context-mode 1.0.134 → 1.0.136

package/build/lifecycle.d.ts

@@ -23,7 +23,7 @@ export interface LifecycleGuardOptions {
     /**
      * Idle shutdown threshold in ms (#565). When the server has handled no
      * MCP activity for this long, `onShutdown` fires. `0` disables.
-     * Default: env `CONTEXT_MODE_IDLE_TIMEOUT_MS`, else 15 minutes.
+     * Default: env `CONTEXT_MODE_IDLE_TIMEOUT_MS`, else 0 (disabled).
      * Skipped on TTY stdin (interactive dev / OpenCode ts-plugin standalone).
      *
      * Pair with the returned `recordActivity()` callback — call it on every
@@ -50,20 +50,20 @@ export interface LifecycleGuardHandle {
 /**
  * Resolve the idle-shutdown threshold (#565).
  *
- * OpenCode + KiloCode open a fresh MCP client per session AND per subagent
- * task, but never tear them down for the host's lifetime. A host alive for
- * a working day accumulates one stdio child per session — observed live at
- * 26 children / 1.6 GB RSS under a single `opencode serve` parent.
+ * Idle shutdown is OFF by default (#592) because most hosts (Claude
+ * Code, Codex, editor MCP clients) keep registered tool handles after a
+ * clean MCP child exit and do NOT transparently respawn on the next call.
+ * The global 15 min default introduced in #568 solved OpenCode's child
+ * accumulation, but stranded ctx_* tools in Claude Code/Codex-style
+ * hosts once the MCP server exited cleanly while the editor stayed alive.
  *
- * None of the existing exit paths (ppid poll, grandparent reparent, stdin
- * EOF, SIGTERM) fire while the host stays alive. Idle shutdown is the
- * structural fix: a server with no work to do should release its memory.
+ * Hosts that are known to benefit from idle shutdown MUST opt in via
+ * CONTEXT_MODE_IDLE_TIMEOUT_MS in their MCP config. Today that is
+ * OpenCode/KiloCode (their configs set 900000 = 15 min). Users and test
+ * harnesses can also opt in explicitly with any positive integer.
  *
- * Default 15 min strikes a balance — long enough that a paused
- * conversation does not pay a cold-start on every resume, short enough
- * that 8 hours of unused sessions do not pin GB of RAM.
- *
- * Set env to `0` to disable entirely.
+ * Missing or malformed env = 0 (disabled, safe default). Set env to
+ * `0` to disable explicitly.
  *
  * Exported for unit-testing.
  */

package/build/lifecycle.js

@@ -17,30 +17,30 @@ import { execFileSync } from "node:child_process";
 /**
  * Resolve the idle-shutdown threshold (#565).
  *
- * OpenCode + KiloCode open a fresh MCP client per session AND per subagent
- * task, but never tear them down for the host's lifetime. A host alive for
- * a working day accumulates one stdio child per session — observed live at
- * 26 children / 1.6 GB RSS under a single `opencode serve` parent.
+ * Idle shutdown is OFF by default (#592) because most hosts (Claude
+ * Code, Codex, editor MCP clients) keep registered tool handles after a
+ * clean MCP child exit and do NOT transparently respawn on the next call.
+ * The global 15 min default introduced in #568 solved OpenCode's child
+ * accumulation, but stranded ctx_* tools in Claude Code/Codex-style
+ * hosts once the MCP server exited cleanly while the editor stayed alive.
  *
- * None of the existing exit paths (ppid poll, grandparent reparent, stdin
- * EOF, SIGTERM) fire while the host stays alive. Idle shutdown is the
- * structural fix: a server with no work to do should release its memory.
+ * Hosts that are known to benefit from idle shutdown MUST opt in via
+ * CONTEXT_MODE_IDLE_TIMEOUT_MS in their MCP config. Today that is
+ * OpenCode/KiloCode (their configs set 900000 = 15 min). Users and test
+ * harnesses can also opt in explicitly with any positive integer.
  *
- * Default 15 min strikes a balance — long enough that a paused
- * conversation does not pay a cold-start on every resume, short enough
- * that 8 hours of unused sessions do not pin GB of RAM.
- *
- * Set env to `0` to disable entirely.
+ * Missing or malformed env = 0 (disabled, safe default). Set env to
+ * `0` to disable explicitly.
  *
  * Exported for unit-testing.
  */
 export function idleTimeoutForEnv(env = process.env) {
     const raw = env.CONTEXT_MODE_IDLE_TIMEOUT_MS;
     if (raw === undefined)
-        return 15 * 60 * 1000;
+        return 0;
     const n = Number.parseInt(raw, 10);
     if (!Number.isFinite(n) || n < 0)
-        return 15 * 60 * 1000;
+        return 0;
     return n;
 }
 /** Read grandparent PID via `ps -o ppid= -p $PPID`. Returns NaN on failure or Windows. */

