context-compress 2026.3.20 → 2026.3.22

package/dist/server.bundle.mjs

@@ -11061,7 +11061,7 @@ function debug(...args) {
 }
 
 // src/server.ts
-import { readFileSync as readFileSync2, realpathSync, statSync } from "node:fs";
+import { readFileSync as readFileSync3, realpathSync, statSync } from "node:fs";
 import { dirname, join as join4, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -21216,7 +21216,182 @@ import { execFileSync, spawn } from "node:child_process";
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join as join2 } from "node:path";
+
+// src/filters.ts
+function applyCommandFilter(code, stdout) {
+  const cmd = code.trim().split(/\s+/)[0];
+  const fullCmd = code.trim();
+  if (cmd === "git") return filterGit(fullCmd, stdout);
+  if (cmd === "npm" || cmd === "yarn" || cmd === "pnpm" || cmd === "bun")
+    return filterPackageManager(fullCmd, stdout);
+  if (fullCmd.includes("test") || fullCmd.includes("jest") || fullCmd.includes("vitest") || fullCmd.includes("pytest") || fullCmd.includes("cargo test")) {
+    return filterTestOutput(stdout);
+  }
+  if (cmd === "cargo" || cmd === "make" || cmd === "gradle")
+    return filterBuildOutput(fullCmd, stdout);
+  if (cmd === "docker" || cmd === "kubectl") return filterContainerOutput(fullCmd, stdout);
+  if (cmd === "ls" || cmd === "find" || cmd === "tree") return filterFileList(fullCmd, stdout);
+  return { output: stdout, filtered: false };
+}
+function filterGit(cmd, stdout) {
+  if (/git\s+(push|pull|fetch|clone)/.test(cmd)) {
+    const lines = stdout.split("\n");
+    const filtered = lines.filter(
+      (l) => !l.startsWith("remote: Counting") && !l.startsWith("remote: Compressing") && !l.startsWith("remote: Total") && !l.includes("Unpacking objects:") && !l.includes("Receiving objects:") && !l.includes("Resolving deltas:") && !/^\s*\d+%/.test(l)
+    );
+    return { output: filtered.join("\n"), filtered: true };
+  }
+  if (/git\s+status/.test(cmd)) {
+    const lines = stdout.split("\n");
+    const filtered = lines.filter((l) => !l.startsWith("  (use ") && l.trim() !== "");
+    return { output: filtered.join("\n"), filtered: true };
+  }
+  return { output: stdout, filtered: false };
+}
+function filterPackageManager(cmd, stdout) {
+  if (/\b(install|add|i)\b/.test(cmd)) {
+    const lines = stdout.split("\n");
+    const filtered = lines.filter(
+      (l) => !l.startsWith("npm warn") && !l.includes("packages are looking for funding") && !l.includes("run `npm fund`") && !l.startsWith("npm notice") && !/^[\s\u2502\u251C\u2514\u2500]+$/.test(l) && // tree-drawing characters
+      !/^\s*$/.test(l)
+    );
+    return { output: filtered.join("\n"), filtered: true };
+  }
+  if (/\btest\b/.test(cmd)) {
+    return filterTestOutput(stdout);
+  }
+  return { output: stdout, filtered: false };
+}
+var FAIL_MARKER_RE = /^\s*[\u2717\u2718\u00D7]\s/;
+var FAIL_WORD_RE = /\bFAIL\b/;
+var FAILED_RE = /\bfailed?\b/i;
+var ERROR_RE = /\bERROR\b/;
+var SUMMARY_RE = /^\s*(Tests?|Suites?|Test Suites)\s*:|^\s*(pass|fail|skip|pending|todo)\s|\b\d+\s+(passing|failing|pending|skipped)\b|^(ok|not ok)\s|^\u2139\s|^(PASS|FAIL)\s/i;
+function isFailMarker(line) {
+  return FAIL_MARKER_RE.test(line) || FAIL_WORD_RE.test(line) || FAILED_RE.test(line) || ERROR_RE.test(line);
+}
+function isSummaryLine(line) {
+  return SUMMARY_RE.test(line);
+}
+function filterTestOutput(stdout) {
