context-compress 1.0.0

package/dist/cli/uninstall.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"uninstall.js","sourceRoot":"","sources":["../../src/cli/uninstall.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACvF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,SAAS;IAC9B,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAChD,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,qCAAqC;IACrC,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IACpE,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAA8C,CAAC;QACtE,IAAI,KAAK,EAAE,UAAU,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;YACvC,KAAK,CAAC,UAAU,GAAI,KAAK,CAAC,UAA6C,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;gBACxF,MAAM,UAAU,GAAG,KAAK,CAAC,KAAgD,CAAC;gBAC1E,OAAO,CAAC,UAAU,EAAE,IAAI,CACvB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CACvF,CAAC;YACH,CAAC,CAAC,CAAC;YACH,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnC,wEAAwE;gBACxE,OAAO,KAAK,CAAC,UAAU,CAAC;YACzB,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;gBACxE,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAC;gBACvB,aAAa,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC/E,OAAO,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;YAC7D,CAAC;QACF,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IACjE,CAAC;IAED,oCAAoC;IACpC,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;IACrD,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAiD,CAAC;QAC9E,IAAI,UAAU,IAAI,kBAAkB,IAAI,UAAU,EAAE,CAAC;YACpD,UAAU,CAAC,kBAAkB,CAAC,GAAG,SAAS,CAAC;YAC3C,aAAa,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC1E,OAAO,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;QACnE,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,gBAAgB;IACjB,CAAC;IAED,qCAAqC;IACrC,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,GAAG,CAAC,UAAiD,CAAC;QACtE,IAAI,OAAO,IAAI,kBAAkB,IAAI,OAAO,EAAE,CAAC;YAC9C,OAAO,CAAC,kBAAkB,CAAC,GAAG,SAAS,CAAC;YACxC,aAAa,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACrE,OAAO,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;QACzD,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,gBAAgB;IACjB,CAAC;IAED,2BAA2B;IAC3B,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClE,KAAK,MAAM,MAAM,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;oBAC3C,IAAI,CAAC;wBACJ,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC;oBACtC,CAAC;oBAAC,MAAM,CAAC;wBACR,SAAS;oBACV,CAAC;gBACF,CAAC;gBACD,OAAO,EAAE,CAAC;YACX,CAAC;QACF,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,WAAW,OAAO,mBAAmB,CAAC,CAAC;QACrD,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,SAAS;IACV,CAAC;IAED,UAAU;IACV,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,OAAO,MAAM,EAAE,CAAC,CAAC;QAC9B,CAAC;IACF,CAAC;SAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;AAChF,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,37 @@
+export interface Config {
+    /** Environment variables to pass through to subprocesses (default: none) */
+    passthroughEnvVars: string[];
+    /** Enable debug logging to stderr */
+    debug: boolean;
+    /** Block curl/wget commands in Bash hook */
+    blockCurl: boolean;
+    /** Block WebFetch tool in hook */
+    blockWebFetch: boolean;
+    /** Nudge on Read tool usage */
+    nudgeOnRead: boolean;
+    /** Nudge on Grep tool usage */
+    nudgeOnGrep: boolean;
+    /** Threshold in bytes to trigger intent-based search filtering */
+    intentSearchThreshold: number;
+    /** Default max output bytes for executor */
+    maxOutputBytes: number;
+    /** Hard cap in bytes for stream-level output (kills process if exceeded) */
+    hardCapBytes: number;
+    /** Max bytes for search results */
+    searchMaxBytes: number;
+    /** Max bytes for batch_execute output */
+    batchMaxBytes: number;
+    /** Default search result limit per query */
+    searchLimit: number;
+    /** Search throttling window in ms */
+    searchWindowMs: number;
+    /** Number of search calls before reducing results */
+    searchReduceAfter: number;
+    /** Number of search calls before blocking */
+    searchBlockAfter: number;
+}
+export declare function loadConfig(projectDir?: string): Config;
+export declare function getConfig(): Config;
+/** Reset config (for testing) */
+export declare function resetConfig(): void;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,MAAM;IACtB,4EAA4E;IAC5E,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,qCAAqC;IACrC,KAAK,EAAE,OAAO,CAAC;IACf,4CAA4C;IAC5C,SAAS,EAAE,OAAO,CAAC;IACnB,kCAAkC;IAClC,aAAa,EAAE,OAAO,CAAC;IACvB,+BAA+B;IAC/B,WAAW,EAAE,OAAO,CAAC;IACrB,+BAA+B;IAC/B,WAAW,EAAE,OAAO,CAAC;IACrB,kEAAkE;IAClE,qBAAqB,EAAE,MAAM,CAAC;IAC9B,4CAA4C;IAC5C,cAAc,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,YAAY,EAAE,MAAM,CAAC;IACrB,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,yCAAyC;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,qCAAqC;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,6CAA6C;IAC7C,gBAAgB,EAAE,MAAM,CAAC;CACzB;AAkED,wBAAgB,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAStD;AAED,wBAAgB,SAAS,IAAI,MAAM,CAGlC;AAED,iCAAiC;AACjC,wBAAgB,WAAW,IAAI,IAAI,CAElC"}

