context-mode 1.0.144 → 1.0.146

package/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Claude Code plugins by Mert Koseoğlu",
-    "version": "1.0.144"
+    "version": "1.0.146"
   },
   "plugins": [
     {
       "name": "context-mode",
       "source": "./",
       "description": "Claude Code MCP plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
-      "version": "1.0.144",
+      "version": "1.0.146",
       "author": {
         "name": "Mert Koseoğlu"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "context-mode",
-  "version": "1.0.144",
+  "version": "1.0.146",
   "description": "MCP server that saves 98% of your context window with session continuity. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and automatic state restore across compactions.",
   "author": {
     "name": "Mert Koseoğlu",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "context-mode",
-  "version": "1.0.144",
+  "version": "1.0.146",
   "description": "MCP server that saves 98% of your context window with session continuity. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and automatic state restore across compactions.",
   "author": {
     "name": "Mert Koseoğlu",

package/.openclaw-plugin/openclaw.plugin.json

@@ -3,7 +3,7 @@
   "name": "Context Mode",
   "kind": "tool",
   "description": "OpenClaw plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
-  "version": "1.0.144",
+  "version": "1.0.146",
   "sandbox": {
     "mode": "permissive",
     "filesystem_access": "full",

package/.openclaw-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "context-mode",
-  "version": "1.0.144",
+  "version": "1.0.146",
   "description": "OpenClaw plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
   "author": {
     "name": "Mert Koseoğlu",

package/README.md

@@ -1387,17 +1387,7 @@ export CTX_FETCH_STRICT=1
 
 That blocks loopback + RFC1918 + ULA in addition to the always-blocked ranges. Useful when context-mode runs as a shared service, not on a developer's own machine.
 
-`tool_input` for any `mcp__*` tool call is also redacted before persistence — keys matching `authorization`, `token`, `secret`, `password`, `api_key`, `cookie`, `signature`, `private_key` get masked to `[REDACTED]` so credentials in MCP arguments don't end up in the session DB.
-
-### Lifecycle environment variables
-
-One runtime knob controls MCP sibling cleanup. Idle self-shutdown was removed after [#592](https://github.com/mksglu/context-mode/issues/592): hosts can keep registered tool handles after a clean MCP exit, making a timer-driven exit unsafe.
-
-| Variable | Default | Purpose |
-|---|---|---|
-| `CONTEXT_MODE_STARTUP_SWEEP` | `1` (enabled) | At boot, a newly-spawned MCP child reaps any other context-mode MCP server pids that share its parent process (`sameParentOnly: true` — never touches MCP children of a different host). This reclaims accumulated siblings immediately instead of waiting for each idle timer to fire. Set to `0` or `false` to disable (useful when you intentionally want multiple concurrent MCP children under the same host, e.g. multi-tenant test runners). |
-
-`CONTEXT_MODE_STARTUP_SWEEP` is read fresh at MCP server start — no restart of the host CLI is required, just spawn a new MCP child (open a new session) for changes to take effect. Unrecognized values fall back to enabled.
+`tool_input` for any `mcp__*` tool call is also redacted before persistence — the regex matcher in `hooks/posttooluse.mjs` masks `authorization`, `auth_token`, `access_token`, `refresh_token`, `bearer`, `token`, `secret`, `password`, `passwd`, `pwd`, `api_key` / `apikey` / `x_api_key`, `cookie` / `set-cookie`, `signature`, `private_key`, and `client_secret` (case-insensitive, hyphen/underscore-insensitive) to `[REDACTED]` so credentials in MCP arguments don't end up in the session DB.
 
