in any single source are caught and logged — partial results
+ * are always returned.
+ */
+export function searchAllSources(opts) {
+    const { query, limit, store, sort = "relevance", source, contentType, sessionDB, projectDir, configDir, adapter, projectScope, } = opts;
+    const results = [];
+    // Capture session start time once — used as proxy for ContentStore items
+    // (we don't know exact indexing time, but all content is from current session)
+    const sessionStartTime = new Date().toISOString();
+    // ── Project scope (#737) ──
+    // Resolve the per-project session-id allow-set ONCE, before the
+    // ContentStore call. `projectScope === null` means cross-project recall —
+    // an explicit "no filter" choice surfaced by the ctx_search caller — and
+    // `undefined` falls back to today's unfiltered behaviour.
+    let sessionIdAllowSet;
+    if (typeof projectScope === "string" && sessionDB) {
+        try {
+            sessionIdAllowSet = new Set(sessionDB.getSessionIdsForProject(projectScope));
+        }
+        catch (e) {
+            if (DEBUG)
+                process.stderr.write(`[ctx] getSessionIdsForProject failed: ${e}\n`);
+        }
+    }
+    // ── Source 1: ContentStore (always, both modes) ──
+    try {
+        const storeResults = store.searchWithFallback(query, limit, source, contentType, "like", sessionIdAllowSet);
+        results.push(...storeResults.map((r) => ({
+            title: r.title,
+            content: r.content,
+            source: r.source,
+            origin: "current-session",
+            timestamp: r.timestamp || sessionStartTime,
+            rank: r.rank,
+            matchLayer: r.matchLayer,
+            highlighted: r.highlighted,
+            contentType: r.contentType,
+        })));
+    }
+    catch (e) {
+        if (DEBUG)
+            process.stderr.write(`[ctx] ContentStore search failed: ${e}\n`);
+    }
+    // ── Sources 2+3: timeline mode only ──
+    if (sort === "timeline") {
+        // Source 2: SessionDB — prior session events
+        try {
+            if (sessionDB) {
+                const dbResults = sessionDB.searchEvents(query, limit, projectDir || "", source);
+                results.push(...dbResults.map((r) => ({
+                    title: `[${r.category}] ${r.type}`,
+                    content: r.data,
+                    source: "prior-session",
+                    origin: "prior-session",
+                    timestamp: r.created_at,
+                })));
+            }
+        }
+        catch (e) {
+            if (DEBUG)
+                process.stderr.write(`[ctx] SessionDB search failed: ${e}\n`);
+        }
+        // Source 3: Auto-memory
+        try {
+            const memResults = searchAutoMemory([query], limit, projectDir, configDir, adapter);
+            results.push(...memResults);
+        }
+        catch (e) {
+            if (DEBUG)
+                process.stderr.write(`[ctx] auto-memory search failed: ${e}\n`);
+        }
+    }
+    // ── Normalize timestamps for consistent sorting ──
+    // SQLite datetime('now') → "YYYY-MM-DD HH:MM:SS" (no T, no Z)
+    // ISO → "YYYY-MM-DDTHH:MM:SS.sssZ"
+    for (const r of results) {
+        if (r.timestamp && !r.timestamp.includes("T")) {
+            r.timestamp = r.timestamp.replace(" ", "T") + "Z";
+        }
+    }
+    // ── Sort ──
+    if (sort === "timeline") {
+        results.sort((a, b) => (a.timestamp || "").localeCompare(b.timestamp || ""));
+    }
+    return results.slice(0, limit);
+}

package/build/security.d.ts

@@ -0,0 +1,206 @@
+export type PermissionDecision = "allow" | "deny" | "ask";
+export interface SecurityPolicy {
+    allow: string[];
+    deny: string[];
+    ask: string[];
+}
+/**
+ * Extract the glob from a Bash permission pattern.
+ * "Bash(sudo *)" returns "sudo *", "Read(.env)" returns null.
+ */
+export declare function parseBashPattern(pattern: string): string | null;
+/**
+ * Parse any tool permission pattern like "ToolName(glob)".
+ * Returns { tool, glob } or null if not a valid pattern.
+ */
+export declare function parseToolPattern(pattern: string): {
+    tool: string;
+    glob: string;
+} | null;
+/**
+ * Convert a Bash permission glob to a regex.