package/dist/config.js

@@ -0,0 +1,79 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+const DEFAULTS = {
+    passthroughEnvVars: [],
+    debug: false,
+    blockCurl: true,
+    blockWebFetch: true,
+    nudgeOnRead: true,
+    nudgeOnGrep: true,
+    intentSearchThreshold: 5_000,
+    maxOutputBytes: 102_400,
+    hardCapBytes: 100 * 1024 * 1024,
+    searchMaxBytes: 40_960,
+    batchMaxBytes: 81_920,
+    searchLimit: 3,
+    searchWindowMs: 60_000,
+    searchReduceAfter: 3,
+    searchBlockAfter: 8,
+};
+function loadFileConfig(projectDir) {
+    const paths = [
+        projectDir && join(projectDir, ".context-compress.json"),
+        join(process.env.HOME ?? "~", ".context-compress.json"),
+    ].filter(Boolean);
+    for (const p of paths) {
+        try {
+            const raw = readFileSync(p, "utf-8");
+            return JSON.parse(raw);
+        }
+        catch {
+            // File doesn't exist or invalid JSON — skip
+        }
+    }
+    return {};
+}
+function loadEnvConfig() {
+    const partial = {};
+    if (process.env.CONTEXT_COMPRESS_DEBUG === "1") {
+        partial.debug = true;
+    }
+    if (process.env.CONTEXT_COMPRESS_PASSTHROUGH_ENV) {
+        partial.passthroughEnvVars = process.env.CONTEXT_COMPRESS_PASSTHROUGH_ENV.split(",")
+            .map((s) => s.trim())
+            .filter(Boolean);
+    }
+    if (process.env.CONTEXT_COMPRESS_BLOCK_CURL !== undefined) {
+        partial.blockCurl = process.env.CONTEXT_COMPRESS_BLOCK_CURL !== "0";
+    }
+    if (process.env.CONTEXT_COMPRESS_BLOCK_WEBFETCH !== undefined) {
+        partial.blockWebFetch = process.env.CONTEXT_COMPRESS_BLOCK_WEBFETCH !== "0";
+    }
+    if (process.env.CONTEXT_COMPRESS_NUDGE_READ !== undefined) {
+        partial.nudgeOnRead = process.env.CONTEXT_COMPRESS_NUDGE_READ !== "0";
+    }
+    if (process.env.CONTEXT_COMPRESS_NUDGE_GREP !== undefined) {
+        partial.nudgeOnGrep = process.env.CONTEXT_COMPRESS_NUDGE_GREP !== "0";
+    }
+    return partial;
+}
+let _config = null;
+export function loadConfig(projectDir) {
+    if (_config)
+        return _config;
+    const fileConfig = loadFileConfig(projectDir);
+    const envConfig = loadEnvConfig();
+    // Priority: ENV > file > defaults
+    _config = { ...DEFAULTS, ...fileConfig, ...envConfig };
+    return _config;
+}
+export function getConfig() {
+    if (!_config)
+        return loadConfig();
+    return _config;
+}
+/** Reset config (for testing) */
+export function resetConfig() {
+    _config = null;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAmCjC,MAAM,QAAQ,GAAW;IACxB,kBAAkB,EAAE,EAAE;IACtB,KAAK,EAAE,KAAK;IACZ,SAAS,EAAE,IAAI;IACf,aAAa,EAAE,IAAI;IACnB,WAAW,EAAE,IAAI;IACjB,WAAW,EAAE,IAAI;IACjB,qBAAqB,EAAE,KAAK;IAC5B,cAAc,EAAE,OAAO;IACvB,YAAY,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;IAC/B,cAAc,EAAE,MAAM;IACtB,aAAa,EAAE,MAAM;IACrB,WAAW,EAAE,CAAC;IACd,cAAc,EAAE,MAAM;IACtB,iBAAiB,EAAE,CAAC;IACpB,gBAAgB,EAAE,CAAC;CACnB,CAAC;AAEF,SAAS,cAAc,CAAC,UAAmB;IAC1C,MAAM,KAAK,GAAG;QACb,UAAU,IAAI,IAAI,CAAC,UAAU,EAAE,wBAAwB,CAAC;QACxD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE,wBAAwB,CAAC;KACvD,CAAC,MAAM,CAAC,OAAO,CAAa,CAAC;IAE9B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACrC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACR,4CAA4C;QAC7C,CAAC;IACF,CAAC;IACD,OAAO,EAAE,CAAC;AACX,CAAC;AAED,SAAS,aAAa;IACrB,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,GAAG,EAAE,CAAC;QAChD,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IACtB,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,gCAAgC,EAAE,CAAC;QAClD,OAAO,CAAC,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,KAAK,CAAC,GAAG,CAAC;aAClF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,SAAS,EAAE,CAAC;QAC3D,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,GAAG,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,SAAS,EAAE,CAAC;QAC/D,OAAO,CAAC,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,GAAG,CAAC;IAC7E,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,SAAS,EAAE,CAAC;QAC3D,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,GAAG,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,SAAS,EAAE,CAAC;QAC3D,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,GAAG,CAAC;IACvE,CAAC;IAED,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,IAAI,OAAO,GAAkB,IAAI,CAAC;AAElC,MAAM,UAAU,UAAU,CAAC,UAAmB;IAC7C,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;IAElC,kCAAkC;IAClC,OAAO,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,UAAU,EAAE,GAAG,SAAS,EAAE,CAAC;IACvD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,SAAS;IACxB,IAAI,CAAC,OAAO;QAAE,OAAO,UAAU,EAAE,CAAC;IAClC,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,iCAAiC;AACjC,MAAM,UAAU,WAAW;IAC1B,OAAO,GAAG,IAAI,CAAC;AAChB,CAAC"}