+  const lines = stdout.split("\n");
+  const failures = [];
+  const summary = [];
+  let inFailure = false;
+  let failCount = 0;
+  for (const line of lines) {
+    if (isFailMarker(line)) {
+      inFailure = true;
+      failCount++;
+    }
+    if (inFailure) {
+      failures.push(line);
+      if (line.trim() === "" && failures.length > 3) inFailure = false;
+    }
+    if (isSummaryLine(line)) {
+      summary.push(line);
+    }
+  }
+  if (failCount === 0 && summary.length > 0) {
+    return { output: summary.join("\n"), filtered: true };
+  }
+  if (failures.length > 0) {
+    const result = [...failures, "", ...summary].join("\n");
+    return { output: result, filtered: true };
+  }
+  return { output: stdout, filtered: false };
+}
+function filterBuildOutput(cmd, stdout) {
+  const lines = stdout.split("\n");
+  const filtered = lines.filter(
+    (l) => !l.includes("Downloading") && !l.includes("Downloaded") && !/Compiling\s+\d+\s+of\s+\d+/.test(l) && !l.includes("Blocking waiting for file lock") && !/^\s*$/.test(l)
+  );
+  return { output: filtered.join("\n"), filtered: filtered.length < lines.length };
+}
+function filterContainerOutput(cmd, stdout) {
+  if (/docker\s+build/.test(cmd)) {
+    const lines = stdout.split("\n");
+    const filtered = lines.filter(
+      (l) => !l.startsWith(" ---> ") && !l.startsWith("Sending build context")
+    );
+    return { output: filtered.join("\n"), filtered: true };
+  }
+  return { output: stdout, filtered: false };
+}
+function filterFileList(cmd, stdout) {
+  const lines = stdout.split("\n").filter((l) => l.trim() !== "");
+  if (lines.length <= 30) return { output: stdout, filtered: false };
+  if (cmd.includes("-R") || cmd.startsWith("find")) {
+    const dirs = /* @__PURE__ */ new Map();
+    for (const line of lines) {
+      const parts = line.split("/");
+      const dir = parts.length > 1 ? parts.slice(0, -1).join("/") : ".";
+      dirs.set(dir, (dirs.get(dir) ?? 0) + 1);
+    }
+    if (dirs.size > 5 && lines.length > 50) {
+      const summary = Array.from(dirs.entries()).sort((a, b) => b[1] - a[1]).map(([dir, count]) => `  ${dir}/ (${count} files)`).join("\n");
+      return {
+        output: `${lines.length} files found:
+${summary}`,
+        filtered: true
+      };
+    }
+  }
+  return { output: stdout, filtered: false };
+}
+
+// src/utils.ts
+function detectInjectionPatterns(content) {
+  const warnings = [];
+  const patterns = [
+    { re: /ignore\s+(all\s+)?previous\s+instructions/i, label: "instruction override" },
+    { re: /you\s+are\s+now\s+/i, label: "role reassignment" },
+    {
+      re: /(?:^|\n)\s*system\s*:\s*(?:you are|you're|as an? )/im,
+      label: "system prompt injection"
+    },
+    { re: /\[INST\]|\[\/INST\]|<\|im_start\|>|<\|im_end\|>/i, label: "chat template injection" },
+    { re: /\n\n(?:Human|Assistant):/m, label: "chat delimiter injection" },
+    { re: /reveal\s+(your|the)\s+(system|secret|confidential)/i, label: "data exfiltration" },
+    { re: /act\s+as\s+(if\s+you\s+are|a)\s+/i, label: "role manipulation" }
+  ];
+  for (const { re, label } of patterns) {
+    if (re.test(content)) {
+      warnings.push(label);
+    }
+  }
+  return warnings;
+}
+async function limitConcurrency(tasks, limit) {
+  const results = new Array(tasks.length);
+  let nextIndex = 0;
+  async function runNext() {
