@mxalbert/context-mode 2.0.3 → 2.0.4

package/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Claude Code plugins by Mert Koseoğlu",
-    "version": "2.0.3"
+    "version": "2.0.4"
   },
   "plugins": [
     {
       "name": "context-mode",
       "source": "./",
       "description": "Claude Code MCP plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
-      "version": "2.0.3",
+      "version": "2.0.4",
       "author": {
         "name": "Mert Koseoğlu"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "context-mode",
-  "version": "2.0.3",
+  "version": "2.0.4",
   "description": "MCP server that saves 98% of your context window with session continuity. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and automatic state restore across compactions.",
   "author": {
     "name": "Mert Koseoğlu",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "context-mode",
-  "version": "2.0.3",
+  "version": "2.0.4",
   "description": "MCP server that saves 98% of your context window with session continuity. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and automatic state restore across compactions.",
   "author": {
     "name": "Mert Koseoğlu",

package/.openclaw-plugin/openclaw.plugin.json

@@ -3,7 +3,7 @@
   "name": "Context Mode",
   "kind": "tool",
   "description": "OpenClaw plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
-  "version": "2.0.3",
+  "version": "2.0.4",
   "sandbox": {
     "mode": "permissive",
     "filesystem_access": "full",

package/.openclaw-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mxalbert/context-mode",
-  "version": "2.0.3",
+  "version": "2.0.4",
   "description": "OpenClaw plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
   "author": {
     "name": "Mert Koseoğlu",

package/build/cli.js

@@ -452,7 +452,7 @@ function defaultSourceForPath(absPath) {
 }
 function assertReadAllowed(path, projectDir) {
     const denyGlobs = readToolDenyPatterns("Read", projectDir);
-    const denied = evaluateFilePath(path, denyGlobs, process.platform === "win32", projectDir);
+    const denied = evaluateFilePath(path, denyGlobs, undefined, projectDir);
     if (denied.denied) {
         throw new Error(`Read denied by policy: ${path}`);
     }
@@ -488,7 +488,7 @@ async function indexCommand(argv) {
                     followSymlinks: boolFlag(parsed.flags, "follow-symlinks"),
                     perFileDeny: (filePath) => {
                         try {
-                            return evaluateFilePath(filePath, denyGlobs, process.platform === "win32", projectDir).denied;
+                            return evaluateFilePath(filePath, denyGlobs, undefined, projectDir).denied;
                         }
                         catch {
                             return false;