package/dist/executor.d.ts

@@ -0,0 +1,21 @@
+import type { Config } from "./config.js";
+import type { RuntimeMap } from "./runtime/index.js";
+import type { ExecFileOptions, ExecOptions, ExecResult } from "./types.js";
+export declare class SubprocessExecutor {
+    private runtimes;
+    private config;
+    private env;
+    constructor(runtimes: RuntimeMap, config: Config);
+    /**
+     * Execute code in a subprocess.
+     */
+    execute(opts: ExecOptions): Promise<ExecResult>;
+    /**
+     * Execute code with FILE_CONTENT injected.
+     */
+    executeFile(opts: ExecFileOptions): Promise<ExecResult>;
+    private spawnAndCapture;
+    private createTempDir;
+    private cleanupTempDir;
+}
+//# sourceMappingURL=executor.d.ts.map

package/dist/executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../src/executor.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAY,MAAM,YAAY,CAAC;AA2HrF,qBAAa,kBAAkB;IAC9B,OAAO,CAAC,QAAQ,CAAa;IAC7B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,GAAG,CAAyB;gBAExB,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM;IAMhD;;OAEG;IACG,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAyErD;;OAEG;IACG,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC;IAsB7D,OAAO,CAAC,eAAe;IAiFvB,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,cAAc;CAOtB"}

