context-mode 1.0.124 → 1.0.125

package/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Claude Code plugins by Mert Koseoğlu",
-    "version": "1.0.124"
+    "version": "1.0.125"
   },
   "plugins": [
     {
       "name": "context-mode",
       "source": "./",
       "description": "Claude Code MCP plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
-      "version": "1.0.124",
+      "version": "1.0.125",
       "author": {
         "name": "Mert Koseoğlu"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "context-mode",
-  "version": "1.0.124",
+  "version": "1.0.125",
   "description": "MCP server that saves 98% of your context window with session continuity. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and automatic state restore across compactions.",
   "author": {
     "name": "Mert Koseoğlu",

package/.openclaw-plugin/openclaw.plugin.json

@@ -3,7 +3,7 @@
   "name": "Context Mode",
   "kind": "tool",
   "description": "OpenClaw plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
-  "version": "1.0.124",
+  "version": "1.0.125",
   "sandbox": {
     "mode": "permissive",
     "filesystem_access": "full",

package/.openclaw-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "context-mode",
-  "version": "1.0.124",
+  "version": "1.0.125",
   "description": "OpenClaw plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
   "author": {
     "name": "Mert Koseoğlu",

package/README.md

@@ -570,7 +570,7 @@ Full documentation: [`docs/adapters/openclaw.md`](docs/adapters/openclaw.md)
    ```json
    {
      "hooks": {
-      "PreToolUse": [{ "matcher": "local_shell|shell|shell_command|exec_command|container.exec|functions\\.exec_command|Bash|Shell|apply_patch|functions\\.apply_patch|Edit|Write|grep_files|ctx_execute|ctx_execute_file|ctx_batch_execute|ctx_fetch_and_index|ctx_search|ctx_index|mcp__.*__ctx_execute|mcp__.*__ctx_execute_file|mcp__.*__ctx_batch_execute|mcp__.*__ctx_fetch_and_index|mcp__.*__ctx_search|mcp__.*__ctx_index|mcp__(?!.*context-mode)", "hooks": [{ "type": "command", "command": "context-mode hook codex pretooluse" }] }],
+      "PreToolUse": [{ "matcher": "local_shell|shell|shell_command|exec_command|Bash|Shell|apply_patch|Edit|Write|grep_files|ctx_execute|ctx_execute_file|ctx_batch_execute|ctx_fetch_and_index|ctx_search|ctx_index|mcp__", "hooks": [{ "type": "command", "command": "context-mode hook codex pretooluse" }] }],
        "PostToolUse": [{ "hooks": [{ "type": "command", "command": "context-mode hook codex posttooluse" }] }],
        "SessionStart": [{ "hooks": [{ "type": "command", "command": "context-mode hook codex sessionstart" }] }],
        "PreCompact": [{ "hooks": [{ "type": "command", "command": "context-mode hook codex precompact" }] }],
@@ -964,7 +964,7 @@ npm install -g context-mode
 | Tool | What it does | Context saved |
 |---|---|---|
 | `ctx_batch_execute` | Run multiple commands + search multiple queries in ONE call. Opt-in `concurrency: 1-8` for I/O-bound batches. | 986 KB → 62 KB |
-| `ctx_execute` | Run code in 11 languages. Only stdout enters context. | 56 KB → 299 B |
+| `ctx_execute` | Run code in 12 languages. Only stdout enters context. | 56 KB → 299 B |
 | `ctx_execute_file` | Process files in sandbox. Raw content never leaves. | 45 KB → 155 B |
 | `ctx_index` | Chunk markdown into FTS5 with BM25 ranking. | 60 KB → 40 B |
 | `ctx_search` | Query indexed content with multiple queries in one call. | On-demand retrieval |
@@ -978,7 +978,7 @@ npm install -g context-mode
 
 Each `ctx_execute` call spawns an isolated subprocess with its own process boundary. Scripts can't access each other's memory or state. The subprocess runs your code, captures stdout, and only that stdout enters the conversation context. The raw data — log files, API responses, snapshots — never leaves the sandbox.
 
-Eleven language runtimes are available: JavaScript, TypeScript, Python, Shell, Ruby, Go, Rust, PHP, Perl, R, and Elixir. Bun is auto-detected for 3-5x faster JS/TS execution.
+Twelve language runtimes are available: JavaScript, TypeScript, Python, Shell, Ruby, Go, Rust, PHP, Perl, R, Elixir, and C#. Bun is auto-detected for 3-5x faster JS/TS execution.
 