+    while (nextIndex < tasks.length) {
+      const index = nextIndex++;
+      try {
+        const value = await tasks[index]();
+        results[index] = { status: "fulfilled", value };
+      } catch (reason) {
+        results[index] = { status: "rejected", reason };
+      }
+    }
+  }
+  const workers = Array.from({ length: Math.min(limit, tasks.length) }, () => runNext());
+  await Promise.all(workers);
+  return results;
+}
+function formatBytes(bytes) {
+  if (bytes < 1024) return `${bytes}B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)}KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)}MB`;
+}
+
+// src/executor.ts
 var DEFAULT_TIMEOUT = 3e4;
+var ANSI_RE = /\x1b\[[0-9;]*[a-zA-Z]/;
+function stripAnsi(str) {
+  return str.replace(new RegExp(ANSI_RE.source, "g"), "");
+}
 var SAFE_ENV_KEYS = [
   "PATH",
   "HOME",
@@ -21269,6 +21444,21 @@ function killProcessTree(pid) {
     }
   }
 }
+function stripProgressLines(output) {
+  const lines = output.split("\n");
+  const filtered = lines.filter((l) => {
+    const trimmed = l.trim();
+    if (ANSI_RE.test(l) && trimmed.replace(new RegExp(ANSI_RE.source, "g"), "").trim() === "")
+      return false;
+    if (/^[\s\[│├└─═━▓░█▒▏▎▍▌▋▊▉\]>=#\-.\d%]+$/.test(trimmed) && trimmed.length > 3) return false;
+    if (/^[⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏\-\\|/]\s/.test(trimmed)) return false;
+    if (/(?:downloading|uploading|fetching|resolving)\s+[\d.]+\s*[kmg]?b/i.test(trimmed))
+      return false;
+    if (/\d+\.?\d*\s*[kmg]?b\/s/i.test(trimmed) && /eta|remaining/i.test(trimmed)) return false;
+    return true;
+  });
+  return filtered.join("\n");
+}
 function deduplicateLines(output) {
   const lines = output.split("\n");
   if (lines.length < 3) return output;
@@ -21300,12 +21490,12 @@ function deduplicateLines(output) {
 function groupErrorLines(output) {
   const lines = output.split("\n");
   if (lines.length < 5) return output;
-  const ERROR_RE = /^(.*?(?:error|warning|Error|Warning|ERR|WARN)[:\s])\s*(.+?)(?:\s+(?:at|in|on)\s+(?:line\s+)?(\d+))?$/i;
+  const ERROR_RE2 = /^(.*?(?:error|warning|Error|Warning|ERR|WARN)[:\s])\s*(.+?)(?:\s+(?:at|in|on)\s+(?:line\s+)?(\d+))?$/i;
   const errorGroups = /* @__PURE__ */ new Map();
   const resultLines = [];
   let groupedCount = 0;
   for (const line of lines) {
-    const match = line.match(ERROR_RE);
+    const match = line.match(ERROR_RE2);
     if (match) {
       const prefix = match[1].trim();
       const msg = match[2].trim();
@@ -21380,20 +21570,26 @@ function smartTruncate(output, maxBytes) {
 `;
   return headLines.join("\n") + separator + tailLines.join("\n");
 }
-function formatBytes(bytes) {
-  if (bytes < 1024) return `${bytes}B`;
-  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)}KB`;
-  return `${(bytes / (1024 * 1024)).toFixed(1)}MB`;
-}
 var SubprocessExecutor = class {
   runtimes;
   config;
   env;
+  activeProcesses = /* @__PURE__ */ new Set();
   constructor(runtimes, config3) {
     this.runtimes = runtimes;
     this.config = config3;
     this.env = buildEnv(config3);
   }
+  /** Kill all active child processes and their process trees. */
+  shutdown() {
+    for (const proc of this.activeProcesses) {
+      try {
+        if (proc.pid) killProcessTree(proc.pid);
+      } catch {
+      }
+    }
+    this.activeProcesses.clear();
+  }
   /**
    * Execute code in a subprocess.