+ *
+ * Two formats:
+ * - Colon: "tree:*" becomes /^tree(\s.*)?$/ (command with optional args)
+ * - Space: "sudo *" becomes /^sudo .*$/  (literal glob match)
+ */
+export declare function globToRegex(glob: string, caseInsensitive?: boolean): RegExp;
+/**
+ * Convert a file path glob to a regex.
+ *
+ * Unlike `globToRegex` (which handles command patterns with colon and
+ * space semantics), this handles file path globs where:
+ * - `**` matches any number of path segments (including zero)
+ * - `*` matches anything except path separators
+ * - Paths are matched with forward slashes (callers normalize first)
+ */
+export declare function fileGlobToRegex(glob: string, caseInsensitive?: boolean): RegExp;
+/**
+ * Check if a command matches any Bash pattern in the list.
+ * Returns the matching pattern string, or null.
+ */
+export declare function matchesAnyPattern(command: string, patterns: string[], caseInsensitive?: boolean): string | null;
+/**
+ * Split a shell command on chain operators (&&, ||, ;, |, \n, \r, &) while
+ * respecting single/double quotes, backticks, subshells, and escape backslashes.
+ *
+ * "echo hello && sudo rm -rf /" → ["echo hello", "sudo rm -rf /"]
+ *
+ * This prevents bypassing deny patterns by prepending innocent commands.
+ */
+export declare function splitChainedCommands(command: string): string[];
+/**
+ * Recursively extract all nested subshell commands from `$()` and `` `...` ``.
+ * Handles escaping and quote contexts to ensure correct command boundary detection.
+ */
+export declare function extractSubshellCommands(command: string): string[];
+/**
+ * Read Bash permission policies from up to 3 settings files.
+ *
+ * Returns policies in precedence order (most local first):
+ *   1. .claude/settings.local.json  (project-local)
+ *   2. .claude/settings.json        (project-shared)
+ *   3. ~/.claude/settings.json      (global)
+ *
+ * Missing or invalid files are silently skipped.
+ */
+export declare function readBashPolicies(projectDir?: string, globalSettingsPath?: string): SecurityPolicy[];
+/**
+ * Read deny patterns for a specific tool from settings files.
+ *
+ * Reads the same 3-tier settings as `readBashPolicies`, but extracts
+ * only deny globs for the given tool. Used for Read and Grep enforcement
+ * — checks if file paths should be blocked by deny patterns.
+ *
+ * Returns an array of arrays (one per settings file, in precedence order).
+ * Each inner array contains the extracted glob strings.
+ */
+export declare function readToolDenyPatterns(toolName: string, projectDir?: string, globalSettingsPath?: string): string[][];
+/**
+ * Read `permissions.{deny|allow}` globs for a tool from every settings file in
+ * precedence order (project local → project shared → adapter globals).
+ *
+ * Generalizes the original deny-only reader so the project-boundary guard
+ * (#852) can consult the SAME `permissions.allow` rules the user already
+ * maintains for the host's `Read` tool — instead of inventing a context-mode-
+ * specific opt-out env that would rot into dead code. A user who legitimately
+ * needs an out-of-project read expresses it once, in the host config, e.g.
+ * `"permissions": { "allow": ["Read(/var/log/**)"] }`, and both the host and
+ * context-mode honor it.
+ */
+export declare function readToolPermissionPatterns(toolName: string, kind: "deny" | "allow", projectDir?: string, globalSettingsPath?: string): string[][];
+interface CommandDecision {
+    decision: PermissionDecision;
+    matchedPattern?: string;
+}
+/**
+ * Evaluate a command against policies in precedence order.
+ *
+ * Splits chained commands (&&, ||, ;, |) and checks each segment
+ * against deny patterns — prevents bypassing deny by prepending
+ * innocent commands like "echo ok && sudo rm -rf /".
+ *
+ * Within each policy: deny > ask > allow (most restrictive wins).
+ * First definitive match across policies wins.
+ * Default (no match in any policy): "ask".
+ */
+export declare function evaluateCommand(command: string, policies: SecurityPolicy[], caseInsensitive?: boolean): CommandDecision;
+/**
+ * Server-side variant: only enforce deny patterns.
+ *
+ * The server has no UI for "ask" prompts, so allow/ask patterns are
+ * irrelevant. Returns "deny" if any deny pattern matches, otherwise "allow".
+ *
+ * Also splits chained commands and nested subshells to prevent bypass.
+ */
+export declare function evaluateCommandDenyOnly(command: string, policies: SecurityPolicy[], caseInsensitive?: boolean): {
+    decision: "deny" | "allow";
+    matchedPattern?: string;
+};
+/**
+ * Check if a file path should be denied based on deny globs.