 Authenticated CLIs work through credential passthrough — `gh`, `aws`, `gcloud`, `kubectl`, `docker` inherit environment variables and config paths without exposing them to the conversation.
 

package/build/adapters/claude-code/hooks.d.ts

@@ -25,22 +25,21 @@ export declare const HOOK_TYPES: {
 };
 export type HookType = (typeof HOOK_TYPES)[keyof typeof HOOK_TYPES];
 /**
- * Negative-lookahead matcher for external MCP tool namespaces (#529).
+ * External MCP catch-all matcher for Claude Code (#529, #547 hotfix).
  *
- * Claude Code's hook matcher engine evaluates each entry as a regex against
- * the tool name. This pattern fires on any `mcp__<server>__<tool>` whose
- * server segment is NOT context-mode's own (`plugin_context-mode_...`).
- * Without it, large payloads from external MCPs (slack channel history,
- * telegram messages, gdrive content, notion pages, …) bypass PreToolUse
- * routing and flood the model's context window — PostToolUse runs too late
- * to keep the raw data out.
- *
- * The negative lookahead prevents this entry from double-firing on
- * context-mode's own ctx_* tools, which already have dedicated entries above.
+ * Claude Code's hook matcher engine treats this entry as a substring match
+ * (it also accepts regex, but `mcp__` alone is enough — every MCP tool
+ * surfaces as `mcp__<server>__<tool>`). v1.0.124 used a negative lookahead
+ * `mcp__(?!plugin_context-mode_)` to skip context-mode's own MCP tools,
+ * but this same hooks.json is bundled to Codex CLI which uses Rust's
+ * `regex` crate (no look-around support) — Codex rejected the matcher at
+ * boot, breaking every Codex user (#547). Drop the lookaround on both
+ * sides; the hook BODY (`isExternalMcpTool()` in hooks/core/routing.mjs)
+ * already filters context-mode's own tools, so semantics are preserved.
  */
-export declare const EXTERNAL_MCP_MATCHER_PATTERN = "mcp__(?!plugin_context-mode_)";
+export declare const EXTERNAL_MCP_MATCHER_PATTERN = "mcp__";
 /** Tools that context-mode's PreToolUse hook intercepts. */
-export declare const PRE_TOOL_USE_MATCHERS: readonly ["Bash", "WebFetch", "Read", "Grep", "Agent", "mcp__plugin_context-mode_context-mode__ctx_execute", "mcp__plugin_context-mode_context-mode__ctx_execute_file", "mcp__plugin_context-mode_context-mode__ctx_batch_execute", "mcp__(?!plugin_context-mode_)"];
+export declare const PRE_TOOL_USE_MATCHERS: readonly ["Bash", "WebFetch", "Read", "Grep", "Agent", "mcp__plugin_context-mode_context-mode__ctx_execute", "mcp__plugin_context-mode_context-mode__ctx_execute_file", "mcp__plugin_context-mode_context-mode__ctx_batch_execute", "mcp__"];
 /**
  * Combined matcher pattern for settings.json (pipe-separated).
  * Used by the upgrade command when writing a single consolidated entry.

package/build/adapters/claude-code/hooks.js

@@ -31,20 +31,19 @@ export const HOOK_TYPES = {
 // PreToolUse matchers
 // ─────────────────────────────────────────────────────────
 /**
- * Negative-lookahead matcher for external MCP tool namespaces (#529).
+ * External MCP catch-all matcher for Claude Code (#529, #547 hotfix).
  *
- * Claude Code's hook matcher engine evaluates each entry as a regex against
- * the tool name. This pattern fires on any `mcp__<server>__<tool>` whose
- * server segment is NOT context-mode's own (`plugin_context-mode_...`).
- * Without it, large payloads from external MCPs (slack channel history,
- * telegram messages, gdrive content, notion pages, …) bypass PreToolUse
- * routing and flood the model's context window — PostToolUse runs too late
- * to keep the raw data out.
- *
- * The negative lookahead prevents this entry from double-firing on
- * context-mode's own ctx_* tools, which already have dedicated entries above.
+ * Claude Code's hook matcher engine treats this entry as a substring match
+ * (it also accepts regex, but `mcp__` alone is enough — every MCP tool
+ * surfaces as `mcp__<server>__<tool>`). v1.0.124 used a negative lookahead
+ * `mcp__(?!plugin_context-mode_)` to skip context-mode's own MCP tools,
+ * but this same hooks.json is bundled to Codex CLI which uses Rust's
+ * `regex` crate (no look-around support) — Codex rejected the matcher at
+ * boot, breaking every Codex user (#547). Drop the lookaround on both
+ * sides; the hook BODY (`isExternalMcpTool()` in hooks/core/routing.mjs)
+ * already filters context-mode's own tools, so semantics are preserved.
  */
-export const EXTERNAL_MCP_MATCHER_PATTERN = "mcp__(?!plugin_context-mode_)";
+export const EXTERNAL_MCP_MATCHER_PATTERN = "mcp__";
 /** Tools that context-mode's PreToolUse hook intercepts. */
 export const PRE_TOOL_USE_MATCHERS = [
     "Bash",

