context-mode 1.0.128 → 1.0.130

package/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Claude Code plugins by Mert Koseoğlu",
-    "version": "1.0.128"
+    "version": "1.0.130"
   },
   "plugins": [
     {
       "name": "context-mode",
       "source": "./",
       "description": "Claude Code MCP plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
-      "version": "1.0.128",
+      "version": "1.0.130",
       "author": {
         "name": "Mert Koseoğlu"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "context-mode",
-  "version": "1.0.128",
+  "version": "1.0.130",
   "description": "MCP server that saves 98% of your context window with session continuity. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and automatic state restore across compactions.",
   "author": {
     "name": "Mert Koseoğlu",

package/.openclaw-plugin/openclaw.plugin.json

@@ -3,7 +3,7 @@
   "name": "Context Mode",
   "kind": "tool",
   "description": "OpenClaw plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
-  "version": "1.0.128",
+  "version": "1.0.130",
   "sandbox": {
     "mode": "permissive",
     "filesystem_access": "full",

package/.openclaw-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "context-mode",
-  "version": "1.0.128",
+  "version": "1.0.130",
   "description": "OpenClaw plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
   "author": {
     "name": "Mert Koseoğlu",

package/build/adapters/detect.d.ts

@@ -34,12 +34,20 @@ export declare function __seedClaudeCodePluginCacheMissForTests(): void;
  *     `resolveProjectDir({ strictPlatform })` to form the candidate list,
  *     and by Pi's bridge to scrub foreign workspace vars on child spawn.
  *   - `identification`: env var only signals which host is running; carries
- *     no project path. NEVER scrubbed (some are load-bearing, e.g.
- *     CLAUDE_PLUGIN_ROOT for hook integrations).
+ *     no project path. PRESERVED in normal operation (some are load-bearing
+ *     for hook integrations on the host that owns them, e.g. CLAUDE_PLUGIN_ROOT
+ *     for Claude Code's hook context).
  *
  * Issue #545 — algorithmic env-leak fix. The split allows resolveProjectDir
  * to derive ALLOW (own workspace vars) and BAN (other platforms' workspace
  * vars) sets from a single registry, satisfying MUST-3 (15 adapters equal).
+ *
+ * Issue #561 — FOREIGN identification vars MUST be scrubbed when spawning a
+ * child under a different host (e.g. Pi spawning context-mode child must
+ * scrub Claude Code identification vars CLAUDE_CODE_ENTRYPOINT /
+ * CLAUDE_PLUGIN_ROOT to prevent detectPlatform() in the child from
+ * misidentifying the host as claude-code and writing Pi's data into
+ * ~/.claude/context-mode/). See `foreignIdentificationEnv()` below.
  */
 export type EnvVarRole = "workspace" | "identification";
 export interface PlatformEnvEntry {
@@ -78,6 +86,26 @@ export declare function workspaceEnvVarsFor(platform: PlatformId): string[];
  * workspace vars from spawned MCP child) and by the matrix regression test.
  */
 export declare function foreignWorkspaceEnv(platform: PlatformId): Set<string>;
+/**
+ * Issue #561 — return the union of identification env vars from ALL
+ * platforms EXCEPT the given one. Sibling of `foreignWorkspaceEnv`,
+ * filtered on `role === "identification"` instead of "workspace".
+ *
+ * Consumed by Pi's bridge env scrub: when Pi spawns the context-mode
+ * MCP child, the child inherits the host shell env including any
+ * identification vars set by a co-resident Claude Code session
+ * (CLAUDE_CODE_ENTRYPOINT / CLAUDE_PLUGIN_ROOT). Without scrubbing,
+ * `detectPlatform()` in the child falls through env priority order and
+ * resolves to claude-code first — Pi's session data then writes into
+ * `~/.claude/context-mode/` instead of Pi's own dir. Scrubbing FOREIGN
+ * identification vars (everyone else's) preserves Pi's OWN identification
+ * vars (PI_CONFIG_DIR / PI_SESSION_FILE / PI_COMPILED) so the child still
+ * detects pi correctly.
+ *
+ * Algorithmic, registry-driven — adding adapter #16 grows the scrub
+ * automatically (no edit to mcp-bridge.ts).
+ */
+export declare function foreignIdentificationEnv(platform: PlatformId): Set<string>;
 /**
  * Sync map from platform identifier → home-relative path segments where that
  * platform stores its config. Mirrors the `super([...])` argument passed by