    */
@@ -21451,7 +21647,8 @@ var SubprocessExecutor = class {
         tmpDir,
         timeout,
         maxOutput,
-        plugin.needsShell
+        plugin.needsShell,
+        opts.language === "shell" ? opts.code : void 0
       );
     } finally {
       setTimeout(() => this.cleanupTempDir(tmpDir), 100).unref();
@@ -21478,7 +21675,7 @@ var SubprocessExecutor = class {
     }
     return this.execute({ ...opts, code });
   }
-  spawnAndCapture(cmd, args, cwd, timeout, maxOutput, useShell) {
+  spawnAndCapture(cmd, args, cwd, timeout, maxOutput, useShell, shellCode) {
     return new Promise((resolve2) => {
       const hardCap = this.config.hardCapBytes;
       const stdoutChunks = [];
@@ -21495,6 +21692,7 @@ var SubprocessExecutor = class {
         shell: useShell,
         detached: process.platform !== "win32"
       });
+      this.activeProcesses.add(proc);
       proc.stdout?.on("data", (chunk) => {
         totalBytes += chunk.length;
         if (totalBytes > hardCap) {
@@ -21515,6 +21713,7 @@ var SubprocessExecutor = class {
       });
       proc.on("error", (err) => {
         debug("Process error:", err.message);
+        this.activeProcesses.delete(proc);
         if (!resolved) {
           resolved = true;
           resolve2({
@@ -21527,6 +21726,7 @@ var SubprocessExecutor = class {
         }
       });
       proc.on("close", (code) => {
+        this.activeProcesses.delete(proc);
         if (resolved) return;
         resolved = true;
         let stdout = Buffer.concat(stdoutChunks).toString("utf-8");
@@ -21540,8 +21740,18 @@ var SubprocessExecutor = class {
           stdout += `
 [output capped at ${formatBytes(hardCap)} \u2014 process killed]`;
         }
-        stdout = deduplicateLines(stdout);
-        stdout = groupErrorLines(stdout);
+        if (shellCode && stdout) {
+          const filtered = applyCommandFilter(shellCode, stdout);
+          if (filtered.filtered) {
+            stdout = filtered.output;
+          }
+        }
+        stdout = stripAnsi(stdout);
+        if (stdout.length > 1e4) {
+          stdout = stripProgressLines(stdout);
+          stdout = deduplicateLines(stdout);
+          stdout = groupErrorLines(stdout);
+        }
         const truncated = Buffer.byteLength(stdout) > maxOutput;
         if (truncated) {
           stdout = smartTruncate(stdout, maxOutput);
@@ -21612,24 +21822,24 @@ async function resolveAndValidate(url) {
   let resolvedIp = null;
   let v4Error = false;
   let v6Error = false;
-  try {
-    const { address } = await dns.promises.lookup(hostname2, { family: 4 });
-    if (isPrivateHost(address)) {
-      throw new Error(`Blocked: ${hostname2} resolved to private IP ${address}`);
-    }
-    resolvedIp = address;
-  } catch (err) {
-    if (err instanceof Error && err.message.startsWith("Blocked:")) throw err;
+  const [v4Result, v6Result] = await Promise.allSettled([
+    dns.promises.lookup(hostname2, { family: 4 }),
+    dns.promises.lookup(hostname2, { family: 6 })
+  ]);
+  if (v4Result.status === "fulfilled") {
+    if (isPrivateHost(v4Result.value.address)) {
+      throw new Error(`Blocked: ${hostname2} resolved to private IP ${v4Result.value.address}`);
+    }
+    resolvedIp = v4Result.value.address;
+  } else {
     v4Error = true;
   }
-  try {
-    const { address } = await dns.promises.lookup(hostname2, { family: 6 });
-    if (isPrivateHost(address)) {
-      throw new Error(`Blocked: ${hostname2} resolved to private IPv6 ${address}`);
+  if (v6Result.status === "fulfilled") {
+    if (isPrivateHost(v6Result.value.address)) {
+      throw new Error(`Blocked: ${hostname2} resolved to private IPv6 ${v6Result.value.address}`);