package/build/adapters/claude-code/index.js

@@ -67,7 +67,13 @@ export class ClaudeCodeAdapter extends ClaudeCodeBaseAdapter {
         return join(this.getConfigDir(), "settings.json");
     }
     generateHookConfig(pluginRoot) {
-        const preToolUseCommand = `node ${pluginRoot}/hooks/pretooluse.mjs`;
+        // Paths must be double-quoted so that hosts (or our own diagnostic
+        // regex) parse them correctly when pluginRoot contains spaces — common
+        // on Windows where the user folder is e.g. "C:\Users\First Last\...".
+        // Without quotes, extractHookScriptPath's `\S+\.mjs` fallback grabs
+        // only the tail after the last space, producing a doubled-path FAIL
+        // in `ctx doctor`. Matches the quoting style used in hooks/hooks.json.
+        const preToolUseCommand = `node "${pluginRoot}/hooks/pretooluse.mjs"`;
         const preToolUseMatchers = [...PRE_TOOL_USE_MATCHERS];
         return {
             PreToolUse: preToolUseMatchers.map((matcher) => ({
@@ -80,7 +86,7 @@ export class ClaudeCodeAdapter extends ClaudeCodeBaseAdapter {
                     hooks: [
                         {
                             type: "command",
-                            command: `node ${pluginRoot}/hooks/posttooluse.mjs`,
+                            command: `node "${pluginRoot}/hooks/posttooluse.mjs"`,
                         },
                     ],
                 },
@@ -91,7 +97,7 @@ export class ClaudeCodeAdapter extends ClaudeCodeBaseAdapter {
                     hooks: [
                         {
                             type: "command",
-                            command: `node ${pluginRoot}/hooks/precompact.mjs`,
+                            command: `node "${pluginRoot}/hooks/precompact.mjs"`,
                         },
                     ],
                 },
@@ -102,7 +108,7 @@ export class ClaudeCodeAdapter extends ClaudeCodeBaseAdapter {
                     hooks: [
                         {
                             type: "command",
-                            command: `node ${pluginRoot}/hooks/userpromptsubmit.mjs`,
+                            command: `node "${pluginRoot}/hooks/userpromptsubmit.mjs"`,
                         },
                     ],
                 },
@@ -113,7 +119,7 @@ export class ClaudeCodeAdapter extends ClaudeCodeBaseAdapter {
                     hooks: [
                         {
                             type: "command",
-                            command: `node ${pluginRoot}/hooks/sessionstart.mjs`,
+                            command: `node "${pluginRoot}/hooks/sessionstart.mjs"`,
                         },
                     ],
                 },

package/build/adapters/codex/hooks.d.ts

@@ -27,24 +27,23 @@ export declare const HOOK_TYPES: {
     readonly STOP: "Stop";
 };
 /**
- * Negative-lookahead matcher for external MCP tool namespaces on Codex CLI (#529).
+ * External MCP catch-all matcher for Codex CLI (#529, #547 hotfix).
  *
  * Codex CLI's hook `tool_name` payload uses `mcp__<server>__<tool>` for any
- * MCP-namespaced tool — verified by configs/codex/hooks.json which already
- * matches `mcp__.*__ctx_execute` style for context-mode's OWN MCP tools. This
- * pattern fires PreToolUse for any external `mcp__<server>__<tool>` whose
- * server segment does NOT contain `context-mode`. Without it, large payloads
- * from slack / telegram / gdrive / notion-style MCPs bypass the routing nudge
- * and flood the model's context — PostToolUse runs too late to keep raw data
- * out.
+ * MCP-namespaced tool. Originally this constant used a negative lookahead
+ * `mcp__(?!.*context-mode)` to exclude context-mode's own MCP tools at the
+ * matcher layer. v1.0.124 shipped that pattern and Codex (Rust `regex` crate)
+ * rejected the matcher at boot with "look-around not supported", breaking
+ * every Codex user (#547).
  *
- * The negative lookahead `(?!.*context-mode)` covers both naming variants
- * Codex sees in practice: the canonical `mcp__context-mode__ctx_*` AND the
- * Claude Code plugin shim `mcp__plugin_context-mode_context-mode__ctx_*`.
- * Codex own bare names (ctx_execute, local_shell, …) are not `mcp__`-prefixed
- * and are unaffected.
+ * Fix: drop the lookaround. The matcher is now a charset-clean literal
+ * (`[A-Za-z0-9_|]` only), satisfying Codex's `is_exact_matcher`
+ * (refs/platforms/codex/codex-rs/hooks/src/events/common.rs:152) which
+ * short-circuits the regex engine entirely. context-mode's own MCP tools are
+ * already filtered in the hook BODY by `isExternalMcpTool()` in
+ * hooks/core/routing.mjs — semantics preserved.
  */
-export declare const EXTERNAL_MCP_MATCHER_PATTERN = "mcp__(?!.*context-mode)";
+export declare const EXTERNAL_MCP_MATCHER_PATTERN = "mcp__";
 /**
  * Path to the routing instructions file for Codex CLI.
  * Used as fallback routing awareness alongside hook-based enforcement.