package/build/adapters/detect.js

@@ -222,6 +222,37 @@ export function foreignWorkspaceEnv(platform) {
     }
     return ban;
 }
+/**
+ * Issue #561 — return the union of identification env vars from ALL
+ * platforms EXCEPT the given one. Sibling of `foreignWorkspaceEnv`,
+ * filtered on `role === "identification"` instead of "workspace".
+ *
+ * Consumed by Pi's bridge env scrub: when Pi spawns the context-mode
+ * MCP child, the child inherits the host shell env including any
+ * identification vars set by a co-resident Claude Code session
+ * (CLAUDE_CODE_ENTRYPOINT / CLAUDE_PLUGIN_ROOT). Without scrubbing,
+ * `detectPlatform()` in the child falls through env priority order and
+ * resolves to claude-code first — Pi's session data then writes into
+ * `~/.claude/context-mode/` instead of Pi's own dir. Scrubbing FOREIGN
+ * identification vars (everyone else's) preserves Pi's OWN identification
+ * vars (PI_CONFIG_DIR / PI_SESSION_FILE / PI_COMPILED) so the child still
+ * detects pi correctly.
+ *
+ * Algorithmic, registry-driven — adding adapter #16 grows the scrub
+ * automatically (no edit to mcp-bridge.ts).
+ */
+export function foreignIdentificationEnv(platform) {
+    const ban = new Set();
+    for (const [p, vars] of PLATFORM_ENV_VARS) {
+        if (p === platform)
+            continue;
+        for (const v of vars) {
+            if (v.role === "identification")
+                ban.add(v.name);
+        }
+    }
+    return ban;
+}
 /**
  * Sync map from platform identifier → home-relative path segments where that
  * platform stores its config. Mirrors the `super([...])` argument passed by

package/build/adapters/pi/mcp-bridge.js

@@ -22,7 +22,7 @@
  */
 import { spawn, execSync } from "node:child_process";
 import { detectRuntimes } from "../../runtime.js";
-import { foreignWorkspaceEnv } from "../detect.js";
+import { foreignWorkspaceEnv, foreignIdentificationEnv } from "../detect.js";
 // ── Fork-bomb prevention (#516) ──────────────────────────────────────
 //
 // Original bug: `spawn(process.execPath, [serverScript])` recursively
@@ -154,12 +154,27 @@ export class MCPStdioClient {
         // and Pi's sessions write into the wrong project. The ban list is
         // derived ALGORITHMICALLY from PLATFORM_ENV_VARS (every other adapter's
         // workspace-role vars), so adding adapter #16 grows the scrub
-        // automatically — no edit to this file. Identification vars
-        // (CLAUDE_PLUGIN_ROOT etc.) and the universal escape hatch
-        // (CONTEXT_MODE_PROJECT_DIR) are NEVER scrubbed.
+        // automatically — no edit to this file. Pi's own workspace vars and
+        // the universal escape hatch (CONTEXT_MODE_PROJECT_DIR) are NEVER
+        // scrubbed.
         for (const banned of foreignWorkspaceEnv("pi")) {
             delete childEnv[banned];
         }
+        // Issue #561 — scrub foreign IDENTIFICATION env vars before spawn.
+        //
+        // Foreign identification vars hijack detectPlatform() — must scrub
+        // when spawning child under a different host (#561). When Pi runs
+        // co-resident with Claude Code, the inherited shell env carries
+        // CLAUDE_CODE_ENTRYPOINT and CLAUDE_PLUGIN_ROOT; the spawned MCP
+        // child's detectPlatform() then walks PLATFORM_ENV_VARS in priority
+        // order (claude-code first), returns claude-code, and Pi's session
+        // data lands in ~/.claude/context-mode/ instead of Pi's own dir.
+        // Pi's OWN identification vars (PI_CONFIG_DIR / PI_SESSION_FILE /
+        // PI_COMPILED) are excluded from the ban set so the child still
+        // detects pi correctly.
+        for (const banned of foreignIdentificationEnv("pi")) {
+            delete childEnv[banned];
+        }
         this._spawnEnv = childEnv;
         this.child = spawn(runtime, [this.serverScript], {
             // Pipe stderr (#472 round-3): swallowing it via "ignore" hides