package/build/security.d.ts

@@ -87,6 +87,18 @@ export declare function readToolDenyPatterns(toolName: string, projectDir?: stri
  * needs an out-of-project read expresses it once, in the host config, e.g.
  * `"permissions": { "allow": ["Read(/var/log/**)"] }`, and both the host and
  * context-mode honor it.
+ *
+ * Settings-source anchor (`/{path}`): per Claude Code's documented permission
+ * semantics, a rule glob with a SINGLE leading slash is NOT rooted at the
+ * filesystem root — it is anchored at the directory of the settings file that
+ * declared it. Project/local settings (`.claude/settings.json`,
+ * `.claude/settings.local.json`) therefore anchor at the primary working
+ * directory (`projectDir`), while user settings (`~/.claude/settings.json`),
+ * adapter-global settings, and a custom `--settings <file>` anchor at that
+ * settings file's own directory. Each such glob is emitted as a settings-source
+ * RESOLVED twin in addition to the literal glob — the change is additive: no
+ * existing literal match is removed, so the README's `Read(/var/log/**)`
+ * filesystem-root escape hatch keeps working as a literal absolute rule.
  */
 export declare function readToolPermissionPatterns(toolName: string, kind: "deny" | "allow", projectDir?: string, globalSettingsPath?: string): string[][];
 interface CommandDecision {
@@ -123,16 +135,36 @@ export declare function evaluateCommandDenyOnly(command: string, policies: Secur
  * Normalizes backslashes to forward slashes before matching so that
  * Windows paths work with Unix-style glob patterns.
  *
- * When `projectRoot` is supplied, the path is also matched in its
- * fully-resolved absolute form **and** — when the file exists — in
- * its canonical form (`fs.realpathSync`). This prevents two classes
- * of bypass:
- *
- *   1. `..` traversal: a relative path like `../../.ssh/id_rsa` no
- *      longer evades absolute-path deny rules.
- *   2. Symlink escape: a project-local path whose realpath points
- *      outside the project (e.g. `safe.log -> ~/.ssh/id_rsa`) no
- *      longer evades absolute-path deny rules.
+ * Rule and file path anchors are expanded before matching:
+ *   - A leading `~` / `~/` in EITHER the rule glob or the file path is
+ *     expanded to the user's home directory (Claude Code's `~/path`
+ *     anchor). `~user/...` is left untouched.
+ *   - A rule glob beginning with `//` is treated as "absolute from the
+ *     filesystem root" and has the leading double slash collapsed to one,
+ *     matching the absolute candidates this module produces. The literal
+ *     double-slash form is preserved as an additional variant so Windows UNC
+ *     rules (e.g. `//server/share/**`) still match UNC candidates, which
+ *     normalize to `//server/share/...`.
+ *
+ * Symlink resolution is mirrored on both sides. For each rule glob the
+ * matcher tests its literal variant AND a best-effort `realpathSync`'d
+ * variant (only the static prefix, before the first glob segment, is
+ * canonicalized). Against those it tests every file candidate: the raw
+ * input, the tilde-expanded input, the path resolved against `projectRoot`
+ * (or `process.cwd()` when no project root is supplied), and — when the
+ * file exists — its canonical form. A deny match therefore fires if ANY
+ * literal/canonical rule variant matches ANY literal/lexical/canonical file
+ * candidate, closing the CVE-2025-59829 symlink deny-bypass class.
+ *
+ * Anchoring the resolved candidate to `projectRoot` (falling back to cwd)
+ * means absolute deny rules still match relative `..` traversal even when
+ * the caller does not know the project root.
+ *
+ * Conversely, a RELATIVE rule glob (no leading `/`, `//`, or `~`) is anchored
+ * to the current directory at match time — `projectRoot` when supplied, else
+ * `process.cwd()` — per the host's "relative to current directory" semantics.
+ * The literal glob is kept as well, so both a relative access path and an
+ * absolute one are matched.
  *
  * realpath is best-effort: if the file does not exist yet (ENOENT)
  * or the syscall fails for any reason, the lexical resolved form is
@@ -163,6 +195,8 @@ export declare function evaluateFilePath(filePath: string, denyGlobs: string[][]
  *
  * A path equal to the project root itself counts as inside. Comparison is
  * case-insensitive on Windows/macOS to match those filesystems' semantics.
+ * A leading `~` in `filePath` is expanded to the user's home directory for
+ * consistency with `evaluateFilePath`.
  *
  * Returns `true` when `projectRoot` is falsy (no boundary to enforce) so the
  * caller's fail-open posture is preserved when the root cannot be resolved.