+ *
+ * Normalizes backslashes to forward slashes before matching so that
+ * Windows paths work with Unix-style glob patterns.
+ *
+ * When `projectRoot` is supplied, the path is also matched in its
+ * fully-resolved absolute form **and** — when the file exists — in
+ * its canonical form (`fs.realpathSync`). This prevents two classes
+ * of bypass:
+ *
+ *   1. `..` traversal: a relative path like `../../.ssh/id_rsa` no
+ *      longer evades absolute-path deny rules.
+ *   2. Symlink escape: a project-local path whose realpath points
+ *      outside the project (e.g. `safe.log -> ~/.ssh/id_rsa`) no
+ *      longer evades absolute-path deny rules.
+ *
+ * realpath is best-effort: if the file does not exist yet (ENOENT)
+ * or the syscall fails for any reason, the lexical resolved form is
+ * still checked. This keeps the function usable for paths that will
+ * be created during execution.
+ */
+export declare function evaluateFilePath(filePath: string, denyGlobs: string[][], caseInsensitive?: boolean, projectRoot?: string): {
+    denied: boolean;
+    matchedPattern?: string;
+};
+/**
+ * Pure, algorithmic (no-regex) test: does `filePath` resolve to a location
+ * inside `projectRoot`?
+ *
+ * Issue #852 — `ctx_execute_file` previously fed its `path` argument straight
+ * into `resolve(projectRoot, path)`. Because `path.resolve` lets an *absolute*
+ * argument win outright, an agent could read any file on the host
+ * (`/home/user/secret`, `/etc/passwd`) regardless of the project root, and
+ * `../` traversal escaped just as easily. Claude Code's harness sandbox cannot
+ * inspect MCP input params, so the user approving the MCP call could not see
+ * that the path escaped the workspace. This guard re-anchors the path to the
+ * project boundary.
+ *
+ * Containment is decided on the *resolved* form. When the file (or its parent
+ * chain) exists, the symlink-canonical form is ALSO required to stay inside —
+ * this closes the symlink-escape class (a project-local `safe.log` whose
+ * realpath points at `~/.ssh/id_rsa`), mirroring `evaluateFilePath`.
+ *
+ * A path equal to the project root itself counts as inside. Comparison is
+ * case-insensitive on Windows/macOS to match those filesystems' semantics.
+ *
+ * Returns `true` when `projectRoot` is falsy (no boundary to enforce) so the
+ * caller's fail-open posture is preserved when the root cannot be resolved.
+ */
+export declare function isPathInsideProject(filePath: string, projectRoot: string | undefined, caseInsensitive?: boolean): boolean;
+/**
+ * Decide whether `filePath` may be processed, given the project boundary AND
+ * the user's existing host `Read(...)` allow rules.
+ *
+ * Decision order:
+ *   1. Inside the project root  → allowed (the common case; no config needed).
+ *   2. Outside the project, but matching a `permissions.allow` `Read(...)` glob
+ *      the user already configured for the host → allowed. This is the
+ *      principled escape hatch: a deliberate out-of-project read is expressed
+ *      ONCE in the host config the user already maintains, reusing the same
+ *      mechanism Claude Code itself uses to whitelist a path outside the
+ *      sandbox — no context-mode-specific opt-out env that would rot into
+ *      dead code.
+ *   3. Outside the project, no allow match → denied (closes the #852 escape).
+ *
+ * `allowGlobs` has the same per-settings-file shape as the deny globs returned
+ * by `readToolPermissionPatterns(toolName, "allow", …)`. Allow-matching reuses
+ * `evaluateFilePath` so absolute/`..`/symlink-canonical candidate resolution is
+ * identical to the deny path — one matcher, no divergence.
+ *
+ * Fail-open on an unknown project root (boundary cannot be computed) so the
+ * guard never blocks legitimate in-project work when resolution fails.
+ */
+export declare function evaluateProjectContainment(filePath: string, projectRoot: string | undefined, allowGlobs?: string[][], caseInsensitive?: boolean): {
+    allowed: boolean;
+    reason: "inside" | "allow-rule" | "outside";
+};
+/**
+ * Scan non-shell code for shell-escape calls and extract the embedded
+ * command strings.
+ *
+ * Returns an array of command strings found in the code. For unknown
+ * languages or code without shell-escape calls, returns an empty array.
+ */
+export declare function extractShellCommands(code: string, language: string): string[];
+export {};