 ### Routing-guidance environment variables
 

package/build/adapters/base.d.ts

@@ -20,7 +20,30 @@
  * `resolveSessionDbPath({ projectDir, sessionsDir: adapter.getSessionDir() })`
  * in `src/session/db.ts`. Adapters expose only `getSessionDir()` for
  * storage-related path concerns.
+ *
+ * Issue #649 — `CONTEXT_MODE_DATA_DIR` universal storage override. Many
+ * adapters (Pi, OMP, Gemini CLI, Codex, Cursor, …) had storage hardcoded to
+ * `~/.<platform>/context-mode/sessions/` with no env-var escape hatch. CI
+ * runners on NFS homes, dev containers, and shared-workspace setups need to
+ * point context-mode storage at a writable volume without patching source or
+ * abusing the host platform's own config-dir variable. The override applies
+ * only to context-mode-owned state (`getSessionDir`, `getMemoryDir`) — never
+ * to platform-native config (`getConfigDir`, `getSettingsPath`), which must
+ * stay where the host platform's own tooling expects it. Adapters that
+ * override `getSessionDir`/`getMemoryDir` directly (claude-code, codex,
+ * opencode, vscode-copilot) honor the override by routing through
+ * `resolveContextModeDataRoot()` at the top of their override.
+ */
+/**
+ * Universal storage-root override. Returns the resolved absolute path when
+ * `CONTEXT_MODE_DATA_DIR` is set to a non-blank value, otherwise `null` so
+ * callers fall back to their platform-native default.
+ *
+ * Mirrors the `resolveClaudeConfigDir` contract for env-var handling
+ * (whitespace guard, tilde expansion, relative-path resolution) so users
+ * get one consistent set of rules across every override site.
  */
+export declare function resolveContextModeDataRoot(env?: NodeJS.ProcessEnv): string | null;
 export declare abstract class BaseAdapter {
     protected readonly sessionDirSegments: string[];
     constructor(sessionDirSegments: string[]);
@@ -33,6 +56,13 @@ export declare abstract class BaseAdapter {
      * openclaw, opencode) override this and resolve their segments against
      * `projectDir` (or `process.cwd()` when omitted).
      *
+     * NOT relocated by `CONTEXT_MODE_DATA_DIR` (#649). The platform owns its
+     * settings.json / hooks.json / config.toml location — relocating that
+     * would silently fork platform behaviour from the platform's own tooling.
+     * Use `CLAUDE_CONFIG_DIR`, `CODEX_HOME`, `XDG_CONFIG_HOME`, etc. to move
+     * platform-native config; use `CONTEXT_MODE_DATA_DIR` to move context-mode
+     * storage independently.
+     *
      * @param _projectDir Unused by the home-rooted default — accepted so
      *                    project-scoped overrides honor the same signature.
      */
@@ -46,6 +76,10 @@ export declare abstract class BaseAdapter {
      * Default: <configDir>/memory. Always absolute (configDir is absolute by
      * contract). Adapters with a different memory dir name (e.g., codex uses
      * "memories" plural) override this.
+     *
+     * Issue #649: when `CONTEXT_MODE_DATA_DIR` is set, memory follows storage
+     * to `<DATA_DIR>/context-mode/memory/` since persistent memory is
+     * context-mode-owned state, not platform-native config.
      */
     getMemoryDir(): string;
     backupSettings(): string | null;