package/build/db-base.d.ts

@@ -139,6 +139,26 @@ export declare function isSQLiteCorruptionError(msg: string): boolean;
 export declare function renameCorruptDB(dbPath: string): void;
 export declare abstract class SQLiteBase {
     #private;
+    /**
+     * Open (or create) a SQLite DB at `dbPath`.
+     *
+     * v1.0.130 — multi-writer is the contract. ALL SQLiteBase consumers
+     * (SessionDB, ContentStore) may open the same on-disk dbPath from
+     * multiple processes simultaneously — that is the legitimate multi-
+     * window UX shape and the WAL handles it natively. SQLITE_BUSY on
+     * write contention is absorbed by `withRetry()` below (busy_timeout
+     * = 30000ms inside `new Database(...)`).
+     *
+     * v1.0.128 introduced a single-writer guard here as a defense against
+     * #560. That defense was an over-correction — the actual root causes
+     * of #560 were #559 (zombie MCP child accumulation) and #561 (Pi
+     * misdetection writing to the wrong DB path), both fixed in v1.0.128
+     * + v1.0.129. The single-writer guard broke legitimate multi-window
+     * users; v1.0.130 rolls it out. See
+     * docs/adr/0001-sessiondb-multi-writer.md and the v1.0.130 INVARIANT
+     * block in tests/util/db-base-platform-gate.test.ts for the
+     * regression-proof anchor (source-pin + behavioural).
+     */
     constructor(dbPath: string);
     /** Called once after WAL pragmas are applied. Subclasses run CREATE TABLE/VIRTUAL TABLE here. */
     protected abstract initSchema(): void;