package/build/adapters/codex/hooks.js

@@ -33,24 +33,23 @@ export const HOOK_TYPES = {
 // External MCP routing matcher (#529)
 // ─────────────────────────────────────────────────────────
 /**
- * Negative-lookahead matcher for external MCP tool namespaces on Codex CLI (#529).
+ * External MCP catch-all matcher for Codex CLI (#529, #547 hotfix).
  *
  * Codex CLI's hook `tool_name` payload uses `mcp__<server>__<tool>` for any
- * MCP-namespaced tool — verified by configs/codex/hooks.json which already
- * matches `mcp__.*__ctx_execute` style for context-mode's OWN MCP tools. This
- * pattern fires PreToolUse for any external `mcp__<server>__<tool>` whose
- * server segment does NOT contain `context-mode`. Without it, large payloads
- * from slack / telegram / gdrive / notion-style MCPs bypass the routing nudge
- * and flood the model's context — PostToolUse runs too late to keep raw data
- * out.
+ * MCP-namespaced tool. Originally this constant used a negative lookahead
+ * `mcp__(?!.*context-mode)` to exclude context-mode's own MCP tools at the
+ * matcher layer. v1.0.124 shipped that pattern and Codex (Rust `regex` crate)
+ * rejected the matcher at boot with "look-around not supported", breaking
+ * every Codex user (#547).
  *
- * The negative lookahead `(?!.*context-mode)` covers both naming variants
- * Codex sees in practice: the canonical `mcp__context-mode__ctx_*` AND the
- * Claude Code plugin shim `mcp__plugin_context-mode_context-mode__ctx_*`.
- * Codex own bare names (ctx_execute, local_shell, …) are not `mcp__`-prefixed
- * and are unaffected.
+ * Fix: drop the lookaround. The matcher is now a charset-clean literal
+ * (`[A-Za-z0-9_|]` only), satisfying Codex's `is_exact_matcher`
+ * (refs/platforms/codex/codex-rs/hooks/src/events/common.rs:152) which
+ * short-circuits the regex engine entirely. context-mode's own MCP tools are
+ * already filtered in the hook BODY by `isExternalMcpTool()` in
+ * hooks/core/routing.mjs — semantics preserved.
  */
-export const EXTERNAL_MCP_MATCHER_PATTERN = "mcp__(?!.*context-mode)";
+export const EXTERNAL_MCP_MATCHER_PATTERN = "mcp__";
 // ─────────────────────────────────────────────────────────
 // Routing instructions
 // ─────────────────────────────────────────────────────────