package/build/adapters/base.js

@@ -20,17 +20,51 @@
  * `resolveSessionDbPath({ projectDir, sessionsDir: adapter.getSessionDir() })`
  * in `src/session/db.ts`. Adapters expose only `getSessionDir()` for
  * storage-related path concerns.
+ *
+ * Issue #649 — `CONTEXT_MODE_DATA_DIR` universal storage override. Many
+ * adapters (Pi, OMP, Gemini CLI, Codex, Cursor, …) had storage hardcoded to
+ * `~/.<platform>/context-mode/sessions/` with no env-var escape hatch. CI
+ * runners on NFS homes, dev containers, and shared-workspace setups need to
+ * point context-mode storage at a writable volume without patching source or
+ * abusing the host platform's own config-dir variable. The override applies
+ * only to context-mode-owned state (`getSessionDir`, `getMemoryDir`) — never
+ * to platform-native config (`getConfigDir`, `getSettingsPath`), which must
+ * stay where the host platform's own tooling expects it. Adapters that
+ * override `getSessionDir`/`getMemoryDir` directly (claude-code, codex,
+ * opencode, vscode-copilot) honor the override by routing through
+ * `resolveContextModeDataRoot()` at the top of their override.
  */
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { accessSync, copyFileSync, constants, mkdirSync } from "node:fs";
 import { homedir } from "node:os";
+/**
+ * Universal storage-root override. Returns the resolved absolute path when
+ * `CONTEXT_MODE_DATA_DIR` is set to a non-blank value, otherwise `null` so
+ * callers fall back to their platform-native default.
+ *
+ * Mirrors the `resolveClaudeConfigDir` contract for env-var handling
+ * (whitespace guard, tilde expansion, relative-path resolution) so users
+ * get one consistent set of rules across every override site.
+ */
+export function resolveContextModeDataRoot(env = process.env) {
+    const raw = env.CONTEXT_MODE_DATA_DIR;
+    if (!raw || raw.trim() === "")
+        return null;
+    if (raw.startsWith("~")) {
+        return resolve(homedir(), raw.replace(/^~[/\\]?/, ""));
+    }
+    return resolve(raw);
+}
 export class BaseAdapter {
     sessionDirSegments;
     constructor(sessionDirSegments) {
         this.sessionDirSegments = sessionDirSegments;
     }
     getSessionDir() {
-        const dir = join(homedir(), ...this.sessionDirSegments, "context-mode", "sessions");
+        const override = resolveContextModeDataRoot();
+        const dir = override
+            ? join(override, "context-mode", "sessions")
+            : join(homedir(), ...this.sessionDirSegments, "context-mode", "sessions");
         mkdirSync(dir, { recursive: true });
         return dir;
     }
@@ -42,6 +76,13 @@ export class BaseAdapter {
      * openclaw, opencode) override this and resolve their segments against
      * `projectDir` (or `process.cwd()` when omitted).
      *
+     * NOT relocated by `CONTEXT_MODE_DATA_DIR` (#649). The platform owns its
+     * settings.json / hooks.json / config.toml location — relocating that
+     * would silently fork platform behaviour from the platform's own tooling.
+     * Use `CLAUDE_CONFIG_DIR`, `CODEX_HOME`, `XDG_CONFIG_HOME`, etc. to move
+     * platform-native config; use `CONTEXT_MODE_DATA_DIR` to move context-mode
+     * storage independently.
+     *
      * @param _projectDir Unused by the home-rooted default — accepted so
      *                    project-scoped overrides honor the same signature.
      */
@@ -59,8 +100,15 @@ export class BaseAdapter {
      * Default: <configDir>/memory. Always absolute (configDir is absolute by
      * contract). Adapters with a different memory dir name (e.g., codex uses
      * "memories" plural) override this.
+     *
+     * Issue #649: when `CONTEXT_MODE_DATA_DIR` is set, memory follows storage
+     * to `<DATA_DIR>/context-mode/memory/` since persistent memory is
+     * context-mode-owned state, not platform-native config.
      */
     getMemoryDir() {
+        const override = resolveContextModeDataRoot();
+        if (override)
+            return join(override, "context-mode", "memory");
         return join(this.getConfigDir(), "memory");
     }
     backupSettings() {

package/build/adapters/claude-code/index.js

@@ -15,6 +15,7 @@ import { readFileSync, writeFileSync, existsSync, readdirSync, chmodSync, access
 import { resolve, join } from "node:path";
 import { homedir } from "node:os";
 import { ClaudeCodeBaseAdapter } from "../claude-code-base.js";
+import { resolveContextModeDataRoot } from "../base.js";
 import { resolveClaudeConfigDir } from "../../util/claude-config.js";
 import { checkPluginCacheIntegritySync } from "../../util/plugin-cache-integrity.js";
 import { buildNodeCommand, } from "../types.js";
@@ -61,7 +62,14 @@ export class ClaudeCodeAdapter extends ClaudeCodeBaseAdapter {
         return resolveClaudeConfigDir();
     }
     getSessionDir() {
-        const dir = join(this.getConfigDir(), "context-mode", "sessions");
+        // Issue #649: honor CONTEXT_MODE_DATA_DIR universal storage override
+        // before falling back to the Claude-rooted default. The override moves
+        // ONLY context-mode-owned state; settings.json + CLAUDE_CONFIG_DIR stay
+        // intact below.
+        const override = resolveContextModeDataRoot();
+        const dir = override
+            ? join(override, "context-mode", "sessions")
+            : join(this.getConfigDir(), "context-mode", "sessions");
         mkdirSync(dir, { recursive: true });
         return dir;
     }