package/build/db-base.js

@@ -9,12 +9,6 @@ import { createRequire } from "node:module";
 import { existsSync, unlinkSync, renameSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-// v1.0.128 — Issue #560 single-writer enforcement.
-// Lockfile is the PRIMARY defense (clean UX with conflicting PID),
-// `locking_mode = EXCLUSIVE` (applied in applyWALPragmas below) is the
-// SECONDARY defense for the narrow race window between lockfile claim
-// and the actual `new Database(...)` open. Both skip-gate on tmpdir paths.
-import { acquireDbLock, releaseDbLock } from "./util/db-lock.js";
 // ─────────────────────────────────────────────────────────
 // bun:sqlite adapter (#45)
 // ─────────────────────────────────────────────────────────
@@ -316,18 +310,13 @@ export function applyWALPragmas(db) {
         db.pragma("mmap_size = 268435456");
     }
     catch { /* unsupported runtime */ }
-    // v1.0.128 — Issue #560 SECONDARY defense for single-writer enforcement.
-    // The .lock file (acquireDbLock in SQLiteBase ctor) is PRIMARY — it
-    // surfaces the conflicting PID with a clear UX message. EXCLUSIVE locking
-    // closes the narrow race window between lockfile claim + the actual
-    // `new Database(...)` open: a parallel process passing the lockfile
-    // check would still get SQLITE_BUSY from this pragma. Wrapped in
-    // try/catch identical to mmap_size — backends that don't expose
-    // locking_mode (or pragma at all) still get the lockfile floor.
-    try {
-        db.pragma("locking_mode = EXCLUSIVE");
-    }
-    catch { /* unsupported runtime */ }
+    // NOTE: `locking_mode = EXCLUSIVE` is intentionally NOT applied here.
+    // ALL DBs built on this helper — ContentStore (FTS5 shared knowledge
+    // base) AND SessionDB (per-project events) — are multi-writer-safe by
+    // contract. WAL + busy_timeout + the withRetry() wrapper below handle
+    // SQLITE_BUSY natively. EXCLUSIVE locking is opt-out, never opt-in
+    // from a base class shared by multi-writer consumers.
+    // See docs/adr/0001-sessiondb-multi-writer.md for the v1.0.130 ADR.
 }
 // ─────────────────────────────────────────────────────────
 // DB file helpers
@@ -468,26 +457,19 @@ export function renameCorruptDB(dbPath) {
  * re-imports within the same fork process (ESM isolate mode clears
  * module-level state but globalThis persists).
  */
-// v1.0.128 — symbol name versioned because the value type changed from
-// Set<DatabaseInstance> to Map<DatabaseInstance, string> (issue #560).
-// A persistent global slot from a pre-v128 module would deserialize as
-// the wrong shape and crash the exit hook iteration.
-const _kLiveDBs = Symbol.for("__context_mode_live_dbs_v2__");
-// v1.0.128 — issue #560: pair each DatabaseInstance with the dbPath that
-// owns its lockfile. The exit hook needs both — closeDB(db) handles the
-// WAL checkpoint, releaseDbLock(dbPath) drops the .lock file. We use a
-// Map keyed by DatabaseInstance to keep API call sites unchanged.
+// v1.0.130 — symbol name bumped because the value type reverted from
+// Map<DatabaseInstance, string> (v1.0.128 lockfile pairing) back to
+// Set<DatabaseInstance>. A persistent global slot from a v1.0.128 or
+// v1.0.129 module would deserialize as the wrong shape and crash the
+// exit hook iteration.
+const _kLiveDBs = Symbol.for("__context_mode_live_dbs_v3__");
 const _liveDBs = (() => {
     const g = globalThis;
     if (!g[_kLiveDBs]) {
-        g[_kLiveDBs] = new Map();
+        g[_kLiveDBs] = new Set();
         process.on("exit", () => {
-            for (const [db, dbPath] of g[_kLiveDBs]) {
+            for (const db of g[_kLiveDBs]) {
                 closeDB(db);
-                // Release lock AFTER close so the WAL checkpoint inside closeDB
-                // runs while we still own the writer slot (no second-opener can
-                // race in mid-checkpoint).
-                releaseDbLock({ dbPath });
             }
             g[_kLiveDBs].clear();
         });
@@ -497,16 +479,29 @@ const _liveDBs = (() => {
 export class SQLiteBase {
     #dbPath;
     #db;
+    /**
+     * Open (or create) a SQLite DB at `dbPath`.
+     *
+     * v1.0.130 — multi-writer is the contract. ALL SQLiteBase consumers
+     * (SessionDB, ContentStore) may open the same on-disk dbPath from
+     * multiple processes simultaneously — that is the legitimate multi-
+     * window UX shape and the WAL handles it natively. SQLITE_BUSY on
+     * write contention is absorbed by `withRetry()` below (busy_timeout
+     * = 30000ms inside `new Database(...)`).
+     *
+     * v1.0.128 introduced a single-writer guard here as a defense against
+     * #560. That defense was an over-correction — the actual root causes
+     * of #560 were #559 (zombie MCP child accumulation) and #561 (Pi
+     * misdetection writing to the wrong DB path), both fixed in v1.0.128
+     * + v1.0.129. The single-writer guard broke legitimate multi-window
+     * users; v1.0.130 rolls it out. See
+     * docs/adr/0001-sessiondb-multi-writer.md and the v1.0.130 INVARIANT
+     * block in tests/util/db-base-platform-gate.test.ts for the
+     * regression-proof anchor (source-pin + behavioural).
+     */
     constructor(dbPath) {
         const Database = loadDatabase();
         this.#dbPath = dbPath;
-        // v1.0.128 — Issue #560 PRIMARY single-writer guard. Must claim
-        // BEFORE `new Database(...)` so a contending opener gets the clean
-        // DatabaseLockedError UX (PID + verbatim message) instead of the
-        // SQLITE_BUSY surfaced by EXCLUSIVE locking. Skip-gate via
-        // tmpdir-prefix check inside the helper — defaultDBPath() output
-        // (per-process tmp DBs) does not contend, so it never claims a lock.
-        acquireDbLock({ dbPath });
         cleanOrphanedWALFiles(dbPath);
         let db;
         try {
@@ -523,19 +518,15 @@ export class SQLiteBase {
                     applyWALPragmas(db);
                 }
                 catch (retryErr) {
-                    // Free the lock before bubbling — caller can never reach
-                    // close()/cleanup() if the ctor throws.
-                    releaseDbLock({ dbPath });
                     throw new Error(`Failed to create fresh DB after renaming corrupt file: ${retryErr instanceof Error ? retryErr.message : String(retryErr)}`);
                 }
             }
             else {
-                releaseDbLock({ dbPath });
                 throw err;
             }
         }
         this.#db = db;
-        _liveDBs.set(this.#db, dbPath);
+        _liveDBs.add(this.#db);
         this.initSchema();
         this.prepareStatements();
     }
@@ -551,10 +542,6 @@ export class SQLiteBase {
     close() {
         _liveDBs.delete(this.#db);
         closeDB(this.#db);
-        // v1.0.128 — Issue #560: drop the .lock file AFTER closeDB so the
-        // WAL checkpoint inside closeDB completes while we still own the
-        // writer slot. releaseDbLock is no-op for tmpdir paths (skip-gate).
-        releaseDbLock({ dbPath: this.#dbPath });
     }
     withRetry(fn) {
         return withRetry(fn);
@@ -567,9 +554,5 @@ export class SQLiteBase {
         _liveDBs.delete(this.#db);
         closeDB(this.#db);
         deleteDBFiles(this.#dbPath);
-        // v1.0.128 — Issue #560: also drop the lockfile during cleanup. Per-
-        // process tmp DBs (defaultDBPath()) skip-gate inside the helper, so
-        // this is only a side-effect for shared on-disk content stores.
-        releaseDbLock({ dbPath: this.#dbPath });
     }
 }