package/build/security.js

@@ -1,5 +1,6 @@
 import { readFileSync, realpathSync } from "node:fs";
-import { relative, resolve, sep } from "node:path";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { resolveAdapterGlobalSettingsPaths } from "./util/claude-config.js";
 // ==============================================================================
 // Pattern Parsing
@@ -380,10 +381,22 @@ export function readToolDenyPatterns(toolName, projectDir, globalSettingsPath) {
  * needs an out-of-project read expresses it once, in the host config, e.g.
  * `"permissions": { "allow": ["Read(/var/log/**)"] }`, and both the host and
  * context-mode honor it.
+ *
+ * Settings-source anchor (`/{path}`): per Claude Code's documented permission
+ * semantics, a rule glob with a SINGLE leading slash is NOT rooted at the
+ * filesystem root — it is anchored at the directory of the settings file that
+ * declared it. Project/local settings (`.claude/settings.json`,
+ * `.claude/settings.local.json`) therefore anchor at the primary working
+ * directory (`projectDir`), while user settings (`~/.claude/settings.json`),
+ * adapter-global settings, and a custom `--settings <file>` anchor at that
+ * settings file's own directory. Each such glob is emitted as a settings-source
+ * RESOLVED twin in addition to the literal glob — the change is additive: no
+ * existing literal match is removed, so the README's `Read(/var/log/**)`
+ * filesystem-root escape hatch keeps working as a literal absolute rule.
  */
 export function readToolPermissionPatterns(toolName, kind, projectDir, globalSettingsPath) {
     const result = [];
-    const extractGlobs = (path) => {
+    const extractGlobs = (path, baseDir) => {
         let raw;
         try {
             raw = readFileSync(path, "utf-8");
@@ -408,15 +421,22 @@ export function readToolPermissionPatterns(toolName, kind, projectDir, globalSet
             const tp = parseToolPattern(entry);
             if (tp && tp.tool === toolName) {
                 globs.push(tp.glob);
+                // `/{path}` settings-source anchor: emit the settings-file-relative
+                // resolved twin alongside the literal glob (additive — the literal
+                // stays so filesystem-root rules like `Read(/var/log/**)` keep
+                // working). `//path` is the filesystem-root anchor and gets no twin.
+                if (baseDir && tp.glob.startsWith("/") && !tp.glob.startsWith("//")) {
+                    globs.push(resolve(baseDir, "." + tp.glob));
+                }
             }
         }
         return globs;
     };
     if (projectDir) {
-        const localGlobs = extractGlobs(resolve(projectDir, ".claude", "settings.local.json"));
+        const localGlobs = extractGlobs(resolve(projectDir, ".claude", "settings.local.json"), projectDir);
         if (localGlobs !== null)
             result.push(localGlobs);
-        const sharedGlobs = extractGlobs(resolve(projectDir, ".claude", "settings.json"));
+        const sharedGlobs = extractGlobs(resolve(projectDir, ".claude", "settings.json"), projectDir);
         if (sharedGlobs !== null)
             result.push(sharedGlobs);
     }
@@ -428,7 +448,7 @@ export function readToolPermissionPatterns(toolName, kind, projectDir, globalSet
         ? [globalSettingsPath]
         : resolveAdapterGlobalSettingsPaths();
     for (const globalPath of globalPaths) {
-        const globalGlobs = extractGlobs(globalPath);
+        const globalGlobs = extractGlobs(globalPath, dirname(globalPath));
         if (globalGlobs !== null)
             result.push(globalGlobs);
     }
@@ -510,22 +530,88 @@ export function evaluateCommandDenyOnly(command, policies, caseInsensitive = pro
 // ==============================================================================
 // File Path Evaluation
 // ==============================================================================
+/**
+ * Expand a leading `~` / `~/` (or `~\` on Windows) to the user's home
+ * directory, mirroring Claude Code's documented `~/path` rule anchor.
+ * `~user/...` is intentionally left unchanged (needs a passwd lookup that is
+ * not portable). Returns the input unchanged when there is nothing to expand.
+ */
+function expandHomeTilde(path) {
+    if (path === "~")
+        return homedir();
+    if (path.startsWith("~/") || path.startsWith("~\\"))
+        return homedir() + path.slice(1);
+    return path;
+}
+/**
+ * Claude Code's `//path` rule anchor means "absolute from the filesystem
+ * root". Collapse the leading double slash to one so the pattern can match
+ * the absolute candidates this module produces (`path.resolve` never emits a
+ * leading `//`). Patterns without the anchor are returned unchanged.
+ */
+function normalizeRuleAnchor(glob) {
+    return glob.startsWith("//") ? glob.slice(1) : glob;
+}
+/**
+ * Best-effort symlink-resolved twin of a permission glob. Only the longest
+ * static prefix (path segments before the first `*`/`?` segment) is passed
+ * through `realpathSync`; glob segments are re-appended untouched. Returns
+ * null when there is no static prefix or it does not exist, so callers can
+ * simply fall back to the literal pattern.
+ */
+function canonicalizeGlob(glob) {
+    const segments = glob.split(/[\\/]/);
+    let cut = segments.findIndex((s) => s.includes("*") || s.includes("?"));
+    if (cut === -1)
+        cut = segments.length;
+    if (cut === 0)
+        return null;
+    const prefix = segments.slice(0, cut).join(sep);
+    if (prefix.length === 0)
+        return null;
+    try {
+        return [realpathSync(prefix), ...segments.slice(cut)].join(sep);
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Check if a file path should be denied based on deny globs.
  *
  * Normalizes backslashes to forward slashes before matching so that
  * Windows paths work with Unix-style glob patterns.
  *
- * When `projectRoot` is supplied, the path is also matched in its
- * fully-resolved absolute form **and** — when the file exists — in
- * its canonical form (`fs.realpathSync`). This prevents two classes
- * of bypass:
+ * Rule and file path anchors are expanded before matching:
+ *   - A leading `~` / `~/` in EITHER the rule glob or the file path is
+ *     expanded to the user's home directory (Claude Code's `~/path`
+ *     anchor). `~user/...` is left untouched.
+ *   - A rule glob beginning with `//` is treated as "absolute from the
+ *     filesystem root" and has the leading double slash collapsed to one,
+ *     matching the absolute candidates this module produces. The literal
+ *     double-slash form is preserved as an additional variant so Windows UNC