package/build/adapters/codex/index.js

@@ -16,7 +16,7 @@
 import { readFileSync, writeFileSync, accessSync, copyFileSync, constants, mkdirSync, } from "node:fs";
 import { resolve, dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { BaseAdapter } from "../base.js";
+import { BaseAdapter, resolveContextModeDataRoot } from "../base.js";
 import { resolveCodexConfigDir } from "./paths.js";
 // PreToolUse matcher: canonical Codex tool names + context-mode bare MCP tool
 // names + external MCP catch-all literal (#529, #547 hotfix).
@@ -236,7 +236,14 @@ export class CodexAdapter extends BaseAdapter {
         return join(this.getConfigDir(), "config.toml");
     }
     getSessionDir() {
-        const dir = join(this.getConfigDir(), "context-mode", "sessions");
+        // Issue #649: honor CONTEXT_MODE_DATA_DIR universal storage override
+        // before falling back to the $CODEX_HOME-rooted default. Settings.toml
+        // and hooks.json continue to live under getConfigDir() so the Codex CLI
+        // sees its own config in the expected place.
+        const override = resolveContextModeDataRoot();
+        const dir = override
+            ? join(override, "context-mode", "sessions")
+            : join(this.getConfigDir(), "context-mode", "sessions");
         mkdirSync(dir, { recursive: true });
         return dir;
     }
@@ -252,6 +259,13 @@ export class CodexAdapter extends BaseAdapter {
     }
     getMemoryDir() {
         // Codex uses "memories" (plural), not the default "memory".
+        // Issue #649: honor CONTEXT_MODE_DATA_DIR for context-mode-owned
+        // persistent memory while preserving the platform-native plural folder
+        // name so legacy Codex tooling continues to find it when DATA_DIR is
+        // unset. Under the override, layout is `<DATA_DIR>/context-mode/memories`.
+        const override = resolveContextModeDataRoot();
+        if (override)
+            return join(override, "context-mode", "memories");
         return join(this.getConfigDir(), "memories");
     }
     generateHookConfig(_pluginRoot) {