package/build/runtime.js

@@ -12,11 +12,14 @@ import { existsSync } from "node:fs";
  * Match is case-insensitive; `.exe` extension tolerated for Windows binaries.
  */
 const ALLOWED_SHELL_BASENAMES = /^(bash|sh|zsh|dash|pwsh|powershell|cmd)(\.exe)?$/i;
+const BUN_BASENAME = /^bun(\.exe)?$/i;
+function runtimeBasename(runtimePath) {
+    const segments = runtimePath.split(/[\\/]/);
+    return segments[segments.length - 1] ?? runtimePath;
+}
 export function isAllowlistedShell(shellPath) {
     // Cross-OS basename: split on either separator, take the last segment.
-    const segments = shellPath.split(/[\\/]/);
-    const base = segments[segments.length - 1];
-    return ALLOWED_SHELL_BASENAMES.test(base);
+    return ALLOWED_SHELL_BASENAMES.test(runtimeBasename(shellPath));
 }
 const isWindows = process.platform === "win32";
 function commandExists(cmd) {
@@ -305,14 +308,14 @@ export function getAvailableLanguages(runtimes) {
 export function buildCommand(runtimes, language, filePath) {
     switch (language) {
         case "javascript":
-            return runtimes.javascript.endsWith("bun")
+            return BUN_BASENAME.test(runtimeBasename(runtimes.javascript))
                 ? [runtimes.javascript, "run", filePath]
                 : [runtimes.javascript, filePath];
         case "typescript":
             if (!runtimes.typescript) {
                 throw new Error("No TypeScript runtime available. Install one of: bun (recommended), tsx (npm i -g tsx), or ts-node.");
             }
-            if (runtimes.typescript?.endsWith("bun"))
+            if (BUN_BASENAME.test(runtimeBasename(runtimes.typescript)))
                 return [runtimes.typescript, "run", filePath];
             if (runtimes.typescript === "tsx")
                 return ["tsx", filePath];

package/build/session/analytics.d.ts

@@ -557,19 +557,6 @@ export declare const adapterLabels: Record<string, string>;
  * information. Scale awareness comes from the unit jump between rows.
  */
 export declare function kb(b: number): string;
-/**
- * Locale + IANA-timezone detection for the narrative renderer.
- *
- * Cascade (each level overrides the next):
- *   1. CONTEXT_MODE_LOCALE / CONTEXT_MODE_TZ env overrides
- *      (used by tests + by users who want to pin output regardless of OS).
- *   2. macOS `defaults read -g AppleLocale` → `en_TR` style → `en-TR`.
- *   3. Linux `LANG` / `LC_TIME` env vars.
- *   4. Fallback: `Intl.DateTimeFormat().resolvedOptions().locale`.
- *
- * Timezone always uses `Intl.DateTimeFormat().resolvedOptions().timeZone`
- * — that one's always available and correct regardless of platform.
- */
 export declare function detectLocaleAndTz(): {
     locale: string;
     tz: string;