package/build/adapters/codex/index.js

@@ -18,14 +18,25 @@ import { resolve, dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { BaseAdapter } from "../base.js";
 import { resolveCodexConfigDir } from "./paths.js";
-// PreToolUse matcher: canonical Codex tool names + context-mode own MCP tools
-// (both bare and `mcp__<server>__<tool>` forms) + external MCP catch-all (#529).
-// The final `mcp__(?!.*context-mode)` segment uses a negative lookahead that
-// excludes any `mcp__` tool whose server segment contains `context-mode` so
-// context-mode's own MCP tools (already wired by the explicit entries above)
-// are not double-routed. Keep this as a single string literal — `codex.test.ts`
-// drift-guard parses the source with a `"([^"]+)"` regex.
-const PRE_TOOL_USE_MATCHER_PATTERN = "local_shell|shell|shell_command|exec_command|container.exec|functions\\.exec_command|Bash|Shell|apply_patch|functions\\.apply_patch|Edit|Write|grep_files|ctx_execute|ctx_execute_file|ctx_batch_execute|ctx_fetch_and_index|ctx_search|ctx_index|mcp__.*__ctx_execute|mcp__.*__ctx_execute_file|mcp__.*__ctx_batch_execute|mcp__.*__ctx_fetch_and_index|mcp__.*__ctx_search|mcp__.*__ctx_index|mcp__(?!.*context-mode)";
+// PreToolUse matcher: canonical Codex tool names + context-mode bare MCP tool
+// names + external MCP catch-all literal (#529, #547 hotfix).
+//
+// Codex CLI's Rust `regex` crate does NOT support look-around, and
+// `is_exact_matcher` (refs/platforms/codex/codex-rs/hooks/src/events/common.rs:152)
+// short-circuits the regex engine entirely when the matcher contains only
+// [A-Za-z0-9_|]. v1.0.124 shipped a matcher with `(?!.*context-mode)` AND
+// `mcp__.*__ctx_*` regex syntax — Codex rejected the file at boot with
+// "look-around not supported" → all v1.0.124 Codex users broken (#547).
+//
+// Fix: keep only literal tool names (charset-clean). The hook BODY already
+// filters context-mode's own MCP tools via `isExternalMcpTool()` in
+// hooks/core/routing.mjs, so dropping `mcp__.*__ctx_*` and the lookaround
+// preserves end-to-end semantics. The literal `mcp__` final segment is a
+// no-op under exact-matcher mode but kept for parity with hooks/hooks.json.
+//
+// Keep this as a single string literal — `codex.test.ts` drift-guard parses
+// the source with a `"([^"]+)"` regex.
+const PRE_TOOL_USE_MATCHER_PATTERN = "local_shell|shell|shell_command|exec_command|Bash|Shell|apply_patch|Edit|Write|grep_files|ctx_execute|ctx_execute_file|ctx_batch_execute|ctx_fetch_and_index|ctx_search|ctx_index|mcp__";
 const CODEX_HOOK_COMMANDS = {
     PreToolUse: "context-mode hook codex pretooluse",
     PostToolUse: "context-mode hook codex posttooluse",

package/build/db-base.d.ts

@@ -61,11 +61,28 @@ export declare class NodeSQLiteAdapter {
  * bundled SQLite always ships with FTS5.
  */
 export declare function nodeSqliteHasFts5(DatabaseSync: any): boolean;
+/**
+ * Returns true when the current runtime ships a built-in SQLite binding:
+ * - Bun has `bun:sqlite` always
+ * - Node has `node:sqlite` since 22.5 (no flag since 22.13)
+ *
+ * Mirrors the helper in hooks/ensure-deps.mjs:61. Exported so the platform
+ * gate in loadDatabase() can be unit-tested without spawning a child
+ * process. `versionsOverride` and `bunOverride` are injection points for
+ * tests — production callers pass nothing.
+ *
+ * Widening the gate from `process.platform === "linux"` to this helper is
+ * required for Node 26 on macOS arm64 (#551): Node 26 removed
+ * `info.This()` from V8 PropertyCallbackInfo, breaking better-sqlite3
+ * 12.9.0's native compile. Using node:sqlite sidesteps the native addon
+ * entirely on every platform that has it.
+ */
+export declare function hasModernSqlite(versionsOverride?: NodeJS.ProcessVersions, bunOverride?: unknown): boolean;
 /**
  * Lazy-load the SQLite driver for the current runtime.
  * Bun → bun:sqlite via BunSQLiteAdapter (issue #45).
- * Linux Node → node:sqlite via NodeSQLiteAdapter when it ships FTS5 (#228, #461).
- * Other Node (or Linux Node without FTS5) → better-sqlite3 (native addon).
+ * Modern Node (>= 22.5) → node:sqlite via NodeSQLiteAdapter when it ships FTS5 (#228, #461, #551).
+ * Other Node (or modern Node without FTS5) → better-sqlite3 (native addon).
  */
 export declare function loadDatabase(): typeof DatabaseConstructor;
 /**