package/build/adapters/omp/plugin.js

@@ -25,8 +25,7 @@
  */
 import { createHash } from "node:crypto";
 import { mkdirSync } from "node:fs";
-import { join } from "node:path";
-import { SessionDB } from "../../session/db.js";
+import { resolveSessionDbPath, SessionDB } from "../../session/db.js";
 import { extractEvents } from "../../session/extract.js";
 import { buildResumeSnapshot } from "../../session/snapshot.js";
 import { OMPAdapter } from "./index.js";
@@ -62,6 +61,7 @@ const BLOCKED_BASH_PATTERNS = [
 // session_start so multi-session reuse within a long-lived plugin
 // process keeps event attribution correct.
 let _db = null;
+let _dbPath = "";
 let _sessionId = "";
 const _ompAdapter = new OMPAdapter();
 function getSessionDir() {
@@ -69,12 +69,31 @@ function getSessionDir() {
     mkdirSync(dir, { recursive: true });
     return dir;
 }
-function getDBPath() {
-    return join(getSessionDir(), "context-mode.db");
+// Issue #645 — route through the canonical per-project resolver the MCP
+// server uses (src/server.ts ctx_stats / ctx_search timeline). The
+// previous shared `context-mode.db` literal was a different file from
+// the `<canonical-hash>.db` the server reads, so every OMP user's
+// `ctx_stats` reported zero history and `ctx_search(sort: "timeline")`
+// silently dropped the sort. Mirrors the matching Pi fix and the
+// opencode plugin pattern (src/adapters/opencode/plugin.ts:307).
+function getDBPath(projectDir) {
+    return resolveSessionDbPath({ projectDir, sessionsDir: getSessionDir() });
 }
-function getOrCreateDB() {
-    if (!_db) {
-        _db = new SessionDB({ dbPath: getDBPath() });
+function getOrCreateDB(projectDir) {
+    // Reopen the singleton if the resolved DB path changes. See the
+    // matching Pi extension comment — defensive re-keying on projectDir
+    // hash keeps tests deterministic and stops a stale singleton from
+    // pointing at an earlier projectDir's `<hash>.db`. (#645)
+    const dbPath = getDBPath(projectDir);
+    if (!_db || _dbPath !== dbPath) {
+        if (_db) {
+            try {
+                _db.close();
+            }
+            catch { /* best effort */ }
+        }
+        _db = new SessionDB({ dbPath });
+        _dbPath = dbPath;
     }
     return _db;
 }
@@ -102,7 +121,14 @@ function deriveSessionId(ctx) {
 // The plugin's default export is the OMP factory; this helper is only
 // imported by tests to clear singletons between cases.
 export function _resetOmpPluginStateForTests() {
+    if (_db) {
+        try {
+            _db.close();
+        }
+        catch { /* best effort */ }
+    }
     _db = null;
+    _dbPath = "";
     _sessionId = "";
 }
 /**
@@ -129,7 +155,7 @@ export default function ompPlugin(pi) {
     // earlier `OMP_PROJECT_DIR` read was an EM mistake — no upstream code
     // ever sets it. Drop it; fall through PI_PROJECT_DIR → cwd().
     const projectDir = process.env.PI_PROJECT_DIR || process.cwd();
-    const db = getOrCreateDB();
+    const db = getOrCreateDB(projectDir);
     // ── 1. session_start — initialize session row ─────────
     pi.on("session_start", (_event, ctx) => {
         try {

package/build/adapters/openclaw/plugin.js

@@ -33,6 +33,8 @@ import { existsSync, mkdirSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { resolveContextModeDataRoot } from "../base.js";
+import { resolveSessionDbPath } from "../../session/db.js";
 import { OpenClawSessionDB } from "./session-db.js";
 import { extractEvents, extractUserEvents } from "../../session/extract.js";
 import { buildResumeSnapshot } from "../../session/snapshot.js";
@@ -70,26 +72,56 @@ const configSchema = {
 };
 // ── Helpers ───────────────────────────────────────────────
 function getSessionDir() {
-    const dir = join(homedir(), ".openclaw", "context-mode", "sessions");
+    // Issue #649: honor CONTEXT_MODE_DATA_DIR universal storage override
+    // ahead of the hardcoded ~/.openclaw root so dev-container/CI/NFS-home
+    // users can relocate context-mode storage without patching the source.
+    // Kept in sync with OpenClawAdapter.getSessionDir() (inherited from
+    // BaseAdapter) — both call sites must agree byte-for-byte.
+    const override = resolveContextModeDataRoot();
+    const dir = override
+        ? join(override, "context-mode", "sessions")
+        : join(homedir(), ".openclaw", "context-mode", "sessions");
     mkdirSync(dir, { recursive: true });
     return dir;
 }
+// Issue #645 follow-up — route through the canonical per-project
+// resolver the MCP server uses (src/server.ts ctx_stats / ctx_search
+// timeline). The previous raw `sha256(projectDir).slice(0, 16)` shape
+// produced a different file from the `<canonical-hash>.db` the server
+// reads on darwin/win32 (case-fold) and inside linked worktrees
+// (suffix). The result was silent degradation of `ctx_stats` (zero
+// history) and `ctx_search(sort: "timeline")` (sort dropped) for any
+// OpenClaw user with an uppercase character in their projectDir.
+// Mirrors the matching Pi (src/adapters/pi/extension.ts:223) and OMP
+// (src/adapters/omp/plugin.ts:90) fixes, and the opencode plugin
+// pattern (src/adapters/opencode/plugin.ts:307).
 function getDBPath(projectDir) {
-    const hash = createHash("sha256")
-        .update(projectDir)
-        .digest("hex")
-        .slice(0, 16);
-    return join(getSessionDir(), `${hash}.db`);
+    return resolveSessionDbPath({ projectDir, sessionsDir: getSessionDir() });
 }
 // ── Module-level DB singleton ─────────────────────────────
 // Shared across all register() calls (one per agent session).
 // Lazy-initialized on first register() using the first projectDir seen.
 // Uses OpenClawSessionDB for session_key mapping and rename support.
 let _dbSingleton = null;
+let _dbSingletonPath = "";
 function getOrCreateDB(projectDir) {
-    if (!_dbSingleton) {
-        const dbPath = getDBPath(projectDir);
+    // Reopen the singleton if the resolved DB path changes. Production
+    // code normally loads the plugin once per process with a single
+    // workspace, but defensive re-keying on resolved path keeps the
+    // contract honest if a host ever calls register() twice with
+    // different projectDirs, and removes a subtle test-isolation
+    // foot-gun where a stale singleton pointed at a prior test's
+    // `<hash>.db`. Mirrors the Pi/OMP fix (#645).
+    const dbPath = getDBPath(projectDir);
+    if (!_dbSingleton || _dbSingletonPath !== dbPath) {
+        if (_dbSingleton) {
+            try {
+                _dbSingleton.close();
+            }
+            catch { /* best effort */ }
+        }
         _dbSingleton = new OpenClawSessionDB({ dbPath });
+        _dbSingletonPath = dbPath;
         _dbSingleton.cleanupOldSessions(7);
     }
     return _dbSingleton;