package/build/session/analytics.js

@@ -1217,9 +1217,45 @@ function formatDuration(uptimeMin) {
  * Timezone always uses `Intl.DateTimeFormat().resolvedOptions().timeZone`
  * — that one's always available and correct regardless of platform.
  */
+/**
+ * Validate that a locale string is a usable BCP 47 tag.
+ *
+ * Ubuntu GHA runners default to `LANG=C.UTF-8`. The extractor below strips
+ * that to `"C"` — a valid POSIX locale identifier but NOT a BCP 47 tag.
+ * On macOS / Node 20, `new Intl.DateTimeFormat("C", …)` throws RangeError
+ * outright. CI run 25887250971 caught this via the v1.0.134 SLICE B test.
+ *
+ * Earlier fix attempt used a permissive `supportedLocalesOf || construction`
+ * OR check — that was wrong: on Linux + Node 22.5, `new Intl.DateTimeFormat
+ * ("POSIX")` does NOT throw, it silently falls back to the root locale and
+ * still emits garbage at format time. CI run 25904838577 surfaced that —
+ * "POSIX" round-tripped through the validator unchanged.
+ *
+ * Strict gate: `Intl.DateTimeFormat.supportedLocalesOf(tag)` returns `[]` for
+ * any tag that doesn't map to a real language (regardless of whether
+ * construction with that tag throws). That's the contract we want — "is this
+ * a BCP 47 tag the host actually has data for". Construction is an explicit
+ * sanity check; both must pass.
+ */
+function isUsableBcp47Locale(raw) {
+    if (!raw)
+        return false;
+    try {
+        if (Intl.DateTimeFormat.supportedLocalesOf(raw).length === 0)
+            return false;
+        // Belt: confirm construction doesn't throw on this host either.
+        new Intl.DateTimeFormat(raw);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 export function detectLocaleAndTz() {
     const env = (process.env ?? {});
     let locale = env.CONTEXT_MODE_LOCALE ?? "";
+    if (locale && !isUsableBcp47Locale(locale))
+        locale = "";
     if (!locale) {
         if (process.platform === "darwin") {
             try {
@@ -1234,11 +1270,18 @@ export function detectLocaleAndTz() {
                     locale = out.replace(/_/g, "-");
             }
             catch { /* defaults missing or sandbox */ }
+            if (locale && !isUsableBcp47Locale(locale))
+                locale = "";
         }
         if (!locale && (env.LC_TIME || env.LANG)) {
             const raw = (env.LC_TIME || env.LANG || "").split(".")[0];
             if (raw)
                 locale = raw.replace(/_/g, "-");
+            // POSIX locale identifiers (`C`, `POSIX`) survive the simple extraction
+            // above but blow up `new Intl.DateTimeFormat(locale, ...)`. Drop and
+            // fall through to the host-default branch below.
+            if (locale && !isUsableBcp47Locale(locale))
+                locale = "";
         }
         if (!locale) {
             try {
@@ -1258,7 +1301,13 @@ export function detectLocaleAndTz() {
             tz = "UTC";
         }
     }
-    return { locale: locale || "en-US", tz: tz || "UTC" };
+    // Final belt-and-suspenders: if the locale we settled on is somehow still
+    // unusable (env mutation between detection and return, contributor adding
+    // a new extraction path that skips the validator), fall back to en-US so
+    // formatLocalDateTime / monthDay / weekdayCap never throw at render time.
+    if (!isUsableBcp47Locale(locale))
+        locale = "en-US";
+    return { locale, tz: tz || "UTC" };
 }
 /**
  * Format an absolute path as a human-friendly display string by

package/build/session/extract.js

@@ -613,7 +613,45 @@ function extractDecision(input) {
     const questionText = Array.isArray(questions) && questions.length > 0
         ? String(questions[0]["question"] ?? "")
         : "";
-    const answer = safeString(String(input.tool_response ?? ""));
+    // tool_response is a JSON string that echoes the full request payload
+    // alongside the answers map: {"questions":[...],"answers":{"<q>":"<label>"}}.
+    // Stringifying the raw blob leaks the echoed questions/options into the
+    // event row and surfaces as "Unhandled case: [object Object]" downstream.
+    const rawResponse = String(input.tool_response ?? "");
+    let answerText = "";
+    try {
+        const parsed = JSON.parse(rawResponse);
+        const answers = parsed?.answers;
+        if (answers && typeof answers === "object") {
+            // multiSelect: true answers arrive as string[]; single-select arrive as
+            // string. Normalize both into a `" | "`-joined string so neither shape
+            // silently produces an empty answer.
+            const toAnswerText = (value) => {
+                if (typeof value === "string")
+                    return value;
+                if (Array.isArray(value)) {
+                    return value.filter((v) => typeof v === "string").join(" | ");
+                }
+                return "";
+            };
+            const matched = questionText ? toAnswerText(answers[questionText]) : "";
+            if (matched) {
+                answerText = matched;
+            }
+            else {
+                const values = Object.values(answers)
+                    .map(toAnswerText)
+                    .filter((v) => v.length > 0);
+                answerText = values.join(" | ");
+            }
+        }
+    }
+    catch {
+        // Non-JSON tool_response — fail safe with empty answer rather than
+        // leaking the raw text (which would re-introduce the original bug
+        // for any future caller that sends a non-JSON payload).
+    }
+    const answer = safeString(answerText);
     const summary = questionText
         ? `Q: ${safeString(questionText)} → A: ${answer}`
         : `answer: ${answer}`;