package/build/db-base.js

@@ -184,11 +184,39 @@ export function nodeSqliteHasFts5(DatabaseSync) {
         catch { /* probe never opened or already closed */ }
     }
 }
+/**
+ * Returns true when the current runtime ships a built-in SQLite binding:
+ * - Bun has `bun:sqlite` always
+ * - Node has `node:sqlite` since 22.5 (no flag since 22.13)
+ *
+ * Mirrors the helper in hooks/ensure-deps.mjs:61. Exported so the platform
+ * gate in loadDatabase() can be unit-tested without spawning a child
+ * process. `versionsOverride` and `bunOverride` are injection points for
+ * tests — production callers pass nothing.
+ *
+ * Widening the gate from `process.platform === "linux"` to this helper is
+ * required for Node 26 on macOS arm64 (#551): Node 26 removed
+ * `info.This()` from V8 PropertyCallbackInfo, breaking better-sqlite3
+ * 12.9.0's native compile. Using node:sqlite sidesteps the native addon
+ * entirely on every platform that has it.
+ */
+export function hasModernSqlite(versionsOverride, bunOverride) {
+    const bun = bunOverride !== undefined ? bunOverride : globalThis.Bun;
+    if (typeof bun !== "undefined" && bun !== null)
+        return true;
+    const versions = versionsOverride ?? process.versions;
+    const [majorStr, minorStr] = (versions.node ?? "0.0.0").split(".");
+    const major = Number(majorStr);
+    const minor = Number(minorStr);
+    if (!Number.isFinite(major) || !Number.isFinite(minor))
+        return false;
+    return major > 22 || (major === 22 && minor >= 5);
+}
 /**
  * Lazy-load the SQLite driver for the current runtime.
  * Bun → bun:sqlite via BunSQLiteAdapter (issue #45).
- * Linux Node → node:sqlite via NodeSQLiteAdapter when it ships FTS5 (#228, #461).
- * Other Node (or Linux Node without FTS5) → better-sqlite3 (native addon).
+ * Modern Node (>= 22.5) → node:sqlite via NodeSQLiteAdapter when it ships FTS5 (#228, #461, #551).
+ * Other Node (or modern Node without FTS5) → better-sqlite3 (native addon).
  */
 export function loadDatabase() {
     if (!_Database) {
@@ -211,13 +239,19 @@ export function loadDatabase() {
                 return adapter;
             };
         }
-        else if (process.platform === "linux") {
-            // Linux — try node:sqlite to avoid native addon SIGSEGV (nodejs/node#62515).
-            // node:sqlite is built into Node >= 22.5, no flag needed since 22.13.
-            // Probe FTS5 support before committing — some Linux Node builds ship
-            // node:sqlite without FTS5, which would silently break ctx_search (#461).
-            // The probe runs at most once per process (cached via _Database below),
-            // so the cost of opening an in-memory DatabaseSync is negligible.
+        else if (hasModernSqlite()) {
+            // Any Node >= 22.5 — try node:sqlite to avoid the native addon path
+            // entirely. Historically this was Linux-only (avoiding the Linux
+            // SIGSEGV per nodejs/node#62515, #228), but Node 26 also broke
+            // better-sqlite3's native compile on macOS arm64 by removing
+            // V8 `info.This()` (#551). The built-in `node:sqlite` ships its
+            // own SQLite, so it sidesteps both issues at once.
+            //
+            // Probe FTS5 support before committing — some Node builds ship
+            // node:sqlite without FTS5, which would silently break ctx_search
+            // (#461). The probe runs at most once per process (cached via
+            // _Database below), so the cost of an in-memory DatabaseSync is
+            // negligible.
             let DatabaseSync = null;
             try {
                 // Array.join() prevents esbuild from resolving the specifier at bundle time
@@ -236,16 +270,16 @@ export function loadDatabase() {
                 };
             }
             else {
-                // node:sqlite missing or built without FTS5 — fall through to better-sqlite3.
-                // Trade-off: this reintroduces the native-addon path that #228 routed
-                // around (Linux SIGSEGV per nodejs/node#62515). Deliberate — a visible
-                // crash on the rare unstable build is preferable to a silent
-                // "no such module: fts5" on every ctx_search call.
+                // node:sqlite missing or built without FTS5 — fall through to
+                // better-sqlite3. Trade-off: on Node 26 + macOS this may now hit
+                // the V8 ABI break (#551). A visible crash on the rare
+                // unstable build is preferable to silent "no such module: fts5"
+                // on every ctx_search call.
                 _Database = require("better-sqlite3");
             }
         }
         else {
-            // Non-Linux Node.js — use better-sqlite3.
+            // Old Node (< 22.5) without bun:sqlite — fall back to better-sqlite3.
             _Database = require("better-sqlite3");
         }
     }