package/build/adapters/opencode/index.js

@@ -25,7 +25,7 @@ function stripJsonComments(str) {
 import { readFileSync, writeFileSync, mkdirSync, copyFileSync, accessSync, constants, } from "node:fs";
 import { resolve, join } from "node:path";
 import { homedir } from "node:os";
-import { BaseAdapter } from "../base.js";
+import { BaseAdapter, resolveContextModeDataRoot } from "../base.js";
 // ─────────────────────────────────────────────────────────
 // Hook constants (re-exported from hooks.ts)
 // ─────────────────────────────────────────────────────────
@@ -177,7 +177,14 @@ export class OpenCodeAdapter extends BaseAdapter {
         ];
     }
     getSessionDir() {
-        const dir = join(this.getConfigDir(), "context-mode", "sessions");
+        // Issue #649: honor CONTEXT_MODE_DATA_DIR universal storage override
+        // ahead of OpenCode/Kilo's XDG-rooted default. opencode.json + plugin
+        // discovery stay under getConfigDir() so OpenCode itself sees its own
+        // config in the expected location.
+        const override = resolveContextModeDataRoot();
+        const dir = override
+            ? join(override, "context-mode", "sessions")
+            : join(this.getConfigDir(), "context-mode", "sessions");
         mkdirSync(dir, { recursive: true });
         return dir;
     }