     }
-    if (!resolvedIp) resolvedIp = address;
-  } catch (err) {
-    if (err instanceof Error && err.message.startsWith("Blocked:")) throw err;
+    if (!resolvedIp) resolvedIp = v6Result.value.address;
+  } else {
     v6Error = true;
   }
   if (v4Error && v6Error) {
@@ -21954,6 +22164,7 @@ function hasBun(runtimes) {
 }
 
 // src/stats.ts
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
 var BAR_WIDTH = 20;
 function asciiBar(ratio, width = BAR_WIDTH) {
   const filled = Math.round(ratio * width);
@@ -21973,6 +22184,10 @@ var SessionTracker = class {
     bytesSandboxed: 0,
     sessionStart: Date.now()
   };
+  cumulativeFile;
+  constructor(cumulativeFile) {
+    this.cumulativeFile = cumulativeFile ?? null;
+  }
   trackCall(toolName, responseBytes) {
     this.stats.calls[toolName] = (this.stats.calls[toolName] ?? 0) + 1;
     this.stats.bytesReturned[toolName] = (this.stats.bytesReturned[toolName] ?? 0) + responseBytes;
@@ -21986,6 +22201,47 @@ var SessionTracker = class {
   getSnapshot() {
     return { ...this.stats };
   }
+  /** Load cumulative stats from disk */
+  loadCumulative() {
+    if (!this.cumulativeFile) return null;
+    try {
+      const data = readFileSync2(this.cumulativeFile, "utf-8");
+      return JSON.parse(data);
+    } catch {
+      return null;
+    }
+  }
+  /** Save current session stats to cumulative file */
+  saveCumulative() {
+    if (!this.cumulativeFile) return;
+    const snap = this.stats;
+    const keptOut = snap.bytesIndexed + snap.bytesSandboxed;
+    const totalReturned = Object.values(snap.bytesReturned).reduce((a, b) => a + b, 0);
+    const cumulative = this.loadCumulative() ?? {
+      totalBytesSaved: 0,
+      totalBytesProcessed: 0,
+      totalCalls: 0,
+      totalSessions: 0,
+      firstSeen: (/* @__PURE__ */ new Date()).toISOString(),
+      lastSeen: (/* @__PURE__ */ new Date()).toISOString(),
+      perCommand: {}
+    };
+    cumulative.totalBytesSaved += keptOut;
+    cumulative.totalBytesProcessed += keptOut + totalReturned;
+    cumulative.totalCalls += Object.values(snap.calls).reduce((a, b) => a + b, 0);
+    cumulative.totalSessions += 1;
+    cumulative.lastSeen = (/* @__PURE__ */ new Date()).toISOString();
+    for (const [name, calls] of Object.entries(snap.calls)) {
+      if (!cumulative.perCommand[name]) {
+        cumulative.perCommand[name] = { calls: 0, bytesSaved: 0 };
+      }
+      cumulative.perCommand[name].calls += calls;
+    }
+    try {
+      writeFileSync2(this.cumulativeFile, JSON.stringify(cumulative, null, 2));
+    } catch {
+    }
+  }
   formatReport() {
     const snap = this.stats;
     const elapsed = Date.now() - snap.sessionStart;
@@ -22046,6 +22302,18 @@ var SessionTracker = class {
       `
 Context-compress kept ${formatBytes(keptOut)} out of context (${reductionPct}% savings).`
     );
+    const cumulative = this.loadCumulative();
+    if (cumulative) {
+      lines.push("\n## Cumulative Savings (All Sessions)\n");
+      lines.push("| Metric | Value |");
+      lines.push("|--------|-------|");
+      lines.push(`| Sessions tracked | ${cumulative.totalSessions} |`);
+      lines.push(`| Total data processed | ${formatBytes(cumulative.totalBytesProcessed)} |`);
+      lines.push(`| Total kept out of context | ${formatBytes(cumulative.totalBytesSaved)} |`);
+      const cumTokensMid = Math.round(cumulative.totalBytesSaved / 4);
+      lines.push(`| Est. total tokens saved | ~${cumTokensMid.toLocaleString()} |`);
+      lines.push(`| Tracking since | ${cumulative.firstSeen.split("T")[0]} |`);
+    }
     return lines.join("\n");