package/build/executor.js

@@ -23,6 +23,7 @@ const SCRIPT_EXT = {
     perl: "pl",
     r: "R",
     elixir: "exs",
+    csharp: "csx",
 };
 /** Pure helper — exported for unit testing. Returns "script" or "script.<ext>". */
 export function buildScriptFilename(language, platform, shellPath) {
@@ -223,7 +224,7 @@ export class PolyglotExecutor {
             // .exe paths now (#506), but if it falls back to the bare "bun" string
             // on Windows that resolution typically goes through a `bun.cmd` shim
             // (npm i -g bun) which CreateProcess can't execute without cmd.exe.
-            const needsShell = isWin && ["tsx", "ts-node", "elixir", "bun"].includes(cmd[0]);
+            const needsShell = isWin && ["tsx", "ts-node", "elixir", "bun", "dotnet-script"].includes(cmd[0]);
             // On Windows with Git Bash, pass the script as `bash -c "source /posix/path"`
             // rather than `bash /path/to/script.sh`. This avoids MSYS2 path mangling
             // while still allowing MSYS_NO_PATHCONV to protect non-ASCII paths in commands.
@@ -412,6 +413,30 @@ export class PolyglotExecutor {
             "R_PROFILE", // site-wide R profile
             "R_PROFILE_USER", // user R profile
             "R_HOME", // R installation override
+            // .NET / C# — runtime/startup hooks, additional deps
+            "DOTNET_STARTUP_HOOKS", // injects managed assemblies on startup
+            "DOTNET_ADDITIONAL_DEPS", // additional .deps.json injection
+            "DOTNET_SHARED_STORE", // shared assembly probe path injection
+            "DOTNET_ROOT", // arbitrary .NET runtime override
+            "DOTNET_ROOT(x86)", // 32-bit override
+            "DOTNET_HOST_PATH", // host binary substitution
+            // .NET / C# — profiler attach (loads arbitrary DLL into dotnet host)
+            // and IPC-based debugger/IL injection. PR #546 follow-up.
+            // learn.microsoft.com/en-us/dotnet/core/runtime-config/debugging-profiling
+            "CORECLR_PROFILER", // CLSID of profiler to attach
+            "CORECLR_PROFILER_PATH", // path to profiler DLL
+            "CORECLR_PROFILER_PATH_32", // 32-bit specific profiler DLL
+            "CORECLR_PROFILER_PATH_64", // 64-bit specific profiler DLL
+            "CORECLR_PROFILER_PATH_ARM32", // ARM32 specific profiler DLL
+            "CORECLR_PROFILER_PATH_ARM64", // ARM64 specific profiler DLL
+            "CORECLR_ENABLE_PROFILING", // gates profiler load
+            "DOTNET_PROFILER_PATH", // cross-platform alias
+            "DOTNET_PROFILER_PATH_32",
+            "DOTNET_PROFILER_PATH_64",
+            "DOTNET_PROFILER_PATH_ARM32",
+            "DOTNET_PROFILER_PATH_ARM64",
+            "DOTNET_DiagnosticPorts", // peer attach via diagnostic IPC
+            "DOTNET_BUNDLE_EXTRACT_BASE_DIR", // single-file extraction hijack
             // Dynamic linker — shared library injection
             "LD_PRELOAD", // loads .so before all others (Linux)
             "DYLD_INSERT_LIBRARIES", // macOS equivalent of LD_PRELOAD
@@ -431,10 +456,17 @@ export class PolyglotExecutor {
             "GIT_SSH_COMMAND", // arbitrary ssh command
             "GIT_ASKPASS", // arbitrary credential command
         ]);
-        // Start with parent env, then strip dangerous vars and apply overrides
+        // Start with parent env, then strip dangerous vars and apply overrides.
+        // The `COMPlus_` prefix sweep covers every COMPlus_* synonym of the
+        // DOTNET_* runtime knobs (.NET back-compat alias — case-insensitive).
+        // PR #546 follow-up: closes the alias bypass for the explicit denylist
+        // entries above.
         const env = {};
         for (const [key, val] of Object.entries(process.env)) {
-            if (val !== undefined && !DENIED.has(key) && !key.startsWith("BASH_FUNC_")) {
+            if (val !== undefined &&
+                !DENIED.has(key) &&
+                !key.startsWith("BASH_FUNC_") &&
+                !/^COMPlus_/i.test(key)) {
                 env[key] = val;
             }
         }
@@ -508,6 +540,11 @@ export class PolyglotExecutor {
                 return `FILE_CONTENT_PATH <- ${escaped}\nfile_path <- FILE_CONTENT_PATH\nFILE_CONTENT <- readLines(FILE_CONTENT_PATH, warn=FALSE, encoding="UTF-8")\nFILE_CONTENT <- paste(FILE_CONTENT, collapse="\\n")\n${code}`;
             case "elixir":
                 return `file_content_path = ${escaped}\nfile_path = file_content_path\nfile_content = File.read!(file_content_path)\n${code}`;
+            case "csharp":
+                // .csx forbids `using` directives after any other top-level statement
+                // (CS1529). User code inside executeFile must use fully-qualified type
+                // names (e.g. `System.Text.Json.JsonDocument`) instead of `using`.
+                return `var FILE_CONTENT_PATH = ${escaped};\nvar file_path = FILE_CONTENT_PATH;\nvar FILE_CONTENT = System.IO.File.ReadAllText(FILE_CONTENT_PATH);\n${code}`;
         }
     }
 }