+ *     rules (e.g. `//server/share/**`) still match UNC candidates, which
+ *     normalize to `//server/share/...`.
+ *
+ * Symlink resolution is mirrored on both sides. For each rule glob the
+ * matcher tests its literal variant AND a best-effort `realpathSync`'d
+ * variant (only the static prefix, before the first glob segment, is
+ * canonicalized). Against those it tests every file candidate: the raw
+ * input, the tilde-expanded input, the path resolved against `projectRoot`
+ * (or `process.cwd()` when no project root is supplied), and — when the
+ * file exists — its canonical form. A deny match therefore fires if ANY
+ * literal/canonical rule variant matches ANY literal/lexical/canonical file
+ * candidate, closing the CVE-2025-59829 symlink deny-bypass class.
+ *
+ * Anchoring the resolved candidate to `projectRoot` (falling back to cwd)
+ * means absolute deny rules still match relative `..` traversal even when
+ * the caller does not know the project root.
  *
- *   1. `..` traversal: a relative path like `../../.ssh/id_rsa` no
- *      longer evades absolute-path deny rules.
- *   2. Symlink escape: a project-local path whose realpath points
- *      outside the project (e.g. `safe.log -> ~/.ssh/id_rsa`) no
- *      longer evades absolute-path deny rules.
+ * Conversely, a RELATIVE rule glob (no leading `/`, `//`, or `~`) is anchored
+ * to the current directory at match time — `projectRoot` when supplied, else
+ * `process.cwd()` — per the host's "relative to current directory" semantics.
+ * The literal glob is kept as well, so both a relative access path and an
+ * absolute one are matched.
  *
  * realpath is best-effort: if the file does not exist yet (ENOENT)
  * or the syscall fails for any reason, the lexical resolved form is
@@ -534,32 +620,59 @@ export function evaluateCommandDenyOnly(command, policies, caseInsensitive = pro
  */
 export function evaluateFilePath(filePath, denyGlobs, caseInsensitive = process.platform === "win32" || process.platform === "darwin", projectRoot) {
     const toForward = (path) => path.replace(/\\/g, "/");
-    // Match against the raw input, the lexically-resolved absolute path,
-    // and the canonical (symlink-resolved) path when the file exists.
-    // Deduplicated so absolute inputs and paths that don't cross symlinks
-    // don't pay the matching cost multiple times.
+    // File-side candidates: raw, tilde-expanded, anchored-resolved, canonical.
     const candidates = new Set();
     candidates.add(toForward(filePath));
-    if (projectRoot) {
-        const lexical = resolve(projectRoot, filePath);
-        candidates.add(toForward(lexical));
-        try {
-            candidates.add(toForward(realpathSync(lexical)));
-        }
-        catch {
-            // File does not exist yet, or realpath failed — rely on lexical form.
-        }
+    const expandedFilePath = expandHomeTilde(filePath);
+    if (expandedFilePath !== filePath) {
+        candidates.add(toForward(expandedFilePath));
+    }
+    const lexical = resolve(projectRoot ?? process.cwd(), expandedFilePath);
+    candidates.add(toForward(lexical));
+    try {
+        candidates.add(toForward(realpathSync(lexical)));
+    }
+    catch {
+        // File does not exist yet, or realpath failed — rely on lexical form.
     }
     for (const globs of denyGlobs) {
         for (const glob of globs) {
+            // Rule-side variants: the literal glob (`//` intact, so Windows UNC
+            // rules still match UNC candidates), its `//`-collapsed root-absolute
+            // anchor form, the `~`-expanded form of each, and a best-effort
+            // symlink-resolved twin of every variant. Matching all of them against
+            // every candidate keeps both sides symmetric.
+            const anchors = new Set();
+            anchors.add(glob);
+            anchors.add(normalizeRuleAnchor(glob));
+            const expandedGlob = expandHomeTilde(glob);
+            if (expandedGlob !== glob) {
+                anchors.add(expandedGlob);
+                anchors.add(normalizeRuleAnchor(expandedGlob));
+            }
+            // Match-time cwd anchor for relative rules (host: "relative to current
+            // directory"). `**/...` rules already reached absolute candidates; bare
+            // `secret/**`, `.env`, `credentials*` did not without this twin.
+            if (!isAbsolute(glob) && !glob.startsWith("~")) {
+                anchors.add(resolve(projectRoot ?? process.cwd(), glob));
+            }
+            const variants = new Set();
+            for (const variant of anchors) {
+                variants.add(variant);
+                const canonical = canonicalizeGlob(variant);
+                if (canonical !== null)
+                    variants.add(canonical);
+            }
             // Normalize the glob's path separators the same way candidates were
             // normalized — otherwise a Windows absolute deny rule like
             // `Read(C:\Users\...\secret.env)` parses with literal backslashes that
             // never match a forward-slash candidate.
-            const regex = fileGlobToRegex(toForward(glob), caseInsensitive);
-            for (const candidate of candidates) {
-                if (regex.test(candidate)) {
-                    return { denied: true, matchedPattern: glob };
+            for (const variant of variants) {
+                const regex = fileGlobToRegex(toForward(variant), caseInsensitive);
+                for (const candidate of candidates) {
+                    if (regex.test(candidate)) {
+                        return { denied: true, matchedPattern: glob };
+                    }
                 }
             }
         }
@@ -589,6 +702,8 @@ export function evaluateFilePath(filePath, denyGlobs, caseInsensitive = process.
  *
  * A path equal to the project root itself counts as inside. Comparison is
  * case-insensitive on Windows/macOS to match those filesystems' semantics.
+ * A leading `~` in `filePath` is expanded to the user's home directory for
+ * consistency with `evaluateFilePath`.
  *
  * Returns `true` when `projectRoot` is falsy (no boundary to enforce) so the
  * caller's fail-open posture is preserved when the root cannot be resolved.
@@ -597,7 +712,7 @@ export function isPathInsideProject(filePath, projectRoot, caseInsensitive = pro
     if (!projectRoot)
         return true;
     const root = resolve(projectRoot);
-    const lexical = resolve(projectRoot, filePath);
+    const lexical = resolve(projectRoot, expandHomeTilde(filePath));
     const within = (root, candidate) => {
         let a = root;
         let b = candidate;