package/build/adapters/pi/extension.js

@@ -15,7 +15,7 @@ import { existsSync, mkdirSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, resolve, dirname } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { SessionDB } from "../../session/db.js";
+import { resolveSessionDbPath, SessionDB } from "../../session/db.js";
 import { extractEvents, extractUserEvents } from "../../session/extract.js";
 import { buildResumeSnapshot } from "../../session/snapshot.js";
 import { bootstrapMCPTools } from "./mcp-bridge.js";
@@ -121,6 +121,7 @@ export function isSafeCurlWget(segment) {
 }
 // ── Module-level DB singleton ────────────────────────────
 let _db = null;
+let _dbPath = "";
 let _sessionId = "";
 // MCP bridge handle. The bridge spawns server.bundle.mjs once and
 // registers each MCP tool through pi.registerTool() so the Pi LLM can
@@ -181,12 +182,38 @@ function getSessionDir() {
     mkdirSync(dir, { recursive: true });
     return dir;
 }
-function getDBPath() {
-    return join(getSessionDir(), "context-mode.db");
+// Issue #645 — the MCP server (src/server.ts ctx_stats / ctx_search
+// timeline) resolves the SessionDB filename via
+// `resolveSessionDbPath({ projectDir, sessionsDir })`, which produces a
+// per-project canonical `<16-hex-hash>.db` (case-folded on darwin/win32,
+// suffixed for non-main worktrees). The Pi extension previously wrote
+// every session to a shared `context-mode.db` literal — a different
+// file the server never reads. The result was silent degradation of
+// `ctx_stats` (zero history) and `ctx_search(sort: "timeline")` (sort
+// dropped) for every Pi user. Routing through the same helper keeps the
+// extension-side writes and the server-side reads aligned across
+// case-fold migrations, worktree suffixes, and any future change to the
+// canonical filename contract.
+function getDBPath(projectDir) {
+    return resolveSessionDbPath({ projectDir, sessionsDir: getSessionDir() });
 }
-function getOrCreateDB() {
-    if (!_db) {
-        _db = new SessionDB({ dbPath: getDBPath() });
+function getOrCreateDB(projectDir) {
+    // Reopen the singleton if the resolved DB path changes. Production code
+    // normally loads the extension once per process with a single workspace,
+    // but defensive re-keying on path keeps the contract honest if a host
+    // ever calls piExtension(pi) twice with different projectDirs, and
+    // removes a subtle test-isolation foot-gun where stale singletons
+    // pointed at a prior test's `<hash>.db`. (#645)
+    const dbPath = getDBPath(projectDir);
+    if (!_db || _dbPath !== dbPath) {
+        if (_db) {
+            try {
+                _db.close();
+            }
+            catch { /* best effort */ }
+        }
+        _db = new SessionDB({ dbPath });
+        _dbPath = dbPath;
     }
     return _db;
 }
@@ -368,7 +395,7 @@ export default function piExtension(pi) {
     // events default to project_dir="" which causes cross-project data leakage
     // in shared SessionDB instances.
     const _attribution = { projectDir, source: "workspace_root", confidence: 0.98 };
-    const db = getOrCreateDB();
+    const db = getOrCreateDB(projectDir);
     // ── 1. session_start — Initialize session ──────────────
     pi.on("session_start", (_event, ctx) => {
         try {
@@ -658,6 +685,7 @@ export default function piExtension(pi) {
                 _db.cleanupOldSessions(7);
             }
             _db = null;
+            _dbPath = "";
             _sessionId = "";
         }
         catch {
@@ -704,7 +732,7 @@ export default function piExtension(pi) {
         description: "Run context-mode diagnostics",
         handler: async (argsOrCtx, maybeCtx) => {
             const ctx = resolveCommandContext(argsOrCtx, maybeCtx);
-            const dbPath = getDBPath();
+            const dbPath = getDBPath(projectDir);
             const dbExists = existsSync(dbPath);
             const lines = [
                 "## ctx-doctor (Pi)",