package/build/runtime.d.ts

@@ -1,5 +1,5 @@
 export declare function isAllowlistedShell(shellPath: string): boolean;
-export type Language = "javascript" | "typescript" | "python" | "shell" | "ruby" | "go" | "rust" | "php" | "perl" | "r" | "elixir";
+export type Language = "javascript" | "typescript" | "python" | "shell" | "ruby" | "go" | "rust" | "php" | "perl" | "r" | "elixir" | "csharp";
 export interface RuntimeInfo {
     command: string;
     available: boolean;
@@ -18,6 +18,7 @@ export interface RuntimeMap {
     perl: string | null;
     r: string | null;
     elixir: string | null;
+    csharp: string | null;
 }
 export declare function detectRuntimes(): RuntimeMap;
 export declare function hasBunRuntime(): boolean;

package/build/runtime.js

@@ -232,6 +232,7 @@ export function detectRuntimes() {
                 ? "r"
                 : null,
         elixir: commandExists("elixir") ? "elixir" : null,
+        csharp: commandExists("dotnet-script") ? "dotnet-script" : null,
     };
 }
 export function hasBunRuntime() {
@@ -269,6 +270,8 @@ export function getRuntimeSummary(runtimes) {
         lines.push(`  R:          ${runtimes.r} (${getVersion(runtimes.r)})`);
     if (runtimes.elixir)
         lines.push(`  Elixir:     ${runtimes.elixir} (${getVersion(runtimes.elixir)})`);
+    if (runtimes.csharp)
+        lines.push(`  C#:         ${runtimes.csharp} (${getVersion(runtimes.csharp)})`);
     if (!bunPreferred) {
         lines.push("");
         lines.push("  Tip: Install Bun for 3-5x faster JS/TS execution → https://bun.sh");
@@ -295,6 +298,8 @@ export function getAvailableLanguages(runtimes) {
         langs.push("r");
     if (runtimes.elixir)
         langs.push("elixir");
+    if (runtimes.csharp)
+        langs.push("csharp");
     return langs;
 }
 export function buildCommand(runtimes, language, filePath) {
@@ -376,5 +381,10 @@ export function buildCommand(runtimes, language, filePath) {
                 throw new Error("Elixir not available. Install elixir.");
             }
             return ["elixir", filePath];
+        case "csharp":
+            if (!runtimes.csharp) {
+                throw new Error("C# not available. Install dotnet-script via `dotnet tool install -g dotnet-script`.");
+            }
+            return [runtimes.csharp, filePath];
     }
 }

package/build/server.js

@@ -929,11 +929,12 @@ server.registerTool("ctx_execute", {
             "perl",
             "r",
             "elixir",
+            "csharp",
         ])
             .describe("Runtime language"),
         code: z
             .string()
-            .describe("Source code to execute. Use console.log (JS/TS), print (Python/Ruby/Perl/R), echo (Shell), echo (PHP), fmt.Println (Go), or IO.puts (Elixir) to output a summary to context."),
+            .describe("Source code to execute. Use console.log (JS/TS), print (Python/Ruby/Perl/R), echo (Shell), echo (PHP), fmt.Println (Go), IO.puts (Elixir), or Console.WriteLine (C#) to output a summary to context."),
         timeout: z
             .coerce.number()
             .optional()
@@ -1224,11 +1225,12 @@ server.registerTool("ctx_execute_file", {
             "perl",
             "r",
             "elixir",
+            "csharp",
         ])
             .describe("Runtime language"),
         code: z
             .string()
-            .describe("Code to process FILE_CONTENT (file_content in Elixir). Print summary via console.log/print/echo/IO.puts."),
+            .describe("Code to process FILE_CONTENT (file_content in Elixir). Print summary via console.log/print/echo/IO.puts/Console.WriteLine."),
         timeout: z
             .coerce.number()
             .optional()