   }
 };
@@ -22216,17 +22484,20 @@ function sanitizeQuery(raw) {
   const words = q.split(/\s+/).filter((w) => w.length >= 2).map((w) => `"${w}"`);
   return words.length > 0 ? words.join(" OR ") : "";
 }
-function levenshtein(a, b) {
+function levenshtein(a, b, maxDist) {
   if (a.length === 0) return b.length;
   if (b.length === 0) return a.length;
   let prev = Array.from({ length: b.length + 1 }, (_, i) => i);
   let curr = new Array(b.length + 1);
   for (let i = 1; i <= a.length; i++) {
     curr[0] = i;
+    let rowMin = curr[0];
     for (let j = 1; j <= b.length; j++) {
       const cost = a[i - 1] === b[j - 1] ? 0 : 1;
       curr[j] = Math.min(prev[j] + 1, curr[j - 1] + 1, prev[j - 1] + cost);
+      if (curr[j] < rowMin) rowMin = curr[j];
     }
+    if (maxDist !== void 0 && rowMin > maxDist) return maxDist + 1;
     [prev, curr] = [curr, prev];
   }
   return prev[b.length];
@@ -22422,7 +22693,7 @@ var ContentStore = class {
       let bestWord = word;
       let bestDist = maxDist + 1;
       for (const { word: candidate } of candidates) {
-        const dist = levenshtein(word.toLowerCase(), candidate.toLowerCase());
+        const dist = levenshtein(word.toLowerCase(), candidate.toLowerCase(), maxDist);
         if (dist < bestDist && dist <= maxDist) {
           bestDist = dist;
           bestWord = candidate;
@@ -22439,7 +22710,8 @@ var ContentStore = class {
   updateVocabulary(content) {
     const currentCount = this.vocabCountStmt.get().cnt;
     if (currentCount >= MAX_VOCABULARY) return;
-    const words = content.split(WORD_SPLIT_RE).filter((w) => w.length >= 3 && !STOPWORDS.has(w.toLowerCase()));
+    const sample = content.length > 51200 ? content.slice(0, 51200) : content;
+    const words = sample.split(WORD_SPLIT_RE).filter((w) => w.length >= 3 && !STOPWORDS.has(w.toLowerCase()));
     const unique = new Set(words.map((w) => w.toLowerCase()));
     const insert = this.vocabInsertStmt;
     let added = 0;
@@ -22659,7 +22931,7 @@ function getVersion() {
   try {
     const __dirname = dirname(fileURLToPath(import.meta.url));
     const pkgPath = join4(__dirname, "..", "package.json");
-    const pkg = JSON.parse(readFileSync2(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync3(pkgPath, "utf-8"));
     return pkg.version ?? "1.0.0";
   } catch {
     return "1.0.0";
@@ -22677,45 +22949,6 @@ function compactLabel(normal, level) {
   }
   return normal;
 }
-async function limitConcurrency(tasks, limit) {
-  const results = new Array(tasks.length);
-  let nextIndex = 0;
-  async function runNext() {
-    while (nextIndex < tasks.length) {
-      const index = nextIndex++;
-      try {
-        const value = await tasks[index]();
-        results[index] = { status: "fulfilled", value };
-      } catch (reason) {
-        results[index] = { status: "rejected", reason };
-      }
-    }
-  }
-  const workers = Array.from({ length: Math.min(limit, tasks.length) }, () => runNext());
-  await Promise.all(workers);
-  return results;
-}
-function detectInjectionPatterns(content) {
-  const warnings = [];
-  const patterns = [
-    { re: /ignore\s+(all\s+)?previous\s+instructions/i, label: "instruction override" },
-    { re: /you\s+are\s+now\s+/i, label: "role reassignment" },
-    {
-      re: /(?:^|\n)\s*system\s*:\s*(?:you are|you're|as an? )/im,
-      label: "system prompt injection"
-    },
-    { re: /\[INST\]|\[\/INST\]|<\|im_start\|>|<\|im_end\|>/i, label: "chat template injection" },
-    { re: /\n\n(?:Human|Assistant):/m, label: "chat delimiter injection" },
-    { re: /reveal\s+(your|the)\s+(system|secret|confidential)/i, label: "data exfiltration" },