package/dist/executor.js

@@ -0,0 +1,301 @@
+import { execFileSync, spawn } from "node:child_process";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { debug, error as logError, warn } from "./logger.js";
+const DEFAULT_TIMEOUT = 30_000;
+const DEFAULT_MAX_OUTPUT = 102_400;
+const DEFAULT_HARD_CAP = 100 * 1024 * 1024;
+/** Safe base environment variables */
+const SAFE_ENV_KEYS = [
+    "PATH",
+    "HOME",
+    "USER",
+    "SHELL",
+    "TMPDIR",
+    "TERM",
+    "LANG",
+    // Windows
+    "SYSTEMROOT",
+    "COMSPEC",
+    "PATHEXT",
+    "USERPROFILE",
+    "APPDATA",
+    "LOCALAPPDATA",
+    "PROGRAMFILES",
+    "PROGRAMFILES(X86)",
+    "COMMONPROGRAMFILES",
+    "WINDIR",
+];
+/**
+ * Build a safe environment for subprocesses.
+ * Security fix: credential passthrough is opt-in via config.passthroughEnvVars.
+ */
+function buildEnv(config) {
+    const env = {};
+    // Copy safe base variables
+    for (const key of SAFE_ENV_KEYS) {
+        if (process.env[key]) {
+            env[key] = process.env[key];
+        }
+    }
+    // Deterministic settings
+    env.LANG = "en_US.UTF-8";
+    env.PYTHONDONTWRITEBYTECODE = "1";
+    env.PYTHONUNBUFFERED = "1";
+    env.NO_COLOR = "1";
+    // Opt-in passthrough (security fix: default is empty)
+    for (const key of config.passthroughEnvVars) {
+        if (process.env[key]) {
+            env[key] = process.env[key];
+        }
+    }
+    return env;
+}
+/** Kill process and its children */
+function killProcessTree(pid) {
+    try {
+        if (process.platform === "win32") {
+            execFileSync("taskkill", ["/F", "/T", "/PID", String(pid)]);
+        }
+        else {
+            // Kill process group
+            process.kill(-pid, "SIGKILL");
+        }
+    }
+    catch {
+        try {
+            process.kill(pid, "SIGKILL");
+        }
+        catch {
+            // Process already exited
+        }
+    }
+}
+/**
+ * Smart truncation: keep 60% head + 40% tail, snapping to line boundaries.
+ */
+function smartTruncate(output, maxBytes) {
+    if (Buffer.byteLength(output) <= maxBytes)
+        return output;
+    const lines = output.split("\n");
+    const headRatio = 0.6;
+    const headTarget = Math.floor(maxBytes * headRatio);
+    const tailTarget = maxBytes - headTarget;
+    // Collect head lines
+    let headBytes = 0;
+    let headEnd = 0;
+    for (let i = 0; i < lines.length; i++) {
+        const lineBytes = Buffer.byteLength(lines[i]) + 1; // +1 for newline
+        if (headBytes + lineBytes > headTarget)
+            break;
+        headBytes += lineBytes;
+        headEnd = i + 1;
+    }
+    // Collect tail lines
+    let tailBytes = 0;
+    let tailStart = lines.length;
+    for (let i = lines.length - 1; i >= headEnd; i--) {
+        const lineBytes = Buffer.byteLength(lines[i]) + 1;
+        if (tailBytes + lineBytes > tailTarget)
+            break;
+        tailBytes += lineBytes;
+        tailStart = i;
+    }
+    const headLines = lines.slice(0, headEnd);
+    const tailLines = lines.slice(tailStart);
+    const truncatedLines = lines.length - headEnd - (lines.length - tailStart);
+    const truncatedBytes = Buffer.byteLength(output) - headBytes - tailBytes;
+    const separator = `\n... [${truncatedLines} lines / ${formatSize(truncatedBytes)} truncated — showing first ${headEnd} + last ${lines.length - tailStart} lines] ...\n`;
+    return headLines.join("\n") + separator + tailLines.join("\n");
+}
+function formatSize(bytes) {
+    if (bytes < 1024)
+        return `${bytes}B`;
+    if (bytes < 1024 * 1024)
+        return `${(bytes / 1024).toFixed(1)}KB`;
+    return `${(bytes / (1024 * 1024)).toFixed(1)}MB`;
+}
+export class SubprocessExecutor {
+    runtimes;
+    config;
+    env;
+    constructor(runtimes, config) {
+        this.runtimes = runtimes;
+        this.config = config;
+        this.env = buildEnv(config);
+    }
+    /**
+     * Execute code in a subprocess.
+     */
+    async execute(opts) {
+        const entry = this.runtimes.get(opts.language);
+        if (!entry) {
+            return {
+                stdout: "",
+                stderr: `Language "${opts.language}" is not available. No runtime detected.`,
+                exitCode: 1,
+                truncated: false,
+                killed: false,
+            };
+        }
+        const { plugin, runtime } = entry;
+        const timeout = opts.timeout ?? DEFAULT_TIMEOUT;
+        const maxOutput = opts.maxOutputBytes ?? this.config.maxOutputBytes;
+        const tmpDir = this.createTempDir();
+        let code = opts.code;
+        // Apply preprocessing (e.g. Go package wrapper, PHP tag, Rust main)
+        const preprocessed = plugin.preprocessCode?.(code);
+        if (preprocessed !== undefined) {
+            code = preprocessed;
+        }
+        // Add network tracking for JS/TS
+        if (opts.language === "javascript" || opts.language === "typescript") {
+            code = wrapWithNetworkTracking(code);
+        }
+        const srcPath = join(tmpDir, `main${plugin.fileExtension}`);
+        writeFileSync(srcPath, code);
+        try {
+            // Handle compiled languages (Rust)
+            if (plugin.compileStep) {
+                const binPath = join(tmpDir, process.platform === "win32" ? "main.exe" : "main");
+                const compileCmd = plugin.compileStep(runtime, srcPath, binPath);
+                try {
+                    // Security fix: execFileSync with array args, no shell injection