package/build/util/claude-config.d.ts

@@ -13,12 +13,18 @@ export declare function resolveClaudeGlobalSettingsPath(env?: NodeJS.ProcessEnv)
  *      adapter is non-claude — claude is already covered by entry 2).
  *   2. The claude global settings.json (always — defense in depth).
  *
- * Lazy import of `./adapters/detect.js` keeps this file free of any direct
- * adapter dependency: the detect module itself only `import type`s adapter
- * types at the top level (concrete adapters are loaded dynamically inside
- * `getAdapter()`), so a static import is safe — but we use `createRequire`
- * to make the dependency direction crystal clear and to avoid surprising
- * future maintainers who add eager adapter imports to detect.ts.
+ * Static import of `../adapters/detect.js` is safe — detect.ts only imports
+ * `node:` builtins, `./types.js` (type-only), and `./client-map.js` (pure
+ * data). It does NOT import claude-config back, so no cycle.
+ *
+ * History: this used `createRequire(import.meta.url).resolve(...)` to lazy-
+ * load detect at call time. That pattern requires `require(esm)`, which is
+ * flag-gated on Node 22.x before 22.12 (`--experimental-require-module`).
+ * CI run 25877550371 on Node 22.5 silently failed every detect.* call —
+ * the catch block ate the error and every cross-adapter deny-policy test
+ * returned an empty policy list. Static import sidesteps the require(esm)
+ * gate entirely, so the same code works on every supported Node version
+ * (20.x, 22.5, 22.12+, 24+) without needing the experimental flag.
  *
  * The returned array is deduplicated and order-stable: adapter-specific path
  * first (most specific), claude global second (fallback).

package/build/util/claude-config.js

@@ -23,7 +23,7 @@
  */
 import { resolve } from "node:path";
 import { homedir } from "node:os";
-import { createRequire } from "node:module";
+import { detectPlatform, getSessionDirSegments } from "../adapters/detect.js";
 export function resolveClaudeConfigDir(env = process.env) {
     const envVal = env.CLAUDE_CONFIG_DIR;
     if (envVal && envVal.trim() !== "") {
@@ -50,34 +50,27 @@ export function resolveClaudeGlobalSettingsPath(env = process.env) {
  *      adapter is non-claude — claude is already covered by entry 2).
  *   2. The claude global settings.json (always — defense in depth).
  *
- * Lazy import of `./adapters/detect.js` keeps this file free of any direct
- * adapter dependency: the detect module itself only `import type`s adapter
- * types at the top level (concrete adapters are loaded dynamically inside
- * `getAdapter()`), so a static import is safe — but we use `createRequire`
- * to make the dependency direction crystal clear and to avoid surprising
- * future maintainers who add eager adapter imports to detect.ts.
+ * Static import of `../adapters/detect.js` is safe — detect.ts only imports
+ * `node:` builtins, `./types.js` (type-only), and `./client-map.js` (pure
+ * data). It does NOT import claude-config back, so no cycle.
+ *
+ * History: this used `createRequire(import.meta.url).resolve(...)` to lazy-
+ * load detect at call time. That pattern requires `require(esm)`, which is
+ * flag-gated on Node 22.x before 22.12 (`--experimental-require-module`).
+ * CI run 25877550371 on Node 22.5 silently failed every detect.* call —
+ * the catch block ate the error and every cross-adapter deny-policy test
+ * returned an empty policy list. Static import sidesteps the require(esm)
+ * gate entirely, so the same code works on every supported Node version
+ * (20.x, 22.5, 22.12+, 24+) without needing the experimental flag.
  *
  * The returned array is deduplicated and order-stable: adapter-specific path
  * first (most specific), claude global second (fallback).
  */
 export function resolveAdapterGlobalSettingsPaths(env = process.env) {
     const paths = [];
-    // Lazy-load detect module to avoid any chance of an adapter import cycle.
-    // `detect.ts` exports pure functions — `detectPlatform` (env-driven) and
-    // `getSessionDirSegments` (sync map). Neither instantiates an adapter.
-    let detected = null;
-    let segmentsFor = null;
-    try {
-        const lazyRequire = createRequire(import.meta.url);
-        const detect = lazyRequire("../adapters/detect.js");
-        detected = detect.detectPlatform();
-        segmentsFor = detect.getSessionDirSegments;
-    }
-    catch {
-        // If detection fails for any reason, fall back to claude-only behavior.
-    }
-    if (detected && segmentsFor && detected.platform !== "claude-code") {
-        const segments = segmentsFor(detected.platform);
+    const detected = detectPlatform();
+    if (detected.platform !== "claude-code") {
+        const segments = getSessionDirSegments(detected.platform);
         if (segments && segments.length > 0) {
             paths.push(resolve(homedir(), ...segments, "settings.json"));
         }