-    { re: /act\s+as\s+(if\s+you\s+are|a)\s+/i, label: "role manipulation" }
-  ];
-  for (const { re, label } of patterns) {
-    if (re.test(content)) {
-      warnings.push(label);
-    }
-  }
-  return warnings;
-}
 async function createServer(config3) {
   const version2 = getVersion();
   debug("Version:", version2);
@@ -22733,7 +22966,22 @@ async function createServer(config3) {
     store = new ContentStore(":memory:");
     dbFallback = true;
   }
-  const tracker = new SessionTracker();
+  const cumulativeFile = config3.persistDb ? join4(config3.dbDir ?? join4(projectDir, ".context-compress"), "stats.json") : void 0;
+  const tracker = new SessionTracker(cumulativeFile);
+  let activeExecutions = 0;
+  const MAX_CONCURRENT_EXECUTIONS = 8;
+  const EXECUTION_LIMIT_ERROR = "Error: too many concurrent executions. Try again shortly.";
+  async function withExecutionLimit(fn) {
+    if (activeExecutions >= MAX_CONCURRENT_EXECUTIONS) {
+      throw new Error(EXECUTION_LIMIT_ERROR);
+    }
+    activeExecutions++;
+    try {
+      return await fn();
+    } finally {
+      activeExecutions--;
+    }
+  }
   function applyIntentFilter(output, intent, sourceLabel) {
     if (Buffer.byteLength(output) <= config3.intentSearchThreshold) return output;
     const indexed = store.index(output, sourceLabel);
@@ -22758,6 +23006,14 @@ Searchable terms: ${terms.join(", ")}
     return compactLabel(filtered, config3.compressionLevel);
   }
   const shutdown = () => {
+    try {
+      tracker.saveCumulative();
+    } catch {
+    }
+    try {
+      executor.shutdown();
+    } catch {
+    }
     try {
       store.close();
     } catch {
@@ -22766,6 +23022,16 @@ Searchable terms: ${terms.join(", ")}
   process.on("SIGINT", shutdown);
   process.on("SIGTERM", shutdown);
   process.on("beforeExit", shutdown);
+  process.on("uncaughtException", (err) => {
+    debug("Uncaught exception:", err);
+    shutdown();
+    process.exit(1);
+  });
+  process.on("unhandledRejection", (err) => {
+    debug("Unhandled rejection:", err);
+    shutdown();
+    process.exit(1);
+  });
   const searchCalls = [];
   const server2 = new McpServer({
     name: "context-compress",
@@ -22787,7 +23053,24 @@ PREFER THIS OVER BASH for: API calls (gh, curl, aws), test runners (npm test, py
       timeout: external_exports.number().default(3e4).describe("Max execution time in ms")
     },
     async ({ language, code, intent, timeout }) => {
-      const result = await executor.execute({ language, code, timeout });
+      const codeBytes = Buffer.byteLength(code);
+      if (codeBytes > 1024e3) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Error: code too large (${(codeBytes / 1024).toFixed(0)}KB). Max 1MB.`
+            }
+          ]
+        };
+      }
+      let result;
+      try {
+        result = await withExecutionLimit(() => executor.execute({ language, code, timeout }));
+      } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        return { content: [{ type: "text", text: msg }] };
+      }
       if (result.networkBytes) {
         tracker.trackSandboxed(result.networkBytes);
       }
@@ -22819,6 +23102,17 @@ ${result.stderr}`;
       timeout: external_exports.number().default(3e4).describe("Max execution time in ms")
     },
     async ({ path: filePath, language, code, intent, timeout }) => {
+      const codeBytes = Buffer.byteLength(code);
+      if (codeBytes > 1024e3) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Error: code too large (${(codeBytes / 1024).toFixed(0)}KB). Max 1MB.`
+            }
+          ]
+        };
+      }
       const absPath = resolve(projectDir, filePath);