+                    execFileSync(compileCmd[0], compileCmd.slice(1), {
+                        timeout: timeout,
+                        cwd: tmpDir,
+                        env: this.env,
+                    });
+                }
+                catch (e) {
+                    const err = e;
+                    return {
+                        stdout: "",
+                        stderr: err.stderr?.toString() ?? err.message ?? "Compilation failed",
+                        exitCode: 1,
+                        truncated: false,
+                        killed: false,
+                    };
+                }
+                return await this.spawnAndCapture(binPath, [], tmpDir, timeout, maxOutput);
+            }
+            const cmd = plugin.buildCommand(runtime, srcPath);
+            return await this.spawnAndCapture(cmd[0], cmd.slice(1), tmpDir, timeout, maxOutput, plugin.needsShell);
+        }
+        finally {
+            // Defer cleanup slightly so runtime (especially Bun) fully exits
+            setTimeout(() => this.cleanupTempDir(tmpDir), 100);
+        }
+    }
+    /**
+     * Execute code with FILE_CONTENT injected.
+     */
+    async executeFile(opts) {
+        const entry = this.runtimes.get(opts.language);
+        if (!entry) {
+            return {
+                stdout: "",
+                stderr: `Language "${opts.language}" is not available.`,
+                exitCode: 1,
+                truncated: false,
+                killed: false,
+            };
+        }
+        const { plugin } = entry;
+        let code = opts.code;
+        if (plugin.wrapWithFileContent) {
+            code = plugin.wrapWithFileContent(code, opts.filePath);
+        }
+        return this.execute({ ...opts, code });
+    }
+    spawnAndCapture(cmd, args, cwd, timeout, maxOutput, useShell) {
+        return new Promise((resolve) => {
+            const hardCap = this.config.hardCapBytes;
+            let stdoutBuf = Buffer.alloc(0);
+            let stderrBuf = Buffer.alloc(0);
+            let totalBytes = 0;
+            let killed = false;
+            let networkBytes;
+            const proc = spawn(cmd, args, {
+                cwd,
+                env: { ...this.env, TMPDIR: cwd },
+                stdio: ["ignore", "pipe", "pipe"],
+                timeout,
+                shell: useShell,
+                detached: process.platform !== "win32",
+            });
+            proc.stdout?.on("data", (chunk) => {
+                totalBytes += chunk.length;
+                if (totalBytes > hardCap) {
+                    killed = true;
+                    if (proc.pid)
+                        killProcessTree(proc.pid);
+                    return;
+                }
+                stdoutBuf = Buffer.concat([stdoutBuf, chunk]);
+            });
+            proc.stderr?.on("data", (chunk) => {
+                totalBytes += chunk.length;
+                if (totalBytes > hardCap) {
+                    killed = true;
+                    if (proc.pid)
+                        killProcessTree(proc.pid);
+                    return;
+                }
+                stderrBuf = Buffer.concat([stderrBuf, chunk]);
+            });
+            proc.on("error", (err) => {
+                debug("Process error:", err.message);
+            });
+            proc.on("close", (code) => {
+                let stdout = stdoutBuf.toString("utf-8");
+                let stderr = stderrBuf.toString("utf-8");
+                // Extract network bytes from JS/TS stderr marker
+                const netMatch = stderr.match(/__CM_NET__:(\d+)/);
+                if (netMatch) {
+                    networkBytes = Number.parseInt(netMatch[1], 10);
+                    stderr = stderr.replace(/__CM_NET__:\d+\n?/, "");
+                }
+                if (killed) {
+                    stdout += `\n[output capped at ${formatSize(hardCap)} — process killed]`;
+                }
+                const truncated = Buffer.byteLength(stdout) > maxOutput;
+                if (truncated) {
+                    stdout = smartTruncate(stdout, maxOutput);
+                }
+                resolve({
+                    stdout,
+                    stderr,
+                    exitCode: code,
+                    truncated,
+                    killed,
+                    networkBytes,
+                });
+            });
+        });
+    }
+    createTempDir() {
+        const base = join(tmpdir(), "context-compress");
+        mkdirSync(base, { recursive: true });
+        return mkdtempSync(join(base, "exec-"));
+    }
+    cleanupTempDir(dir) {
+        try {
+            rmSync(dir, { recursive: true, force: true });
+        }
+        catch (e) {
+            debug("Failed to cleanup temp dir:", dir, e);
+        }
+    }
+}
+/**
+ * Wrap JS/TS code with fetch interceptor for network tracking.
+ */
+function wrapWithNetworkTracking(code) {
+    const preamble = "let __cm_net=0;const __cm_f=globalThis.fetch;if(__cm_f){globalThis.fetch=async(...a)=>{const r=await __cm_f(...a);try{const cl=r.clone();const b=await cl.arrayBuffer();__cm_net+=b.byteLength}catch{}return r};}";
+    const epilogue = `\nprocess.stderr.write('__CM_NET__:'+__cm_net+'\\n');`;
+    // Wrap in async IIFE
+    return `${preamble}\nasync function __cm_main(){${code}}\n__cm_main().then(()=>{${epilogue}}).catch(e=>{console.error(e);${epilogue}process.exit(1)});`;
+}
+//# sourceMappingURL=executor.js.map