package/build/adapters/pi/mcp-bridge.js

@@ -102,6 +102,25 @@ export function resolveJsRuntimeForBridge(deps = {}) {
 // layer (per-tool timeout / background mode / Pi-level cancel), not
 // to the transport.
 const DEFAULT_REQUEST_TIMEOUT_MS = 60_000;
+// Retry budget for the bridge bootstrap `initialize` handshake (#647).
+//
+// On cold NFS home dirs, first JIT compile of server.bundle.mjs, or
+// constrained CI runners, the first `initialize` can exceed the 60s
+// ceiling above. Before this fix, bootstrapMCPTools propagated the
+// rejection up to extension.ts, which logged once and continued with
+// NO ctx_* tools registered — silently degrading the session for its
+// entire lifetime while the routing block kept emitting ~2.5K tokens
+// of dead instructions per turn.
+//
+// Retry pattern mirrors the existing #583 single-flight respawn shape:
+// on failure, shut the prior child cleanly, sleep a short backoff so
+// the OS reclaims fds, then start + initialize again. After the budget
+// is exhausted we re-throw and the existing extension.ts handler runs
+// the degrade-and-log path — preserving the contract for genuinely
+// broken servers (binary missing, runtime crash, etc.) while
+// self-healing the transient warm-up case.
+const MAX_INIT_RETRIES = 2;
+const INIT_RETRY_DELAY_MS = 1_000;
 class PiTextComponent {
     text;
     constructor(text = "") {
@@ -566,8 +585,45 @@ export async function bootstrapMCPTools(pi, serverScript, options = {}) {
         return skippedBridge();
     }
     const client = new MCPStdioClient(serverScript, env, runtime);
-    client.start();
-    await client.initialize();
+    // Retry-on-slow-initialize (#647).
+    //
+    // Each attempt is independently bounded by DEFAULT_REQUEST_TIMEOUT_MS
+    // (60s) inside request(). On failure we shutdown the child to release
+    // its fds before respawning — this is the same sequencing the #583
+    // respawn path uses, just hoisted into the bootstrap layer where the
+    // failure happens before any tool was registered. Final attempt's
+    // rejection is re-thrown so extension.ts's existing then/onRejected
+    // handler runs the degrade-and-log path for genuinely broken servers.
+    let lastError;
+    for (let attempt = 0; attempt <= MAX_INIT_RETRIES; attempt++) {
+        try {
+            client.start();
+            await client.initialize();
+            lastError = undefined;
+            break;
+        }
+        catch (err) {
+            lastError = err;
+            if (attempt === MAX_INIT_RETRIES)
+                break;
+            const msg = err instanceof Error ? err.message : String(err);
+            process.stderr.write(`[context-mode] WARNING: MCP bridge initialize failed ` +
+                `(attempt ${attempt + 1}/${MAX_INIT_RETRIES + 1}): ${msg}. Retrying…\n`);
+            // Reclaim the failed child's fds before respawning. shutdown() is
+            // idempotent and bounded by a 5s SIGKILL fallback (#472 round-3),
+            // so a child stuck in an uninterruptible syscall cannot block the
+            // retry loop indefinitely.
+            try {
+                client.shutdown();
+            }
+            catch {
+                // best effort — we are already on the failure path
+            }
+            await new Promise((resolve) => setTimeout(resolve, INIT_RETRY_DELAY_MS));
+        }
+    }
+    if (lastError !== undefined)
+        throw lastError;
     const tools = await client.listTools();
     const registered = [];
     for (const tool of tools) {

package/build/adapters/vscode-copilot/index.js

@@ -13,6 +13,7 @@ import { readFileSync, mkdirSync, accessSync, existsSync, constants, } from "nod
 import { resolve, join } from "node:path";
 import { homedir } from "node:os";
 import { CopilotBaseAdapter } from "../copilot-base.js";
+import { resolveContextModeDataRoot } from "../base.js";
 // ─────────────────────────────────────────────────────────
 // Hook constants (re-exported from hooks.ts)
 // ─────────────────────────────────────────────────────────
@@ -45,6 +46,16 @@ export class VSCodeCopilotAdapter extends CopilotBaseAdapter {
         return process.env.CLAUDE_PROJECT_DIR || process.cwd();
     }
     getSessionDir() {
+        // Issue #649: CONTEXT_MODE_DATA_DIR wins over both the .github project
+        // dir and the ~/.vscode fallback so dev-container/CI users can pin
+        // storage to a writable volume regardless of whether a .github tree
+        // happens to exist in cwd.
+        const override = resolveContextModeDataRoot();
+        if (override) {
+            const overrideDir = join(override, "context-mode", "sessions");
+            mkdirSync(overrideDir, { recursive: true });
+            return overrideDir;
+        }
         // Prefer .github/context-mode/sessions/ if .github exists,
         // otherwise fall back to ~/.vscode/context-mode/sessions/
         const githubDir = resolve(".github", "context-mode", "sessions");