       if (!isWithinProject(absPath)) {
         return {
@@ -22830,12 +23124,20 @@ ${result.stderr}`;
           ]
         };
       }
-      const result = await executor.executeFile({
-        language,
-        code,
-        filePath: absPath,
-        timeout
-      });
+      let result;
+      try {
+        result = await withExecutionLimit(
+          () => executor.executeFile({
+            language,
+            code,
+            filePath: absPath,
+            timeout
+          })
+        );
+      } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        return { content: [{ type: "text", text: msg }] };
+      }
       let output = result.stdout;
       if (result.stderr && result.exitCode !== 0) {
         output += `
@@ -22886,7 +23188,7 @@ ${result.stderr}`;
               ]
             };
           }
-          text = readFileSync2(absPath, "utf-8");
+          text = readFileSync3(absPath, "utf-8");
           label = source ?? filePath;
         } catch (e) {
           const msg = e instanceof Error ? e.message : String(e);
@@ -23020,11 +23322,19 @@ ${hit.snippet}
       }
       const label = source ?? url;
       const fetchCode = buildFetchCode(url, resolvedIp);
-      const result = await executor.execute({
-        language: "javascript",
-        code: fetchCode,
-        timeout: 3e4
-      });
+      let result;
+      try {
+        result = await withExecutionLimit(
+          () => executor.execute({
+            language: "javascript",
+            code: fetchCode,
+            timeout: 3e4
+          })
+        );
+      } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        return { content: [{ type: "text", text: msg }] };
+      }
       if (result.exitCode !== 0 || !result.stdout.trim()) {
         const errMsg = `Failed to fetch ${url}: ${result.stderr || "empty response"}`;
         tracker.trackCall("fetch_and_index", Buffer.byteLength(errMsg));
@@ -23076,11 +23386,13 @@ Searchable terms: ${terms.join(", ")}`;
     async ({ commands, queries, timeout }) => {
       const commandResults = await limitConcurrency(
         commands.map((cmd) => async () => {
-          const result = await executor.execute({
-            language: "shell",
-            code: cmd.command,
-            timeout
-          });
+          const result = await withExecutionLimit(
+            () => executor.execute({
+              language: "shell",
+              code: cmd.command,
+              timeout
+            })
+          );
           return { label: cmd.label, result };
         }),
         4
@@ -23157,6 +23469,7 @@ Searchable terms: ${terms.join(", ")}`;
     "Returns context consumption statistics for the current session. Shows total bytes returned to context, breakdown by tool, call counts, estimated token usage, context savings ratio, and visual charts.",
     {},
     async () => {
+      tracker.saveCumulative();
       const report = tracker.formatReport();
       tracker.trackCall("stats", Buffer.byteLength(report));
       return { content: [{ type: "text", text: report }] };
@@ -23262,7 +23575,14 @@ const resp = await fetch(url, { redirect: 'error' });`;
   }
   return `${fetchSetup}
 if (!resp.ok) { console.error("HTTP " + resp.status); process.exit(1); }
+const cl = resp.headers.get('content-length');
+if (cl && parseInt(cl, 10) > 10 * 1024 * 1024) {
+    console.error("Response too large: " + cl + " bytes"); process.exit(1);
+}
 const html = await resp.text();
+if (html.length > 10 * 1024 * 1024) {
+    console.error("Response body too large: " + html.length + " chars"); process.exit(1);
+}
 
 // Strip unwanted tags
 let md = html