package/dist/executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../src/executor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,QAAQ,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAK7D,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,kBAAkB,GAAG,OAAO,CAAC;AACnC,MAAM,gBAAgB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAE3C,sCAAsC;AACtC,MAAM,aAAa,GAAG;IACrB,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;IACN,UAAU;IACV,YAAY;IACZ,SAAS;IACT,SAAS;IACT,aAAa;IACb,SAAS;IACT,cAAc;IACd,cAAc;IACd,mBAAmB;IACnB,oBAAoB;IACpB,QAAQ;CACR,CAAC;AAEF;;;GAGG;AACH,SAAS,QAAQ,CAAC,MAAc;IAC/B,MAAM,GAAG,GAA2B,EAAE,CAAC;IAEvC,2BAA2B;IAC3B,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QACjC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAW,CAAC;QACvC,CAAC;IACF,CAAC;IAED,yBAAyB;IACzB,GAAG,CAAC,IAAI,GAAG,aAAa,CAAC;IACzB,GAAG,CAAC,uBAAuB,GAAG,GAAG,CAAC;IAClC,GAAG,CAAC,gBAAgB,GAAG,GAAG,CAAC;IAC3B,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC;IAEnB,sDAAsD;IACtD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC7C,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAW,CAAC;QACvC,CAAC;IACF,CAAC;IAED,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,oCAAoC;AACpC,SAAS,eAAe,CAAC,GAAW;IACnC,IAAI,CAAC;QACJ,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAClC,YAAY,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACP,qBAAqB;YACrB,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC/B,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,IAAI,CAAC;YACJ,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACR,yBAAyB;QAC1B,CAAC;IACF,CAAC;AACF,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,MAAc,EAAE,QAAgB;IACtD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,QAAQ;QAAE,OAAO,MAAM,CAAC;IAEzD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,GAAG,CAAC;IACtB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,QAAQ,GAAG,UAAU,CAAC;IAEzC,qBAAqB;IACrB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,iBAAiB;QACpE,IAAI,SAAS,GAAG,SAAS,GAAG,UAAU;YAAE,MAAM;QAC9C,SAAS,IAAI,SAAS,CAAC;QACvB,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAED,qBAAqB;IACrB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,SAAS,GAAG,SAAS,GAAG,UAAU;YAAE,MAAM;QAC9C,SAAS,IAAI,SAAS,CAAC;QACvB,SAAS,GAAG,CAAC,CAAC;IACf,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC3E,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,SAAS,GAAG,SAAS,CAAC;IAEzE,MAAM,SAAS,GAAG,UAAU,cAAc,YAAY,UAAU,CAAC,cAAc,CAAC,8BAA8B,OAAO,WAAW,KAAK,CAAC,MAAM,GAAG,SAAS,eAAe,CAAC;IAExK,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAChC,IAAI,KAAK,GAAG,IAAI;QAAE,OAAO,GAAG,KAAK,GAAG,CAAC;IACrC,IAAI,KAAK,GAAG,IAAI,GAAG,IAAI;QAAE,OAAO,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,OAAO,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,MAAM,OAAO,kBAAkB;IACtB,QAAQ,CAAa;IACrB,MAAM,CAAS;IACf,GAAG,CAAyB;IAEpC,YAAY,QAAoB,EAAE,MAAc;QAC/C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,IAAiB;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,OAAO;gBACN,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,aAAa,IAAI,CAAC,QAAQ,0CAA0C;gBAC5E,QAAQ,EAAE,CAAC;gBACX,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,KAAK;aACb,CAAC;QACH,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAEpC,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QAErB,oEAAoE;QACpE,MAAM,YAAY,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,GAAG,YAAY,CAAC;QACrB,CAAC;QAED,iCAAiC;QACjC,IAAI,IAAI,CAAC,QAAQ,KAAK,YAAY,IAAI,IAAI,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YACtE,IAAI,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;QAC5D,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAE7B,IAAI,CAAC;YACJ,mCAAmC;YACnC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACxB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBACjF,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;gBACjE,IAAI,CAAC;oBACJ,iEAAiE;oBACjE,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;wBAChD,OAAO,EAAE,OAAO;wBAChB,GAAG,EAAE,MAAM;wBACX,GAAG,EAAE,IAAI,CAAC,GAAG;qBACb,CAAC,CAAC;gBACJ,CAAC;gBAAC,OAAO,CAAU,EAAE,CAAC;oBACrB,MAAM,GAAG,GAAG,CAA0C,CAAC;oBACvD,OAAO;wBACN,MAAM,EAAE,EAAE;wBACV,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,GAAG,CAAC,OAAO,IAAI,oBAAoB;wBACrE,QAAQ,EAAE,CAAC;wBACX,SAAS,EAAE,KAAK;wBAChB,MAAM,EAAE,KAAK;qBACb,CAAC;gBACH,CAAC;gBACD,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;YAC5E,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAClD,OAAO,MAAM,IAAI,CAAC,eAAe,CAChC,GAAG,CAAC,CAAC,CAAC,EACN,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EACZ,MAAM,EACN,OAAO,EACP,SAAS,EACT,MAAM,CAAC,UAAU,CACjB,CAAC;QACH,CAAC;gBAAS,CAAC;YACV,iEAAiE;YACjE,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QACpD,CAAC;IACF,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,IAAqB;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,OAAO;gBACN,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,aAAa,IAAI,CAAC,QAAQ,qBAAqB;gBACvD,QAAQ,EAAE,CAAC;gBACX,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,KAAK;aACb,CAAC;QACH,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;QACzB,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QAErB,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAChC,IAAI,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;IAEO,eAAe,CACtB,GAAW,EACX,IAAc,EACd,GAAW,EACX,OAAe,EACf,SAAiB,EACjB,QAAkB;QAElB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YACzC,IAAI,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,IAAI,YAAgC,CAAC;YAErC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;gBAC7B,GAAG;gBACH,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE;gBACjC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;gBACjC,OAAO;gBACP,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;aACtC,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACzC,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC3B,IAAI,UAAU,GAAG,OAAO,EAAE,CAAC;oBAC1B,MAAM,GAAG,IAAI,CAAC;oBACd,IAAI,IAAI,CAAC,GAAG;wBAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACxC,OAAO;gBACR,CAAC;gBACD,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACzC,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC3B,IAAI,UAAU,GAAG,OAAO,EAAE,CAAC;oBAC1B,MAAM,GAAG,IAAI,CAAC;oBACd,IAAI,IAAI,CAAC,GAAG;wBAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACxC,OAAO;gBACR,CAAC;gBACD,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACxB,KAAK,CAAC,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACtC,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,IAAI,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACzC,IAAI,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAEzC,iDAAiD;gBACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBAClD,IAAI,QAAQ,EAAE,CAAC;oBACd,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAChD,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;gBAClD,CAAC;gBAED,IAAI,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,uBAAuB,UAAU,CAAC,OAAO,CAAC,oBAAoB,CAAC;gBAC1E,CAAC;gBAED,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;gBACxD,IAAI,SAAS,EAAE,CAAC;oBACf,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBAC3C,CAAC;gBAED,OAAO,CAAC;oBACP,MAAM;oBACN,MAAM;oBACN,QAAQ,EAAE,IAAI;oBACd,SAAS;oBACT,MAAM;oBACN,YAAY;iBACZ,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAEO,aAAa;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC;QAChD,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACzC,CAAC;IAEO,cAAc,CAAC,GAAW;QACjC,IAAI,CAAC;YACJ,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACZ,KAAK,CAAC,6BAA6B,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAC9C,CAAC;IACF,CAAC;CACD;AAED;;GAEG;AACH,SAAS,uBAAuB,CAAC,IAAY;IAC5C,MAAM,QAAQ,GACb,mNAAmN,CAAC;IACrN,MAAM,QAAQ,GAAG,uDAAuD,CAAC;IAEzE,qBAAqB;IACrB,OAAO,GAAG,QAAQ,gCAAgC,IAAI,4BAA4B,QAAQ,iCAAiC,QAAQ,oBAAoB,CAAC;AACzJ,CAAC"}