package/build/server.js

@@ -670,7 +670,7 @@ function getStore() {
         store.setDenyChecker((filePath) => {
             try {
                 const denyGlobs = readToolDenyPatterns("Read", storeProjectDir);
-                const r = evaluateFilePath(filePath, denyGlobs, process.platform === "win32", storeProjectDir);
+                const r = evaluateFilePath(filePath, denyGlobs, undefined, storeProjectDir);
                 return r.denied;
             }
             catch {
@@ -1139,7 +1139,7 @@ function checkFilePathDenyPolicy(filePath, toolName) {
     try {
         const projectDir = getProjectDir();
         const denyGlobs = readToolDenyPatterns("Read", projectDir);
-        const result = evaluateFilePath(filePath, denyGlobs, process.platform === "win32", projectDir);
+        const result = evaluateFilePath(filePath, denyGlobs, undefined, projectDir);
         if (result.denied) {
             return trackResponse(toolName, {
                 content: [{
@@ -2127,10 +2127,9 @@ EXAMPLE: ctx_index(path: "/path/to/large-spec.md", source: "openapi-v2-spec")`,
             const store = getStore();
             const projectDir = getProjectDir();
             const denyGlobs = readToolDenyPatterns("Read", projectDir);
-            const isWin32 = process.platform === "win32";
             const perFileDeny = (absPath) => {
                 try {
-                    return evaluateFilePath(absPath, denyGlobs, isWin32, projectDir).denied;
+                    return evaluateFilePath(absPath, denyGlobs, undefined, projectDir).denied;
                 }
                 catch {
                     return false; // fail-open consistent with checkFilePathDenyPolicy