package/dist/hooks/pretooluse.d.ts

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+/**
+ * PreToolUse hook for context-compress.
+ * Redirects data-fetching tools to context-compress MCP tools.
+ *
+ * Security: NO self-modification of settings.json or installed_plugins.json.
+ * Config: Reads CONTEXT_COMPRESS_* env vars for opt-out of blocking behavior.
+ */
+export {};
+//# sourceMappingURL=pretooluse.d.ts.map

package/dist/hooks/pretooluse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pretooluse.d.ts","sourceRoot":"","sources":["../../src/hooks/pretooluse.ts"],"names":[],"mappings":";AACA;;;;;;GAMG"}

package/dist/hooks/pretooluse.js

@@ -0,0 +1,117 @@
+#!/usr/bin/env node
+/**
+ * PreToolUse hook for context-compress.
+ * Redirects data-fetching tools to context-compress MCP tools.
+ *
+ * Security: NO self-modification of settings.json or installed_plugins.json.
+ * Config: Reads CONTEXT_COMPRESS_* env vars for opt-out of blocking behavior.
+ */
+const TOOL_PREFIX = "context-compress";
+// Read config from env
+const blockCurl = process.env.CONTEXT_COMPRESS_BLOCK_CURL !== "0";
+const blockWebFetch = process.env.CONTEXT_COMPRESS_BLOCK_WEBFETCH !== "0";
+const nudgeOnRead = process.env.CONTEXT_COMPRESS_NUDGE_READ !== "0";
+const nudgeOnGrep = process.env.CONTEXT_COMPRESS_NUDGE_GREP !== "0";
+let raw = "";
+process.stdin.setEncoding("utf-8");
+for await (const chunk of process.stdin)
+    raw += chunk;
+const input = JSON.parse(raw);
+const tool = input.tool_name ?? "";
+const toolInput = input.tool_input ?? {};
+function respond(output) {
+    console.log(JSON.stringify({ hookSpecificOutput: { hookEventName: "PreToolUse", ...output } }));
+    process.exit(0);
+}
+// ─── Bash: redirect data-fetching commands ───
+if (tool === "Bash") {
+    const command = toolInput.command ?? "";
+    // curl/wget → block and redirect
+    if (blockCurl && /(^|\s|&&|\||\;)(curl|wget)\s/i.test(command)) {
+        respond({
+            updatedInput: {
+                command: `echo "${TOOL_PREFIX}: curl/wget blocked. Use mcp__${TOOL_PREFIX}__fetch_and_index(url, source) to fetch URLs, or mcp__${TOOL_PREFIX}__execute(language, code) to run HTTP calls in sandbox. Set CONTEXT_COMPRESS_BLOCK_CURL=0 to disable this."`,
+            },
+        });
+    }
+    // inline fetch → block and redirect
+    if (blockCurl &&
+        (/fetch\s*\(\s*['"](https?:\/\/|http)/i.test(command) ||
+            /requests\.(get|post|put)\s*\(/i.test(command) ||
+            /http\.(get|request)\s*\(/i.test(command))) {
+        respond({
+            updatedInput: {
+                command: `echo "${TOOL_PREFIX}: Inline HTTP blocked. Use mcp__${TOOL_PREFIX}__execute(language, code) to run HTTP calls in sandbox, or mcp__${TOOL_PREFIX}__fetch_and_index(url, source) for web pages."`,
+            },
+        });
+    }
+    // Allow all other Bash commands
+    process.exit(0);
+}
+// ─── Read: nudge toward execute_file ───
+if (tool === "Read" && nudgeOnRead) {
+    respond({
+        additionalContext: `CONTEXT TIP: If this file is large (>50 lines), prefer mcp__${TOOL_PREFIX}__execute_file(path, language, code) — processes in sandbox, only stdout enters context.`,
+    });
+}
+// ─── Grep: nudge toward execute ───
+if (tool === "Grep" && nudgeOnGrep) {
+    respond({
+        additionalContext: `CONTEXT TIP: If results may be large, prefer mcp__${TOOL_PREFIX}__execute(language: "shell", code: "grep ...") — runs in sandbox, only stdout enters context.`,
+    });
+}
+// ─── WebFetch: deny + redirect to sandbox ───
+if (tool === "WebFetch" && blockWebFetch) {
+    const url = toolInput.url ?? "";
+    respond({
+        permissionDecision: "deny",
+        reason: `${TOOL_PREFIX}: WebFetch blocked. Use mcp__${TOOL_PREFIX}__fetch_and_index(url: "${url}", source: "...") to fetch this URL in sandbox. Then use mcp__${TOOL_PREFIX}__search(queries: [...]) to query results.`,
+    });
+}
+// ─── Task/Agent: inject context-compress routing into subagent prompts ───
+if (tool === "Task" || tool === "Agent") {
+    const subagentType = toolInput.subagent_type ?? "";
+    const prompt = toolInput.prompt ?? "";
+    const ROUTING_BLOCK = `
+
+---
+CONTEXT WINDOW PROTECTION — USE CONTEXT-COMPRESS MCP TOOLS
+
+Raw Bash/Read/WebFetch output floods your context. You have context-compress tools that keep data in sandbox.
+
+STEP 1 — GATHER: mcp__${TOOL_PREFIX}__batch_execute(commands, queries)
+  commands: [{label: "Name", command: "shell cmd"}, ...]
+  queries: ["query1", "query2", ...] — put 5-8 queries covering everything you need.
+  Runs all commands, indexes output, returns search results. ONE call, no follow-ups.
+
+STEP 2 — FOLLOW-UP: mcp__${TOOL_PREFIX}__search(queries: ["q1", "q2", "q3", ...])
+  Pass ALL follow-up questions as queries array. ONE call, not separate calls.
+
+OTHER: execute(language, code) | execute_file(path, language, code) | fetch_and_index(url) + search
+
+FORBIDDEN: Bash for output, Read for files, WebFetch. Bash is ONLY for git/mkdir/rm/mv.
+
+OUTPUT FORMAT — KEEP YOUR FINAL RESPONSE UNDER 500 WORDS:
+The parent agent context window is precious. Your full response gets injected into it.
+
+1. ARTIFACTS (PRDs, configs, code files) → Write to FILES, never return as inline text.
+   Return only: file path + 1-line description.
+2. DETAILED FINDINGS → Index into knowledge base:
+   mcp__${TOOL_PREFIX}__index(content: "...", source: "descriptive-label")
+   The parent agent shares the SAME knowledge base and can search() your indexed content.
+3. YOUR RESPONSE must be a concise summary:
+   - What you did (2-3 bullets)
+   - File paths created/modified (if any)
+   - Source labels you indexed (so parent can search)
+   - Key findings in bullet points
+   Do NOT return raw data, full file contents, or lengthy explanations.
+---`;
+    const updatedInput = subagentType === "Bash"
+        ? { ...toolInput, prompt: prompt + ROUTING_BLOCK, subagent_type: "general-purpose" }
+        : { ...toolInput, prompt: prompt + ROUTING_BLOCK };
+    respond({ updatedInput });
+}
+// Unknown tool — pass through
+process.exit(0);
+export {};
+//# sourceMappingURL=pretooluse.js.map

package/dist/hooks/pretooluse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pretooluse.js","sourceRoot":"","sources":["../../src/hooks/pretooluse.ts"],"names":[],"mappings":";AACA;;;;;;GAMG;AAEH,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAEvC,uBAAuB;AACvB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,GAAG,CAAC;AAClE,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,GAAG,CAAC;AAC1E,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,GAAG,CAAC;AACpE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,GAAG,CAAC;AAEpE,IAAI,GAAG,GAAG,EAAE,CAAC;AACb,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AACnC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK;IAAE,GAAG,IAAI,KAAK,CAAC;AAEtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;AACnC,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC;AAEzC,SAAS,OAAO,CAAC,MAA+B;IAC/C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,kBAAkB,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,gDAAgD;AAChD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;IACrB,MAAM,OAAO,GAAW,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC;IAEhD,iCAAiC;IACjC,IAAI,SAAS,IAAI,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC;YACP,YAAY,EAAE;gBACb,OAAO,EAAE,SAAS,WAAW,iCAAiC,WAAW,yDAAyD,WAAW,6GAA6G;aAC1P;SACD,CAAC,CAAC;IACJ,CAAC;IAED,oCAAoC;IACpC,IACC,SAAS;QACT,CAAC,sCAAsC,CAAC,IAAI,CAAC,OAAO,CAAC;YACpD,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC;YAC9C,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAC1C,CAAC;QACF,OAAO,CAAC;YACP,YAAY,EAAE;gBACb,OAAO,EAAE,SAAS,WAAW,mCAAmC,WAAW,mEAAmE,WAAW,gDAAgD;aACzM;SACD,CAAC,CAAC;IACJ,CAAC;IAED,gCAAgC;IAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,0CAA0C;AAC1C,IAAI,IAAI,KAAK,MAAM,IAAI,WAAW,EAAE,CAAC;IACpC,OAAO,CAAC;QACP,iBAAiB,EAAE,+DAA+D,WAAW,0FAA0F;KACvL,CAAC,CAAC;AACJ,CAAC;AAED,qCAAqC;AACrC,IAAI,IAAI,KAAK,MAAM,IAAI,WAAW,EAAE,CAAC;IACpC,OAAO,CAAC;QACP,iBAAiB,EAAE,qDAAqD,WAAW,+FAA+F;KAClL,CAAC,CAAC;AACJ,CAAC;AAED,+CAA+C;AAC/C,IAAI,IAAI,KAAK,UAAU,IAAI,aAAa,EAAE,CAAC;IAC1C,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,IAAI,EAAE,CAAC;IAChC,OAAO,CAAC;QACP,kBAAkB,EAAE,MAAM;QAC1B,MAAM,EAAE,GAAG,WAAW,gCAAgC,WAAW,2BAA2B,GAAG,iEAAiE,WAAW,4CAA4C;KACvN,CAAC,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;IACzC,MAAM,YAAY,GAAG,SAAS,CAAC,aAAa,IAAI,EAAE,CAAC;IACnD,MAAM,MAAM,GAAW,SAAS,CAAC,MAAM,IAAI,EAAE,CAAC;IAE9C,MAAM,aAAa,GAAG;;;;;;;wBAOC,WAAW;;;;;2BAKR,WAAW;;;;;;;;;;;;;UAa5B,WAAW;;;;;;;;IAQjB,CAAC;IAEJ,MAAM,YAAY,GACjB,YAAY,KAAK,MAAM;QACtB,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE;QACpF,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE,CAAC;IAErD,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,8BAA8B;AAC9B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -0,0 +1,9 @@
+import { loadConfig } from "./config.js";
+import { debug } from "./logger.js";
+import { createServer } from "./server.js";
+const config = loadConfig(process.env.CLAUDE_PROJECT_DIR);
+debug("Starting context-compress server");
+debug("Config:", JSON.stringify(config, null, 2));
+const server = await createServer(config);
+await server.start();
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC1D,KAAK,CAAC,kCAAkC,CAAC,CAAC;AAC1C,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAElD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;AAC1C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC"}

package/dist/logger.d.ts

@@ -0,0 +1,4 @@
+export declare function debug(...args: unknown[]): void;
+export declare function warn(...args: unknown[]): void;
+export declare function error(...args: unknown[]): void;
+//# sourceMappingURL=logger.d.ts.map

package/dist/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAEA,wBAAgB,KAAK,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAI9C;AAED,wBAAgB,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAE7C;AAED,wBAAgB,KAAK,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAE9C"}